[HemSoft]

Refs #83

Refs, not Closes: #83 stays open until a view change saves on Home.

Summary

#84 fixed the Windows 1307 save error but was only tested in code. This PR adds a check that clicks every view in the real app, in the conditions that cause the error, and screenshots each one. No app code changes.

The check is scripts/native-capture/Invoke-ViewSaveCapture.ps1, in the Release workflow's PR runs:

• It runs the release exe on the hosted Windows desktop, with the token Home's non-elevated app has: Administrators deny-only, medium integrity (FilteredToken.cs).
• config.toml is owned by BUILTIN\Administrators, with the user given full control through inherited entries. That's Home's shape.
• It clicks Project, Backlog and Fleet with real mouse input and reads each screenshot with OCR.

A view fails if the error banner shows, if config.toml doesn't change to that view, or if the view's content is missing. The run also fails if the owner is still Administrators at the end, if the access entries or group changed, or if the bytes differ after returning to the first view.

Start-LoopbackPmd.ps1 gains the Backlog and Fleet routes, so those views show rows.

With the fix: every view saves

Run on head 3d66be0. All data is synthetic.

Step	Saved view	Banner	Owner of config.toml
Start	project	None	BUILTIN\Administrators
Click Backlog	backlog	None	The runner's user
Click Fleet	fleet	None	The runner's user
Click Project	project	None	The runner's user

Backlog

Fleet

Project, back at the first view. This image is byte-identical to the one taken at the start.

Without the fix: the banner Franz reported

Run on head 4b85ec7, a temporary commit that put the pre-#84 save code back. The same check failed with the same message, This security ID may not be assigned as the owner of this object. (os error 1307), and config.toml never left project.

The later commit 86833c3 removed that code and also completed the Fleet fixture, so the Fleet rows in this run read Stale and Unknown. That was missing test data, not part of the bug.

Backlog

Fleet

Project

Delivery on Home

The merged #84 build (51005e31…, from merge 27a02e6) replaced the installed exe at 09:04 EST on November 5. Nothing was stopped or started; the running window keeps the old build until it's next opened. The old exe is kept beside it as project-dashboard.pre-27a02e6.exe.

Limits

• This ran on a GitHub runner with synthetic data, not on Home's config or Home's pmd. Home's first view change on the new build is still unobserved, which is why Save config.toml when the running token cannot assign its owner #83 stays open.
• The exe here is CI's build of this head (49f60921…), not the bytes installed on Home. The app source is identical: this PR's diff from 27a02e6 touches only the workflow, AGENTS.md and scripts/native-capture.
• Saving moves config.toml's owner from Administrators to the caller, as fix: save config.toml when the running token can't assign its owner #84 documented and this run shows.
• The runner's desktop is smaller than Home's, so the Fleet screenshot stops at the T3 client column.

Validation

• core and rust on Ubuntu and Windows, advisories and windows all pass on 3d66be0.
• python scripts/native-capture/test_fixture.py passes on Home.
• On Home, a process started through FilteredToken reported Administrators "Group used for deny only" and "Medium Mandatory Level" from whoami /groups.

🤖 Generated with Claude Code

[HemSoft]

@sfl review

[Copilot]

🔵 Needs a closer look

The change combines privileged Windows token and ACL operations with desktop input and OCR validation, while its correctness depends on interactive hosted-runner conditions and runtime evidence unavailable in this review environment.

No open issues 🎉

What changed in this PR

Adds a Windows-native CI regression capture for issue #83. It exercises Project, Backlog, and Fleet view changes under a filtered administrator token and verifies persistence, screenshots, ACLs, ownership, and the absence of the Windows 1307 error. No application source code is changed.

Changes:

• Adds synthetic Backlog and Fleet responses to the loopback PMD fixture.
• Adds filtered-token launching and interactive OCR-based view capture with security and persistence checks.
• Runs and uploads the capture evidence for pull requests and documents the workflow.

The capture script has three unresolved moderate findings: per-view capture errors can stop later views from being tested; the ACL fixture relies on temporary-directory defaults instead of explicitly constructing and verifying the required access; and the ownership check does not verify that the final owner is the filtered caller.

File	Summary
scripts/​native-capture/​Start-LoopbackPmd.ps1	Adds synthetic Backlog and Fleet API responses for populated captures.
scripts/​native-capture/​Invoke-ViewSaveCapture.ps1	Creates the security fixture, launches the filtered-token app, captures and validates each view, and checks configuration persistence. Contains three unresolved moderate findings described above.
scripts/​native-capture/​FilteredToken.cs	Creates a medium-integrity token with Administrators deny-only and launches the dashboard under it.
AGENTS.md	Documents the Windows native capture and evidence artifact.
.github/​workflows/​release.yml	Runs the capture on pull requests and uploads its evidence.

This pull request requires changes.

_{Review effort: Lite}

[HemSoft]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 3d66be0816

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T15:20:53.489801Z	3d66be0	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[hemsoft-sfl-reviewer]

SFL review skipped: PR closed or head/base moved; post a fresh request.