[GOD13emad]

Current security review — production candidate R356, validated through R360

Exact PR head: f3a841856c6b7eeeec41beb464fc22af88e3aef8 (same in the personal and organization review branches). Status: scoped security review only, not merged and not published. The official, owner-installed v1.7.8 remains intentionally unsigned and unchanged. This review is AI-assisted technical evidence, not a claim of a named person's independent approval.

Accepted production change: the original Setup's deferred cleanup uses SetFileInformationByHandle(FileDispositionInfo) to delete verified empty directories via their still-pinned native handles, removing the previously observed release-to-path-delete window. The protected Helper's existing Broker/Supervisor leaf-identity and journal-recovery safeguards remain in place. The original 22,000-character PowerShell command guard was preserved.

Verified evidence (exact versions and scope):

• R356 original compiled Setup tests: Windows 2025/2022, 8/8 nominal, root/child junction and live rename cases; 94 named checks, 8 GitHub archive ZIPs and 10 raw JSON SHA-256 matches, 27 hostile receipt mutants rejected.
• R356 full Build/Verification: 3/3 successful.
• R358 unchanged original PE Helper: 2/2 hosted Windows PREPARED journal cold recoveries with separate native symlink replacement attempts denied; original protected binary/task XML restored.
• R360 unchanged original PE Helper: 2/2 hosted Windows PREPARED journal recoveries with real two-link hardlink MoveFileExW attempts denied (Win32 5); external file hashes preserved, 30 independent receipt mutants rejected. R360 Build successful. R358/R360 are test-only descendants, not additional unmerged product changes.
• Project accepted evidence is recorded through R360. Previous manually compiled local-threat CodeQL findings were triaged within their source-to-sink scope; warnings were not dismissed.

Explicit remaining limitations: no exhaustive claim for all NTFS/cross-user races or all malware; real owner-visible secure-desktop UAC consent and actual physical Windows banner/speaker delivery are not independently witnessed. Issue #6 awaits the original reporter's flagged driver SHA-256 and download/installation origin; do not bypass Defender. Signing is intentionally waived for this release.

Decision: keep this PR in review; do not equate CI success with blanket security acceptance, a merged release or the already installed v1.7.8.

---

Historical R349–R355 review notes (retained for provenance)

Historical R355 security candidate — scoped acceptance, not yet merged

• Exact PR head: 8695cd7c8afdb1906645c0948ef750f6b2d3a4ab, derived by non-force fast-forward from R349 46c896f; product change is confined to installer/TaskbarMonitorEnhanced_Setup.cs. An in-memory native directory lease pins canonical profile/AppData and owned subdirectories without FILE_SHARE_DELETE during original deferred cleanup, with native final-path and reparse verification.
• Original compiled Setup cleanup versus separate active root-renamer, Windows 2025 + 2022: 2/2 successful, 14 exact checks per guest. The actor renamed/restored the synthetic AppData root before Cleanup, then after the first actual test file deletion its native rename was refused with Win32 error 32 while the original Cleanup process was alive; Cleanup exited 0, no outside canary byte changed and the Build-created test AppData was restored to its original hash.
• Compiled native directory lease witness: Windows A/B both PASS, six checks each, real separate process rename denied under a pinned handle and allowed after release, genuine junction rejected. All two native + four live actor/parent GitHub ZIP and raw artifact SHA-256 hashes independently matched, and 12 + 21 mutated receipts were rejected.
• Full Build and Verification on exact test head: 3/3 SUCCESS. R354 original Setup static root/child junction/native cleanup regression 39329109043: 6/6 SUCCESS with unchanged R355 production code. Accepted scoped project-state record: local R355 commit 4ad4244.

Remain OPEN: the final per-directory release-to-Directory.Delete(..., false) micro-window and other NTFS/privileged Broker leaf races are not exhaustively proven; true user-visible native secure-desktop UAC consent, real owner OS thermal warning banner/speaker and external Issue #6 reporter-specific WinRing0 driver SHA/source have not been independently witnessed. Do not infer full malware clearance or dismiss CodeQL reports. This candidate is not authorized as complete security FINAL, and is not a change to installed/public intentionally unsigned v1.7.8.

---

Historical R349 review context (preserved)

R349 exact embedded native leaf handle and original Helper regression (2026-10-19)

• Reviewed but NOT merged: Both security PR heads are now exactly 46c896f123a98aa7fa234bd4b266c8003ebb621e, non-force fast-forward descendants of R347. The personal PR remains OPEN; organization PR Release 1.0.1: resilient sensors, AMD/Intel GPU portability, adaptive taskbar placement #2 remains OPEN/DRAFT. Owner original unsigned v1.7.8 executable/Glass config, public release and protected main were not changed.
• Bounded product repair: R348 had genuinely shown an already-Administrator second process could overwrite Broker leaf contents despite R347's pinned directory handles. R349 adds a native TBMEProtectedBrokerLease.OpenReplayLeaf using actual GENERIC_READ|GENERIC_WRITE and only FILE_SHARE_READ, with FILE_FLAG_OPEN_REPARSE_POINT, file-type/reparse/hardlink count and final-path checks. It retains each opened original snapshot leaf handle across PREPARED file write/readback, old task restoration and journal retirement. Restore writes and SHA rereads use the same exact handle, and preopens all original snapshot files before writing. Already-held DELETE access prevents new exclusive lease (fail closed). Compacting CSharp comments/indentation kept the original single in-memory PE resource and trusted RunAs command length limits intact; no user-writable script extraction, security bypass or new driver installation.
• Independent native evidence: R349 already-admin Windows A/B 39257019395 2/2 SUCCESS, 8 checks each. A distinct administrator process's known protected-leaf overwrite was denied by real OS sharing; exact previous leaf bytes unchanged while open. A preopened DELETE-access handle refused subsequent exclusive replay-leaf open with Win32 error 32; after both handles closed, the test-owned file could be rewritten normally. Four typed parent/actor raw receipts independently SHA-256 checked (A parent F5E5CBEA/actor 7651D72E; B parent 9E224CB5/actor 81C90E43). Temporary ProgramFiles fixtures and canaries cleaned/checked.
• Original complete production Helper: exact-source Windows 2025/2022 8-job regression 39257112602 8/8 SUCCESS nominal, early kill, post-task delete and post-Broker.exe delete. Post-mutation original Helper cold-restored exact binary/owner hashes, task principal/byte-exact XML and retired journal before final Uninstall. All 8 Helper + 8 ACL + 2 no-valid-journal typed receipts independently checked. Exact code full CI 39257019337 3/3 SUCCESS. Local four-component build, R334 24/24 and R335 23/23 passed. R349 F00 native test-only run 39256574218 was FAIL because harness missed an exact managed IOException with WIN32_32, corrected without product code change. Initial uncompressed CSharp triggered the established Setup command-line length limit, corrected by removing only CSharp comments/indentation (never relaxing the limit).
• Open gates / scope: R349 locks original saved leaf files during replay, not every newly introduced file pending deletion, and only the isolated adversarial test used a concurrent second administrator while the real full Helper regression did not deliberately overlap a concurrent privileged writer. Already-open DELETE was demonstrated to fail closed in the native class; a full Helper cold-replay-under-that-handle witness, race on allowlisted new-file deletion and other privileged leaf/reparse swaps still need independent proof. Native interactive UAC consent, seven inherited CSharp command warnings (4 Supervisor, 3 Setup), physical Glass thermal Windows banner/speaker and Defender Issue do not donwload. virus #6 original reporter SHA/provenance remain OPEN. No merge, release or CodeQL dismissal authorized.

---

R347 actual Windows privileged directory-rename defense (2026-10-19)

• Exact security source head 2e246134ddf5a3efcfa66900d6d97fc19167643f; both security PRs have been non-force fast-forwarded, remain OPEN / UNMERGED (organization PR Release 1.0.1: resilient sensors, AMD/Intel GPU portability, adaptive taskbar placement #2 stays Draft). Original user-installed unsigned v1.7.8, Glass config, protected main, release and CodeQL alerts were not changed.
• Root cause and scoped fix: the previous TBMEProtectedBrokerLease used FILE_READ_ATTRIBUTES which Microsoft documents as exempt from sharing restrictions; hostile privileged directory rename succeeded despite the handle. F01 requests FILE_LIST_DIRECTORY with FILE_SHARE_READ|FILE_SHARE_WRITE and no FILE_SHARE_DELETE, pins the real Program Files, protected product root and SensorBroker directory across hash-bound PREPARED journal replay and task restoration; uses one exact Setup-compatible native Add-Type here-string.
• Actual disposable native proof: R347 Windows 2025/2022 test 39248307747 2/2 SUCCESS. Two distinct concurrent processes holding administrative tokens (not different accounts) ran on each host; the second process made 80 Broker plus 80 product-directory rename attempts, all 160/160 denied per host. While handles remained open, the parent validated the canonical pinned tree 109 times on A and 112 on B. After handle disposal, admin rename succeeded. A real NTFS junction was rejected by the compiled PE-embedded CSharp lease without touching the outside canary. Each host completed 8/8 typed checks; exact four parent/actor raw SHA-256 receipts independently downloaded, SID/Process ID and counts bound, and test-created protected fixtures removed.
• Regression: R347 full Helper nominal, early-kill, post-task and post-Broker-deletion 39247474001 8/8 SUCCESS on Windows A/B with actual original PE-embedded Helper cold replay; exact R347 F03 full CI 39248307770 3/3 SUCCESS. Local full four-project Build plus native security command-sink R334 24/24 and user-log lease R335 23/23 passed. Earlier R347 experiments 39246502929 (attribute-only handle did not block rename) and 39247473885 (PS5.1 nested .NET sharing/junction exception was incorrectly interpreted by test harness) remain FAIL provenance, not promoted.
• Residual acceptance is separate: genuine test blocked directory rename/reparse while pinned; it does not prove atomic identity of individual Broker leaf files, racing privileged leaf overwrite, or resilience to an already-open privileged DELETE handle. No physical interactive UAC consent was observed. Seven inherited manually compiled CSharp CodeQL command findings (4 Supervisor, 3 Setup) still require independent security adjudication; physical thermal toast/audio and external Defender Issue do not donwload. virus #6 reporter file provenance also remain open. No merge, public release, or dismissal of security findings.

---

Current supplemental security evidence — R345 serial privileged foreign-member refusal (2026-10-19)

• Production review code remains exact R344 F08 ce33b95b859845d865e5bb90db5120fdf0ed129f; R345 cc85d570e18bf30a3cc226212b6884f940150e1f is a distinct test-only branch with no additional product change. Both PRs remain unmerged (organization PR remains Draft), and official unsigned v1.7.8 and owner Glass settings are unchanged.
• Original PE-embedded Helper privileged unknown-member native Windows A/B run: 2/2 PASS, 14 typed checks per guest, both independent raw SHA-256 receipts verified. An already-admin disposable actor injected a test file into protected Broker after the actual Helper was killed following Broker.exe deletion; real Helper refused cold replay with DEGRADED_ROLLBACK_RECOVERY_REQUIRED, preserved the unexpected file and PREPARED journal. After the exact test-owned file alone was removed and hash checked, identical Helper restored prior owner, Broker/Supervisor binaries and Task XML, retired journal, and final Uninstall succeeded. Exact-head full CI 3/3 PASS.
• Limit: This proves fail-closed behavior against a serial unexpected privileged filesystem write, NOT simultaneous privileged reparse/rename race atomicity or real interactive UAC consent. Seven inherited manual CSharp CodeQL command findings (4 Supervisor, 3 Setup), physical warning/audio witness, external Defender Issue do not donwload. virus #6 reporter SHA/origin and independent security approval remain OPEN. No release, merge or alert dismissal is authorized by these tests.

---

CURRENT scoped security review — authenticated protected uninstall PREPARED journal recovery (R344, 2026-10-19)

• Exact review head: ce33b95b859845d865e5bb90db5120fdf0ed129f (non-force fast-forward from R338 ce91a0328e4af353e7e77ed227b9900327e82e76); PR remains OPEN / UNMERGED. The unsigned official v1.7.8, both protected main refs, maintainer's running Main executable and Glass settings are untouched. No release or driver installation was performed.
• Defect + fix: original R343 reproducible failure 39223363336 showed original elevated-intended Helper killed after protected Broker executable deletion, leaving a SID-less BrokerRoot that it would not subsequently clear. R344 journals exact prior protected files + Task XML as a SID/hash-bound, admin-owned PREPARED snapshot BEFORE task/file removal. Its exact cold path refuses an unowned/foreign tree without a trusted journal, verifies the original owner marker, restores previous bytes/Task principal/action/XML, retires the journal, then a new unchanged original Helper may finish Uninstall. Two independently reproduced root causes were repaired: composite FileSystemRights.Modify masks incorrectly flag Users ReadAndExecute as Write, and local-versus-$script: PowerShell state shadowing had emitted a zero-file PREPARED snapshot. Diagnostic-only temporary logging was removed from the accepted PE source.
• Native original production Helper + security negatives: R344 F09 final 8-job guest matrix 39236025913 8/8 SUCCESS (Windows 2025/2022 × nominal, killed before shared mutation, killed after real Task unregister, killed after Broker.exe deletion). Post-mutation variants each pass 11 exact checks, including original binary/owner-marker SHA and byte-identical Task XML restoration, verified DEGRADED_PREVIOUS_LAYER_RESTORED, journal retirement, third original RunAs Helper finished with UNINSTALLED / exit 0. Eight real NTFS ACL proof receipts (6 checks each) and two direct unchanged original-Helper negative tests reject both unowned/no journal and foreign SID marker/no journal while preserving protected bytes. All 18 raw typed guest receipts independently SHA-256 and commit-bound verified, official Setup candidate SHA256 21745837189E8897BC77877EC312CE087C04A98846CDFC5297BD3C4AD8383B38. Earlier red/failed test runs remain recorded and were not treated as PASS.
• Exact-head CI: candidate 3/3 success 39236026025, current personal PR 3/3 success 39236700676, organization Draft PR 3/3 success 39236732075. Organization CodeQL csharp analysis 39236724810 PASS under its separate configuration; prior manually compiled local-threat CodeQL 4 Supervisor + 3 Setup command sinks remain UNADJUDICATED, not dismissed by that success.
• Acceptance remains deliberately scoped: hosted guest runners were already Admin; actual native interactive UAC consent was not observed. A simultaneously privileged competing writer/reparse path race, physical user Windows temperature banner/speaker and Issue do not donwload. virus #6 external Defender reporter driver SHA/origin are not proven. These separate blockers and independent security review must be resolved BEFORE merge/release. No suppression, merge, public publish, owner installed service/process change or claim of overall FINAL.

---

R340–R341 exact original Sensor Helper process and early-kill evidence (2026-10-19)

• Production security PR head remains ce91a0328e4af353e7e77ed227b9900327e82e76, OPEN and UNMERGED. The additional isolated test-only head b992c4e13770a5a08c281c5f433bb13edf45a9b3 modifies only build/Test-R340-OriginalHelperActualUninstall-Native.ps1 and .github/workflows/audit-r340-real-original-helper-uninstall.yml, not product source, owner installation/config, either protected main, or official unsigned v1.7.8.
• Native real Helper A/B: final Windows 2025/2022 nominal vs killed four-job run 39218769937 4/4 SUCCESS. On each disposable already-admin Windows VM, compiled original Setup PE's in-memory bundled, unmodified TBME_Setup_Elevated_Helper.ps1 was invoked via the original System32 PowerShell 5.1 BuildElevatedSensorProcessInfo RunAs factory against an exact temporary Administrator-owned real Program Files Broker + disabled, never-executed global task with matched owner SID and binary SHA. Nominal R340 A/B 9/9 checks: actual helper process exited 0, wrote UNINSTALLED result/log through native sink, removed temporary Broker and task. Killed R341 A/B 10/10 checks: the original Helper (not synthetic worker) was forcibly terminated after BEGIN mode=Uninstall log before any protected files/task were altered, witnessed unchanged task and exact binary hashes, and a different PID using identical real factory completed normal Uninstall/cleanup with exit 0.
• Raw evidence: all four A/B receipts independently downloaded and typed/SHA-256 verified. R340 nominal A F087C4B54175A620027F9CFEAE9A4CC8E931085DD957BA1DF2142C9BED2F9E32, B C852A96516FC341E313815B4700886EDBA6ADB6EED6D60506A65035FDB6821E3; R341 early kill A 2578F5104C291E6D871FCAF8388E9C399245F1234681C57F3BD3FED41AA21524, B F87B406EBEF3917AD53B1CF4FC27028A1F226B0CADD65141FAF209C9C12E4DA0. Exact test branch full CI 39218769924 3/3 SUCCESS. Test-harness-only failed predecessors 39216484416 (Scheduler account-name/SID), 39217108563 (PS5.1 reflection object wrappers), and 39218420796 (SwitchParameter to integer receipt) were diagnosed, corrected and not counted as PASS.
• Scope still OPEN: hosted runners were already Administrator; no actual native interactive UAC consent dialog. Helper kill occurred before, not after, first shared protected Task/Broker mutation; it does not prove interrupted PREPARED journal's post-mutation cold restoration or active competing privileged writer/reparse races. Seven manually compiled CSharp CodeQL sinks (4 Supervisor, 3 Setup), physical Glass temperature banner/speaker, original reporter Defender Issue do not donwload. virus #6 SHA/provenance, and independent security review remain unresolved. No driver installed, PR merged, security warning dismissed or official Release changed.

---

Earlier R339 scoped real-other-SID Windows evidence for the unchanged R338 security candidate (2026-10-19)

• Production review head is still ce91a0328e4af353e7e77ed227b9900327e82e76. R339 test-only commit 78f60a99c6bf0c5ba63848245196756d521b765d adds two Windows PowerShell native test scripts and one disposable GitHub Actions workflow; no product source, protected main, public release or owner installation/config changes.
• Native Windows 2025/2022 real two-account run 39213817332 2/2 SUCCESS. On each fresh hosted VM, an already-administrative runner created a temporary administrator-owned Program Files protected SensorBroker fixture from the exact compiled candidate binaries and a genuinely separate local nonadmin SID. Across seven mutation classes × 60 attempts, all 420 attempted nonadmin protected root/file renames, overwrite/delete, new folder and junction operations were denied. In parallel, actual compiled R338 TrustedWorkerPaths accepted its approved protected executable and output paths 32 times on Windows 2025 / 51 on Windows 2022, with hashes intact. Both accounts, private Program Files fixture and ProgramData scratch were removed; pre-existing harmless build-only LocalAppData scratch was preserved. Both typed raw guest receipts independently SHA-256-checked. Full source CI 39213817390 3/3 SUCCESS.
• Failure provenance: earlier experimental runs 39212545093, 39212770097, 39213144825 and 39213371171 failed in the test harness (early receipt null, initial preexistence ambiguity, Windows 48-character account-description limit, and null ExitCode from the alternate-credential Process wrapper). The accepted test requires the child to have exited, then verifies the typed second-SID receipt, 420 denied operations and preserved admin-owned binary hashes, even when Windows does not expose a Process.ExitCode. Failed attempts were not counted as passing. Exact accepted evidence is stored in the existing project Control Index and raw private receipts.
• Still OPEN: this does not present an interactive UAC dialog, kill/restore the original elevated Sensor Helper, concurrently mutate the protected tree as an administrator, or prove safety against an elevated malicious peer or TOCTOU reparse race. Seven earlier manually built local-threat CodeQL command findings (four Supervisor, three Setup) still need independent security adjudication. Owner physical Glass warning/audio and external Defender Issue do not donwload. virus #6 attribution remain unproven. Do not merge either security review or publish a new release yet.

---

R338 security review code candidate — exact privileged Supervisor CLI trust boundary (2026-10-19)

• Current exact head ce91a0328e4af353e7e77ed227b9900327e82e76, non-force descendant of R337 997c6f349fa64cfe6385113a9ede46d35479cc7a. Production fix edf2610c20789028050b3ea76b1bee01c77d07bf; the final child commit adds only an equal-threat manual compiled CodeQL workflow. Both protected main branches, official immutable unsigned v1.7.8 and the maintainer's installed Main/config are unchanged.
• Root cause and mitigation: The protected TaskbarMonitorSensorSupervisor previously accepted arbitrary CLI --broker executables, arbitrary --output telemetry destinations and unknown extra tokens before building child ProcessStartInfo fields. R338 requires one exact four-token pair, binds the Broker to the adjacent fixed protected Program Files filename and output to the exact canonical user LocalAppData path using OS known folders, rejects reparse and altered source directory, and constructs production paths from those OS known folders rather than forwarding CLI values. This is a bounded prelaunch mitigation, not atomic path-race proof or a real high-integrity UAC test.
• Reproducible native results: Windows 2025 and Windows 2022 differential 39178809907 4/4 SUCCESS: two baseline jobs reproduce accepting hostile Broker/output and unexpected flags; two candidate jobs pass 12 native cases each, including a real NTFS junction refusal, exact trusted path and canary. Four raw typed receipts independently downloaded and SHA-256 validated. Exact source CI 39178809877, test-only CodeQL workflow-head CI 39179087616, and current PR head CI 39179699954 all passed three jobs each.
• Static findings correctly remain open: Manual compiled CSharp CodeQL run 39179087768 2/2 SUCCESS, both real four-project .NET Framework builds with zero compiler errors. Equal local-threat comparison of R337 and R338 returned 113 → 113 total, 15 → 15 command-line findings (four inherited Supervisor, three inherited Setup); zero added and zero removed primary fingerprints. This confirms no new scanner regression; it does not prove scanner clearance or exploitability adjudication. No alert was suppressed or dismissed.
• Real acceptance gates remain: original high-integrity Helper interruption with native interactive UAC and exact protected Program Files restoration; cross-user concurrent reparse/rename races; independent review of inherited command alerts; physical user-observed temperature toast/speaker; external Defender Issue do not donwload. virus #6 reporter driver provenance. Both security PRs remain unmerged; no release or owner system service/settings mutation.

---

Historical unmerged security review — R337 protected sensor first-install recovery (2026-10-19)

• Exact current review head: 997c6f349fa64cfe6385113a9ede46d35479cc7a, fast-forward descendant of R335 fa57ae2c89304974f4b91d5a9ca7c3d5b06f57e1. Protected main, immutable unsigned official v1.7.8, live Main/config and user sensor services were not changed.
• Specific recovered defect: If a brand-new protected SensorBroker install died after a PREPARED journal and new files, cold replay removed known files but could leave an empty protected BrokerRoot after its owner SID marker was removed. The next repair then refused this unowned orphan. R337 deletes only allowlisted empty nested directories and the now-empty root nonrecursively after validated replay; unexpected content or reparse points still fail closed.
• Real native Windows evidence: Windows 2025/2022 A/B differential 39176263137 4/4 SUCCESS, 10 typed checks each. Both baseline runs reproduce the orphan; both corrected runs leave no orphan and retire the journal. Raw four receipts independently downloaded, SHA-256 checked and version-bound. First attempt 39175990570 FAILED only because the split-checkout test receipt invoked Git in a non-repo CWD; F01 corrected that and all four reran successfully.
• Other verification: exact candidate full CI 39176263122 3/3 SUCCESS, including Glass/thermal and two disposable native Windows regression jobs. Current personal review CI 39176735564 3/3 SUCCESS. Organization Draft Release 1.0.1: resilient sensors, AMD/Intel GPU portability, adaptive taskbar placement #2 review CI 39176748144 3/3 SUCCESS; organization CodeQL check PASS under its separate configuration.
• Acceptance is narrowly scoped. The differential invokes the actual embedded PowerShell 5.1 Helper's recovery functions with protected-ACL synthetic directories on disposable Windows, not a genuine interactive UAC dialog or killed high-integrity original Helper writing real Program Files services. These and cross-user path races remain OPEN. Three inherited local-threat Setup command-line findings are unadjudicated; actual OS alert/banner/speaker and Defender reporter provenance remain externally unproven. No CodeQL suppression/dismissal, merge, owner install or release was performed.

---

Historical R298 security review — absolute native PowerShell for runas

• Exact reviewed head: 6b38199821652515c5c0f0d13952be687d4c333d, non-force descendant of R297 c20e4ee. The personal protected main, official immutable unsigned v1.7.8, owner Main/config and protected sensor services remain unchanged.
• Targeted security correction: the optional UAC sensor Helper formerly used ProcessStartInfo.FileName="powershell.exe" with UseShellExecute=true and Verb="runas". Windows ShellExecute searches the current directory and PATH for an unqualified executable. R298 now constructs a fully qualified executable from the OS-provided Environment.SystemDirectory, checks the expected WindowsPowerShell/v1.0 file and each intermediate component for reparse, pins WorkingDirectory to that trusted directory and keeps runas plus the existing bounded in-memory -EncodedCommand contract. No fallback to an unqualified filename.
• Exact-head verification: full personal Build/Glass/thermal CI 39023857203 SUCCESS, disposable Windows 2025/2022 A/B 39023632894 3/3 SUCCESS, with independently retrieved and SHA-checked raw A/B receipts. Each guest passed 12/12 R298 checks including exact absolute SystemDirectory host, no reparse, unchanged runas and -EncodedCommand, forged powershell.exe in the test's CWD and PATH ignored, and both Install/Uninstall pinned to the same system executable. Prior R286–R297 native and visual regressions PASS. The guest did not actually invoke UAC or modify a driver, task or protected service.
• Security decision still withheld: organization Draft PR #2 exact-head CodeQL analysis 1972442411 FAILED with 11 High (10 cs/path-injection, one cs/command-line-injection); all primary fingerprints unchanged from R297 analysis 1972389031. Static taint starts at Environment.GetFolderPath(LocalApplicationData) in an asInvoker Setup; independent per-user vs elevated exploitability analysis and actual UAC behavior remain open, as does R296 memory-only rollback's process-crash durability. No suppression, merge, signing or new release is implied.

---

Historical R053 trace — R052-only analysis (superseded as PR head by R290)

The historical R052 organization CodeQL check at that R052 commit reported nine new High cs/path-injection findings. The corresponding CodeQL check failed; this one-line R052 patch did NOT close those findings.

The full GitHub SARIF trace for analysis 1970888296 identifies the source of the tainted value as Environment.GetFolderPath(SpecialFolder.LocalApplicationData) in the per-user AppRoot, flowing through UPath() and into upgrade/rollback filesystem checks. It does not show the on-disk ReadStageIndex().parts[0] string as the origin of those nine findings. The new allowlist rebinding is still valid defense in depth but is not a CodeQL acceptance fix.

A separate security assessment should establish whether using the OS-known per-user LocalAppData folder in an unprivileged per-user installer creates an actionable cross-boundary path risk, accounting for the existing canonical-root and reparse/junction checks. If legitimate, fix the trust boundary with regression evidence. If a static-analysis false positive, document the exact reasoning for human review; do not suppress alerts simply to obtain a green check. Actual installed Windows upgrade/rollback remains untested here.

Security review candidate: upgrade-journal path binding (R052)

The organization synchronization draft surfaced nine new High CodeQL path-expression alerts in the installer upgrade/rollback journal. The affected ReadStageIndex() already compares every journal label with UpgradeTargets[i].Rel and rejects a mismatch, but it then passed the on-disk string to StageEntry. This narrowly scoped fix instead binds the validated label back to the compile-time allowlisted value before file operations.

Exact scope and evidence

• Base original-personal main: 9960a06dba606d1c93b8ca2b84e0e3e25ca4f68d.
• Candidate security/upgrade-journal-constant-path-r052: 486abbbbf7d1c50097113d77c8f00ee13b393c09.
• One file: installer/TaskbarMonitorEnhanced_Setup.cs; one added comment and one binding change. Exact journal-format comparison and existing checksum/reparse/rollback checks remain.
• A clean temporary checkout verified the exact diff, the preexisting journal-path equality check and the new static binding, with git diff --check PASS. Three offline synthetic G13/G14 host-witness, G15 signing-origin and G16 publication-contract test scripts PASS.
• Remaining acceptance: Build the actual Windows installer and execute representative upgrade/rollback, including hostile/foreign journal paths, on isolated disposable Windows environments. Independently verify CodeQL against the updated organization candidate; a passing synthetic test is not proof that nine alerts close or that the installer is fully safe.

The organization draft will be advanced only non-forcibly, with SHA readback, to the same commit so its CodeQL PR scan can analyze the patch. Neither personal nor organization protected main, official releases, installed applications or privileged settings were changed by this proposal.

Review needed: Request independent, real Owner assessment before merging the source patch or the eventual organization synchronization.

[mohammadmohammadzadeh19960-code]

AI-assisted technical review under the connected MMZ GitHub account; this does NOT assert that a named human personally reviewed or approved the change.

Exact PR #80 head 8695cd7c8afdb1906645c0948ef750f6b2d3a4ab fast-forwards the old reviewed R349 security source. The production change is isolated to the in-memory PowerShell cleanup source in installer/TaskbarMonitorEnhanced_Setup.cs (C# Git blob 57a7555): TBMEDeferredDirectoryLeaseSet uses no-FILE_SHARE_DELETE native directory handles, verifies final path / reparse bits and preserves owner ancestry through file inventory and removal.

Independent hosted Windows 2025/2022 test coverage: compiled native class witness 39329467616 2/2 success, six exact checks per guest; actual original compiled Setup-generated cleanup overlapped a separate process's real root-rename attempt AFTER first test-file deletion 39331803665 2/2 success, 14 exact checks/guest, native Win32 sharing violation 32 while cleanup process was alive, original cleanup exit 0, canary and hosted Build AppData SHA preserved. Full exact-head PR CI 39333066467 all three jobs SUCCESS. Two native + four live parent/actor GitHub ZIP/raw SHA pairs independently matched, with 12 + 21 rejected receipt mutations. R354 regression 39329109043 6/6 successful against same production Setup source.

SCOPED ACCEPTANCE ONLY. The narrow observed active root-rename denial is supported, but it is not exhaustive proof against final Release-to-nonrecursive-Delete timing, every NTFS leaf/reparse/link race, cross-account elevated Broker mutation, interactive Windows secure-desktop UAC, or unrelated thermal OS banner/speaker and external Defender Issue #6 attribution. The manual C# local-threat SARIF is not suppressed or dismissed. This is a COMMENT review and not permission to merge or publish an unaccepted security release.

[mohammadmohammadzadeh19960-code]

AI-assisted, evidence-scoped security review using the linked GitHub connection (not a claim of a person's independent approval). Exact reviewed head: f3a8418. R356 changes the final owned empty-directory deletion from Release+Directory.Delete(path) to SetFileInformationByHandle(FileDispositionInfo) on the verified pinned native directory handle, keeping the original 22,000-character EncodedCommand guard. On two actual disposable Windows guests the original compiled Setup passed Nominal, RootJunction, ChildJunction, and independent LiveRace (8/8 jobs; 94 named checks); all 8 GitHub artifact ZIPs and 10 raw receipts were independently SHA-verified; the typed verifier rejected 27 hostile receipt mutations. Native API feasibility passed Windows A/B with Win32 32 rename denial, Win32 145 nonempty refusal, and 0 exact empty-directory disposition. Full source Build and Verification 39336379393 succeeded (3/3), original PE tests 39336379320 succeeded (8/8), and the updated PR CI 39338293952 succeeded (3/3). The repository's installed and official unsigned v1.7.8 release is unchanged. This review accepts ONLY those scoped native deletion outcomes, not exhaustive NTFS/file-leaf races, privileged Sensor Broker reparse substitution, real interactive secure-desktop UAC, physical Glass notification/audio, or reporter-supplied Defender Issue #6 driver SHA/origin. COMMENT only: keep this PR open/unmerged pending distinct remaining gates; do not mistake static scanning/build PASS for total security acceptance.

[mohammadmohammadzadeh19960-code]

AI-assisted scoped review update (not a personal human approval): security candidate HEAD remains f3a8418, while the new R358 test-only source a481af7 changes ONLY test harness/workflow. The original production Setup C# blob 2ab641628dd5a265d0c85a380d44f081a1346ec6 and protected Helper blob a3a967c869b247afd8ae7fe697565cabac8ff1d2 are byte-identical on those heads. Actual unmodified compiled Setup PE Helper PREPARED journal cold replay was exercised on separate Windows 2025/2022 hosted admin guests against a distinct native symlink MoveFileExW attempt at the fixed protected Supervisor leaf: run 39343228831 2/2 PASS with 15 exact checks per host, Win32 5 denial while Helper alive and trusted PREPARED/READY journal present; exact prior protected Broker/Supervisor/owner SHA, disabled scheduled task action/principal/export XML, journal retirement and final guest uninstall restored. Real independent GitHub ZIP/archive/raw SHA match both hosts. Project-accepted independent verifier rejected 26 typed receipt mutants; an additional separate reviewer validation rejected 19 more mutations and confirmed byte-for-byte zipped receipt linkage. Full source Build 39343228743 3/3 PASS. R358 local project authority commit fcff314; the test-only branch was NOT merged into the production security PR. This closes only the observed privileged symlink move attempt in full original Helper PREPARED replay; it does not prove every NTFS/hardlink/cross-user race, true secure-desktop interactive UAC, physical OS thermal banner or speaker, or external Defender Issue #6 reporter SHA/origin. No owner installed/public unsigned v1.7.8 changed. COMMENT only; do not interpret this as unconditional security acceptance or a human review.