Adds windows/, the Python client for the kids' Windows computers, and proves
both halves of the Phase 4 definition of done on the real box
(DESKTOP-TE2RHV2).
The client:
- subscribes, retained, to its own config on the 8883 TLS device plane with its
own broker account (FR-3, FR-6);
- keeps the last valid config on disk and loads it before connecting, so a
broker outage changes nothing (FR-14);
- terminates every process on the blocklist while the device is effectively
locked, with the allowlist winning and the client's own tree plus critical
system processes protected (FR-4, FR-16);
- publishes presence and daily per-app usage; the day's totals are held on disk
and republished when the link returns (FR-7);
- shows an always-on-top warning window naming what is blocked, why and until
when (FR-9).
install-scheduled-task.ps1 registers the logon Scheduled Task for the kid's
account with an interactive token, and grants that account Modify on the state
directory: a file created from an elevated shell inherits Administrators only,
and the limited task is otherwise refused with Access denied.
Evidence (windows/EVIDENCE.md, from the machine's own log): notepad.exe killed
inside a scheduled window (pid 16600, then 9724), the device online in the
Control Service with locked/until/reason, a telemetry row for the device
(app=690s), enforcement continuing with the broker unreachable
(192.168.20.13:8884), the warning window on the interactive desktop, and the
Scheduled Task registered at logon as New Comp.
Domains are deliberately not reported: Windows has no cheap per-process DNS
attribution, so the client sends "domains": [] and the gap is documented rather
than guessed.
54 unit tests, run with `make windows-test` (no broker, no Windows, no psutil).
AGENTS.md §11 is now 10 of 10.
Phase 10 (the last phase of this project) is the project-docs pass. Update the
Gitea README, add the Mermaid source and rendered PNG, build the interactive
Archify map, add the Vikunja board tasks, and write the Outline AI-context
collection in Simplified Technical English.
Deliverables:
- README.md: status header, Phase 4 gap statement, "Architecture" section with
embedded Mermaid + image + Archify link, "Documentation set" table, an
explicit two-plane MQTT section (1883 plain+anonymous, 8883 TLS+ACLs), and
the Android client's Usage Access and VpnService paths.
- AGENTS.md section 11: tick Phase 10, leave Phase 4 unticked, status line now
"9 of 10 done - only Phase 4 outstanding".
- docs/architecture.mmd + docs/diagrams/architecture.png (mmdc).
- docs/archify/architecture.architecture.json + docs/architecture-map.html
(Archify, showcase, 9/9 checks, 0 errors).
- docs/outline/00-index.md .. 04-agent-runbook.md (STE).
- docs/vikunja-tasks.json (Vikunja project "Internet Use Control", id 20).
- Obsidian note written to 010 inbox on .27; the obsidian-sorter proposed a
folder and waits for the vault owner's approval.
Phase 4 (Python Windows computer client) is deliberately deferred and is NOT
built. Every document says so.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
