Sam Rolfe
1275b1baaa
Adds windows/, the Python client for the kids' Windows computers, and proves both halves of the Phase 4 definition of done on the real box (DESKTOP-TE2RHV2). The client: - subscribes, retained, to its own config on the 8883 TLS device plane with its own broker account (FR-3, FR-6); - keeps the last valid config on disk and loads it before connecting, so a broker outage changes nothing (FR-14); - terminates every process on the blocklist while the device is effectively locked, with the allowlist winning and the client's own tree plus critical system processes protected (FR-4, FR-16); - publishes presence and daily per-app usage; the day's totals are held on disk and republished when the link returns (FR-7); - shows an always-on-top warning window naming what is blocked, why and until when (FR-9). install-scheduled-task.ps1 registers the logon Scheduled Task for the kid's account with an interactive token, and grants that account Modify on the state directory: a file created from an elevated shell inherits Administrators only, and the limited task is otherwise refused with Access denied. Evidence (windows/EVIDENCE.md, from the machine's own log): notepad.exe killed inside a scheduled window (pid 16600, then 9724), the device online in the Control Service with locked/until/reason, a telemetry row for the device (app=690s), enforcement continuing with the broker unreachable (192.168.20.13:8884), the warning window on the interactive desktop, and the Scheduled Task registered at logon as New Comp. Domains are deliberately not reported: Windows has no cheap per-process DNS attribution, so the client sends "domains": [] and the gap is documented rather than guessed. 54 unit tests, run with `make windows-test` (no broker, no Windows, no psutil). AGENTS.md §11 is now 10 of 10.
13 lines
530 B
Python
13 lines
530 B
Python
"""Kids' Windows computer client for Internet Use Control (AGENTS.md §11 Phase 4).
|
|
|
|
The client is a device, not a control plane. It subscribes to its own retained
|
|
config on the MQTT 8883 plane, blocks listed processes while the device is
|
|
locked, reports presence and daily usage, warns the child, and keeps enforcing
|
|
its last config when the broker is unreachable (FR-14). It never changes its own
|
|
rules (AGENTS.md §10 rule 7).
|
|
|
|
Run it as ``python -m webrestrict`` (see ``windows/README.md``).
|
|
"""
|
|
|
|
__version__ = "1.0.0-phase4"
|