Add isolated Windows PR CI and require public-trust releases

External drop into the WebView (default-enabled) is a picker-free route
into the dashboard's QR-image HTML file input and a drag-to-navigate
surface. Disable it with the supported per-app WebView2
AllowExternalDrop property; in-page drag interactions and every scanner
path are unaffected, and the same-origin policy still cancels drag
navigation. Documented as LOCK-10 in the threat model and acceptance
plan; the LOCK-09 memo notes this does not suppress the native chooser.

Also guard ApplySignedDashboardUrl's navigation: a signed URL update
arriving while the browser process is dead or being replaced previously
threw on the dispatcher and shut the kiosk down; it now defers to the
existing recovery timer, matching RecoverIfNeeded.

Test-WebViewLockdown.ps1 pins both behaviors and was negatively
validated against mutated source.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add camera QR capture acceptance procedure f55aab5711

The README claims origin-scoped automatic camera permission and the
LOCK-09 memo requires re-running camera QR capture, but the acceptance
plan had no camera section. Add explicit steps: verify Windows camera
privacy state for the installed app identity, confirm no permission
prompt appears and only the configured origin can capture, and repeat
after reboot and WebView2 restart. Requires physical evidence.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Harden dashboard-URL pin, manifest parsing, and picker honesty 560cb92190

Adversarial release audit of the signed URL channel and browser lockdown
surfaced two source issues and two honesty gaps.

- KioskConfig applied a process environment DASHBOARD_URL over the
  admin-owned ProgramData pin. A standard kiosk account can set
  HKCU\Environment, so this let a non-admin redirect the kiosk origin and
  silently suppress the signed URL channel (DashboardUrlIsLocalPin). Drop
  DASHBOARD_URL from the environment-override loop so, like the capability
  mode, it comes only from package defaults, the admin machine file, or
  admin launch arguments. Hardware keys are unchanged.
- SignedDashboardUrlManifest's field gate accepted a duplicated known key
  (count matched, no unknown keys) before failing later on the missing
  field. Reject with an exact key-set/count check so a malformed object is
  refused at the schema gate. Not exploitable (signature is verified first
  and the signer emits canonical JSON); hardening only.

Documentation, not code, for two native-dialog/containment routes the
dashboard legitimately uses, so the host must not break them:
- window.print() reaches WebView2's Save-as-PDF native dialog, which the
  Ctrl+P accelerator block does not stop and WebView2 exposes no per-app
  cancel for. Tracked as a LOCK-09 acceptance route (memo, threat model,
  LOCK-05) and pinned in Test-WebViewLockdown.ps1.
- Cross-origin <iframe> loads are not policed (only top-level nav is); the
  dashboard embeds camera-viewer iframes, so a blanket cancel would break a
  feature. Recorded as a bounded, mitigated residual in the threat model.

Adds regression tests for both code fixes (79/79 .NET tests pass, build
clean under -warnaserror, all PowerShell suites pass).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Use current Artifact Signing RBAC role name dd9442b80d

Fail closed on WebView2 loader overrides

CI / verify (pull_request) Waiting to run

Details

9abe9b30bb

WebView2 loader environment variables and current-user policy can override the
host-selected user data folder, runtime, release channel, and browser arguments.
Reject user-owned overrides before creating the persistent kiosk profile.

jdh added 2 commits

2026-07-22 09:47:35 -04:00

Merge remote-tracking branch 'origin/main' into integration/windows-kiosk-pr-refresh-20260721 5c7c95b5f9

Align release-status docs with verified reality and fix validator exit code

CI / verify (pull_request) Waiting to run

Details

331359b156

- CURRENT-RELEASE-STATUS.md: record the verified 200 lab-pilot download,
  list the actual runner labels each workflow requires (signer/ci/builder),
  note zero recorded Actions runs, and surface the missing
  config/update-public.pem channel-key prerequisite.
- RELEASE-HANDOFF.md: stop describing the machine-local 1.0.0.0 TEST-ONLY
  package as existing in a fresh checkout.
- config/test-kiosk-config-validator.ps1: exit 0 on success so CI exit-code
  propagation does not fail an all-passed run (last case is a reject-case).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

jdh added 1 commit

2026-07-22 10:48:18 -04:00

Merge remote-tracking branch 'origin/main' into integration/windows-kiosk-pr-refresh-20260721

CI / verify (pull_request) Has been cancelled

Details

c64334e955

jdh referenced this pull request

2026-07-23 12:19:54 -04:00

Integrate verified Windows kiosk release-readiness work #2

jdh closed this pull request

2026-07-23 12:20:04 -04:00