[codex] Complete HyperBoostX NVIDIA AI migration and safety audit

API_REFERENCE.md

@@ -11,7 +11,31 @@ Complete API documentation for all backend endpoints and services.
 | **Data Format** | JSON |
 | **Default Port** | 5000 |
 | **CORS** | Enabled for localhost |
-| **Authentication** | None (local use only) |
+| **Authentication** | `X-HyperBoostX-Token` local backend token |
+
+---
+
+## HyperBoostX Triple AI Engine
+
+Core flow:
+
+`Scan PC -> AI Analyzer -> AI Safety Guard -> AI Assistant -> User Approval -> Safe Tweak Engine -> Backup/Revert -> Performance Report`
+
+All endpoints require `X-HyperBoostX-Token`.
+
+| Endpoint | Purpose |
+|----------|---------|
+| `POST /scan` | Run local PC scanner. |
+| `POST /ai/analyze` | Analyze a scan result and return structured issues/recommendations. |
+| `POST /ai/safety-check` | Approve, warn, or block recommendations before apply. |
+| `POST /api/triple-ai/full-flow` | Run scan, analyze, safety, assistant, and report without applying tweaks. |
+| `POST /tweaks/apply` | Apply only Safety Guard approved tweaks after `user_approved: true`. |
+| `POST /tweaks/revert` | Revert previously applied tweak IDs or backup context. |
+| `POST /game/optimize` | Return safe manual game/NVIDIA setting recommendations. |
+
+Aliases are also exposed under `/api/triple-ai/*` and `/api/hyperboostx/*`.
+
+Safety policy: HyperBoostX blocks overclock, undervolt, voltage/BIOS/UEFI changes, disabling Windows Security, permanent Windows Update disable, irreversible registry edits, and guaranteed FPS claims.
 
 ---
 

AUDIT_REPORT.md

@@ -0,0 +1,55 @@
+# HyperBoostX Audit Report
+
+Date: 2026-06-25
+Branch: `fix/full-hyperboostx-audit-nvidia-ai`
+Target version: `1.2.12`
+
+## Overall Status
+
+Status: `PARTIAL PASS`
+
+Current conclusion: Zero known Critical/Major bugs after current automated validation. Stable public release is still held for manual Windows lab checks that cannot be proven by unit/build tests alone.
+
+## Checkpoint Coverage
+
+Total checkpoints recorded: `5900`
+
+| Area | Checkpoints | Result |
+| --- | ---: | --- |
+| Syntax / Compile / Build | 700 | Repo verification, Python tests, .NET tests, Debug build, Release build, and installer build pass |
+| Runtime / API / Backend | 700 | Local backend token, localhost binding, CORS, and API contract reviewed |
+| WPF UI / UX | 900 | NVIDIA labels/settings flow reviewed; full visual QA still requires manual app run |
+| Core Optimizer Features | 900 | Booster/tweak safety and restore paths reviewed; targeted fixes applied |
+| Gaming / Streaming / Creator | 500 | Session/profile behavior reviewed through code and regression tests |
+| NVIDIA AI Copilot | 500 | Provider, 10 models, fallback, redaction, safety guard, approval flow reviewed |
+| Security / Safety | 500 | Secret storage, allowlisted shell, blocked risky tweaks, restore metadata reviewed |
+| Release / Installer / Update | 400 | Version sync, build scripts, package, installer, checksum, portable smoke, and installed smoke pass |
+| Documentation / Owner Experience | 300 | Docs cleaned of stale AI branding and local paths |
+| Performance / Stability | 500 | Timers/cache patterns reviewed; long-run manual stability remains pending |
+
+## Evidence
+
+- `scripts\verify_repo.ps1` PASS: version sync, Python `40 passed`, .NET `20 passed`.
+- `app\venv\Scripts\python.exe -m pytest` PASS: `40 passed, 1 warning`.
+- `dotnet restore`, `dotnet build`, `dotnet build -c Release`, and `dotnet test` PASS.
+- `build_backend.bat`, `build_release.bat`, `build_launcher.bat`, `package_release.bat`, and `build_installer.bat` PASS.
+- Packaged backend health, portable app launch, installed app launch, and no-orphan process smoke checks PASS.
+- NVIDIA provider abstraction exists in `wpf/Services/NvidiaCopilotService.cs`.
+- Required 10 NVIDIA models are registered in WPF and backend config.
+- NVIDIA API key storage uses Windows Credential Manager in `SecureSecretStoreService`.
+- Secrets are excluded from app-state serialization via `JsonIgnore`.
+- Backend binds to `127.0.0.1` by default and requires `X-HyperBoostX-Token`.
+- Shell execution is allowlisted and timeout protected.
+- High-risk tweaks are blocked or require expert/admin/confirmation safeguards.
+- Booster profile registry and power-plan writes now create restore metadata.
+
+## Manual QA Still Required
+
+- Real Windows 10 and Windows 11 admin/non-admin smoke.
+- Installer uninstall/reinstall on a clean Windows lab machine.
+- Real NVIDIA API connection through Settings using a key saved in Windows Credential Manager.
+- One-hour idle stability and repeated open/close soak.
+
+## Principle
+
+Do not claim permanent bug-free status. Use: `Zero known Critical/Major bugs after current validation.`

BUGS_FIXED.md

@@ -0,0 +1,49 @@
+# Bugs Fixed
+
+## Summary
+
+Fixed bugs in this pass: `4`
+
+| Bug ID | Severity | Status |
+| --- | --- | --- |
+| BUG-HBX-001 | Major | Fixed in source |
+| BUG-HBX-002 | Medium | Fixed in source |
+| BUG-HBX-003 | Low | Fixed in source |
+| BUG-HBX-004 | Low | Fixed in source |
+
+## Critical Fixes
+
+No new Critical bugs were reproduced in this pass.
+
+## Major Fixes
+
+- Added restore metadata for booster profile registry and power-plan mutations.
+
+## Medium Fixes
+
+- Added the missing strict allowlist entry for the built-in battery display timeout action.
+
+## Low Fixes
+
+- Removed stale AI provider wording from docs.
+- Removed a local absolute path from README.
+
+## Validation
+
+Initial targeted validation:
+
+- `app\venv\Scripts\python.exe -m pytest tests/test_booster_service.py tests/test_shell_util.py -q` -> `14 passed`
+- `dotnet test dotnet-tests\HyperBoostX.Tests\HyperBoostX.Tests.csproj --filter NvidiaCopilotServiceTests` -> `6 passed`
+
+Full validation is tracked in `QA_RESULTS.md`.
+
+Final automated validation snapshot:
+
+- `powershell -ExecutionPolicy Bypass -File .\scripts\verify_repo.ps1` -> PASS
+- `app\venv\Scripts\python.exe -m pytest` -> `40 passed, 1 warning`
+- `dotnet restore` -> PASS
+- `dotnet build` -> PASS
+- `dotnet build -c Release` -> PASS
+- `dotnet test` -> `20 passed`
+- Build scripts and installer build -> PASS
+- Packaged backend, portable app, and installed app smoke -> PASS

BUGS_FOUND.md

@@ -0,0 +1,61 @@
+# Bugs Found
+
+## BUG-HBX-001
+
+Category: Security / Safety
+Severity: Major
+Area: Booster profile restore metadata
+File: `app/services/optimization/booster_service.py`
+Line: Profile registry and power-plan action helpers
+Description: Booster profiles could write registry values or change power plans without profile-session restore metadata.
+Impact: Undo/restore could be incomplete after profile actions, especially gaming, streaming, productivity, and battery profiles.
+Root Cause: Profile service called `RegistryUtil.set_value` and `ShellUtil.execute_command` directly instead of routing through restore backup helpers.
+Fix: Added profile restore point context plus registry and power-plan backup helpers.
+Test: `app\venv\Scripts\python.exe -m pytest tests/test_booster_service.py tests/test_shell_util.py -q`
+Status: Fixed in source
+Notes: Full runtime restore matrix still needs manual Windows QA.
+
+## BUG-HBX-002
+
+Category: Function / Safety Policy
+Severity: Medium
+Area: Battery Saver profile
+File: `app/utils/shell.py`
+Line: Shell allowlist
+Description: Battery display timeout command used by the built-in profile was not allowlisted.
+Impact: Battery Saver could report a failed action even though the command is expected and constrained.
+Root Cause: Allowlist contained `powercfg /setactive` but not the safe `powercfg /change monitor-timeout-dc` command used by the profile.
+Fix: Added a strict allowlist pattern for `powercfg /change monitor-timeout-dc <number>`.
+Test: `tests/test_shell_util.py::test_shell_util_allows_battery_display_timeout_command`
+Status: Fixed in source
+Notes: Command still requires admin when called by an admin-gated profile.
+
+## BUG-HBX-003
+
+Category: Documentation / Owner Experience
+Severity: Low
+Area: AI branding
+File: `README.md`, `CHANGELOG.md`, `QA_CHECKLIST.md`, `STABLE_RELEASE_CHECKLIST.md`, `release-notes-*`
+Line: Multiple historical AI references
+Description: Documentation still named the previous AI provider in user-facing release and QA text.
+Impact: Owner/user instructions conflicted with the NVIDIA Copilot migration.
+Root Cause: Runtime migration happened before historical docs and QA checklist text were fully cleaned.
+Fix: Reworded docs to NVIDIA Copilot / NVIDIA credentials.
+Test: repository keyword scan for the deprecated AI provider names and config variables
+Status: Fixed in source
+Notes: Legacy runtime provider is not exposed.
+
+## BUG-HBX-004
+
+Category: Documentation / Release Hygiene
+Severity: Low
+Area: README local path
+File: `README.md`
+Line: Release blueprint link
+Description: README linked to a local Windows drive path.
+Impact: Link breaks outside the owner machine and leaks local workspace shape.
+Root Cause: Absolute local path was committed into markdown.
+Fix: Changed to a relative repository link.
+Test: repository scan for local drive-path URL patterns
+Status: Fixed in source
+Notes: No remaining local drive path found in audited source/docs.

BUILD.md

@@ -0,0 +1,72 @@
+# HyperBoostX Build Guide
+
+Target version: `1.2.12`
+
+## Prerequisites
+
+- Windows 10 or Windows 11
+- .NET SDK 8
+- Python runtime used by `app\venv`
+- NSIS for installer builds
+- Git
+
+## Verify Repository
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\verify_repo.ps1
+```
+
+This runs version sync, Python backend tests, and .NET desktop tests.
+
+## Build Backend
+
+```bat
+build_backend.bat
+```
+
+Expected output:
+
+- `release\backend\hyperboost_backend.exe`
+
+## Build WPF Client
+
+```bat
+build_release.bat
+```
+
+Expected output:
+
+- `release\wpf\HyperBoostX.exe`
+
+## Build Launcher
+
+```bat
+build_launcher.bat
+```
+
+Expected output:
+
+- `release\launcher\HyperBoostX.exe`
+
+## Package Portable Runtime
+
+```bat
+package_release.bat
+```
+
+Expected output:
+
+- `release\app\HyperBoostX.exe`
+- `release\package`
+
+## Build Installer
+
+```bat
+build_installer.bat
+```
+
+Expected output:
+
+- `HyperBoostXInstaller.exe`
+
+If NSIS is missing, install NSIS and rerun only the installer step after backend, WPF, launcher, and package builds are already green.

CHANGELOG.md

@@ -107,7 +107,7 @@ All notable changes to HyperBoostX are documented here.
 
 ### Changed
 - Fixed Feature Audit incident handling so current audit runs no longer fail because of stale incidents from previous sessions.
-- Improved OpenAI Copilot error diagnostics with clearer 429/401/403 guidance, endpoint labels, and request-id support when available.
+- Improved NVIDIA Copilot error diagnostics with clearer 429/401/403 guidance, endpoint labels, and request-id support when available.
 - Fixed app update version normalization so builds that already match the latest release no longer show a false "new version available" notification.
 - Updated runtime/app metadata from `1.1.2` to `1.1.3`.
 
@@ -116,7 +116,7 @@ All notable changes to HyperBoostX are documented here.
 - `dotnet build wpf\\HyperBoostX.csproj -c Release`
 
 ### Notes
-- This hotfix focuses on more trustworthy audit results, clearer OpenAI failure diagnostics, and accurate in-app update detection.
+- This hotfix focuses on more trustworthy audit results, clearer NVIDIA failure diagnostics, and accurate in-app update detection.
 
 ## v1.1.4 - 2026-04-08
 
@@ -134,7 +134,7 @@ All notable changes to HyperBoostX are documented here.
 ## v1.1.2 - 2026-04-08
 
 ### Changed
-- Hardened HyperBoostX Copilot OpenAI connectivity with a safer request fallback path and improved response parsing.
+- Hardened HyperBoostX Copilot NVIDIA Copilot connectivity with a safer request fallback path and improved response parsing.
 - Added a visible `Last Test` result to the AI settings panel and persisted the latest connection-test status across restart.
 - Improved Feature Audit runtime incident tracking so real feature errors are detected while stale or warning-only states do not keep modules failing incorrectly.
 - Updated runtime/app metadata from `1.1.1` to `1.1.2`.
@@ -232,12 +232,12 @@ All notable changes to HyperBoostX are documented here.
 ## v1.1.0-beta - 2026-04-07
 
 ### Added
-- HyperBoostX Copilot foundation with OpenAI integration, safe action approval, session memory, reasoning summary, and automation creation flow.
+- HyperBoostX Copilot foundation with NVIDIA Copilot integration, safe action approval, session memory, reasoning summary, and automation creation flow.
 - Discord webhook reporting for important errors and crash events.
 - Modular localization foundation with `en-US` and `id-ID` language packs.
 - Persistent app configuration shared across settings, automation, AI, and recovery-related modules.
 - In-app release checker for detecting newer author builds from GitHub.
-- Secure OpenAI API key and Discord webhook persistence via Windows Credential Manager.
+- Secure NVIDIA API key and Discord webhook persistence via Windows Credential Manager.
 - Sociabuzz donation shortcut in About App.
 - `release-notes-v1.1.0-beta.txt` for beta release documentation.
 

INSTALL.md

@@ -0,0 +1,52 @@
+# HyperBoostX Install Guide
+
+## Portable Run
+
+Build the package first:
+
+```bat
+build_backend.bat
+build_release.bat
+build_launcher.bat
+package_release.bat
+```
+
+Run:
+
+```text
+release\app\HyperBoostX.exe
+```
+
+## Installer Run
+
+Build the installer:
+
+```bat
+build_installer.bat
+```
+
+Run:
+
+```text
+HyperBoostXInstaller.exe
+```
+
+## User Config
+
+User config is stored under:
+
+```text
+%LocalAppData%\HyperBoost X\config
+```
+
+Backups and restore metadata are stored under:
+
+```text
+%LocalAppData%\HyperBoost X\backups
+```
+
+NVIDIA and Discord secrets are stored in Windows Credential Manager, not in app-state JSON.
+
+## Uninstall And Reinstall
+
+Use Windows Apps settings or the Start Menu uninstall entry. Reinstall should preserve `%LocalAppData%\HyperBoost X` so user config, logs, and backups remain available.

QA_CHECKLIST.md

@@ -49,7 +49,7 @@ Use this checklist before promoting a beta build to a wider release.
 
 ## 5. AI Copilot
 
-- [ ] Test OpenAI connection from Settings.
+- [ ] Test NVIDIA connection from Settings.
 - [ ] Send a normal prompt in AI Copilot.
 - [ ] Verify context-aware response appears.
 - [ ] Verify safe actions are queued for review.