Release v0.3.3

Compact human summary of the 0.3.3 corrective source-evidence hardening release. Code, tests, workflows, pyproject.toml, README, docs, local wiki source, and AGENTS.md remain source truth.

Pick Your Path

Highlights

Source Evidence Semantics

Microsoft public sources can arrive out of order. Release Health Current Versions remains the latest_build source. Atom-linked Support article evidence can move latest_observed_build ahead, but that observation is administrator context only until baseline rules select the same build as required_baseline_build. When Release Health has caught up and the baseline rules select that same build, all three build fields can legitimately match.

Atom discovers Support article hrefs; it is not a synthesized /help/<KB> resolver. The generator prefers safe Atom alternate links to https://support.microsoft.com article paths and records a Source Diagnostic when no usable support href exists. Otherwise safe article URLs have tracking queries and fragments stripped; unsafe ports, userinfo, traversal, overlong paths, and non-support hosts still reject. Direct or fixture-provided Atom entries are revalidated before their links can become release-history URLs, support metadata, manifest evidence, dashboard hrefs, or copied diagnostics JSON. Release History enrichment prefers Atom entries that match both KB and build, then build-only entries, and skips ambiguous KB-only fallbacks.

Support article enrichment is trusted only after URL, KB, expected build, and parseable Applies to evidence are compatible with the Atom record. Mismatch and degraded statuses stay visible without dumping raw article HTML or treating mismatched article text as summary/security truth. The parser records bounded applies_to text and applies_to_releases when release values can be parsed. If those parsed releases explicitly exclude the expected release, the article is a visible mismatch and is untrusted for summaries or Support-derived security wording for that event.

MSRC CVRF exact-KB-token evidence can still classify a KB as security when the Support article is bad. Larger tokens such as KB50941260, 15094126, and 5094126a do not match KB5094126, and malformed/unavailable CVRF data does not silently become non-security proof. Exact-KB remediation evidence remains security evidence even without optional CVE/severity/product fields. Dashboard and visible JSON exports publish the classification and evidence source, not CVE lists or counts.

When a real non-preview, non-OOB Release Health B-release row becomes the required baseline and matches the broad target's latest observed build, the dashboard can show an informational blue/white baseline-update notice for 14 days from the source-derived official baseline date. It labels date-only Release Health precision explicitly and uses deterministic local facts from Release Health, Atom, validated Support, and exact MSRC data. It does not call an LLM or cloud API, and it does not change signed verdicts, baseline selection, Source Diagnostics issue sync, runtime behavior, or /api/v1 aliases. Expired or inactive notice metadata does not trigger optional Support/MSRC enrichment fetches solely for stale notice data. If an already published static page becomes stale, inline local JavaScript hides the expired notice and removes the has-baseline-notice grid class so the operational panels reflow; invalid expiry data leaves the notice visible instead of crashing the page.

Generated Output Coverage

Generated-output regressions exercise the policy JSON, policy manifest, dashboard HTML, /api/v1 aliases, visible Source Diagnostics JSON export, and remote parser acceptance. They cover the KB5094126 latest-observed case, the caught-up Release Health case, unique diagnostic IDs, Support mismatch/degraded states, MSRC unavailable/malformed states, no raw Support HTML leakage, and no synthesized /help/5094126 fallback. Additional coverage guards unsafe direct Atom links, build-aware Atom matching, explicit release/applicability mismatches, expired-notice no-fetch behavior, stale-notice grid reflow, and static dashboard constraints.

Release Gate Result

The local 0.3.3 release gate passed compileall, the full pytest suite, fixture Pages generation, generated-output sanity inspection, secret scanning, clean archive export/validation, identity/version/action audits, --self-test, live public policy/pages checks, and the Windows Panther JSON regression harness. Generated archive validation reported 153 clean source entries.

Packaging And PyPI

Signed Policy Note

The local version bump does not regenerate the signed bundled production policy or detached signature. Release packaging and Pages publishing must use the existing secure signing workflow with the real policy signing key.

Unchanged Boundaries

Verify Commands

python -m compileall -q win11_release_guard tools tests
python tools/check_version_consistency.py
python tools/check_project_identity.py
python tools/check_github_action_versions.py
pytest -q
python -m win11_release_guard --self-test
python tools/scan_for_secret_material.py README.md CHANGELOG.md AGENTS.md docs wiki win11_release_guard tests tools pyproject.toml .github
python tools/export_clean_archive.py --output dist/win11_release_guard-source.zip
python tools/export_clean_archive.py --validate dist/win11_release_guard-source.zip
python -m build
python -m twine check dist/*

Related Pages

Home | Architecture | Policy Feed and Trust Model | Source Diagnostics | Tagged Release Lane | Build, Test and Release