Draft security review R356: pinned cleanup and protected Helper recovery

.github/workflows/audit-r265-sensor-safety.yml

@@ -0,0 +1,108 @@
+name: R265 - Scoped cross-account sensor helper guard on disposable Windows
+on:
+  push:
+    branches:
+      - release/r265-v175-sensor-crossuser-safety
+permissions:
+  contents: read
+jobs:
+  guest-sensor-guard:
+    name: "R265 no-driver guard-only cross-user test ${{ matrix.guest }}"
+    runs-on: ${{ matrix.system }}
+    timeout-minutes: 17
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - guest: A
+            system: windows-2025
+          - guest: B
+            system: windows-2022
+    steps:
+      - name: Checkout exact unmodified public v1.7.4 ancestor
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Ensure only helper/test/workflow changed; disposable admin host
+        shell: pwsh
+        run: |
+          $ErrorActionPreference='Stop'
+          if($env:GITHUB_ACTIONS -cne 'true' -or
+             $env:RUNNER_ENVIRONMENT -cne 'github-hosted' -or
+             $env:RUNNER_OS -cne 'Windows' -or
+             $env:GITHUB_REPOSITORY -cne 'GOD13emad/TaskbarMonitorEnhanced' -or
+             ($env:GITHUB_REF -cne 'refs/heads/release/r265-v175-sensor-crossuser-safety' -and $env:GITHUB_REF -cne 'refs/heads/main') -or
+             $env:COMPUTERNAME -match '(?i)EMAD|ALI|LAPTOP'){
+             throw 'R265_REJECT_NON_DISPOSABLE_HOST'
+          }
+          $base='1375d719989aa93966bae445ac63b9a415f637ad'
+          git merge-base --is-ancestor $base HEAD
+          if($LASTEXITCODE -ne 0){throw 'R265_EXACT_RELEASE_SOURCE_NOT_BASE'}
+          $actual=@(git diff --name-only $base HEAD)
+          $allowed=@(
+            '.github/workflows/audit-r265-sensor-safety.yml',
+            'build/Test-R265-CrossUserGuard.ps1',
+            'installer/TBME_Setup_Elevated_Helper.ps1'
+          )
+          if($actual.Count -lt 14 -or $actual -cnotcontains 'installer/TBME_Setup_Elevated_Helper.ps1' -or $actual -cnotcontains 'installer/TaskbarMonitorEnhanced_Setup.cs'){
+             throw 'R265_VERSIONED_PRODUCT_SOURCE_GUARD_NOT_STAGED'
+          }
+          $files=@(
+            @{File='installer/TBME_Setup_Elevated_Helper.ps1';SHA='84A7DC21012A63C5959447D7234B365CF926028016A81B742F891951B191E7FB'},
+            @{File='build/Test-R265-CrossUserGuard.ps1';SHA='153268FBDC57F65B8AEC56ED80832F4C6EF5839A3640D0233DF2D7B4ED4606E2'}
+          )
+          foreach($item in $files){
+            $path=(Resolve-Path $item.File).Path
+            $str=[IO.File]::ReadAllText($path,[Text.Encoding]::UTF8)
+            $lf=$str.Replace(([string][char]13+[string][char]10),([string][char]10)).Replace(([string][char]13),([string][char]10))
+            $sha=[Convert]::ToHexString([Security.Cryptography.SHA256]::HashData([Text.Encoding]::UTF8.GetBytes($lf)))
+            if($sha -cne $item.SHA){throw 'R265_SOURCE_DIGEST_CHANGED'}
+            $tok=$null;$err=$null
+            [void][Management.Automation.Language.Parser]::ParseFile($path,[ref]$tok,[ref]$err)
+            if(@($err).Count){throw 'R265_WINDOWS_POWERSHELL51_SYNTAX_FAILED'}
+          }
+          $isAdmin=[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent())
+          if(!$isAdmin.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){
+             throw 'R265_NO_ADMIN_ON_GUEST_NO_ESCALATION'
+          }
+          if(Get-ScheduledTask -TaskName 'TaskbarMonitorEnhanced Sensor Broker' -ErrorAction SilentlyContinue){
+             throw 'R265_EXISTING_REAL_TASK_MUST_NOT_BE_TOUCHED'
+          }
+          if(Test-Path (Join-Path $env:ProgramFiles 'TaskbarMonitorEnhanced\SensorBroker')){
+             throw 'R265_EXISTING_REAL_BROKER_MUST_NOT_BE_TOUCHED'
+          }
+          'R265_FRESH_VM_TEST_ONLY_SCOPE_PIN=PASS'
+      - name: Test actual owner SID guard on both helper modes without executing later side effects
+        shell: powershell
+        run: |
+          $ErrorActionPreference='Stop'
+          ./build/Test-R265-CrossUserGuard.ps1 -HostLabel '${{ matrix.guest }}'
+          $p=Join-Path $env:RUNNER_TEMP 'TBME_R265_${{ matrix.guest }}/R265_CROSSUSER.json'
+          if(!(Test-Path $p)){throw 'R265_TEST_RECEIPT_NOT_FOUND'}
+          $r=Get-Content $p -Raw|ConvertFrom-Json
+          if($r.Revision -cne 'R265' -or
+             $r.Status -cne 'PASS_OTHER_USER_SENSOR_TASK_PRESERVED_AND_SAME_OWNER_GUARD_ALLOWED' -or
+             $r.Guest -cne '${{ matrix.guest }}' -or
+             @($r.OtherUserModesRefused).Count -ne 4 -or
+             @($r.SameUserModesPermitted).Count -ne 4 -or
+             $r.VerifiedRealFullHelperEarlyRefusal -ne $true -or
+             $r.TestOwnedTaskDeleted -ne $true -or
+             $r.GuestUserAccountDeleted -ne $true -or
+             $r.ExactProductionHelperAfterGuardWasNotExecuted -ne $true -or
+             $r.NoSensorTaskTriggered -ne $true -or
+             $r.NoPawnIODriverOrSetupExecuted -ne $true -or
+             $r.OwnerPCAndPublicV174Unchanged -ne $true){
+             throw 'R265_GENUINE_VM_GUARD_SCOPE_NOT_ACCEPTED'
+          }
+          'R265_OTHER_USER_TASK_PRESERVED_BOTH_MODES_AND_SAME_OWNER_PERMITTED=PASS'
+          $global:LASTEXITCODE=0
+      - name: Preserve disposable bounded acceptance evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: R265-guard-${{ matrix.guest }}
+          if-no-files-found: warn
+          retention-days: 21
+          path: |
+            ${{ runner.temp }}/TBME_R265_${{ matrix.guest }}/R265_CROSSUSER.json

.github/workflows/audit-r282-disposable-abrupt-recovery.yml

@@ -0,0 +1,92 @@
+name: R282 Pinned 1.7.5 fixture and immutable 1.7.6 cold journal recovery
+
+on:
+  push:
+    branches: [test/r282-disposable-abrupt-update-recovery]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  original-release-cold-recovery:
+    name: Public v1.7.6 Setup / ${{ matrix.phase }} / pinned-file guest ${{ matrix.host }}
+    timeout-minutes: 20
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: A
+            phase: PREPARED
+            os: windows-2025
+          - host: B
+            phase: COMMITTING
+            os: windows-2022
+    steps:
+      - name: Checkout test-only source on exact hosted revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+
+      - name: Verify PowerShell 5.1 parser and disposable execution contract
+        shell: powershell
+        run: |
+          $ErrorActionPreference='Stop'
+          if($env:GITHUB_ACTIONS -cne 'true' -or
+             $env:RUNNER_ENVIRONMENT -cne 'github-hosted' -or
+             $env:RUNNER_OS -cne 'Windows' -or
+             $env:COMPUTERNAME -match 'EMAD-PC'){throw 'R282_UNSAFE_NON_DISPOSABLE_HOST'}
+          if((git rev-parse HEAD).Trim() -cne $env:GITHUB_SHA){throw 'R282_SOURCE_CHECKOUT_MISMATCH'}
+          $p=(Resolve-Path build/Test-AbruptStageRecovery-R282.ps1).Path
+          $tokens=$null; $errors=$null
+          [void][Management.Automation.Language.Parser]::ParseFile($p,[ref]$tokens,[ref]$errors)
+          if(@($errors).Count){$errors | ForEach-Object { Write-Output $_.Message };throw 'R282_POWERSHELL_PARSER_FAILED'}
+          $source=[IO.File]::ReadAllText($p)
+          if($source.Contains('[string]$args') -or !$source.Contains('[string]$arguments') -or
+             !$source.Contains('$si.Arguments=$arguments')){
+             throw 'R282_BLOCK_RESERVED_POWERSHELL_AUTOMATIC_ARGS_PARAMETER'
+          }
+          if(!(Test-Path build/official-v175-managed.json)){throw 'R282_PREDECESSOR_PINNED_FIXTURE_MISSING'}
+          'R282_EXACT_HOSTED_GUARDS_AND_TEST_PARSER_PASS'
+
+      - name: Build exact resource-pinned prior fixture, kill test helper, recover with real public Setup
+        shell: powershell
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $ErrorActionPreference='Stop'
+          ./build/Test-AbruptStageRecovery-R282.ps1 -HostLabel '${{ matrix.host }}' -Phase '${{ matrix.phase }}'
+          $receipt=Join-Path $env:RUNNER_TEMP 'TBME_R282_${{ matrix.host }}_${{ matrix.phase }}/R282_ABRUPT_RECOVERY.json'
+          if(!(Test-Path $receipt)){throw 'R282_DURABLE_RECEIPT_ABSENT'}
+          $r=Get-Content $receipt -Raw|ConvertFrom-Json
+          if($r.Status -cne 'PASS_DISPOSABLE_CHILD_KILLED_THEN_OFFICIAL_INSTALLER_AUTO_RECOVERED' -or
+             $r.SourceBranchCommit -cne $env:GITHUB_SHA -or
+             $r.HostLabel -cne '${{ matrix.host }}' -or
+             $r.Scenario -cne '${{ matrix.phase }}' -or
+             $r.Official175ManagedFixtureRowsExact -ne 22 -or
+             $r.OriginalOfficial175InstallerFreshInstallPerformed -ne $false -or
+             $r.HistoricalV175FilesExtractedFromPinnedPublishedInstallerResources -ne $true -or
+             $r.PrivilegedSensorDriverInstallPerformedForTest -ne $false -or
+             $r.StagingHelperExternalProcessKilled -ne $true -or
+             $r.NativeSetupAutomaticJournalRecoveryAndInPlaceUpgrade -ne $true -or
+             $r.ExactProtectedUserDataSHA256Preserved -ne $true -or
+             $r.SingleCanonicalUserRoot -ne $true -or
+             $r.RealPhysicalMainsCut -ne $false -or
+             $r.ActualSetupExecutableProcessKilled -ne $false -or
+             $r.NoOriginalOwnerPcTouched -ne $true){throw 'R282_TYPED_DISPOSABLE_RECOVERY_NOT_ACCEPTED'}
+          if('${{ matrix.phase }}' -ceq 'COMMITTING' -and $r.ManagedComponentsPartiallyReplacedBeforeKill -ne 2){throw 'R282_PARTIAL_COMMIT_NOT_PROVEN'}
+          'R282_VERIFIED_EXACT_OFFICIAL_176_AFTER_REAL_TEST_CHILD_KILL=PASS'
+
+      - name: Preserve the bounded individual fail/pass receipt on hosted runner
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: R282-abrupt-${{ matrix.host }}-${{ matrix.phase }}
+          if-no-files-found: warn
+          retention-days: 21
+          path: |
+            ${{ runner.temp }}/TBME_R282_${{ matrix.host }}_${{ matrix.phase }}/R282_ABRUPT_RECOVERY.json
+            ${{ runner.temp }}/TBME_R282_${{ matrix.host }}_${{ matrix.phase }}/ARMED.json
+            ${{ runner.temp }}/TBME_R282_${{ matrix.host }}_${{ matrix.phase }}/ARMED.error.txt
+            ${{ runner.temp }}/TBME_R282_${{ matrix.host }}_${{ matrix.phase }}/R282_INSTALL_DIAGNOSTIC.json

.github/workflows/audit-r284-candidate-restore-residue.yml

@@ -0,0 +1,135 @@
+name: R284 private v1.7.7 candidate and exact interrupted Setup recovery
+
+on:
+  push:
+    branches: [fix/v1.7.7-restore-residue-r284]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  candidate:
+    name: Build private unsigned v1.7.7 candidate (not a public release)
+    runs-on: windows-2025
+    timeout-minutes: 25
+    steps:
+      - name: Checkout exact candidate source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
+        with:
+          dotnet-version: 10.0.400
+      - name: Build hash-bound private Setup candidate
+        shell: pwsh
+        run: |
+          $ErrorActionPreference='Stop'
+          if((git rev-parse HEAD).Trim() -cne $env:GITHUB_SHA -or
+             $env:GITHUB_ACTIONS -cne 'true' -or
+             $env:RUNNER_ENVIRONMENT -cne 'github-hosted' -or
+             $env:RUNNER_OS -cne 'Windows'){throw 'R284_BAD_HOSTED_SOURCE'}
+          ./build/Build.ps1
+          if($LASTEXITCODE -ne 0){throw 'R284_VERSIONED_BUILD_FAILED'}
+          $setup='build/_out/Setup/TaskbarMonitorEnhanced_Setup_1.7.7.exe'
+          $main='build/_out/App/TaskbarMonitorEnhanced.exe'
+          if(!(Test-Path $setup) -or !(Test-Path $main)){throw 'R284_PRIVATE_BINARIES_MISSING'}
+          $record=[ordered]@{
+            Schema=1;Status='PRIVATE_NOT_A_RELEASE';Commit=$env:GITHUB_SHA
+            Version='1.7.7';Private=$true;NotForPublicInstallation=$true
+            SetupSHA256=(Get-FileHash $setup).Hash
+            MainSHA256=(Get-FileHash $main).Hash
+          }
+          [IO.File]::WriteAllText('build/_out/CANDIDATE.json',($record|ConvertTo-Json -Depth 4),[Text.UTF8Encoding]::new($false))
+          'R284_CANDIDATE_COMPILED_AND_HASH_BOUND'
+      - name: Upload bounded candidate for disposable tests only
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: R284-PRIVATE-NOT-PUBLIC-RELEASE
+          if-no-files-found: error
+          retention-days: 14
+          path: |
+            build/_out/CANDIDATE.json
+            build/_out/Setup/TaskbarMonitorEnhanced_Setup_1.7.7.exe
+            build/_out/App/TaskbarMonitorEnhanced.exe
+
+  cold-recovery:
+    name: Recovery exact Main candidate on isolated Windows ${{ matrix.host }}
+    needs: candidate
+    timeout-minutes: 18
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: A
+            os: windows-2025
+          - host: B
+            os: windows-2022
+    steps:
+      - name: Exact candidate source checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Retrieve private candidate
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: R284-PRIVATE-NOT-PUBLIC-RELEASE
+          path: _r284_private_candidate
+      - name: Preflight script parser and strict disposable host
+        shell: powershell
+        run: |
+          $ErrorActionPreference='Stop'
+          if($env:GITHUB_ACTIONS -cne 'true' -or
+             $env:RUNNER_ENVIRONMENT -cne 'github-hosted' -or
+             $env:RUNNER_OS -cne 'Windows' -or
+             $env:COMPUTERNAME -match 'EMAD-PC'){throw 'R284_UNSAFE_NON_DISPOSABLE_HOST'}
+          if((git rev-parse HEAD).Trim() -cne $env:GITHUB_SHA){throw 'R284_BAD_SOURCE_CHECKOUT'}
+          $p=(Resolve-Path build/Test-R284-RestoreResidue-NativeRecovery.ps1).Path
+          $tokens=$null;$errors=$null
+          [void][Management.Automation.Language.Parser]::ParseFile($p,[ref]$tokens,[ref]$errors)
+          if(@($errors).Count){$errors|ForEach-Object{$_.Message};throw 'R284_PS51_SCRIPT_PARSER_INVALID'}
+          if(!(Test-Path build/official-v176-managed.json)){throw 'R284_PINNED_176_MISSING'}
+          $c=Get-Content _r284_private_candidate/CANDIDATE.json -Raw|ConvertFrom-Json
+          if($c.Commit -cne $env:GITHUB_SHA -or $c.Version -cne '1.7.7' -or
+             $c.Private -ne $true -or $c.NotForPublicInstallation -ne $true){throw 'R284_NOT_EXACT_PRIVATE_CANDIDATE'}
+          'R284_GUEST_PRECONDITION_PASS'
+      - name: Force helper crash; prove residue recovery, and real Setup kill on B
+        shell: powershell
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $ErrorActionPreference='Stop'
+          ./build/Test-R284-RestoreResidue-NativeRecovery.ps1 -HostLabel '${{ matrix.host }}' -CandidateDir (Resolve-Path _r284_private_candidate).Path
+          if($LASTEXITCODE -ne 0){throw 'R284_GUEST_TEST_FAILED'}
+          $p=Join-Path $env:RUNNER_TEMP ('R284_${{ matrix.host }}_'+$env:GITHUB_RUN_ID+'/R284_RECOVERY_RECEIPT.json')
+          if(!(Test-Path $p)){throw 'R284_GUEST_RECEIPT_MISSING'}
+          $r=Get-Content $p -Raw|ConvertFrom-Json
+          if($r.Schema -ne 1 -or $r.Revision -cne 'R284' -or
+             $r.Status -cne 'PASS_EXACT_V177_SETUP_RETRY_AFTER_STRANDED_RESTORE' -or
+             $r.Host -cne '${{ matrix.host }}' -or
+             $r.SourceCommit -cne $env:GITHUB_SHA -or
+             $r.PreviousManifestRowsSHAAndSizeChecked -ne 22 -or
+             $r.StagingHelperActuallyKilled -ne $true -or
+             $r.StrandedUpdaterOwnedRestoreZeroByteProven -ne $true -or
+             $r.RecoveredAfterSecondNativeSetupRun -ne $true -or
+             $r.SingleCanonicalUserRootPreserved -ne $true -or
+             $r.ProtectedUserDataHashPreserved -ne $true -or
+             $r.JournalRemoved -ne $true -or
+             $r.OriginalOwnerComputerTouched -ne $false -or
+             $r.PhysicalMainsLossTriggered -ne $false){throw 'R284_RECEIPT_TYPED_PASS_FAILED'}
+          if('${{ matrix.host }}' -ceq 'B' -and
+             ($r.NativeSetupProcessActuallyKilled -ne $true -or
+              $r.NativeSetupManagedNoteDeletionWitnessed -ne $true)){throw 'R284_REAL_SETUP_KILL_NOT_WITNESSED'}
+          'R284_GUEST_TYPED_RECOVERY_PASS'
+      - name: Preserve bounded guest evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: R284-guest-${{ matrix.host }}-${{ github.sha }}
+          if-no-files-found: warn
+          retention-days: 21
+          path: |
+            ${{ runner.temp }}/R284_${{ matrix.host }}_${{ github.run_id }}/R284_RECOVERY_RECEIPT.json
+            ${{ runner.temp }}/R284_${{ matrix.host }}_${{ github.run_id }}/ARMED.json