From f2ef138a745bbbc0563018355d5d3e8be140292e Mon Sep 17 00:00:00 2001 From: RomainROCH Date: Wed, 14 Oct 2026 21:06:47 +0200 Subject: [PATCH 1/2] docs: prepare v0.2.1 release notes --- CHANGELOG.md | 3 ++- docs/RELEASE_NOTES_DRAFT.md | 22 ++++++++++++++++------ 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6661df6..c51b185 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,10 +4,11 @@ All notable changes to this project will be documented in this file. ## [Unreleased] -Target version: `0.2.1`. This is a local candidate, not a published release. +## [0.2.1] - 2026-10-14 ### Changed - Share one two-second connection-retry deadline across the read-only status pipe and its legacy control fallback, preserving the initial status startup grace and ordinary control retries. The unavailable-endpoint wait targets about two seconds plus scheduling overhead; connected reply reads are not bounded by this deadline. +- Add isolated native Windows singleton tests for primary/secondary claims, handle cleanup, bounded retries and reclaim after owner release. These tests do not start protection or validate an elevated relaunch; same-session mutex denial-of-service hardening remains pending. - Gate release tags on matching package/lock/manifest versions, main-branch provenance and successful Windows checks for the exact commit. Build and transfer the same checked binary into a draft only; publication remains manual. - Bound newline-terminated control IPC requests to 4096 bytes and one total second, preserving independent status availability and rejection/recovery behavior. - Validate autostart path access with identification tokens, and record disposable-VM idle-power acceptance without claiming physical hardware coverage. diff --git a/docs/RELEASE_NOTES_DRAFT.md b/docs/RELEASE_NOTES_DRAFT.md index f59c89d..52f9482 100644 --- a/docs/RELEASE_NOTES_DRAFT.md +++ b/docs/RELEASE_NOTES_DRAFT.md @@ -1,13 +1,21 @@ -# Wardoff v0.2.1 (draft, unreleased) +# Wardoff v0.2.1 -This candidate has not been published. The tag workflow prepares a draft only -after validation; a maintainer must review and publish it separately. +The tag workflow prepares a draft only after validation; a maintainer reviews +the exact candidate and publishes it separately. ## Changes since v0.2.0 - Bound each newline-terminated control request to 4096 wire bytes and one total second. Malformed, oversized, incomplete and disconnected clients cannot hold the control reader indefinitely; status remains independently available. +- Share one two-second connection-retry budget between the read-only status pipe + and its legacy control fallback. Unavailable-endpoint discovery targets about + two seconds plus scheduling overhead; connected reply reads remain outside this + budget, and ordinary control retries are unchanged. +- Add isolated native Windows singleton tests for primary/secondary claims, + handle cleanup, bounded retries and reclaim after owner release. They do not + start protection or validate an elevated relaunch, and do not fix the documented + same-session mutex denial-of-service risk. - Use process-owned system/display Power Requests for idle-power protection. Report activation errors synchronously, release on Allow/exit, and renew after the existing resume notification. Explicit Sleep/Hibernate are not vetoed. @@ -25,9 +33,11 @@ The draft includes `build-info.json` and `SHA256SUMS.txt` for its exact unsigned MSVC binary and the Windows workflow run. Review the run and its explicit smoke skips before publishing. A green run on another commit is not release evidence. -- Disposable-VM idle-power results are recorded in - [IDLE_POWER_VALIDATION.md](IDLE_POWER_VALIDATION.md); physical S3/monitor, - Hibernate and Modern Standby acceptance remains incomplete. +- Eight historical disposable-VM idle-power cases passed for source `4041db0` + and the earlier retained binary identified in + [IDLE_POWER_VALIDATION.md](IDLE_POWER_VALIDATION.md). Those results do not qualify + the new v0.2.1 binary. Physical S3/monitor, Hibernate and Modern Standby acceptance + remains incomplete. - Missing UpdateOrchestrator Reboot tasks and unavailable interactive linked tokens cause documented smoke skips, not successful coverage of those paths. - Same-session mutex denial of service, the status pipe DACL and other residual From dd4e789dedaf3c70e022d3a06b20309a0a756889 Mon Sep 17 00:00:00 2001 From: RomainROCH Date: Wed, 14 Oct 2026 23:45:46 +0200 Subject: [PATCH 2/2] docs: finalize v0.2.1 release notes --- CHANGELOG.md | 2 ++ docs/RELEASE_NOTES_DRAFT.md | 14 ++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c51b185..00d94d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,8 @@ All notable changes to this project will be documented in this file. - Add isolated native Windows singleton tests for primary/secondary claims, handle cleanup, bounded retries and reclaim after owner release. These tests do not start protection or validate an elevated relaunch; same-session mutex denial-of-service hardening remains pending. - Gate release tags on matching package/lock/manifest versions, main-branch provenance and successful Windows checks for the exact commit. Build and transfer the same checked binary into a draft only; publication remains manual. - Bound newline-terminated control IPC requests to 4096 bytes and one total second, preserving independent status availability and rejection/recovery behavior. +- Fix a missed status wake-up between named-pipe instances that could leave shutdown waiting for the status worker. Cover the creation gap with an isolated regression that verifies cleanup without a rescue connection. +- Add passive physical-power validation preparation and checkpoint scripts with mocked diagnostic checks; physical S3/monitor, Hibernate and Modern Standby acceptance remains pending. - Validate autostart path access with identification tokens, and record disposable-VM idle-power acceptance without claiming physical hardware coverage. - Bounded `--log --tail N` to 100000 lines and made line-buffer reservation incremental and fallible, so extreme values return a readable error instead of a capacity-overflow panic. - Ensure the runtime unregisters callbacks and shuts down its resources even when the Windows message loop fails; preserve both errors if cleanup also fails. diff --git a/docs/RELEASE_NOTES_DRAFT.md b/docs/RELEASE_NOTES_DRAFT.md index 52f9482..a5a8158 100644 --- a/docs/RELEASE_NOTES_DRAFT.md +++ b/docs/RELEASE_NOTES_DRAFT.md @@ -8,6 +8,9 @@ the exact candidate and publishes it separately. - Bound each newline-terminated control request to 4096 wire bytes and one total second. Malformed, oversized, incomplete and disconnected clients cannot hold the control reader indefinitely; status remains independently available. +- Fix a missed status wake-up between named-pipe instances that could leave + shutdown waiting for the status worker. Coordinate instance publication with + the stop request, preserving the separate control and status pipes. - Share one two-second connection-retry budget between the read-only status pipe and its legacy control fallback. Unavailable-endpoint discovery targets about two seconds plus scheduling overhead; connected reply reads remain outside this @@ -23,6 +26,10 @@ the exact candidate and publishes it separately. trusted-path and same-user/elevation boundaries. - Reject excessive log-tail requests with a readable error and bound allocation. Clean up runtime resources when the Windows message loop fails. +- Provide a passive physical-power validation kit to prepare a case matrix and + collect local checkpoints. Follow the existing + [validation matrix](MVP_VALIDATION_MATRIX.md); actual hardware acceptance remains + separate. - Isolate Windows smoke cleanup, consolidate developer instructions and checks, and validate release provenance, versions and the exact binary before creating a draft. No automatic public release or signing is added. @@ -33,6 +40,13 @@ The draft includes `build-info.json` and `SHA256SUMS.txt` for its exact unsigned MSVC binary and the Windows workflow run. Review the run and its explicit smoke skips before publishing. A green run on another commit is not release evidence. +- An isolated status-shutdown regression reproduces the missed wake-up on the + prior worker, then verifies joined threads and endpoint cleanup without a + rescue connection after the correction. It does not establish the cause of the + earlier CI stall. +- The passive validation kit passes 111 checks with diagnostics mocked. Those + checks validate preparation, not actual sleep, display timeout, Hibernate or + Modern Standby behavior. - Eight historical disposable-VM idle-power cases passed for source `4041db0` and the earlier retained binary identified in [IDLE_POWER_VALIDATION.md](IDLE_POWER_VALIDATION.md). Those results do not qualify