Ship versioned Authority host and functional Settings UI

[Wibias]

Why

The stable updater previously replaced the github-delivery skill directory but did not upgrade the separately installed Windows GitHubDeliveryAuthority.exe. That allowed a current 0.5.x skill installation to keep running an older Authority GUI/runtime. The WinUI Control Center also exposed a Settings destination without a functional editor for the existing protection modes.

What changed

Versioned Authority release component

• Builds GitHubDeliveryAuthority on windows-latest as a self-contained win-x64 release component from the exact tagged source commit.
• Packages a versioned Authority ZIP plus metadata as separate GitHub Release assets; the npm package remains a thin bootstrap and contains no Authority binary.
• Attests the Authority ZIP from the protected release.yml workflow before attaching it to the release.
• Verifies exact version/source identity, GitHub asset digest when available, metadata SHA-256, tagged source commit, release-workflow attestation, and strict bounded ZIP extraction before installation.

State-preserving install / upgrade

• Adds authority-host/windows/install-release.ps1 as the no-.NET stable deployment boundary.
• Uses versioned runtime directories under %LOCALAPPDATA%\GitHubDeliveryAuthority\app\vX.Y.Z plus authority-host-install.json for active-version metadata.
• Preserves authority.db, trust-store.json, and %LOCALAPPDATA%\github-delivery\config.json across upgrades.
• Stops only a running Authority process whose executable resolves inside the selected install root.
• Keeps repository/development install.ps1 as the source-build path; it still requires Windows 11 + .NET 8, then delegates deployment to the same release installer.

Unified setup / update / doctor lifecycle

• off + Authority never installed: no Authority download/install.
• high-assurance or all + missing Authority on supported Windows: verified install/repair.
• Existing or legacy Authority participates in stable alignment even while the current mode is off.
• A configured-but-broken install record whose executable is missing is repaired.
• An Authority host ahead of stable is reported as already_ahead and is never automatically downgraded.
• A skill already at the latest version can still update/repair a stale Authority host, and the update result reports that component change accurately.
• A skill already ahead of stable remains a complete no-op, including Authority reconciliation.
• Unsupported OS + an effective high-assurance / all mode is surfaced as a required-but-unsupported Authority condition instead of being silently treated as harmless.
• doctor reports skill and Authority independently, including requiredByMode and missing, legacy, update, already_current, or already_ahead relations.

Functional WinUI Settings

Control Center > Settings now edits the same persistent user config used by the Node CLI:

• Off -> off
• Sensitive actions -> high-assurance (recommended)
• Every GitHub write -> all

The UI writes the exact lowercase Node-compatible JSON schema, shows stored/effective protection mode plus Authority version/source status, and warns when an environment override makes the effective mode stricter than the stored preference.

Documentation

Updated README, INSTALL, Windows Authority documentation, configuration reference, and Unreleased changelog to describe the managed stable component lifecycle, the no-.NET stable path, Settings UI, and separate doctor status.

Validation

Fresh validation on head 23bf155dd87f9cb215aefc09a4084fb7fe93f529:

• CI: Node 22 + 24 on Ubuntu, macOS, and Windows — all 6 matrix jobs pass.
• Every matrix job passes npm run check and the architecture-contract tests.
• Windows 22 + 24: PowerShell installer syntax, locked .NET restore, WinUI Authority build, and Authority self-test pass.
• Windows / Node 24: self-contained Authority publish passes.
• Architecture Contracts: pass.
• Dependency Review: pass.
• CodeQL: pass.

The implementation remains scoped to Authority release packaging/verification, component install/update/doctor integration, WinUI Settings/version status, associated tests, and user-facing documentation.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.