Settings changes are applied to the latest stored settings under a cross-process lock and renamed into place in one step, so two instances no longer erase each other's changes and a file that cannot be read is never replaced by defaults. Invalid content is repaired per property with a copy of the original kept aside. ADR-0006 records the file protocol.
Closes#46
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Pins the sanitizer allowlist, the resource-policy boundaries and Windows file-name rules with exact tests. Themes with undecodable text or repeated property names are refused; renamed and edited themes are written compactly and kept under their own size limit.
Closes#48
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
They assert on failing child processes themselves; the shared workflow's
native-exit-code preference turned those expected failures into errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assert-Coverage.ps1 reports a shortfall with exit 1, which only stops the
build when the script runs as a native process.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The KOF Windows runner provides SDK 10.0.403, whose implicit ILLink
reference is 10.0.14; locked restore failed against the 10.0.12 entries
the 10.0.401 pin produced.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Locked restore, warnings-as-errors build, dotnet format, core tests with the
100% coverage gate and the PowerShell analyzer/Pester checks run on the KOF
Windows host runner; the review-gate scripts lint and test on node.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stable1.0.2 and dev1.0.2-beta.1 EXEs/ZIPs are public and their actual
downloaded signatures, timestamps, payloads, hashes, SBOM/provenance and
updater feeds verify. Complete the owner's renewed MSI request by
pinning standards1.2.0 at0ef3d319, enabling signed per-user MSI
alongside EXE/ZIP, preparing1.0.3 channel links and next development
prefix1.0.4.
Stop duplicate release validation: a tag must be on main, have a
verified source signature, match the entire genuinely merged PR Git
tree, and reuse that head's latest successful required technical checks
under their configured provider identities. Missing, failed, stale,
pending or different-tree proof fails publication. All branch technical
gates remain required; fresh release build/core coverage, signing, exact
MSI payload/native lifecycle and distribution/SBOM/provenance checks
remain required. Application behavior/dependencies/Azure trust are
unchanged.
Validation: all8 script tests pass (including10 release-proof boundary
cases), live source proof verifies all17 genuine checks on the actual
published18d8ae9 tree, five actual documents pass canonical lint,
actionlint/zizmor and signed commit hooks pass. Exact-head full CI
starts with this PR; production signed MSI lifecycle is still required
before delivery. No claim of published MSI yet.
Owner explicitly authorized release without further human-review
requests. Record a truthful release-specific waiver; never fabricate
personal-read acknowledgement; restore original rules immediately after
the bounded merge. Substantial AI assistance: Codex GPT-6. Refs
#33,#36,#38 and KofTwentyTwo/standards#47.
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
Both1.0.1 release candidates passed acceptance and Azure login but
stopped before signing because of the shared inline PowerShell wrapper.
Pin the corrected, personally approved standards1.1.2 builder at083d903.
Preserve failed tags; use new1.0.2 stable/dev refs, prepare direct
EXE/ZIP download links, correct portable-update guidance and developer
verification links, and set the next development prefix to1.0.3.
Application behavior remains the reviewed and fully accepted PR37
source.
Validation: five actual Markdown files pass canonical lint; actionlint
and signed-commit hooks pass. Exact-head full hosted checks are running.
Production publication and downloaded-artifact signature/provenance
verification remain required. MSI remains next release per the owner's
latest decision. OpenSSF remains70%, not passing.
The owner expressly authorized completion without further human-review
requests. This is a release-specific waiver, not a fabricated
personal-read acknowledgement. Preserve all technical/security/signature
gates. Substantial AI assistance: Codex GPT-6. Refs #33, #34 and
KofTwentyTwo/standards#45.
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
The protected releases encountered two blockers: the full111-test
Windows acceptance suite ran into its600-second process budget, and
Microsoft's signing action dependency installer conflicted with the
caller's NuGet source mapping. A subsequent completed run exposed an
immediate keyboard assertion reading jk before the required jkg value.
Allow900 seconds for each full published/installed suite and60 minutes
for all three suites plus packaging/update probes. Individual test
deadlines, assertions and filters remain unchanged. Keep the exact jkg
assertion, first awaiting that exact native textbox value within the
existing10-second deadline; FlaUI5.0.0's UntilInputIsProcessed only
sleeps100ms. Add this exact case to the focused hosted regression job.
No input is replayed and a genuinely lost key still fails.
Pin published immutable standards1.1.1
at96cbdf208a15c9c524676bd15ff9e323228a952b. The owner personally
reviewed its signing fix in PR44; it merged normally and production
builder release38322016784 succeeds. The fixed official dependency
staging verifies the exact package SHA256 and NuGet signatures without
changing application package source mapping, OIDC trust or signing
verification. Preserve only the previously approved exact Syft entry in
the setup plan, retaining restrictive container regression tests.
Refs #33. EXE/ZIP first, MSI next release (#36), following the latest
owner decision. No app release exists; preserved failed1.0.0 tags will
not be rewritten. New app candidates will use1.0.1/stable
and1.0.1-beta.1/dev after this reviewed exact-head CI passes.
Validation: zero-warning app/test builds and test formatting;42
process/registry/setup boundary tests pass, zero skips; configured
PowerShell analysis, actionlint, medium-and-above workflow security gate
and all commit hooks pass. The scan's five preexisting low
self-repository recommendations remain unchanged. Fresh full
native/published/installed hosted acceptance is running. Local baseline
and changed keyboard runs both stop earlier at missing FindText, so
neither verifies the hosted jkg fix. Temporary fixture diagnostics
removed; original user previews/profiles preserved.
Substantial AI assistance: Codex GPT-6. Genuine final-head maintainer
review under K22-AI-01 is required before merge. This PR contains no
application behavior change or weakened assertion.
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
This replaces the blocked history in PR #3 with one properly attributed,
signed/DCO commit. The owner personally reviewed and approved PR #3 in
the release session.
**No file changes from the approved candidate:** both
baee14f492 and
e605df62c4 have exact Git tree
a85912cbad. Original PR #3 and its commits
are preserved for review history. Historical commits were locally signed
but GitHub reported no_user; protected merge checks those introduced
commits even for squash merging. This commit resolves attribution
without bypassing or weakening signature rules.
The reader, Settings, themes, source highlighting/split, live reload,
file associations, Print/PDF, About credits, toolbar/footer/editor
fixes, user-first README/screenshots and developer guides are exactly
the approved implementation. Stable/dev separation and protected Azure
signing caller are unchanged.
Evidence:
- Approved tree baee14f / CI38285775463 passes all checks. Downloaded
focused29/29, published111/111, stable110/110 and dev110/110 TRXs have
zero failures/skips. Core coverage100% lines/98.86% branches; actual
update/restart/coexistence/default-preservation receipts verify.
- New single-commit hooks, online workflow security, signing and DCO
pass. GitHub must rerun all required checks on this commit; results are
not copied across SHAs.
- Live repository setup validates18 Actions-bound checks, with only
fuzzing added and all prior protections preserved.
- OpenSSF project15417 is now owner-reviewed and saved at70% under
owner-confirmed CDLA-Permissive2.0. This is an in-progress assessment,
not a passing badge.
- Production CI OIDC and signed1.0/dev publication remain required;
local representative signing is not CI proof.
Substantial AI assistance: Codex (GPT-6). Supersedes PR #3. Release work
remains tracked in #33.
Closes#4, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17, #18,
#19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #32, #34.
Refs #1, #5, #30, #31, #33.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
Carry the verified starter bootstrap correction into the Windows application. Keep the selected-actions policy and required security checks while allowing only the two published scanner digests.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <jmaes@dmdbrands.com>
Generate the GUI-only AppKit foundation, lock published dependencies and record the Windows feature requirements against the pinned original. The greeting is still scaffold content; no Markdown viewer or release is claimed.
Validation: zero-warning solution build; 20 core tests; 100% core coverage; formatting and documentation checks.
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <jmaes@dmdbrands.com>
james.maesandClaude Fable 5.2
forge-recovery