Consolidate all branches onto main, fix pre-existing failures, and implement the missing planned modules

[lizTheDeveloper]

Consolidates the three diverged branches onto main, greens a suite that had 64 failures, and implements the six planned modules the roadmap named but never built.

Full suite: 3503 passed, 0 failed (from 64 failed / 3341 passed). Registry discovers 278 modules. rescue/security/integrity_manifest.json verifies clean.

Branch consolidation

main could not merge any of the three branches: they have completely unrelated histories, no common ancestor at all. main's own root commit is a mid-stream feature commit, so it looks like a re-rooted snapshot rather than a continuation.

Rather than force a ~400-file conflict through --allow-unrelated-histories, I compared the trees:

Branch	Files missing from main
wip-checkpoint-2026-07-16	0 — fully subsumed
feat/core-framework	0 — fully subsumed
claude/bloatware-spyware-remediation-0mbzkb	43, in 3 commits

Only the third carried unique content, so those 3 commits are cherry-picked here (cryptojacking IOC pack, stalkerware_scan, LAN inventory / ARP-spoof / router-security modules, and the home_network_intrusion and identity_theft_recovery profiles and guides). git diff against every branch tip now reports zero missing files, and the merge introduced zero regressions.

This makes PR #3 redundant — its content is fully contained here, and its base branch is one of the branches being retired.

Audit findings

Several of these contradicted docs/ROADMAP_STATUS.md, which is corrected in a dated section rather than edited in place, so what was previously believed stays legible.

Python 3.11 support was broken, not partially broken. pyproject.toml declares >=3.11, but:

• 3 files did not parse on 3.11 (PEP 701 nested-quote f-strings; a backslash inside an f-string expression). Two were shipped modules, so module discovery broke. The bloatware branch had already fixed these independently — one concrete reason the consolidation mattered.
• 30 call sites across 16 modules passed follow_symlinks= to pathlib.Path.is_file()/is_dir(). That keyword arrived in 3.13, so every one raised TypeError at runtime. Those modules did not work on two of the three supported versions.

rescue.fsbounds now exposes is_file_nofollow / is_dir_nofollow, which get the same no-follow semantics from os.lstat everywhere. fsbounds' own follow_symlinks arguments are deliberately untouched — those are os.DirEntry from os.scandir, where the keyword has always been valid.

The integrity manifest was invalid on main — 8 tampered, 5 added files, so startup verification failed and every launch printed a tamper warning. ROADMAP_STATUS.md recorded this as verifying clean; the regeneration was real but happened on the other lineage, and main's commits then added remediation.py, serialize.py, threat_map.py and two TUI screens without regenerating. Fixed.

There is no CI. No .github/ directory exists. A matrix that actually ran the suite on 3.11 would have caught the largest defect in the tree.

Verified healthy, for balance: auto_apply = True appears in zero modules, so auto mode genuinely is read-only as P0#5 intends; no NotImplementedError stubs or placeholder TODOs; the only skipped tests are correctly conditional on gpg; 272 pre-existing modules discover cleanly with no duplicate names; and both setup.py and rescue.spec glob the content directories, so new modules ship without packaging changes.

The 64 failures were environment coupling, not flakiness

Every one was a test that silently depended on the machine it ran on, so the suite only passed on one developer's macOS box:

• 7 + 1 + 1 — notification_center_check, kext_audit, appleid_security_check each check a real path under ~/Library or /Library and return early if absent, so check() short-circuited before the mocked subprocess was reached. appleid additionally needed a real plist on disk, since patching plistlib.load still left open() to fail.
• 2 — a time bomb. win_safe_mode_check used absolute dates chosen to be "5 days ago" when written; real time moved past them and the fixture aged into a >30-day uptime, tripping the warning it asserts is absent. Fixtures are now relative.
• 1 — disk_permissions_repair asserted ownership against a hardcoded uid 501, so it only passed as a typical macOS user. It now derives the uid from the process, with /usr/local given a separate non-root uid: "correctly owned" means the running user for a home directory but explicitly not root for /usr/local, which one uid cannot express when running as root.
• 3 — CliRunner(mix_stderr=...), removed in click 8.2.
• 1 — update/test_verify signed a tag without pinning gpg.format, so on a host configured for SSH commit signing it produced an SSH signature while asserting on the GPG path. No trust check was weakened to green this: git verify-tag detects signature type on its own, the verification code was correct, and only the test changed.
• ~45 — the follow_symlinks breakage above.

The fix pattern is now a convention: a module's traversal roots are class attributes so tests can point them at a fixture tree.

Desktop IPC hardening

ipcMain.handle('open-setting', …) passed any renderer-supplied string straight to shell.openExternal, which hands the URL to the OS handler.

The renderer escapes all scan output, so there is no live injection path today. But the URLs it opens come from permissions-content.json — precisely the kind of data file the signed-content-update mechanism exists to replace. Left unrestricted, the channel turns "attacker influences shipped content" into "attacker launches local files and registered protocol handlers", a bad trade for a tool people run on machines they already suspect are compromised.

The walkthrough only opens OS settings panes, so this is an allowlist of scheme prefixes rather than sanitisation — allowlists have no parser differentials, and matching is startsWith so an allowed scheme embedded later in a file:// URL does not qualify it. Also sets sandbox: true, denies window.open, and blocks navigation. The predicate lives in desktop/setting-urls.js so it is testable without booting Electron, and package.json gains the test script the desktop app was missing.

Planned modules

Resolved against the roadmap, not guessed. Profiles, guides and the threat map reference no missing modules, and every module named in docs/superpowers/plans/ exists. Two sources yielded real gaps:

Module	Source	Why it exists
password_manager_check	P0#8	Named, never built
twofa_audit	P0#8	Named, never built
session_revocation_scan	P0#8	Named, never built
code_signature_audit	P2 "Trust and reputation verification"	No signature validation existed
security_baseline_diff	P2 "Baselines and differential scans"	No baseline capability existed
evidence_bundle	P2 "Evidence collection and forensic handoff"	Nothing preserved evidence before repair

P0#8's three were recorded as "done" because the profile was made valid by deleting the references — the capability was never built.

All six are read-only, guidance-only (ActionKind.GUIDANCE, no auto_apply), read no secret of any kind, and bound their filesystem and command work. Three design points worth review attention:

• twofa_audit refuses to overclaim. A local tool cannot know whether 2FA is on at your provider; confirming it means signing in. So it reports what it observes and marks account status NOT CHECKED, and absence of evidence is reported as unknown, never as "two-factor is off". There is a test asserting it can never collapse to False.
• security_baseline_diff is deliberately asymmetric. New persistence/port/extension warns; removals do not. Protection going on → off is CRITICAL; off → on is silent. Symmetric reporting buries the four changes that matter under forty that do not. Every finding states the trust-on-first-use limit, and a protection that merely became unqueryable is never reported as disabled — both tested.
• evidence_bundle.check() writes nothing. Creating files is a real effect and belongs behind an explicit human decision. Its bundle is redacted by construction, hashes every item, records what it omitted and why, and has no network path. A test asserts no collection command can read a credential store.

digital_security_reset now includes these with evidence_bundle first, and its description no longer claims the password-manager/2FA/session steps are entirely human-led — the device-side half is real now, while the provider-side work stays human-led.

Test plan

• Full suite before and after each stage, with counts reported rather than summarised: 3503 passed, 0 failed.
• grep -rnE '\.(is_file|is_dir)\(follow_symlinks' modules/ returns nothing.
• Every new module confirmed discoverable via discover_modules; tests/test_all_shipped_content.py, tests/test_remediation_validation.py and tests/test_module_code_consistency.py all pass. That last one caught a real defect during development — codes built with an f-string instead of code="..." literals — which is fixed.
• python3 scripts/generate_integrity_manifest.py then verify_package_integrity → clean.
• node --test in desktop/ → 7 passing.

Follow-ups not in this PR

• Retire wip-checkpoint-2026-07-16, feat/core-framework and claude/bloatware-spyware-remediation-0mbzkb after this merges, and close the now-redundant PR Cryptojacking, home-network intrusion, stalkerware, and identity theft recovery #3.
• Add CI. This is the highest-value remaining gap — a 3.11 matrix would have caught the largest defect here.
• P0#7 command-runner migration: 756 subprocess.run calls in modules, 0 through rescue.command.run, 435 without timeouts. The roadmap counted 744/395 — both have grown.
• emits_codes migration: 169 of 272 pre-existing modules declare none.

Both migrations are large mechanical sweeps that deserve their own PRs.