9.4 KiB
Implementation plan and decision record
Product scope
Build a Windows privacy wizard with three browser choices: Tor Browser, Zen and Helium. Its job is to reduce collection and retention, expose tradeoffs, and verify specific settings. It must never present a percentage-anonymous score or claim that a host is untraceable.
The current release-candidate version is 0.0.3. See ROADMAP.md for the reconciled open and validation work and NATIVE-API.md for direct API and security-product behavior.
The running Windows installation is the development host. Development and read-only inspection are authorized; this iteration creates the tool and planning artifacts without destructive OS changes or installation of applications on that host.
Profiles
| Profile | Default behavior | Availability |
|---|---|---|
| Standard | Minimum supported diagnostic policy, no advertising ID, Windows location/camera restrictions, covered app microphone default deny, Activity Feed/upload off, no cloud speech/clipboard sync/Find My Device/cloud search, WER off and DO without peering; updates unchanged | Implements policy configuration on reviewed Pro/Enterprise/Education build families |
| Strict | Standard plus denied app access to account, calendar, contacts, call history, email, messaging, diagnostics, trusted/unpaired devices and voice activation; no clipboard history; DO mode 99; selected connected/cloud/diagnostic services disabled; future consumer Microsoft app authentication and workplace registration blocked; current Microsoft app sign-ins selected for purge | Default wizard profile. Policies and services are reversible; account-package reset and credential deletion are irreversible and require a separate acknowledgement. |
| Isolated session | Separate Tails environment; explicit persistence and identity separation | Guidance; not an automated OS installer |
Users can select individual supported IDs with -Id. The future UI needs a clear restore action for each restriction so camera/microphone use is possible when wanted. Software permission controls and hardware disconnection must have distinct labels.
Work packages
| Area | Delivered now | Next implementation and acceptance gate |
|---|---|---|
| Policy engine | Audit, Plan, Apply, Restore, edition/build gates, readback, recovery journal and transaction tests | VM verification on each supported build/edition; confirm policy consumption after reboot |
| Browser/app selection | Exact package IDs, optional interactive installer, no default takeover, -WhatIf |
Verify freshness/publisher manifests in release pipeline; UI choices; detect updates without importing personal profiles |
| Home edition | Read-only report and explicit manual guide | Supported Settings integration; verify actual toggles rather than pretending Pro policies work |
| Diagnostics | Supported minimum policy, feedback prompts off, WER policy/service off, reviewed endpoint rules and DiagTrack shutdown | Validate effective traffic on each supported build and retain required security/update channels |
| Connected experiences | Activity upload policies, app capability restrictions, CDPSvc/CDPUserSvc, OneSyncSvc and CloudBackupRestoreSvc reversible shutdown | Validate reboot persistence and effects on Phone Link, Nearby Sharing, Miracast, mail/calendar/contact sync and cloud backup |
| Network controls | Observe, reviewed optional-FQDN rules, timed default-outbound isolation, explicit confirmation, restore and Pktmon capture | Complete IPv4/IPv6/DNS/DoH/QUIC/VPN and external-gateway lab validation; expand endpoints only with provenance |
| AI removal | Recall inventory, deletion acknowledgement, supported policy and optional-feature disable/restore | Eligible-device deletion/reboot validation; installed Copilot inventory remains catalog-driven app selection |
| Debloat | Exact current-user inventory, curated bundled default, personal opt-in, browser-before-removal, OneDrive/Edge handling and protected dependencies | Live package/data/reinstall/new-user validation on every supported build |
| Updates | Keep, Automatic, Notify, Manual registry choices on eligible editions | Reboot and actual update workflow tests; UI temporary pause uses supported Windows mechanisms; browser/AV updates independent |
| Sensors | Location/camera policy, limited app microphone policy and exact selected PnP device disable/restore | Physical camera/microphone/Hello and restoration validation; nothing selected by default |
| Cleanup | Preview-first allowlisted Temp, WER/crash, Recent/Jump List, thumbnail, PowerShell-history and expired-report cleanup; age threshold; reparse/change/lock checks; optional safe schedule | Live active-installer, locked-cache and long-running schedule validation; browser-owned retention remains separate |
| Lock behavior | SessionLock scheduled task, current clipboard clear, exact selected VeraCrypt graceful unmount and local result report | Win+L/auto-lock/user-switch/RDP and busy-volume validation; password-manager adapters remain product-specific |
| Encryption | Guidance only | Read-only encryption status without recovery-key capture; key-custody guide; no automatic encryption/decryption migration |
| Security software | Preserve existing protections | Optional Bitdefender selection after conflict checks; no automatic Zillya recommendation pending sufficient evidence |
| Packaging | Self-contained x64 WinExe with UAC manifest, hash-manifested embedded runtime and Program Files installation; local CLI, native TUI, tabbed Windows Forms wizard, source ZIP builder and AME wrapper/builder | VM-run executable and AME validation, code signing, reproducible CI artifacts and release provenance |
Network design requirements
The requested no-direct-Microsoft-contact option now has a separate collector and offline-maintenance design. Local inventory and bundle-integrity verification are implemented; isolation, signed-package authentication, offline scan and installation are not deployed. A connected profile with update exceptions necessarily retains some outbound Microsoft traffic. The fully isolated profile loses online cloud security capabilities and needs explicit maintenance for all security components.
- Normal mode retains security maintenance, licensing and requested connected functions. Fewer observed connections is a measurable result, not proof of anonymity.
- Strict egress must be opt-in and recoverable. Before applying rules, export the exact relevant state, maintain local console recovery, schedule a short rollback, and cancel it only after connectivity checks pass. The recovery service must not depend on the network being tested.
- Account for all firewall profiles, existing explicit allows, IPv4/IPv6, TCP/UDP/QUIC, DNS and application DoH, physical/VPN adapters, sleep/wake and boot-time behavior.
- Do not install a TLS interception root certificate to inspect traffic. Encrypted captures establish destination/timing observations; do not claim their payloads have been audited.
- Never claim VPN Lockdown prevents Microsoft collection inside the tunnel. If the requirement is absolutely no Microsoft-bound traffic, document the compatibility loss and use a separately enforced/offline environment rather than a hidden default.
- Network captures are opt-in, local and short-lived, with an explicit deletion/export choice. They can reveal private endpoints; they are not included in normal audit output.
Wizard flow
- Explain protected data and limits; choose Standard or Strict.
- Detect OS edition/build and managed-device constraints. Show unavailable controls as unavailable.
- Choose browsers and optional Mullvad/VeraCrypt; show installation separately from configuration.
- Review each setting, its source, expected result, compatibility impact and reversibility. Separate data-deleting actions.
- Prepare local recovery journals, then apply selected actions in recorded groups. Continue after an unrelated group fails; skip only a group whose declared prerequisite failed.
- Report configured, pending reboot, behavior verified, unsupported, failed and conflict states separately.
- Offer rollback by group and show remaining manual checks. A successful registry write never earns a "verified anonymous" badge.
Reversibility rules
Configuration rollback restores original values and absence, not guessed Microsoft defaults. Package reinstalls do not restore application data automatically. Disabling Recall may remove snapshots. Closing an app may lose unsaved work. Unmounting a container does not erase the plaintext already copied by another process. These are different operations and must not share one "undo everything" claim.
Journals contain only allowlisted setting values, not entire registry branches, credentials, hardware IDs or browser history. Restoration derives targets from the local catalog rather than accepting registry paths in imported files. It refuses foreign profile markers and reports subsequent-edit conflicts. This is recovery metadata, not a cryptographic attestation against an administrator modifying both the tool and its state.
Release gates
The prototype is not approved for broad deployment until the validation protocol passes in clean VMs and representative hardware. AME packaging and a GUI must reuse the engine; neither should hide incomplete controls or add unverified registry tweaks. No combination of successful tests can prove universal absence of telemetry or endpoint compromise.