Decisions

2026-11-04: Keep the native proxy's inspection decision interface platform neutral and inject the facade's exact Windows socket and managed-process authority. Freeze one decision per TCP connection and per admitted UDP association before TLS or content work. Reuse the attribution index's socket-match rank so exact, wildcard, and dual-stack UDP binds agree with packet attribution; equal-ranked competing owners remain ambiguous. Bound active and timed-out lookup workers with a separate session semaphore and retain uncertainty rather than promoting a late owner match. Preserve the current launch-chain CLI path until the separate blind relay and operator integration work exists. Treat the Npcap SDK import library as a recurring link-time dependency acquired for each build; its short-lived CI copy does not make the build dependency optional or remove the separate runtime Npcap prerequisite.

2026-11-04: Preserve the PowerShell script-block braces and type brackets through MSI SetProperty formatting so the current-user fresh-start identity check reaches PowerShell intact. WixQuietExec passes that already formatted command to PowerShell, so each literal requires exactly one MSI escape layer. Add and then trim a trailing dot on AppData arguments so their terminal backslashes cannot consume closing command-line quotes. Use ordinary string characters for the adjacent Defender add, rollback, and remove path trimming, avoiding type brackets in those commands. 2026-11-04: Keep scripts/Test-PackageCertification.ps1 compatible with published v0.10.13 package replay by selecting its AppData fixtures when the replay workflow supplies FRAGCAP_REVIEW_ARTIFACTS; certify S192's .fragcap roots and independent ordinary-process readback for the new candidate. A confirmed fresh start writes a durable marker beside the new data roots before deletion, preventing retained legacy AppData state from being imported on the next start. Compare SQLite schema and row values instead of DB and WAL file bytes so an idle checkpoint does not create a false transition conflict.

2026-11-04 Reuse the S191 frozen owner decision on the existing authenticated listener. A hostname bypass or second listener would break same-origin game and launcher separation and duplicate destination and route-owner authority.

Relay HTTP/1 CONNECT and SOCKS TCP as original bytes. Plaintext HTTP/1 and cleartext HTTP/2 still use their framing engines, with excluded application event sinks and retention disabled; retained connection diagnostics carry the relay decision and transfer totals.

Keep UDP association ownership independent from its TCP control decision. An excluded association forwards QUIC Initial as an original datagram and cannot create the session-CA QUIC gateway.

Preserve the public CLI's launch-chain behavior until #561. This slice supplies the runtime branch consumed by that operator integration and by #560 calibration; it does not claim #542's launcher failure resolved or a pre-release installed-product test.

2026-11-05 Seal the public scope vocabulary as auto|game|launch-chain. Resolve auto before effects, using exact-game inspection with blind relay for launcher-mediated targets and launch-chain inspection for direct targets.

Make requested scope, effective scope, middleware handling, and policy identity exact applicability dimensions. Store version 14 preserves legacy facts with absent dimensions, so they remain readable but inapplicable to new exact cases.

Keep fallback authority in the initial immutable workflow and select recovery from the typed inspection result independently from lifecycle completion. One unsuccessful launch-chain inspection may produce one fresh exact-game successor only when that authority was reviewed and fresh resolution reproduces its target and resolved launch authority apart from the scope transition. Packet-only fallback retains its actual passive observation without creating a positive Deep Capture fact only after capture output, required artifacts, event delivery, and cleanup reconcile; otherwise the original failure remains authoritative.

Certify the parser and exact-game authorization contract from the packaged executable in CI. Installed-product and private-title observations occur after release and any defect returns as a GitHub issue.

2026-11-06 Correct the hosted Windows calibration regression at its test-only timing boundary: the controlled setup-to-fresh-calibration path uses the same finite seven-second launch allowance as adjacent calibration cases, while production defaults and exact operator deadlines remain unchanged.

Prepare S189 through S194 and the timing correction as v0.10.14 candidate source on the required release branch. Candidate version, generated output, conformance identity, dependency authorities, specification applicability, changelog, notes, and package identity advance together. Verified current-public and frozen-review records remain on v0.10.13 until separately authorized publication and independent readback.

Close #566 through the candidate correction and keep release-delivery issue #567 open through tag, asset, registry, and current-marker reconciliation. Installed-product and private-title observations occur only after release; any concrete failure returns as a version-specific issue.

2026-11-06 The v0.10.14 release bump changes only the eleven first-party package versions across the three locked dependency graphs. Rebind the measured graph digests and the unchanged unsafe implementation inventory without changing third-party packages, sources, features, providers, package counts, edge counts, exception inventory, or review expiry. Synchronize the nine first-party identities in each isolated fuzz and native-performance lockfile; their third-party resolutions remain unchanged. The not-started independent-review template moves to 0.10.14 without claiming a review.

2026-11-02: Advance current v0.10.13 publication markers, documentation coverage, frozen review candidate, and six exact asset authorities only after merged source, annotated tag, all ten post-merge main workflows, all four tagged jobs, normal protected registry approval, six independently downloaded files, and ten non-yanked registry archives reconcile. Retarget the published replay label to these verified bytes. Preserve the v0.8.0 predecessor, historical evidence, and unperformed independent whole-product review status. Hosted certification did not exercise a private title on the operator workstation or establish universal title compatibility; later installed-product failures return as version-specific issues.