# Validation and evidence boundaries

[Documentation](README.md) · [Installation](INSTALLATION.md) · [Usage](USAGE.md) · [Release history](RELEASE_HISTORY.md) · [Architecture](ARCHITECTURE.md) · [Roadmap](ROADMAP.md)

**Evidence is version-, source-, platform- and scenario-specific.** A build is not a release; a hosted native desktop is not physical hardware; a screenshot with simulated observations is not a microphone/camera capture test. This guide separates verified public packages from earlier native/source-specific qualification. These documentation edits did not execute new installation, device-control or physical-hardware tests.

## Public release 0.21.0

[v0.21.0](https://github.com/Roman-Cuisset/miccamwatch/releases/tag/v0.21.0) is the public stable/latest release, ID **`424498504`**, published **2026-10-26 at 16:38:28Z**, pinned to immutable source [`3d74686ace7b04728794765f9eb57c0c0a8bc84c`](https://github.com/Roman-Cuisset/miccamwatch/tree/3d74686ace7b04728794765f9eb57c0c0a8bc84c). It publishes Windows x64 ZIP/MSI, Linux x64/ARM64 archives, macOS Apple Silicon/Intel archives and DMGs, the SPDX SBOM and `SHA256SUMS`.

**Actual public-package gate passed:** all **ten public HTTPS downloads** matched the original [tag-run 40331094727](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40331094727) bytes and API digests; **nine named manifest entries** and **nine cryptographically verified provenance subjects** passed. Verification constrained the certificate identity to `https://github.com/Roman-Cuisset/miccamwatch/.github/workflows/release.yml@refs/tags/v0.21.0`, source and signer to `3d74686ace7b04728794765f9eb57c0c0a8bc84c`, and hosted runners only. Generated GitHub source archives are separate from these ten uploaded assets.

The original workflow **remains failed** after three HTTP 500 responses in its generate-notes-or-create wrapper; the raw failing endpoint is unknown. Separately authorized official REST recovery reused the existing packages without rebuilding, moving/recreating the tag or replacing assets. The release's tag association was corrected to the existing `v0.21.0` with the same ten asset IDs/hashes. See [the release record](RELEASE_0.21.0.md) for the full recovery sequence; this is not a rerun labelled successful.

| Public target | Release capability and evidence | Qualification boundary |
| --- | --- | --- |
| Windows x64 | Redesigned native consultation, retained owner/window and explicit/background activation; public ZIP/MSI package/provenance verification | Earlier integrated native and real standard-user guest proofs below retain their exact sources; no new public installation on the personal host, universal device enforcement or Windows 10/DPI/accessibility certification |
| Linux x64 / ARM64, glibc 2.35+ | Native GTK3 consultation, owned launcher and PipeWire/SPA CLI/helper packages; public archive verification | ARM64 is native hosted-runner software qualification, **not physical ARM/Raspberry Pi/SBC or peripheral validation**; GTK3/graphical session required for consultation, not headless CLI |
| macOS 15+, Apple Silicon / Intel | Redesigned AppKit consultation and owned activation; public archives/DMGs verified | Earlier native Finder/window/helper/login proofs retain their sources; no new physical capture, human TCC/profile approval, Gatekeeper approval or cross-version app-upgrade claim |

**Actual signing status:** the byte-identical public Windows ZIP's two EXEs and public MSI correspond to three Authenticode **`NotSigned`** results, with no signer or timestamp. Both public macOS archive CLI binaries have **no `LC_CODE_SIGNATURE`** and are unsigned. Matching DMG native packaging logs report **ad-hoc app seals only**, not Developer ID signing/notarization or new Gatekeeper validation. Checksums and GitHub provenance do not replace platform signing, antivirus clearance or OS/user authorization; see [Signing](SIGNING.md#published-stable-0210-signature-and-provenance-evidence).

The retained public-package receipt is `%LOCALAPPDATA%\MicCamWatchQualification\0.21.0-publication-recovery-20261026\public-package-gate.json`; it records downloaded-public-byte verification, not a public installation test. The qualification history below remains source-specific and is not relabelled as testing these public bytes.

## Public release 0.20.0

The previous public baseline was [v0.20.0](https://github.com/Roman-Cuisset/miccamwatch/releases/tag/v0.20.0), source [`a26522028eafe02591f58c03ceb5c367f2d5d60b`](https://github.com/Roman-Cuisset/miccamwatch/tree/a26522028eafe02591f58c03ceb5c367f2d5d60b), annotated tag object `547f6185a0579876041d1ae7ebcdd6feccdcb5cf`. It was published on 2026-10-22, release ID `420936561`. [Native release run 39807585260](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39807585260) passed and the public files were subsequently downloaded/verified: **nine uploaded assets**, eight named SHA-256 entries and eight signed SLSA v1 provenance subjects. GitHub's automatically generated source archives are separate from those uploaded assets.

| Public target | Recorded native/software evidence | Not established by that evidence |
| --- | --- | --- |
| Windows x64 | Native CLI/TUI/tray, scoped owners/IPC, portable transactions and ZIP/MSI package smoke; official Shell/installed icon checks | Universal device enforcement, antivirus clearance, a full three-pane consultation window on public 0.20, or transfer of active protection during update |
| Linux x64, glibc 2.35+ | Native PipeWire/SPA builds and regression checks, extracted CLI/PTY, StatusNotifier lifecycle, managed installation/removal and optional helper privilege boundaries | Every desktop/session, direct ALSA/V4L2 capture attribution, physical microphone denial, non-USB/CSI control, or any public Linux ARM64 package |
| macOS 15+, Apple Silicon and Intel | Native CoreAudio/CoreMediaIO helper, CLI/TUI/menu, **0.20 singleton consultation**, app/DMG, Finder reopen, autostart intent and accepted-socket correction | Camera client PID/frame flow, human TCC/profile approval, notarization, physical microphone/camera transitions, or the redesigned 0.21 consultation |

### Supporting scenarios and their limits

- [Integrated native CI 39768698678](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39768698678), product source `201e`, passed four targets. Both AppKit reports covered normal menu Exit, close/reopen singleton consultation, ordinary Finder activation, duplicate-owner preservation, readiness and moved bundle. Hardware/OS authorization remained outside that proof.
- [Mac lifecycle 39579584237](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39579584237), source `24303fe`, passed eight start/readiness/stop cycles per architecture and three reopens per cycle. The fix explicitly made accepted streams blocking on BSD; it did not enlarge deadlines. The failed 0.19.1 Intel attempt remains historical evidence, not an unresolved claim that the unchanged 0.20 scenario still fails.
- [Windows branding 39655798674](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39655798674) exercised the actual per-user MSI and installed CLI/tray/Start/Apps icon surfaces at 16–256 pixels, 36 comparisons, followed by real removal. This did not manufacture Authenticode identity or PE version metadata.
- Homebrew [ARM 39768723173](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39768723173) and [Intel 39774103433](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39774103433) qualified six loaded/dormant/disabled autostart paths on the same product source `201e`: genuine 0.16.1 → 0.20 source-package upgrade, explicit ordinary-user refresh before cleanup, no-op, test/removal/reinstall and retained user data. This is recipe qualification, **not publication of a tap/Homebrew-core package**. A repository AUR recipe likewise does not prove an external AUR submission.
- Authorized Windows workstation tests used isolated payloads and state under a real ordinary-user token. Companion- and CLI-hosted portable removal reached actual worker `removed` results with retained data; command acceptance alone was not counted as deletion. Six refusal cases preserved bytes/state; actual Cargo delegation/removal and a separate test-family per-user MSI routing/removal passed. The original pair, running user tray, two existing 0.19 MSI registrations and device-control state were preserved. **The private-family MSI test was not a migration/removal of the unchanged public MSI on that workstation.** These local reports are recorded, not publicly downloadable CI artifacts; see the [immutable 0.20 qualification journal](https://github.com/Roman-Cuisset/miccamwatch/blob/dc40e95bc9c1c6a14386eb5e773f01b62b47aa71/docs/ROADMAP.md#L1359-L1366).

Windows EXEs/MSI are **unsigned**; macOS bundles are **ad-hoc sealed, not Developer ID signed or notarized**. A valid checksum or GitHub attestation is not platform signing, malware clearance or SmartScreen/Gatekeeper approval. [Signing](SIGNING.md) preserves exact historical Windows hashes, observed Defender scan limits and safe incident handling. The TLS dependency audit addressed the versioned advisories listed in [0.20 history](RELEASE_HISTORY.md#0200--native-consultation-and-scoped-uninstall); three Linux D-Bus dependency maintenance warnings remained visible, with no suppressed advisory.

## Candidate 0.21.0

**Historical pre-publication qualification, not today's release status.** This section preserves the candidate checkpoints, including their then-open gates, failed attempts and source-specific successes. Public stable 0.21.0 and its actual package verification are recorded [above](#public-release-0210). The former integration branch was [`release/0.21.0-candidate`](https://github.com/Roman-Cuisset/miccamwatch/tree/release/0.21.0-candidate); the preserved earlier GUI/ARM snapshot is [`cafd98daf7541f317b44aee98edb3b6efa3af561`](https://github.com/Roman-Cuisset/miccamwatch/tree/cafd98daf7541f317b44aee98edb3b6efa3af561). Neither the earlier snapshot nor a local guest binary is the final tag-run package.

### Windows standard-user qualification — 2026-10-26

**The blocking Windows interactive standard-user gate is closed.** This is actual local Hyper-V guest evidence, not a reclassification of the failed hosted `Service-…` run or of an administrator safety smoke. Windows 11 Enterprise Evaluation x64 was installed from the user's verified official Microsoft ISO in the sole isolated Generation-2 guest, with Secure Boot/TPM and no forwarded microphone/camera, personal folders or clipboard. The real QA console login had an unrestricted nonadministrator primary token, loaded profile, same-user unelevated Explorer and visible `WinSta0/Default`; production doctor positively observed zero capture endpoints and zero cameras.

| Actual stage | Result | Evidence boundary |
| --- | --- | --- |
| Release build of CLI/tray as QA | Exit 0 | Compiled source `30051ce70e904912d988d17ad8e72cf4d19c6568`; no replacement build claimed |
| Portable pair/frontend removals and ownership refusals | Passed | Actual companion/console tray, cooperative autostart removal, busy-worker/modified-receipt/hardlink/protection refusals; native zero-device ownership |
| Same installed per-user MSI application | Passed, `standardUserQualified=true`, `requireStandardUser=true`, `cleanupSafe=true` | Actual Start Menu link/AUMID, one retained owner/HWND, close/hide/reopen and concurrent GUI/CLI/shortcut launches |
| Installed MSI binary self-update | Expected exit 2 in 335 ms | Zero proxy connections/staging events; unchanged payload, registration, shortcut, PATH and data; no automatic MSI upgrade |
| Genuine MSI and Cargo manager removal | Both exit 0 | Exact product/root delegation, real manager procedures, retained preferences/history and unchanged unexpanded user PATH ordering |
| Targeted hosted safety CI | Passed | [40301860252](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40301860252), harness source `bebad88aeac245fc286a52b3c8b23871654e2430`; **qualificationStatus=not_executed**, not the local native run |

The user explicitly approved **staged continuation without replaying successful builds/installations**. Harness defects were corrected without weakening admission or cleanup: one-byte native token information, first-command scalar selection, PowerShell 5 JSON-array boxing, shallow owned temporary paths, hidden-ancestor reads and completion tracking for actual Shell shortcut processes. The resident/HWND count remains strict and every tracked secondary launcher must exit 0.

The final local receipt is **`explicitly-approved-staged-native-aggregate`**, not a rewritten successful original orchestrator. It reuses the genuinely completed portable cases, executes the original remaining MSI assertions/Cargo consumer and verifies **244 earlier proof-file hashes unchanged**. Original failures remain failed. The final application consumer's only behavioral source changes are qualification-harness changes through `bebad88`; application/build/installer payload code remains unchanged from the five-target source `4b90fd6` below.

Durable private evidence is at **`%LOCALAPPDATA%\MicCamWatchQualification\0.21.0-20261026-c1c5de53`**: readable final native/application receipts, byte/SHA-verified failed and successful archives, two final window captures, exact reproduction inputs and the real tested binary/MSI evidence ZIP. This is **local evidence, not a public release or GitHub artifact claim**. Representative actual standard-user window rendering was examined in English/light mode; the earlier five-target seven-language/theme evidence keeps its own scope.

Post-qualification observation confirmed no test product/shortcut/Cargo pair or active MCW process left; local EXE/MSI Authenticode status was actually **NotSigned**. The sole guest was shut down with **Off read back**, then its finite controller exited. On 2026-10-26, after the interruption was inspected and all 24 manifest entries were SHA-verified again, the separately authorized one-shot cleanup removed only the exact stopped test VM, its owned VHD/checkpoint chain and mission-only temporary files. The durable proofs were SHA-verified again after removal; the original official ISO, other VM registrations, worktrees, personal installations and shared caches were preserved. See [Roadmap](ROADMAP.md) for the measured space recovery and completed cleanup record.

**Historical readiness/authorization checkpoint before tag publication:** the following two paragraphs record the earlier unpublished-package stage; they do not describe today's public release or current authorization.

**READY FOR RELEASE within the recorded software-qualification scope; publication is still unauthorized.** On 2026-10-26 the owner separately authorized unpublished final-package preparation and verification under [the release plan](RELEASE_0.21.0.md#ordered-publication-plan--future-approval-required); that permission does not authorize `main` integration, tags, GitHub publication or website deployment. Package/signature/provenance results must identify their actual frozen source and ref, not future rebuilt tag bytes. This does not certify physical capture controls, physical ARM boards, Windows 10 or every real desktop/DPI/accessibility combination.

**Unpublished package verification completed separately:** [Release 40316172507](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40316172507), attempt 1, and complete [CI 40315147426](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40315147426) succeeded on exact source **`ff0f05ceba6506dc4cffd0ca54f117780b54511e`**. The ten-file bundle/API ZIP digest, nine named SHA-256 entries and all nine source/ref/workflow/hosted-constrained attestations were verified. Independent final Windows reads returned **NotSigned**; MSI payloads matched the ZIP pair without installation on the personal host. Both native copied-DMG seals returned 0, ad-hoc only. Initial Sigstore initialization failures and successful same-policy retries are separately retained. See [the actual hashes, receipts and remaining authorization boundaries](RELEASE_0.21.0.md#unpublished-packages-verified--2026-10-26). These branch packages are not the older local guest bytes or the future tag-run bytes; no new physical/manual certification or publication is implied.

### Integrated native qualification — 2026-10-24

**Five-target CI passed; the Windows gate was still open at this checkpoint.** [Run 40106706806](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40106706806) exercised the exact integrated source **`4b90fd6bdfc2aaddf6218a64ce71f6554e06c789`**. All five native jobs passed format/lint, tests, builds and their required native scenarios. Logs and downloaded JSON/image receipts were inspected; this is a fresh common-source run, not the earlier aggregate.

| Target | Rust library + CLI results | Native evidence inspected |
| --- | --- | --- |
| Windows x64 | 185 + 1 passed, 6 ignored, both with and without `windows-tray`; selected ignored native scenarios run separately | One installed MSI product/shortcut, same owner/HWND across real GUI/CLI/shortcut launches, hidden background/close/reopen, eight Explorer popups, profiles, portable transactions |
| Linux x64 | 105 + 1 passed, 3 ignored; native SPA C roundtrip passed | Real Gio launch, exact WM_CLASS, same owner/XID, 21 GTK language/theme cases, installer/root boundaries and virtual PipeWire |
| Linux ARM64 | 105 + 1 passed, 3 ignored; native SPA C roundtrip passed | Same native coverage; both ELF machine 183 payload hashes checked against actual downloaded files, no physical-board claim |
| macOS Intel | 79 + 1 passed, 1 ignored | AppKit views/preferences/geometry, copied-DMG Finder cold launch, one owner/helper, retained window, owned login lifecycle and cleanup |
| macOS Apple Silicon | 79 + 1 passed, 1 ignored | Same native coverage and complete `app-smoke.json`, not a partial exit-77 receipt |

The installed Windows updater refusal returned 2 in 142 ms with zero proxy connections/staging events and unchanged payload, registration, shortcut, PATH and user data. Its runner was elevated: per-user MSI registration is not standard-token proof. Both Mac lifecycle receipts report `passed`, preserve preferences/history, and explicitly do **not** establish physical capture, granted OS authorization, cross-version app upgrade or notarization.

Seven languages were exercised on each platform. GTK has 21 passed cases per architecture (Adwaita/light-dark/HighContrast); Windows has 62 captures and verified keyboard focus. AppKit requested native light/dark/high-contrast appearances and retained native-view capture provenance. Representative actual images were examined, not every image manually. The ARM installed `explicit-launch.png` captured a blank initial frame; its cold-launch image and GTK fixture views render normally. The blank image does not establish painted-content readiness, even though owner/XID lifecycle assertions passed. AppKit composites and simulated observations remain explicitly distinct from WindowServer or hardware evidence.

**Blocking separate workflow:** [native uninstall run 40106709656](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40106709656), on the same source, passed all four Unix targets but failed Windows. A genuine non-elevated fixture account removed a portable pair without a frontend, then both companion and diagnostic CLI tray startup exited 2 with `failed to register system tray icon`. The MSI/Cargo cases after that failure were **not executed**. The bootstrap reported a real Explorer on a `Service-…` window station, not interactive `WinSta0`; [Microsoft documents that other stations are noninteractive](https://learn.microsoft.com/en-us/windows/win32/winstation/window-stations). This is an unmet interactive-desktop qualification prerequisite; the exact cause of the Shell API refusal is not proved. Do not waive assertions, fake a hosted marker, broaden ACLs or label the workflow passed. A disposable **interactive standard-user desktop**, followed by the actual remaining uninstall/MSI/Cargo cases, is required to close this gate.

**Verdict at this historical checkpoint: NOT READY FOR RELEASE.** The later [2026-10-26 Windows qualification](#windows-standard-user-qualification--2026-10-26) closes that blocker; the failure itself remains recorded. No tag, GitHub release, main merge or site deployment occurred. Later documentation and qualification-tooling commits do not relabel that product-source run: product/build/installer payload sources remain those of the exact qualified commit above; future release revision and package bytes require their own recorded checks.

The [interactive standard-user VM procedure](WINDOWS_STANDARD_USER.md) now supplies a strict reproducible alternative instead of retrying the same hosted batch launcher. It requires an actual local nonadmin console/RDP login, matching token/process/LSA session, visible `WinSta0` input desktop, genuine loaded profile and that user's actual Explorer. Filtered/restricted administrator tokens and a personal physical self-hosted machine are refused. The GitHub runners inventory returned **zero self-hosted runners** on 2026-10-24; no suitable guest was available and the full new scenario has **not run**.

The separate read-only local smoke parsed four PowerShell scripts, compiled their three literal C# definition blocks and exercised actual context observation/admission. It refused the personal/nonstandard host, without running any MCW executable, MSI or device action. A first smoke failed because it tried to compile its own dynamic compiler call; that fixture-only mistake was corrected and the next run passed. The `RequireStandardUser` caller switch is also preserved across helper dot-sourcing. A safety-smoke PASS explicitly retains `qualificationStatus=not_executed`; it is not standard-user GUI, install or uninstall qualification.

The same read-only smoke also **passed on GitHub** in [run 40127113302](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40127113302), exact tooling source `5cc515b4c65a76b50e70a1edc70f9c48565e8c8d`. Its downloaded receipt and real native observations were inspected: session/token/LSA 2, logon type 2, visible `WinSta0`, `Default` input desktop and real Explorer, but elevated token, account privilege 2 and elevated shell. Strict standard-account admission correctly refused it. `safetySmokeStatus=passed`, `qualificationStatus=not_executed`, `productActionsInvoked=false`; the other native jobs were not rerun. The successful safety job does not replace the outstanding real standard-user guest qualification.

Preparation on **2026-10-25**, tooling source `84e3ed7`, adds an explicit **local disposable-guest route without a GitHub runner**. Local PowerShell parsing/C# smoke passed; the actual physical PC was rejected by VM metadata checks at the orchestrator, native and installed-application entry points before any native proof-directory creation or product/device action. Preserved strict dot-source arguments and Python syntax were checked. These are safety/refusal checks, not a positive Windows guest qualification. Source reviewers found no concrete defect in the prior fixtures or current local integration; review alone is not runtime evidence.

The elevated local inventory had shown zero registered VMs; its later bounded controller is now recorded closed with `ownedVmId=null`. No new UAC, VM creation, Windows installation, standard login or ISO/license acceptance was performed during the user's absence. The local procedure and proof paths are in [Windows standard-user qualification](WINDOWS_STANDARD_USER.md#local-vm--no-github-runner).

Targeted hosted application/MSI regression [40168712499](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40168712499) **passed** on exact tooling source `84e3ed73a0d2beecb34aa40ee2918b8114b9e2d2`. Build/WiX/native logs, downloaded receipts and an actual reopened-window image were inspected. Actual per-user MSI assignment type 0, one `--open` shortcut/AUMID, retained owner/HWND across close/reopen/concurrent activation, unchanged PATH entries, cooperative exit and MSI uninstall exit 0 were proved. MSI binary-update refusal returned 2 in 165 ms with zero proxy connections/staging events and unchanged payload/preferences/registration/shortcut. The application receipt is `passed`, `cleanupSafe=true`, `fixtureHostKind=github-hosted`, **`requireStandardUser=false`, `standardUserQualified=false`**. This is targeted regression of the existing elevated-runner path, not standard-user guest, physical capture or new seven-language/theme coverage.

Later local progress on **2026-10-25**: user-supplied official ISO verified by complete SHA-256, WIM edition/architecture/version and valid Microsoft Setup signature; new authorized Hyper-V VM actually created with Secure Boot and TPM, and Windows installed up to normal OOBE. Windows and guest-tool license approvals were explicit. Two guest-only preparation scripts were inspected/parsed, and a four-file read-only data ISO was generated and attached without installing host software or sharing personal data/devices. This is **environment preparation**, not a positive native test. No standard account desktop, guest tool installation, MSI/Cargo/portable scenario, activation proof or new product build is claimed. The official local-account UI did not advance on keyboard activation; Windows reported cancellation of the additional mouse-only UAC. Preserve that state and ask the user before any renewed elevation.

The subsequent **actual standard-session proof passed**: `guest-actual-standard-interactive-context.json`, task exit 0, `context-verified`, genuine console/LSA Interactive logon 2, matching session/token 2, visible WinSta0/Default, same-user unelevated Explorer, real loaded profile and no administrative/restricted token. The task uses the already logged-in InteractiveToken/Limited account; it does not create or move a logon token. Script-policy changes were separately authorized for CurrentUser in these two disposable guest accounts only. This remains **not product PASS**. The later real Machine prerequisite call hit a client timeout after 1800 seconds; its remote install outcome is unknown, not safely replayable. Additional read-only UAC was cancelled and the original authority is unavailable; no build, MSI/Cargo/portable result or final powered-off state is claimed. See the latest [Roadmap](ROADMAP.md) checkpoint before resuming.

The candidate adds native Linux ARM64, redesigned native consultation on Win32/GTK3/AppKit and unified owned activation. Its **previous five-target qualification was an aggregate of platform-specific runs on unchanged platform sources**, not one all-green run of the final GUI/ARM snapshot or the new integrated candidate:

| Historical targets | Previously qualified functional source | Successful native run and actual scope |
| --- | --- | --- |
| Windows x64 | [`3f52ee4`](https://github.com/Roman-Cuisset/miccamwatch/commit/3f52ee4) | [40062931635](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40062931635): installed MSI/CLI/GUI/shortcut concurrent activation, retained HWND/owner, eight genuine Explorer popups, portable update and MSI double-ownership refusal |
| macOS Intel / Apple Silicon | [`4931e00`](https://github.com/Roman-Cuisset/miccamwatch/commit/4931e00) | [40065426316](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40065426316): securely published socket, AppKit, cold Finder opening, retained window/owner, bundle/LaunchAgent lifecycle and normal removal |
| Linux x64 / ARM64 | [`519dc1c`](https://github.com/Roman-Cuisset/miccamwatch/commit/519dc1c) | [40078682137](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/40078682137): installed GTK/Gio launcher, exact WM_CLASS, retained XID/owner through activation and normal close/reopen, ELF and privilege boundaries, profiles/menu and owned removal |

The Windows run above also contained then-failing Unix jobs; the macOS-qualified run still had Linux WM_CLASS failures. Later targeted Unix/Linux runs closed those failures without rerunning unchanged successful platform sources. Do not relabel every job in every linked run as successful. The [immutable prior GUI/ARM qualification record](https://github.com/Roman-Cuisset/miccamwatch/blob/cafd98daf7541f317b44aee98edb3b6efa3af561/docs/ROADMAP.md#L1698-L1718) and [integrated roadmap](ROADMAP.md) preserve that historical sequence and its limits; fresh exact-candidate CI is a separate gate.

Linux reports covered **21 GTK cases per architecture**, seven languages and Adwaita/light-dark/HighContrast. Installed receipts confirmed exact `MicCamWatch` WM_CLASS, repeated activation, focused Alt+F4 hiding and reopening the same owned window, hidden background startup and real refusal of foreign namespaces/modified assets. The x64 report covered the real 0.20 launcher migration; ARM's historical-migration field stayed `null` because no old public ARM package exists.

Earlier native ARM qualification [39832624207](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39832624207), source `2998946`, passed five platforms; [39828453493](https://github.com/Roman-Cuisset/miccamwatch/actions/runs/39828453493) exercised managed/Cargo removal across four Unix targets. The ARM runner established native Ubuntu 22.04/glibc 2.35/PipeWire-SPA 0.3.48, ELF64 little-endian machine 183 on **both** executables, native ABI roundtrip, virtual capture, bounded PipeWire faults and recovery without false STOP, installation/root rollback/refusals and a VM panel. These earlier runs are not substitutes for the later GUI/launcher qualification above.

**Qualification boundaries retained after publication:**

- Linux ARM64 now has a public asset, but no historical pre-0.21 ARM migration/resource baseline or Raspberry Pi/SBC physical certification. A native hosted ARM VM is not a physical board; ARMv7/32-bit/musl and CSI camera control are not promised.
- The Windows integration runner was an administrator. That run did not qualify MSI installation with a standard-user token; the later real standard-user guest proof above is separate. Neither qualifies every Windows 10/DPI configuration, real taskbar grouping or all accessibility readers.
- Linux GUI checks used a hosted graphical environment/Xvfb; they did not qualify every real Wayland desktop, login/reboot path or ARM peripheral. GTK3 is required for the public consultation window, not for headless CLI use.
- GUI observation fixtures explicitly marked simulated data validate native presentation and real preferences/geometry, not physical capture. AppKit mounted/composited PNGs are not automatically WindowServer screenshots. Actual installed-window/activation proofs and simulated-observation views are distinct evidence classes.
- No physical microphone/camera enforcement certification, new OS authorization, antivirus clearance, signing/notarization or global 15 MB resource-budget success follows from these runs. Earlier failed fixtures/results remain recorded rather than rewritten.

## Hardware and manual limits

| Evidence class | What exists | Boundary that must remain visible |
| --- | --- | --- |
| Authorized physical Linux USB camera | One checksum/provenance-verified UVC package on one host; real Polkit cancellation/approval, ongoing-capture revocation, refusal of new root capture, exact driver restoration and resumed capture | Versioned 0.16-era support envelope, not every webcam/kernel, future candidate, non-USB/CSI, hotplug reblock or physical microphone protection; [exact device/archive/agent record](ARCHITECTURE.md#authorized-linux-physical-verification) |
| Friend-reported macOS physical camera | [@repentandliveholy](https://github.com/repentandliveholy), Apple Silicon/macOS 27: Telegram 0 → 1 → 0 and locally patched FaceTime HD Camera START/STOP | Reported, not maintainer/CI hardware evidence; unknown camera client PID, medium confidence/degraded coverage, no frame-flow or per-app enforcement proof; [attribution and empty-runner limits](ARCHITECTURE.md#native-0151-verification-boundaries) |
| Real Linux PipeWire virtual source | Authenticated capture PID, active/idle/stop, independent mute/restoration, already-muted preservation and systemd socket activation | Real session graph/readback, not a physical microphone, global access denial or audible output; [socket proof](ARCHITECTURE.md#socket-activated-pipewire-mute-verification) |
| Windows native owners on zero-device runners | Ownership/IPC/isolation, UI-exit persistence, explicit release, refusal/cleanup and measured process-tree costs | No physical exclusive/ASIO/direct-driver protection or multi-endpoint/hotplug hardware certification; [protection contract](ARCHITECTURE.md#candidate-0170-windows-first-protection-contract) |
| Native notifications/sound/UI | OS API acceptance, selected visible notifications/menu/window checks, isolated keyboard/clipboard-denial scenarios | API success is not every notification's visibility, granted macOS notification authorization, physical speaker audibility or all accessibility behavior |

Requested protection, effective SDK mute/device restriction and observed capture are **three separate facts**. SDK mute is not capture permission; camera running-state is not frame flow. Partial, unavailable or unknown observation/control never means safe, idle, muted or globally allowed. macOS profile administrator inspection is not TCC permission; Linux camera helper Polkit authorization is separate from user capture permission. Camera PID unknown on macOS cannot authorize process termination.

Physical Linux/macOS microphone mute/capture effects, macOS approved-profile effectiveness, real lock transitions, authorization dialogs and other hardware/session combinations need separately authorized manual evidence. Do not run controls on a user's live installation merely to reproduce CI. Explicitly release protection using the matching version and finish owned restoration before external replacement/removal; closing the frontend or killing a guard is not a release. See [operational limits](USAGE.md#observation-and-control-limits) and [safe updates](INSTALLATION.md#updates).

**Resources:** the soft target is **15,000,000 bytes**; approximately 30 MB is a reference, not a hard cutoff. Neither target success nor complete Linux budget coverage is established merely by bounded code or low sampled RSS. Include every MCW helper/guard/tray and transient child, distinguish root peak from concurrent/sustained tree values, and report shared-page double counting, missing brief children and sampling gaps. Historical populated-host and zero-device measurements, failed reference profiles and comparison qualification remain in [Architecture's native resource evidence](ARCHITECTURE.md#historical-native-candidate-qualification), not recast as current hardware guarantees.

## Historical evidence

[Release history](RELEASE_HISTORY.md) preserves each removed README historical/version block, distinct release/CI/migration proof links and an [original-to-destination map](RELEASE_HISTORY.md#original-readme-mapping). The immutable [original main README](https://github.com/Roman-Cuisset/miccamwatch/blob/dc40e95bc9c1c6a14386eb5e773f01b62b47aa71/README.md) provides the pre-reorganization source; the GUI-branch README is a different, candidate-containing snapshot.

Use [Architecture](ARCHITECTURE.md) as the canonical detailed contract/fixture ledger and [Signing](SIGNING.md) for exact historical Windows hashes, signature results and Defender limits. Some unchanged canonical sections say “candidate”, “stable/latest” or “publication held” in their original version context. Read their subsequent publication sections and the chronological archive; those phrases do not override public 0.20.0 or make 0.21.0 public. [ROADMAP](ROADMAP.md) keeps the chronological decisions, failed runs and qualification closure. Historical site beacon observations are [dated website evidence](RELEASE_HISTORY.md#historical-website-evidence), not a current analytics assertion; current policy is [publicly available](https://miccamwatch.pages.dev/privacy).

## Reproducing checks

### Match the source before interpreting results

1. Choose the public tag or the **exact recorded candidate source commit**, not a moving branch tip. The platform commits above reproduce historical evidence only; new integrated qualification must record its own exact commit. Inspect that revision's workflow, runner architecture, dependencies, feature flags and artifact reports. A cross-target `check`, newer source tree or green job summary cannot replace that native evidence.
2. Public verification starts with release metadata, exact asset bytes and the named checksum entry. Follow [Installation: verify downloads](INSTALLATION.md#verify-downloads), then verify signed build provenance against the exact repository, release workflow, tag/ref, source digest and signer, refusing self-hosted runners where the original proof required hosted runners. `SHA256SUMS` and API digests share the release channel; they are not an independent publisher signature. The checksum manifest is not itself one of the eight attested payload/SBOM subjects.
3. Inspect the actual retained `app-smoke.json`, `resources.json`, installation/removal receipts and screenshots appropriate to the run, not just workflow color. `comparison_qualified`, baseline/candidate functional success, cleanup, absent hardware and skipped cases have distinct meanings. Private local reports cited by the roadmap are not magically public/downloadable.

### Native developer checks

These are documented workflow commands, **not checks run by this documentation change**. Install native build prerequisites from [Build from source](INSTALLATION.md#build-from-source), use an isolated checkout/test account and choose features for the actual host:

```sh
cargo fmt --check
# Windows, including native tray:
cargo clippy --all-targets --features windows-tray --locked -- -D warnings
cargo test --all-targets --features windows-tray --locked
# Linux, including the optional camera-helper build:
cargo clippy --all-targets --features linux-camera-helper --locked -- -D warnings
cargo test --all-targets --features linux-camera-helper --locked
# macOS:
cargo clippy --all-targets --locked -- -D warnings
cargo test --all-targets --locked
# With cargo-audit installed:
cargo audit
```

Do not run all host-specific blocks indiscriminately. The Linux native ABI regression is `cargo test --locked -p libspa --lib native_headers_builder_roundtrip_after_growth -- --nocapture`. Windows CI also tests the basic CLI without `windows-tray`. A normal test pass does not exercise every ignored native/visual/privileged scenario.

Canonical workflow entry points in this checkout:

| Purpose | Source |
| --- | --- |
| Native CLI/TUI/tray, owner/IPC, resource and extracted-package evidence | [ci.yml](../.github/workflows/ci.yml) |
| Public packaging/provenance/publication gates | [release.yml](../.github/workflows/release.yml) |
| Public Unix installer/shell/upgrade paths | [unix-install.yml](../.github/workflows/unix-install.yml) |
| Public Windows updater transactions | [windows-update.yml](../.github/workflows/windows-update.yml) |
| Native scoped removal/delegation | [native-uninstall.yml](../.github/workflows/native-uninstall.yml) |
| Native Homebrew and Arch recipe lifecycle | [homebrew-native.yml](../.github/workflows/homebrew-native.yml), [arch-package-native.yml](../.github/workflows/arch-package-native.yml) |

For current candidate drivers/options inspect [the integrated candidate's CI workflow](https://github.com/Roman-Cuisset/miccamwatch/blob/release/0.21.0-candidate/.github/workflows/ci.yml), then pin the exact source commit before running or interpreting qualification. The [historical GUI/ARM workflow at cafd98d](https://github.com/Roman-Cuisset/miccamwatch/blob/cafd98daf7541f317b44aee98edb3b6efa3af561/.github/workflows/ci.yml) remains available to reproduce the earlier evidence. Native platform selection and fresh five-target ARM/GUI qualification must not be inferred from the older stable workflow matrix or the prior aggregate.

**Safety gate:** native integration drivers can install/remove packages, alter a disposable account's autostart/clipboard/desktop or exercise controls. Use their documented disposable-host prerequisites and retained ownership/cleanup checks; never strip isolation guards, fix permissions broadly or use the installed user application as a fixture. Hosted prerequisites are not recommended production ACL changes. Publication/deployment workflows require separate explicit authorization; documenting a reproduction path does not authorize a release, tag, device action or website deployment.