chore(release): prepare mac v0.3.101-author.1 - #117
Merged
Amir Bredy (ABMFST) merged 14 commits intoAug 8, 2026
Conversation
…lone servers
The three bundled WS2022 role baselines shipped in their original generated
form: 71-73 rules per profile addressed audit policy, user rights and account
policy through Microsoft.Windows/CSP at ./Vendor/MSFT/Policy/Result/..., which
only resolves through OMA-DM. On a standalone (non-MDM-enrolled) server those
settings come back unread instead of compliant/non-compliant. The profiles also
used colon-less registry hive prefixes, legacy value-type aliases, and ambiguous
schema: {} compliance blocks.
WS2025 hit the identical defect and was repaired in #82/#93. This change applies
the same reviewed mechanism to WS2022 via a deterministic converter:
- Every Policy/Result CSP rule moves to a dedicated AuditPolicy (exact
subcategory GUID), UserRightsAssignment (exact Se* right) or AccountPolicy
(exact policy name) provider. Residual CSP: zero in all three profiles.
- Registry keyPaths gain the required hive colon and canonical REG_* value
types; five array-in-Dword payloads are reshaped per the WS2025 contract for
the identical keyPath/valueName.
- schema: {} blocks become explicit CEL expression/template pairs. Ambiguous
ones become the WS2025 informational form rather than an invented assertion;
each downgrade is recorded with its reason.
WS2022 desired values are authoritative - only mechanism and addressing are
borrowed from WS2025. The only value changes are provider-mandated reshapes,
all enumerated in conversion-report.json.
Counts: Member Server 257 -> 259, Domain Controller 242 -> 244, Workgroup
Member 200 -> 202. The +2 delta is the composite AccountLockoutPolicy CSP
string expanding into LockoutDuration/LockoutThreshold/LockoutReset.
The mapping tables are committed as reviewable JSON extracted from the WS2025
repair commits; derive-maps.mjs --check proves they still match. The conversion
report is committed too, because CI checks out shallow and the tests must
validate parity without reading pre-repair history.
OSConfig security baseline support is officially Windows Server 2025 only, so
WS2022 remains best-effort; the README states this and the remaining
limitations honestly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
(cherry picked from commit 91dd551)
…provenance Follow-up to 91dd551, addressing independent review findings. Restore real assertions on "must be unassigned" user rights. Seven controls per member profile and six on the domain controller carried the scalar schema {"oneOf":[{"const":""},{"type":"null"}]} with a desired value of "", i.e. the right must be granted to nobody. Because UserRightsAssignment reads back a list of principals, the previous change downgraded them to expression: 'true', which silently dropped a real security constraint. They are now restated over the list as `value == null || value.size() == 0`. CEL's || short-circuits so size() never touches an unset value, and size() on a UserRightsAssignment principal list is already exercised in packages/core/src/import-export/index.test.ts. translatePrincipalListSchema() returns null for any other shape, so an unreviewed schema still surfaces as an explicit downgrade. assertionDowngrades is now empty in all three profiles; assertionRestatements is 7/6/7. Pin all provenance to full SHAs reachable from origin/main. 6fb3052 was a branch-local commit and is replaced by 37ab26a, the main-reachable schema-to-expression translation; the derived tables are byte-identical, which confirms the substitution. derive-maps.mjs now loads both the before and after artifacts with `git show <full SHA>`, never the working tree, refuses any ref that is not a 40-character SHA, and verifies each pin resolves to itself and is an ancestor of origin/main before deriving anything. The map _provenance blocks carry providerBeforeCommit/providerAfterCommit and schemaBeforeCommit/schemaAfterCommit instead of a mutable HEAD reference. Break the circular tests. The old suite asserted generated output against the map that generated it, and a provenance regex silently matched the string "undefined". The suite now asserts the exact pinned SHAs and their ancestry, independently parses the pinned before/after baselines and re-derives every CSP map target address (audit subcategory GUID, Se* right name, account policy name) and every schema-to-expression pair from that evidence, and pins explicit representative mappings and desired values. It also proves the pinned schema commit has zero Policy/Result CSP rules and exactly the five reviewed Policy/Config residuals. Make --report read-only as documented. Writes now happen only when neither --check nor --report is given, and a filesystem test asserts the three baselines, both maps and the conversion report keep their content, size and mtime across a --report run that still prints the full summary. Record the live smoke result as labelled evidence in conversion-report.json and the README: the shipped workgroup-member profile returned 171 compliant with 29 read errors, the repaired profile 200 compliant, 2 genuinely non-compliant and 0 read errors, under oscfg 1.3.12. That run was executed on a Windows Server 2025 host and is explicitly not native Windows Server 2022 validation. The CI vitest job now checks out with fetch-depth: 0 so the evidence re-derivation tests can run; they skip on a shallow local clone but are mandatory whenever CI is set. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 6714c81)
…view5 Review correction. The live smoke run of ws2022-workgroup-member was performed with oscfg 1.3.12-preview5, not the released 1.3.12. The exact preview build is now recorded everywhere the smoke provenance appears: LIVE_SMOKE in the converter, _provenance.liveSmoke in the deterministically regenerated conversion-report.json, the README evidence table, and the test expectation. Evidence only; no baseline, mapping table or assertion changes. The three ws2022-*.osc.yaml profiles are byte-identical, and --check passes for both the converter and the map derivation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit f65d2cb)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 1c4b18d)
Preserve exact QWord values and canonical Registry contracts across authoring, import/export, Diff, reports, history, and rationale while leaving deploy, revert, elevation, and device-audit behavior unchanged. (cherry picked from commit d1e058b) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 (cherry picked from commit 2f56384)
Upgrade to js-yaml 4.3.1 to resolve GHSA-5p4m-2wfm-xmqj without a breaking 5.x migration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 (cherry picked from commit 2e68aaa)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.12 to 3.4.13. - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.12...3.4.13) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 25e038c)
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit f575b05)
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 742410b)
Update patched React Router and build-only Undici releases reported by Dependabot. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 (cherry picked from commit 51a4d80)
Align author package metadata, release notes, support documentation, expected assets, and immutable-tag examples with the compatible 0.3.101 baseline, authoring, packaging, build, and security ports. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804
Use the shared lossless serializer for compliance tables and Markdown exports, and remove the unused icon import left by the selective port. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804
Track only active ancestors so true cycles render as placeholders while repeated YAML aliases still serialize as full values and QWords remain exact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.3.101-author.1release metadataSource changes
Validation
0.3.101-author.1