total-recall-brain 3.40.1 → 3.40.3

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "tr-plugin-security",
+  "version": "0.3.1",
+  "type": "module",
+  "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "build:ui": "node scripts/build-ui.mjs"
+  },
+  "license": "MIT",
+  "files": [
+    "cli.mjs",
+    "plugin.json",
+    "README.md",
+    "LICENSE",
+    "src/",
+    "!src/**/*.spec.mjs",
+    "skills/",
+    "scripts/",
+    "ui/"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scaffold/.agent/skills/total-recall/plugins/security/plugin.json

@@ -0,0 +1,297 @@
+{
+  "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
+  "id": "security",
+  "name": "Security Assessments",
+  "version": "0.3.1",
+  "description": "Machine and device security assessments for macOS, Linux, Windows, Android, Chromebook, iPhone and iPad, with explicit measured and manual coverage.",
+  "license": "MIT",
+  "branding": {
+    "name": "Security Assessments",
+    "color": "#f43f5e",
+    "badge": "Security Enclave",
+    "font": "chivo-mono"
+  },
+  "auth": {
+    "plugin": "auth",
+    "methods": [
+      "passkey",
+      "google-oauth2"
+    ],
+    "session_verification": true
+  },
+  "card_face": {
+    "skin": "winamp-classic",
+    "theme": "vibrant",
+    "headline": "Security & Hardening Suite",
+    "quick_actions": [
+      {
+        "subcommand": "machine",
+        "label": "THIS MACHINE"
+      },
+      {
+        "subcommand": "fleet",
+        "label": "MESH FLEET"
+      },
+      {
+        "subcommand": "plugins",
+        "label": "PLUGINS"
+      },
+      {
+        "subcommand": "harden",
+        "label": "HARDENING PLAN"
+      }
+    ],
+    "touch_layout": "comfortable",
+    "interactive": true
+  },
+  "ssss_schemas": {
+    "categories": [
+      {
+        "name": "security-audits",
+        "description": "Security audit reports, static analysis findings, and compliance baseline records",
+        "node_type": "memory"
+      },
+      {
+        "name": "security-hardening",
+        "description": "Applied hardening profiles, permission policies, and egress firewall rules",
+        "node_type": "memory"
+      },
+      {
+        "name": "security-events",
+        "description": "SSSS security events, rotation logs, and threat telemetry",
+        "node_type": "memory"
+      }
+    ]
+  },
+  "deploy": {
+    "targets": [
+      "ssss-app",
+      "nextjs",
+      "react",
+      "flask"
+    ],
+    "required_ssss_version": ">=0.9.3",
+    "access_grants": [
+      "auth:session:verify",
+      "ssss:vault:read",
+      "ssss:vault:write",
+      "ssss:events:append"
+    ]
+  },
+  "secrets": [
+    {
+      "key": "SECURITY_MASTER_KEY",
+      "description": "Master encryption key for envelope encryption and credential hardening",
+      "required": false
+    },
+    {
+      "key": "CHALLENGE_SECRET_KEY",
+      "required": false,
+      "description": "Provider challenge verification credential; managed exclusively by auth"
+    }
+  ],
+  "cli": {
+    "command": "security",
+    "handler": "./cli.mjs",
+    "subcommands": [
+      {
+        "name": "platforms",
+        "description": "List native collectors and guided device review coverage",
+        "effect": "read"
+      },
+      {
+        "name": "device",
+        "description": "Guided review: --platform ios|ipados|android|chromeos|chromeos-flex|windows --device label [--stdin|--answers-json JSON]; never automatically verified",
+        "effect": "write"
+      },
+      {
+        "name": "android",
+        "description": "Limited device-property reads: --serial existing-authorized-adb-serial; never enables debugging",
+        "timeout_ms": 60000,
+        "effect": "read"
+      },
+      {
+        "name": "machine",
+        "description": "Inspect local firewall, disk protection, effective SSH policy and listeners; --apply-permissions verifies local SSH permission repair",
+        "timeout_ms": 120000,
+        "effect": "write"
+      },
+      {
+        "name": "network",
+        "description": "Inspect local network listeners and host security posture",
+        "timeout_ms": 120000,
+        "effect": "read"
+      },
+      {
+        "name": "fleet",
+        "description": "Audit discovered mesh machines; optional --target hostname",
+        "timeout_ms": 600000,
+        "effect": "read"
+      },
+      {
+        "name": "status",
+        "description": "Display active security suite modules and crypto status",
+        "effect": "read"
+      },
+      {
+        "name": "audit",
+        "description": "Execute comprehensive file permission, egress policy, and SAST audit",
+        "timeout_ms": 120000,
+        "effect": "read"
+      },
+      {
+        "name": "scan",
+        "description": "Run static analysis scanner for code injection and token leaks",
+        "effect": "read"
+      },
+      {
+        "name": "harden",
+        "description": "Prepare observed hardening plan; --apply-permissions repairs recognized local SSH metadata",
+        "timeout_ms": 120000,
+        "effect": "write"
+      },
+      {
+        "name": "plugins",
+        "description": "Audit installed plugin source and auth declarations; manifests are never auto-rewritten",
+        "timeout_ms": 120000,
+        "effect": "read"
+      },
+      {
+        "name": "secure-all",
+        "description": "Audit entire discovered mesh fleet with explicit coverage and remediation; no blanket secured claims",
+        "timeout_ms": 600000,
+        "effect": "write"
+      },
+      {
+        "name": "encrypt",
+        "description": "Perform AES-256-GCM authenticated envelope encryption",
+        "effect": "write"
+      },
+      {
+        "name": "decrypt",
+        "description": "Decrypt AES-256-GCM envelope payload",
+        "effect": "read"
+      },
+      {
+        "name": "probe",
+        "description": "Real HTTPS response and security-header presence check; requires --url",
+        "effect": "read"
+      },
+      {
+        "name": "token",
+        "description": "Inspect or save the auth-managed security master key through stdin",
+        "effect": "write"
+      },
+      {
+        "name": "challenge",
+        "description": "Create, solve or verify authenticated proof-of-work challenges",
+        "effect": "write"
+      },
+      {
+        "name": "bot-mitigate",
+        "description": "Evaluate submission risk with optional provider challenge verification",
+        "effect": "read"
+      },
+      {
+        "name": "site-audit",
+        "description": "Review actual website security headers on an authorized HTTPS target",
+        "effect": "read"
+      },
+      {
+        "name": "site-shield",
+        "description": "Generate application middleware for review; does not claim installation",
+        "effect": "write"
+      }
+    ]
+  },
+  "ui": {
+    "design_tokens": "ui/DESIGN.md",
+    "elements": [
+      {
+        "id": "panel",
+        "kind": "panel",
+        "tag": "security-panel",
+        "module": "ui/panel.js",
+        "description": "Machine, network and mesh security audit console",
+        "events": [],
+        "tokens": [
+          "color-text",
+          "color-surface",
+          "color-border",
+          "spacing-md",
+          "radius-md"
+        ],
+        "optional_tokens": [],
+        "props": {
+          "view": {
+            "type": "object",
+            "description": "Printed by `total-recall security token status --json`: { present, secretKey }"
+          }
+        }
+      },
+      {
+        "id": "card",
+        "kind": "card",
+        "tag": "tr-security-card",
+        "module": "ui/card.js",
+        "description": "Fortress Card Face"
+      }
+    ]
+  },
+  "skills": [
+    {
+      "path": "skills/security/SKILL.md",
+      "id": "security"
+    }
+  ],
+  "runtime": {
+    "modules": {
+      "machines": "src/machines.mjs",
+      "scanner": "src/scanner.mjs",
+      "website": "cli.mjs",
+      "devices": "src/devices.mjs",
+      "windows": "src/windows.mjs",
+      "android": "src/android.mjs"
+    }
+  },
+  "status": {
+    "command": "status",
+    "refresh_seconds": 60
+  },
+  "distribution": {
+    "tier": "official",
+    "license": "open"
+  },
+  "card_layout": {
+    "template": "vault",
+    "regions": [
+      {
+        "widget": "status",
+        "title": "Status"
+      },
+      {
+        "widget": "live",
+        "title": "Live view"
+      },
+      {
+        "widget": "list",
+        "title": "Details",
+        "source": {
+          "command": "platforms"
+        }
+      },
+      {
+        "widget": "actions",
+        "title": "Commands"
+      },
+      {
+        "widget": "credentials",
+        "title": "Credentials"
+      },
+      {
+        "widget": "activity",
+        "title": "Recent activity"
+      }
+    ]
+  }
+}

package/scaffold/.agent/skills/total-recall/plugins/security/scripts/build-ui.mjs

@@ -0,0 +1,4 @@
+import fs from 'node:fs';
+const card = fs.readFileSync(new URL('../ui/card.js', import.meta.url), 'utf8');
+// The host runs each interface from a standalone Blob module; bundle the shared class.
+fs.writeFileSync(new URL('../ui/panel.js', import.meta.url), `${card}\nclass SecurityPanel extends SecuritySecurityCard {}\nif (!customElements.get('security-panel')) customElements.define('security-panel', SecurityPanel);\n`);

package/scaffold/.agent/skills/total-recall/plugins/security/skills/security/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: security
+description: Audit and harden machines, mesh networks, plugin credentials and websites using the security plugin, with measured coverage and verified remediation.
+---
+
+# Security plugin
+
+Discover `total-recall security status --json` and installed mesh/auth capabilities. Security owns audits and remediation; mesh owns machine discovery and remote execution; auth owns every credential. No ambient credential, default key, core secret store or alternate-machine fallback is permitted.
+
+Use `security machine --json` for the current host or `security network --json` for its network posture. Reports include firewall, disk protection, effective SSH settings, TCP/UDP bindings and SSH file metadata. macOS additionally checks Gatekeeper, System Integrity Protection and update scheduling. Linux inspects UFW, root encryption ancestry and update-service configuration. Unsupported tools, privileges and storage layouts remain unavailable. An enabled firewall alone does not certify its rules; configured update services do not prove patch currency.
+
+Use `security fleet --json` or `security fleet --target <discovered-hostname> --json` for mesh machines. `secure-all` is the fleet assessment workflow. The security plugin must already be installed on each peer; this operation never installs agents or substitutes another machine. Review observed/selected counts, offline machines, freshness, identity and unavailable checks before making a fleet claim. Mobile and ChromeOS peers without a connected collector remain unverified and route to device review; mesh presence never proves device security.
+
+For each failed/review check, follow the report's remediation. `security harden --json` prepares the current machine's plan. `security machine --apply-permissions --json` restricts recognized local SSH permissions and verifies inode ownership and resulting modes. It refuses symlink traversal. Firewall, SSH daemon, disk-encryption and recovery changes require a concrete access/rollback plan; validate configuration and a second working administrative connection before applying those changes. Never label a generated recommendation as applied protection.
+
+Use `security plugins --json` for installed plugin declarations and source findings, and `security scan <path> --json` for scoped source inspection. Findings omit matched values. Scanner findings are review evidence, not proof that all credentials or vulnerabilities have been found. Missing paths, coverage limits and unreadable files fail the operation. Manifest auth declarations do not prove runtime enforcement; follow credential reads/writes and route checks through the actual owner. Do not automatically add grants or rewrite manifests as a substitute for implementation.
+
+Use `security probe --url https://authorized-site --json` for a real HTTPS response and header-presence check. Header presence does not prove correct policy. Restrict targets to authorized systems; do not widen scanning to arbitrary network ranges. `site-audit` provides additional website review; challenge, bot-mitigation and site-shield tools need application integration and verification.
+
+Signing/encryption require SECURITY_MASTER_KEY stored through auth; use `security token set --stdin` for at least 32 bytes of random material. Remote challenge verification uses its separately declared provider credential. Never pass keys or plaintext in argv. `security encrypt --stdin --json` accepts plaintext on stdin. Explicit decryption exposes plaintext by design: route output only to the intended secure consumer and never capture it in audit logs or documentation.
+
+Run meaningful clean/unsafe fixtures and the full owner suite on the configured sanctioned test node. Preserve raw exit status, tested source identity and cleanup evidence. Report findings, unavailable coverage, actual fixes and residual risks separately. Update the active project tracker and OpenWiki via its installed plugin; never store secrets in reports, hubs, SSSS audit records or UI output.
+
+## Windows, Android, Chromebook, iPhone and iPad
+
+Run `security platforms --json` for the support matrix. Windows `machine` uses fixed read-only PowerShell queries for active firewall profiles, built-in antivirus, system-volume encryption, Secure Boot and TCP/UDP bindings. Missing cmdlets, editions and privileges stay unavailable. All firewall rules, alternate antivirus and Windows patch currency still require review. This collector never requests recovery-key material or applies administrative changes.
+
+Use `security android --serial <already-authorized-serial> --json` only with an existing authorized ADB device. It reads four allowlisted boot, encryption and security-patch properties. It never connects, authorizes, roots, flashes or enables debugging. Properties are device-reported rather than hardware attestation; full posture stays incomplete. Android-native runtimes may use `machine`; Linux containers and Termux identified as Linux must not be assumed to certify Android.
+
+Use `security device --platform ios|ipados|android|chromeos|chromeos-flex|windows --device <label> --json` for the device-specific guide. Initial checks are unverified. After observing settings on that device, submit `--stdin` with an object keyed by check ID, each containing only `status` (`secure`, `needs-attention`, `unknown`) and ISO `observedAt`. The UI supplies this same workflow through Review device / Evaluate review. Only changed answers receive timestamps. Answers expire after 24 hours. Never record passcodes, recovery codes, keys, profiles, arbitrary notes or other secret material.
+
+Manual outcomes are user-attested: reviewed is never automatic passed; coverage.complete remains false and automatic remains zero. Incomplete/at-risk reviews exit 1; a complete manual review exits 0 within those limited semantics. Do not turn manual answers into native observations, invent device-management enrollment, or substitute a browser scan. iPhone/iPad have distinct guides; Safety Check is not assumed on iPad. Chromebook and ChromeOS Flex have distinct boot protection guidance; Crostini/container checks never certify the host. Network reviews cover saved Wi-Fi, VPN, hotspot and sharing; router firmware/rules need a separate authorized router assessment.
+
+Windows/Android collectors are fixture-tested on the sanctioned Mac mini; live execution on those operating systems is not yet verified. No mobile management or Verified Access integration is connected. Keep these limitations visible until actual device evidence establishes coverage.
+
+
+Scanner coverage now includes JavaScript/TypeScript, Python and shell/PowerShell source. Dynamic credential reads, synthetic provider/signing defaults and linked uninspected source produce redacted review findings. Coverage limits fail explicitly; source review does not establish runtime enforcement. `security --help` lists actual commands. Latest scanner/device suite: 28 tests passed on sanctioned node, exit 0. All-plugin audit remains failed while CRM credential paths are unresolved.

package/scaffold/.agent/skills/total-recall/plugins/security/src/android.mjs

@@ -0,0 +1,21 @@
+const properties = ['ro.boot.verifiedbootstate', 'ro.boot.flash.locked', 'ro.crypto.state', 'ro.build.version.security_patch'];
+export function auditAndroid({ execute, serial, hostname = 'Android runtime' }) {
+  if (serial !== undefined) {
+    if (typeof serial !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(serial)) throw new Error('Explicit authorized device serial required');
+    const inventory = execute('adb', ['devices']);
+    if (!inventory.ok || !inventory.output.split('\n').some(line => line.trim().split(/\s+/)[0] === serial && line.trim().split(/\s+/)[1] === 'device')) throw new Error('Device is not present and authorized; no connection or debugging changes were attempted');
+    hostname = serial;
+  }
+  const checks = properties.map(property => {
+    const result = serial ? execute('adb', ['-s', serial, 'shell', 'getprop', property]) : execute('getprop', [property]);
+    const value = result.ok ? result.output.trim() : '';
+    let state = 'unavailable', observed;
+    if (property.endsWith('verifiedbootstate') && ['green', 'yellow', 'orange', 'red'].includes(value)) { state = value === 'green' ? 'pass' : 'fail'; observed = value; }
+    if (property.endsWith('flash.locked') && ['0', '1'].includes(value)) { state = value === '1' ? 'pass' : 'fail'; observed = value; }
+    if (property === 'ro.crypto.state' && ['encrypted', 'unencrypted'].includes(value)) { state = value === 'encrypted' ? 'pass' : 'fail'; observed = value; }
+    if (property.endsWith('security_patch') && /^\d{4}-\d{2}-\d{2}$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value) { state = Date.parse(value) > Date.now() + 86400000 ? 'unavailable' : 'review'; observed = value; }
+    return { id: property, state, evidence: state === 'unavailable' ? 'none' : 'device-reported-property', ...(observed ? { observed } : {}), remediation: 'Review the manufacturer security settings and support policy. Properties are not hardware attestation; never flash, root or relock a device through this tool.' };
+  });
+  checks.push({ id: 'device-settings-review', state: 'unavailable', evidence: 'none', remediation: 'Complete security device --platform android for screen lock, app protection, permissions, accounts, debugging and network access.' });
+  return { schema: 'security-machine/v1', platform: 'android', hostname, timestamp: new Date().toISOString(), status: checks.some(v => v.state === 'fail') ? 'at-risk' : 'incomplete', coverage: { complete: false, observed: checks.filter(v => v.state !== 'unavailable').length, total: checks.length, limitations: ['Device-reported properties only; rooted devices may misreport state', 'No hardware attestation or full settings inspection', 'Never enable debugging solely for a scan; revoke unused debugging access after use'] }, checks, listeners: [] };
+}

package/scaffold/.agent/skills/total-recall/plugins/security/src/devices.mjs

@@ -0,0 +1,94 @@
+const apple = 'https://support.apple.com/guide/personal-safety/welcome/web';
+const android = 'https://support.google.com/android/answer/7680439';
+const chrome = 'https://support.google.com/chromebook/answer/9367166';
+const windows = 'https://learn.microsoft.com/en-us/windows/security/';
+const check = (id, title, remediation, source) => ({ id, title, remediation, source });
+const appleChecks = [
+  check('updates', 'OS and security updates reviewed', 'Open Settings → General → Software Update. Install available supported updates and review Automatic Updates. A version number alone does not prove current protection.', apple),
+  check('screen-lock', 'Strong passcode and automatic lock', 'Review Face ID / Touch ID & Passcode and Display & Brightness → Auto-Lock. Use a strong unique passcode; never enter that passcode in this assessment.', apple),
+  check('account-recovery', 'Account protection and recovery reviewed', 'In Settings → your account → Sign-In & Security, review two-factor authentication, trusted devices and recovery options. Keep recovery material outside this report.', apple),
+  check('lost-device', 'Lost-device protection enabled', 'Review Find My and Activation Lock for this device. Confirm recovery access before changing account settings.', apple),
+  check('management', 'Management profiles and VPNs recognized', 'Review Settings → General → VPN & Device Management. Investigate unknown profiles or VPNs; coordinate legitimate managed policies with your administrator.', apple),
+  check('app-permissions', 'App access and sharing reviewed', 'Review Privacy & Security permissions, location access and installed apps. Restrict unnecessary camera, microphone, contacts and tracking access.', 'https://support.apple.com/en-us/102515'),
+  check('network', 'Wi-Fi and network exposure reviewed', 'Review known Wi-Fi networks, Auto-Join, hotspot access and sharing settings. Use trusted encrypted networks; inspect the router separately. An active VPN is not proof that the device is secure.', apple),
+];
+const profiles = {
+  ios: { name: 'iPhone', limitations: ['No native device-posture collector or management enrollment is established', 'A browser cannot inspect passcodes, installed profiles or OS protection settings'], checks: [...appleChecks,
+    check('sharing-safety', 'Safety Check and theft protection reviewed', 'Use Settings → Privacy & Security → Safety Check → Manage Sharing & Access when available. Review Stolen Device Protection under Face ID / Touch ID & Passcode. Consider the personal impact before revoking sharing.', 'https://support.apple.com/en-euro/guide/personal-safety/-ips2aad835e1/web'),
+    check('targeted-threats', 'Targeted-threat protection considered', 'Review whether Lockdown Mode is appropriate for your threat model. It is optional and restricts functionality; leaving it off is not itself a failed baseline. Mark reviewed after making an informed choice.', 'https://support.apple.com/en-us/105120'),
+  ] },
+  ipados: { name: 'iPad', limitations: ['No native device-posture collector or management enrollment is established', 'iPhone Safety Check and Stolen Device Protection are not assumed available on iPad'], checks: [...appleChecks,
+    check('targeted-threats', 'Targeted-threat protection considered', 'Review Lockdown Mode in Privacy & Security for targeted threats. It is optional and restricts functionality; decide whether it fits your risk.', 'https://support.apple.com/en-us/105120'),
+  ] },
+  android: { name: 'Android', limitations: ['Native property checks require an existing authorized ADB session or an Android runtime', 'Property reads are not hardware attestation and cannot prove a rooted device is trustworthy'], checks: [
+    check('updates', 'OS, security patch and system updates reviewed', 'Review Settings → About phone/tablet → Android version and System → Software updates. Check OS, security-patch and system-update status plus your manufacturer support period.', android),
+    check('screen-lock', 'Strong screen lock and automatic locking', 'Review Security & Privacy → Device unlock / Screen lock. Use a strong unique PIN or password with automatic locking; never enter it in this assessment.', android),
+    check('app-protection', 'App protection and certification reviewed', 'On devices with Google Play, review Play Store → profile → Play Protect and Settings → About → certification. On another distribution, review its documented equivalent; do not assume Play services exist.', 'https://support.google.com/googleplay/answer/2812853'),
+    check('boot-integrity', 'Boot integrity and modifications reviewed', 'Review boot warnings and manufacturer bootloader/root status. Do not relock or flash a bootloader from this tool: those changes can erase data or prevent booting.', 'https://source.android.com/docs/core/architecture/bootloader/locking_unlocking'),
+    check('debugging', 'Debugging and unknown-app installation restricted', 'Review Developer options → USB/Wireless debugging and per-app Install unknown apps permissions. Revoke unneeded debugging authorizations; do not enable debugging solely for a security scan.', android),
+    check('permissions', 'Accessibility, device-admin and app access reviewed', 'Review Privacy & Security, Accessibility services, Device admin apps and special app access. Investigate unrecognized administrators or services before making changes.', android),
+    check('account-recovery', 'Account recovery and lost-device access reviewed', 'Review your account security, two-factor authentication and supported lost-device location/lock features. Confirm recovery access without recording keys or codes.', android),
+    check('network', 'Wi-Fi, hotspot and VPN access reviewed', 'Remove untrusted saved Wi-Fi networks, restrict hotspot access and inspect VPN permissions. Inspect router firmware, management and wireless encryption separately.', android),
+  ] },
+  chromeos: { name: 'Chromebook / ChromeOS', limitations: ['Linux development-container checks do not measure the ChromeOS host', 'Verified Access and enterprise device-management APIs are not connected'], checks: [
+    check('updates', 'OS update and support expiration reviewed', 'Open Settings → About ChromeOS → Check for updates and Additional details → Update schedule. Confirm the model still receives security updates and restart to complete pending updates.', chrome),
+    check('verified-boot', 'Verified boot and developer mode reviewed', 'Review boot warnings and developer-mode state. Preserve normal verified boot for everyday use. Leaving developer mode can erase local data; back up and follow the model-specific recovery procedure.', 'https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot/'),
+    check('screen-lock', 'Screen lock and account authentication reviewed', 'Review Security and Privacy → Lock screen and sign-in. Require authentication after sleep; protect the account with a passkey or two-factor authentication.', chrome),
+    check('extensions', 'Browser extensions and site permissions reviewed', 'Review Chrome extensions and Safety Check. Remove unrecognized extensions and restrict site camera, microphone, notification and location permissions.', 'https://support.google.com/chrome/answer/3014197'),
+    check('containers', 'Linux/Android environments and sharing reviewed', 'Review Linux development-environment shared folders, forwarded ports and Android app permissions. Audit each container separately; its results cannot certify the host.', 'https://support.google.com/chromebook/answer/9145439'),
+    check('management', 'Device management and account access recognized', 'Review device management, signed-in accounts and administrator policies. Investigate unfamiliar control without removing legitimate managed configuration.', 'https://support.google.com/chrome/a/answer/1375678'),
+    check('network', 'Wi-Fi and private-service exposure reviewed', 'Review saved networks, VPN access, device sharing and container port forwarding. Inspect router access and encryption separately; mesh connectivity alone proves no security posture.', chrome),
+  ] },
+  windows: { name: 'Windows', limitations: ['Guided review is separate from the native machine collector', 'No administrative changes are applied by this assessment'], checks: [
+    check('updates', 'Supported Windows release and updates reviewed', 'Open Settings → Windows Update. Install available updates and confirm support or extended-security entitlement for this exact release. Update-service presence alone is insufficient.', windows),
+    check('antivirus', 'Active antivirus provider and real-time protection reviewed', 'Review Windows Security → Virus & threat protection, active security providers, real-time protection and definition updates. A disabled built-in provider may require reviewing another installed provider.', windows),
+    check('firewall', 'Firewall profiles and inbound rules reviewed', 'Review Windows Security → Firewall & network protection for Domain, Private and Public profiles and their rules. Preserve verified administrative access before changing rules.', windows),
+    check('encryption', 'Disk encryption and recovery custody reviewed', 'Review Device encryption or BitLocker, protection state and recovery-key custody. Never paste a recovery key in this assessment; enabling encryption needs a verified backup and recovery plan.', windows),
+    check('boot-integrity', 'Secure Boot and hardware protection reviewed', 'Review System Information and Windows Security → Device security. Firmware/boot changes require hardware-specific instructions and recovery access.', windows),
+    check('screen-lock', 'Sign-in, lock and account privilege reviewed', 'Review Accounts → Sign-in options, automatic locking and local administrator membership. Use strong authentication and least privilege.', windows),
+    check('network', 'Remote access and listening services reviewed', 'Review Remote Desktop, OpenSSH, file sharing and native machine listener findings. Remove unneeded exposure while retaining a tested management path.', windows),
+  ] },
+};
+profiles['chromeos-flex'] = { ...profiles.chromeos, name: 'ChromeOS Flex', limitations: [...profiles.chromeos.limitations, 'Flex has different boot-security and hardware guarantees from Chromebook hardware'], checks: profiles.chromeos.checks.filter(item => item.id !== 'verified-boot' && item.id !== 'containers').concat([
+  check('boot-integrity', 'UEFI Secure Boot and hardware support reviewed', 'Follow the certified-device guidance for UEFI Secure Boot. ChromeOS Flex does not provide Chromebook hardware verified-boot guarantees; do not equate those protections.', 'https://support.google.com/chrome/a/answer/11542901'),
+]) };
+
+export function normalizePlatform(value) {
+  const aliases = { iphone: 'ios', ipad: 'ipados', chromebook: 'chromeos', win32: 'windows' };
+  const platform = aliases[value] || value;
+  if (!Object.hasOwn(profiles, platform)) throw new Error('Unknown device platform');
+  return platform;
+}
+export function deviceProfile(value) {
+  const platform = normalizePlatform(value);
+  return structuredClone({ schema: 'security-device-profile/v1', platform, ...profiles[platform], evidence: 'user-attested', instructions: 'Check each item on the named device. Unknown is an honest result. Never enter passwords, recovery keys or provider tokens.', outcomes: ['secure', 'needs-attention', 'unknown'] });
+}
+export function platformInventory() {
+  return { schema: 'security-platforms/v1', timestamp: new Date().toISOString(), platforms: [
+    { platform: 'darwin', name: 'macOS', automatic: 'native machine collector' },
+    { platform: 'linux', name: 'Linux', automatic: 'native runtime collector; containers do not certify hosts' },
+    { platform: 'windows', name: 'Windows', automatic: 'native PowerShell collector', guided: true },
+    { platform: 'android', name: 'Android', automatic: 'limited properties through authorized ADB or Android runtime', guided: true },
+    { platform: 'chromeos', name: 'Chromebook / ChromeOS', automatic: null, guided: true },
+    { platform: 'chromeos-flex', name: 'ChromeOS Flex', automatic: null, guided: true },
+    { platform: 'ios', name: 'iPhone', automatic: null, guided: true },
+    { platform: 'ipados', name: 'iPad', automatic: null, guided: true },
+  ], limitations: ['Guide availability is not automatic device inspection', 'Native Windows and Android collectors require live device verification; fixtures alone do not certify hardware'] };
+}
+export function assessDevice(input, { now = Date.now() } = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(key => !['platform', 'deviceId', 'observations'].includes(key))) throw new Error('Unexpected device assessment fields');
+  const profile = deviceProfile(input.platform);
+  if (typeof input.deviceId !== 'string' || !/^[\p{L}\p{N} ._()-]{1,80}$/u.test(input.deviceId)) throw new Error('A bounded device label is required; do not include secret material');
+  const observations = input.observations === undefined ? {} : input.observations;
+  if (!observations || typeof observations !== 'object' || Array.isArray(observations) || Object.keys(observations).some(id => !profile.checks.some(item => item.id === id))) throw new Error('Unknown check identifiers');
+  const checks = profile.checks.map(item => {
+    const observation = observations[item.id];
+    if (Object.hasOwn(observations, item.id) && (!observation || typeof observation !== 'object' || Array.isArray(observation) || Object.keys(observation).some(key => !['status', 'observedAt'].includes(key)) || !profile.outcomes.includes(observation.status))) throw new Error('Invalid observation; only status and observation time are accepted');
+    if (observation && (typeof observation.observedAt !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(observation.observedAt))) throw new Error('An ISO UTC observation timestamp is required');
+    const age = observation ? now - Date.parse(observation.observedAt) : NaN;
+    const fresh = Number.isFinite(age) && age >= -5000 && age <= 86400000;
+    return { ...item, state: !fresh || observation.status === 'unknown' ? 'unverified' : observation.status === 'secure' ? 'user-confirmed' : 'fail', evidence: observation && fresh ? 'user-attested' : 'none', observed_at: observation && fresh ? observation.observedAt : null, ...(observation && !fresh ? { reason: 'missing-stale-or-invalid-observation-time' } : {}) };
+  });
+  const reviewed = checks.filter(item => item.state !== 'unverified').length;
+  return { schema: 'security-device/v1', platform: profile.platform, name: profile.name, device_id: input.deviceId, timestamp: new Date(now).toISOString(), status: checks.some(item => item.state === 'fail') ? 'at-risk' : reviewed !== checks.length ? 'incomplete' : 'reviewed', verification: 'user-attested-not-automatically-verified', coverage: { complete: false, automatic: 0, reviewed, total: checks.length, manual_complete: reviewed === checks.length }, limitations: profile.limitations, checks };
+}