Integrate verified Windows kiosk release-readiness work #2

Closed

jdh wants to merge 0 commits from server/windows-integration-20260723 into main

pull from: server/windows-integration-20260723

merge into: jdh:main

jdh:main

Conversation 0 Commits - Files changed -

jdh commented 2026-07-23 12:19:54 -04:00

Owner

Copy link

Supersedes PR #1 and every older audit/agent branch. Includes the complete release-readiness candidate plus fail-closed stable-promotion API and physical-evidence repairs. Linux PowerShell behavior suites and zero-warning cross-build are green. Do not merge until the dedicated printago-windows-ci Windows check is green.

Supersedes PR #1 and every older audit/agent branch. Includes the complete release-readiness candidate plus fail-closed stable-promotion API and physical-evidence repairs. Linux PowerShell behavior suites and zero-warning cross-build are green. Do not merge until the dedicated printago-windows-ci Windows check is green.

jdh added 32 commits 2026-07-23 12:19:55 -04:00

Add unprivileged Windows pull request CI f3f2366f60

Require public trust for stable Windows releases da761a3351

Harden LAB release source trust 0aad82be05

Align kiosk scanner acceptance with dashboard 7bf8d11b79

Keep unverified Windows releases marked prerelease 9df80a1e9d

Add signed dashboard URL channel 03c501c892

Harden signed URL persistence and installer elevation 9f39a4f73b

Repair corrupt signed URL generation targets 050f656555

Block external URI scheme launches 19faf2913b

Restore stable Windows channel after publish failure 51823f23f8

Keep home kiosk installation production-only 4c3651f13d

Track WebView2 file picker containment gate fa80bc1d7a

Document WebView2 file picker blocker 36b6833970

Fix LOCK-09 decision formatting 1c43a08712

Add locked-kiosk scanner capability header 497c67e638

Close external drag-and-drop route and guard signed URL navigation ... cc2f9b6d00

External drop into the WebView (default-enabled) is a picker-free route
into the dashboard's QR-image HTML file input and a drag-to-navigate
surface. Disable it with the supported per-app WebView2
AllowExternalDrop property; in-page drag interactions and every scanner
path are unaffected, and the same-origin policy still cancels drag
navigation. Documented as LOCK-10 in the threat model and acceptance
plan; the LOCK-09 memo notes this does not suppress the native chooser.

Also guard ApplySignedDashboardUrl's navigation: a signed URL update
arriving while the browser process is dead or being replaced previously
threw on the dispatcher and shut the kiosk down; it now defers to the
existing recovery timer, matching RecoverIfNeeded.

Test-WebViewLockdown.ps1 pins both behaviors and was negatively
validated against mutated source.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add camera QR capture acceptance procedure ... f55aab5711

The README claims origin-scoped automatic camera permission and the
LOCK-09 memo requires re-running camera QR capture, but the acceptance
plan had no camera section. Add explicit steps: verify Windows camera
privacy state for the installed app identity, confirm no permission
prompt appears and only the configured origin can capture, and repeat
after reboot and WebView2 restart. Requires physical evidence.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Harden dashboard-URL pin, manifest parsing, and picker honesty ... 560cb92190

Adversarial release audit of the signed URL channel and browser lockdown
surfaced two source issues and two honesty gaps.

- KioskConfig applied a process environment DASHBOARD_URL over the
  admin-owned ProgramData pin. A standard kiosk account can set
  HKCU\Environment, so this let a non-admin redirect the kiosk origin and
  silently suppress the signed URL channel (DashboardUrlIsLocalPin). Drop
  DASHBOARD_URL from the environment-override loop so, like the capability
  mode, it comes only from package defaults, the admin machine file, or
  admin launch arguments. Hardware keys are unchanged.
- SignedDashboardUrlManifest's field gate accepted a duplicated known key
  (count matched, no unknown keys) before failing later on the missing
  field. Reject with an exact key-set/count check so a malformed object is
  refused at the schema gate. Not exploitable (signature is verified first
  and the signer emits canonical JSON); hardening only.

Documentation, not code, for two native-dialog/containment routes the
dashboard legitimately uses, so the host must not break them:
- window.print() reaches WebView2's Save-as-PDF native dialog, which the
  Ctrl+P accelerator block does not stop and WebView2 exposes no per-app
  cancel for. Tracked as a LOCK-09 acceptance route (memo, threat model,
  LOCK-05) and pinned in Test-WebViewLockdown.ps1.
- Cross-origin <iframe> loads are not policed (only top-level nav is); the
  dashboard embeds camera-viewer iframes, so a blanket cancel would break a
  feature. Recorded as a bounded, mitigated residual in the threat model.

Adds regression tests for both code fixes (79/79 .NET tests pass, build
clean under -warnaserror, all PowerShell suites pass).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Use current Artifact Signing RBAC role name dd9442b80d

Fail closed on WebView2 loader overrides ... 9abe9b30bb

WebView2 loader environment variables and current-user policy can override the
host-selected user data folder, runtime, release channel, and browser arguments.
Reject user-owned overrides before creating the persistent kiosk profile.

Merge remote-tracking branch 'origin/main' into integration/windows-kiosk-pr-refresh-20260721 5c7c95b5f9

Align release-status docs with verified reality and fix validator exit code ... 331359b156

- CURRENT-RELEASE-STATUS.md: record the verified 200 lab-pilot download,
  list the actual runner labels each workflow requires (signer/ci/builder),
  note zero recorded Actions runs, and surface the missing
  config/update-public.pem channel-key prerequisite.
- RELEASE-HANDOFF.md: stop describing the machine-local 1.0.0.0 TEST-ONLY
  package as existing in a fresh checkout.
- config/test-kiosk-config-validator.ps1: exit 0 on success so CI exit-code
  propagation does not fail an all-passed run (last case is a reject-case).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into integration/windows-kiosk-pr-refresh-20260721 c64334e955

Merge branch 'integration/windows-kiosk-pr-refresh-20260721' into agent/windows-release-readiness-20260722 ad16ba504d

Harden Windows update trust and stable promotion 65bbbc0099

Document honest Windows deployment and blockers 3a250dd9e9

Bind Windows stable promotion to accepted physical scope d1e7ce6907

Remove unprovable generic PFX stable trust df93c06780

Record tested Windows candidate and rollback limits cf86b4141e

docs: align Windows production trust and lifecycle 5ad5c1a6f3

feat: add certificate-free portable deployment 4317df5a1c

Harden Windows stable promotion evidence 94169969e8

jdh referenced this pull request 2026-07-23 12:20:04 -04:00

Add isolated Windows PR CI and require public-trust releases #1

jdh closed this pull request 2026-07-24 14:39:16 -04:00

Some checks failed

Hide checks

CI / verify (pull_request) Has been cancelled

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jdh/printago-windows-kiosk!2

No description provided.