A copy of an invalid settings file that cannot be written, for example
on a full disk, is now reported and the save goes ahead, as it does
when the copy cannot be given its name. Before, the save was refused.
On a volume that needs the fallback move, a read-only settings file is
recognized by its attribute and refused at once instead of after the
full wait.
Refs #46
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
The rename that replaces the settings file now takes the path in the
form Windows reads as written, so a data folder past 260 characters,
or one whose name is not well-formed UTF-16, saves like any other.
Before, every save after the first was refused there.
The copy of an invalid file is written to a temporary name and given
its kept-aside name only after the save succeeds, so a failed save can
no longer overwrite and then delete an earlier copy, and a killed save
leaves no duplicate copies. A file over 16 MiB is replaced without a
copy.
On a volume that needs the fallback move, a reader's open handle is
waited out instead of failing the save at once.
Refs #46
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Pins the sanitizer allowlist, the resource-policy boundaries and Windows file-name rules with exact tests. Themes with undecodable text or repeated property names are refused; renamed and edited themes are written compactly and kept under their own size limit.
Closes#48
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
The stored file is now replaced with a single rename that works while
other handles are open on it, so there is never a moment without a
settings file and a process killed mid-save leaves the old file or the
new one. Volumes without that rename fall back to a move.
Content the JSON reader cannot decode is treated as invalid content
rather than an error, the read handle is released on every path, and a
kept-aside copy that cannot be made no longer blocks the save. Clearing
recent files also deletes kept-aside copies.
ADR-0006, the user guide and the threat model describe the protocol as
implemented.
Refs #46
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Reading while denying writers makes a file that is being rewritten in
place read as busy instead of as invalid content, and the read handle is
held until the swap, so the content judged is the content replaced. The
swap uses a replace operation: an invalid original moves to its kept-aside
name in the same step, a failed save leaves it in place, and a reader that
allows replacement no longer blocks a save.
Access denied is permanent and reported at once; only a sharing violation
is waited out, so a read-only profile no longer stalls a window. One
invalid value costs only that value, a trailing comma, a comment and a
quoted number are accepted, and a saved theme the JSON reader cannot
decode is discarded instead of stopping startup. Kept-aside files use the
first free of nine names. Only this store's own temporary files are
removed. ADR-0006 records the on-disk protocol.
Tests cover each of these with real handles held the way other programs
hold them, a deterministic interleaving of two instances, the on-disk
format against the previous store, and bounded retries in the concurrent
test.
Refs #46
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
A load that hit a sharing violation returned defaults, and the next save
wrote them back over the stored themes, CSS, editors and recent files. Two
processes over one data folder also erased each other's changes: each did
load, modify, save with no lock and one shared temporary file name.
AppSettingsStore applies one change to the latest stored settings under a
lock file beside settings.json and replaces the file by rename. A file that
cannot be read after bounded retries is never overwritten; only invalid
content counts as corruption and is kept as settings.json.corrupt. A file
over 16 MiB is not loaded, abandoned temporary files are removed, and
faults are logged by kind, exception type and HRESULT only.
Every save in the app now goes through Update. Tests use real exclusive
handles and concurrent instances and count attempts instead of time.
Closes#46
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Stable1.0.2 and dev1.0.2-beta.1 EXEs/ZIPs are public and their actual
downloaded signatures, timestamps, payloads, hashes, SBOM/provenance and
updater feeds verify. Complete the owner's renewed MSI request by
pinning standards1.2.0 at0ef3d319, enabling signed per-user MSI
alongside EXE/ZIP, preparing1.0.3 channel links and next development
prefix1.0.4.
Stop duplicate release validation: a tag must be on main, have a
verified source signature, match the entire genuinely merged PR Git
tree, and reuse that head's latest successful required technical checks
under their configured provider identities. Missing, failed, stale,
pending or different-tree proof fails publication. All branch technical
gates remain required; fresh release build/core coverage, signing, exact
MSI payload/native lifecycle and distribution/SBOM/provenance checks
remain required. Application behavior/dependencies/Azure trust are
unchanged.
Validation: all8 script tests pass (including10 release-proof boundary
cases), live source proof verifies all17 genuine checks on the actual
published18d8ae9 tree, five actual documents pass canonical lint,
actionlint/zizmor and signed commit hooks pass. Exact-head full CI
starts with this PR; production signed MSI lifecycle is still required
before delivery. No claim of published MSI yet.
Owner explicitly authorized release without further human-review
requests. Record a truthful release-specific waiver; never fabricate
personal-read acknowledgement; restore original rules immediately after
the bounded merge. Substantial AI assistance: Codex GPT-6. Refs
#33,#36,#38 and KofTwentyTwo/standards#47.
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
Both1.0.1 release candidates passed acceptance and Azure login but
stopped before signing because of the shared inline PowerShell wrapper.
Pin the corrected, personally approved standards1.1.2 builder at083d903.
Preserve failed tags; use new1.0.2 stable/dev refs, prepare direct
EXE/ZIP download links, correct portable-update guidance and developer
verification links, and set the next development prefix to1.0.3.
Application behavior remains the reviewed and fully accepted PR37
source.
Validation: five actual Markdown files pass canonical lint; actionlint
and signed-commit hooks pass. Exact-head full hosted checks are running.
Production publication and downloaded-artifact signature/provenance
verification remain required. MSI remains next release per the owner's
latest decision. OpenSSF remains70%, not passing.
The owner expressly authorized completion without further human-review
requests. This is a release-specific waiver, not a fabricated
personal-read acknowledgement. Preserve all technical/security/signature
gates. Substantial AI assistance: Codex GPT-6. Refs #33, #34 and
KofTwentyTwo/standards#45.
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
The protected releases encountered two blockers: the full111-test
Windows acceptance suite ran into its600-second process budget, and
Microsoft's signing action dependency installer conflicted with the
caller's NuGet source mapping. A subsequent completed run exposed an
immediate keyboard assertion reading jk before the required jkg value.
Allow900 seconds for each full published/installed suite and60 minutes
for all three suites plus packaging/update probes. Individual test
deadlines, assertions and filters remain unchanged. Keep the exact jkg
assertion, first awaiting that exact native textbox value within the
existing10-second deadline; FlaUI5.0.0's UntilInputIsProcessed only
sleeps100ms. Add this exact case to the focused hosted regression job.
No input is replayed and a genuinely lost key still fails.
Pin published immutable standards1.1.1
at96cbdf208a15c9c524676bd15ff9e323228a952b. The owner personally
reviewed its signing fix in PR44; it merged normally and production
builder release38322016784 succeeds. The fixed official dependency
staging verifies the exact package SHA256 and NuGet signatures without
changing application package source mapping, OIDC trust or signing
verification. Preserve only the previously approved exact Syft entry in
the setup plan, retaining restrictive container regression tests.
Refs #33. EXE/ZIP first, MSI next release (#36), following the latest
owner decision. No app release exists; preserved failed1.0.0 tags will
not be rewritten. New app candidates will use1.0.1/stable
and1.0.1-beta.1/dev after this reviewed exact-head CI passes.
Validation: zero-warning app/test builds and test formatting;42
process/registry/setup boundary tests pass, zero skips; configured
PowerShell analysis, actionlint, medium-and-above workflow security gate
and all commit hooks pass. The scan's five preexisting low
self-repository recommendations remain unchanged. Fresh full
native/published/installed hosted acceptance is running. Local baseline
and changed keyboard runs both stop earlier at missing FindText, so
neither verifies the hosted jkg fix. Temporary fixture diagnostics
removed; original user previews/profiles preserved.
Substantial AI assistance: Codex GPT-6. Genuine final-head maintainer
review under K22-AI-01 is required before merge. This PR contains no
application behavior change or weakened assertion.
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
This replaces the blocked history in PR #3 with one properly attributed,
signed/DCO commit. The owner personally reviewed and approved PR #3 in
the release session.
**No file changes from the approved candidate:** both
baee14f492 and
e605df62c4 have exact Git tree
a85912cbad. Original PR #3 and its commits
are preserved for review history. Historical commits were locally signed
but GitHub reported no_user; protected merge checks those introduced
commits even for squash merging. This commit resolves attribution
without bypassing or weakening signature rules.
The reader, Settings, themes, source highlighting/split, live reload,
file associations, Print/PDF, About credits, toolbar/footer/editor
fixes, user-first README/screenshots and developer guides are exactly
the approved implementation. Stable/dev separation and protected Azure
signing caller are unchanged.
Evidence:
- Approved tree baee14f / CI38285775463 passes all checks. Downloaded
focused29/29, published111/111, stable110/110 and dev110/110 TRXs have
zero failures/skips. Core coverage100% lines/98.86% branches; actual
update/restart/coexistence/default-preservation receipts verify.
- New single-commit hooks, online workflow security, signing and DCO
pass. GitHub must rerun all required checks on this commit; results are
not copied across SHAs.
- Live repository setup validates18 Actions-bound checks, with only
fuzzing added and all prior protections preserved.
- OpenSSF project15417 is now owner-reviewed and saved at70% under
owner-confirmed CDLA-Permissive2.0. This is an in-progress assessment,
not a passing badge.
- Production CI OIDC and signed1.0/dev publication remain required;
local representative signing is not CI proof.
Substantial AI assistance: Codex (GPT-6). Supersedes PR #3. Release work
remains tracked in #33.
Closes#4, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17, #18,
#19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #32, #34.
Refs #1, #5, #30, #31, #33.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
Carry the verified starter bootstrap correction into the Windows application. Keep the selected-actions policy and required security checks while allowing only the two published scanner digests.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <jmaes@dmdbrands.com>
Generate the GUI-only AppKit foundation, lock published dependencies and record the Windows feature requirements against the pinned original. The greeting is still scaffold content; no Markdown viewer or release is claimed.
Validation: zero-warning solution build; 20 core tests; 100% core coverage; formatting and documentation checks.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <jmaes@dmdbrands.com>
james.maesandClaude Fable 5.2