Ship versioned Authority host and functional Settings UI

.github/workflows/ci.yml

@@ -52,6 +52,8 @@ jobs:
         run: |
           $Installer = Get-Content authority-host/windows/install.ps1 -Raw
           [void][scriptblock]::Create($Installer)
+          $ReleaseInstaller = Get-Content authority-host/windows/install-release.ps1 -Raw
+          [void][scriptblock]::Create($ReleaseInstaller)
 
       - name: Restore Windows authority host in locked mode
         if: runner.os == 'Windows'

.github/workflows/release.yml

@@ -72,10 +72,58 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+  authority_host:
+    name: Build Windows authority host release asset
+    needs: validate
+    runs-on: windows-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+
+      - name: Resolve release version
+        id: release_version
+        shell: pwsh
+        run: |
+          $Version = (Get-Content package.json -Raw | ConvertFrom-Json).version
+          if ($Version -notmatch '^\d+\.\d+\.\d+$') { throw 'package version must be semantic x.y.z' }
+          "version=$Version" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+
+      - name: Restore and publish Windows authority host
+        shell: pwsh
+        run: |
+          $Project = 'authority-host/windows/GitHubDeliveryAuthority/GitHubDeliveryAuthority.csproj'
+          $PublishDir = Join-Path $env:RUNNER_TEMP 'github-delivery-authority-publish'
+          dotnet restore $Project --locked-mode
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          dotnet publish $Project --configuration Release --runtime win-x64 --self-contained true --no-restore --output $PublishDir
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          node scripts/build-authority-host-release.mjs --publish-dir "$PublishDir" --out-dir "dist/authority-host" --version "${{ steps.release_version.outputs.version }}" --source-commit "${{ github.sha }}"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Upload Windows authority host release subject
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: github-delivery-authority-${{ github.sha }}
+          path: |
+            dist/authority-host/github-delivery-authority-v*.zip
+            dist/authority-host/github-delivery-authority-v*.json
+          if-no-files-found: error
+          retention-days: 14
+
   publish:
     name: Publish attested release
     if: startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-    needs: validate
+    needs:
+      - validate
+      - authority_host
     runs-on: ubuntu-latest
     environment: release
     permissions:
@@ -116,13 +164,24 @@ jobs:
             --ref "${GITHUB_REF}" \
             --source-commit "${GITHUB_SHA}"
 
+      - name: Download Windows authority host release subject
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: github-delivery-authority-${{ github.sha }}
+          path: dist/authority-host
+
       - name: Attest release provenance
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: |
             dist/github-delivery-v*.zip
             dist/github-delivery-v*.tar.gz
 
+      - name: Attest Windows authority host
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: dist/authority-host/github-delivery-authority-v*.zip
+
       - name: Attest release SBOM
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
@@ -152,6 +211,8 @@ jobs:
             dist/manifest.json \
             dist/SHA256SUMS \
             dist/sbom.spdx.json \
+            dist/authority-host/github-delivery-authority-v*.zip \
+            dist/authority-host/github-delivery-authority-v*.json \
             --verify-tag \
             --title "github-delivery ${GITHUB_REF_NAME}" \
             --notes-file dist/RELEASE_NOTES.md

CHANGELOG.md

@@ -4,22 +4,40 @@ All notable changes to `github-delivery` are documented here.
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-08-12
+
 ### Added
 
+- First-class stable Windows Authority-host delivery and Control Center settings.
+  Releases now build a self-contained `win-x64` Authority component from the
+  exact tagged commit, publish versioned ZIP + metadata assets, and attest the
+  archive through the protected `release.yml` identity. Stable `setup`,
+  `doctor`, and `update --apply` can verify/install/repair/upgrade that component
+  without a local .NET SDK while preserving `authority.db`, `trust-store.json`,
+  and persistent user config. An absent host remains absent when protection is
+  `off`; an already-installed host is kept aligned even when the skill itself
+  is current; ahead hosts are not automatically downgraded. The WinUI Control
+  Center Settings view now writes the existing `off` / `high-assurance` / `all`
+  preference and reports stored/effective mode plus Authority version/source
+  status. `doctor` reports `missing`, `legacy`, `update`, `already_current`, or
+  `already_ahead` component relations and whether the active mode requires the
+  host.
+
 - Verified stable self-update for installed skills. `node scripts/install-skill.mjs
   --update` now performs a non-mutating check against the fixed upstream's
   latest published stable Release, while `--update --apply` reuses the existing
   backup/replacement installer only after release metadata, GitHub asset digests
   when exposed, `SHA256SUMS`, the distribution manifest, tag-to-source-commit
   binding, a workflow/tag/commit-constrained GitHub artifact attestation, and a
   strict bounded ZIP extraction all verify successfully. Local installed
-  modifications block replacement even with `--force`; current/ahead versions
-  are no-ops; update mode cannot use `--source`, `--restore`, or
-  `--allow-downgrade`; post-install manifest verification and persistent user
-  config preservation fail closed and surface the backup path after a completed
-  replacement. `scripts/update-skill.mjs` is now only a compatibility forwarder
-  to the same verified installer path, so there is one release trust chain and
-  one mutation boundary.
+  modifications block skill replacement even with `--force`; an already-ahead
+  skill is a complete no-op, while an already-current skill can still reconcile
+  a stale/legacy Authority component; update mode cannot use `--source`,
+  `--restore`, or `--allow-downgrade`; post-install manifest verification and
+  persistent user config preservation fail closed and surface the backup path
+  after a completed skill replacement. `scripts/update-skill.mjs` is now only a
+  compatibility forwarder to the same verified installer path, so there is one
+  release trust chain and one skill mutation boundary.
 
 - Supersede and maintainer-overtake lifecycle actions. A new
   `references/supersede-pr.md` workflow closes an obsolete open PR in favor of

INSTALL.md

@@ -57,7 +57,7 @@ node scripts/install-skill.mjs --update
 node scripts/install-skill.mjs --update --apply
 ```
 
-The first command is a dry-run. It discovers and fully verifies the latest published stable `Wibias/github-delivery` GitHub Release, compares it with the installed copy, and prints the update plan without replacing the installed skill. Add `--apply` only after inspecting that plan.
+The first command is a dry-run. It discovers and fully verifies the latest published stable `Wibias/github-delivery` GitHub Release, compares it with the installed copy, and prints the update plan without replacing the installed skill. On supported Windows systems it also reports the separately installed Authority-host component plan. Add `--apply` only after inspecting that plan.
 
 Unless `--target` is explicitly provided, release self-update targets the root of the installed bundle that is executing `install-skill.mjs`. The compatibility command below reaches the same implementation and security boundary:
 
@@ -72,11 +72,11 @@ The compatibility wrapper does not contain its own downloader or installer. It f
 
 Self-update accepts only the latest published, non-draft, non-prerelease release from the fixed upstream repository, with a strict `vX.Y.Z` tag. It never falls back to `main`, another branch, a fork, an arbitrary URL, or GitHub's generated source archive.
 
-Self-update never downgrades. If the installed version is already current, or is newer than the latest published stable release, `--apply` is a no-op. `--update` rejects `--source`, `--restore`, and `--allow-downgrade` so those separate local install/recovery controls cannot weaken release provenance.
+Self-update never downgrades the installed skill. An installed skill newer than the latest published stable release is a complete no-op, including Authority reconciliation. If the skill itself is already current, `--update --apply` may still repair or update an installed/required Windows Authority host that is stale or legacy. A versioned Authority host newer than stable is never automatically downgraded. `--update` rejects `--source`, `--restore`, and `--allow-downgrade` so those separate local install/recovery controls cannot weaken release provenance.
 
 ### Verification before replacement
 
-The downloaded release is not trusted merely because it came from a GitHub Release page. Before the existing installer can replace anything, self-update requires the complete chain below:
+The downloaded release is not trusted merely because it came from a GitHub Release page. Before the existing installer can replace anything, self-update requires the complete skill chain below:
 
 1. Valid latest-stable Release metadata and exactly one version-matching ZIP, `manifest.json`, and `SHA256SUMS` asset.
 2. GitHub `sha256:` asset-digest verification for each required asset when GitHub exposes a digest.
@@ -88,15 +88,21 @@ The downloaded release is not trusted merely because it came from a GitHub Relea
 8. Rehashing and byte-count verification of every extracted manifest file before that directory can become an installation source.
 9. Comparison of the current installed payload with its installed manifest. Local tracked modifications block replacement, and `--force` does not bypass this self-update guard.
 
-Redirects remain HTTPS-only and downloads are size bounded. Verification failures occur before the installed skill is replaced.
+Stable GitHub Releases also publish a separately versioned self-contained Windows Authority-host archive plus metadata. When the Authority component needs installation/repair/update, the updater additionally requires exact versioned asset identity, Windows/x64 metadata, metadata SHA-256 equality, the same exact tagged source commit, GitHub asset digest when available, a `release.yml` attestation bound to the same tag/source, and strict bounded Authority ZIP extraction. No unverified Authority binary is installed.
 
-### Apply, backup, and recovery
+Redirects remain HTTPS-only and downloads are size bounded. Verification failures occur before the corresponding installed component is replaced.
 
-For a clean, strictly newer verified release, `--update --apply` passes the verified extracted directory into the existing installer. The existing backup and replacement implementation remains authoritative rather than introducing a second mutation path.
+### Apply, backup, Authority state, and recovery
+
+For a clean, strictly newer verified skill release, `--update --apply` passes the verified extracted directory into the existing installer. The existing backup and replacement implementation remains authoritative rather than introducing a second skill mutation path.
 
 After replacement, self-update verifies that the installed `manifest.json` is exactly the verified release manifest, rechecks every tracked file, and rereads persistent user configuration. The user configuration must remain unchanged.
 
-If replacement succeeded but a post-install verification fails, the command fails instead of claiming success and reports the preserved backup path. Restore it with the normal restore command documented below.
+On Windows, the same update operation then reconciles the Authority component when required or already installed. Its verified release runtime is installed beneath `%LOCALAPPDATA%\GitHubDeliveryAuthority\app\vX.Y.Z`; the root `authority-host-install.json` selects the active version. `authority.db`, `trust-store.json`, and `%LOCALAPPDATA%\github-delivery\config.json` are persistent state and are not release-owned files, so Authority replacement preserves them. A configured install whose executable is missing is repaired rather than mistaken for a deliberate absence.
+
+If the effective protection mode is `off` and Authority has never been installed, setup/update does not download or install the component. If Authority is already installed, stable update keeps it aligned even while mode is `off`. A host ahead of stable remains untouched.
+
+If skill replacement succeeded but a post-install verification fails, the command fails instead of claiming success and reports the preserved skill backup path. Restore it with the normal restore command documented below. Authority replacement likewise fails closed until its installed version/source metadata and executable verify; `doctor` then exposes any remaining component mismatch rather than reporting a clean fully-current state.
 
 Persistent user settings are not reset or migrated silently. After an update, inspect any new configuration options and decide explicitly whether to adopt them.
 
@@ -208,20 +214,29 @@ Extract an archive and copy the resulting `github-delivery` directory into the h
 
 ## Optional Windows authority host
 
-The optional Windows 11 authority host turns local Windows Hello approvals into short-lived, exact-scope trusted grants for high-assurance mutations. It is not required for ordinary installation and does not automatically enable global strict-authority enforcement.
+The optional Windows 11 Authority host turns local Windows Hello approvals into short-lived, exact-scope trusted grants for high-assurance mutations. It does not automatically enable a stricter global protection mode.
 
-Install it from the repository root with:
+For a normal stable installation, the **guided setup** is managed by the github-delivery bootstrap; do **not** build the Authority host manually. Use:
 
-```powershell
-.\authority-host\windows\install.ps1
+```bash
+npx github-delivery setup
+npx github-delivery doctor
 ```
 
-The installer requires Windows 11 build 22000 or newer and a .NET 8 SDK, then opens a **guided setup**. That flow checks Windows Hello readiness, runs a real verification test, asks for the first trusted repository, and requires a fresh Hello approval before the repository is allowlisted.
+Stable GitHub Releases include a separately verified self-contained Windows Authority-host asset, and the managed setup/update path does **not** require the .NET SDK. The Control Center's **Settings** page exposes **Off**, **Sensitive actions** (recommended), and **Every GitHub write**, backed by the same persistent `authorityMode` configuration used by the CLI.
 
 A **Windows Hello PIN** is sufficient. Biometric hardware is not required when a Hello PIN is available. If Hello is missing or not configured, the setup UI can take you to **Settings > Accounts > Sign-in options** and let you check readiness again.
 
-See [`authority-host/windows/README.md`](authority-host/windows/README.md) for the full prerequisite, recovery, upgrade, and security behavior.
+For repository development or a source build, use:
+
+```powershell
+.\authority-host\windows\install.ps1
+```
+
+That source/development installer requires Windows 11 build 22000 or newer and a .NET 8 SDK. After building locally it delegates deployment to the same state-preserving release installer used by the managed component path.
+
+See [`authority-host/windows/README.md`](authority-host/windows/README.md) for the full stable lifecycle, source prerequisites, recovery, upgrade, Settings, and security behavior.
 
 ## Uninstall
 
-Remove only the installed `github-delivery` directory. Keep its latest backup until the replacement version has completed at least one real workflow successfully.
+Remove only the installed `github-delivery` directory. Keep its latest backup until the replacement version has completed at least one real workflow successfully. If the Windows Authority host is installed, it is a separate stateful component under `%LOCALAPPDATA%\GitHubDeliveryAuthority`; removing the skill directory does not implicitly delete its authority database, trust store, or host installation.