[rijff24]

This draft turns the preserved Swan-specific baseline into remote support hosted independently by each company. It adds an Axum/SQLite management server with local MFA accounts, groups and device approval; signed company configuration and session authorization; configurable customer and technician editions; Windows packaging workers; administrator-approved updates; and Windows/Linux deployment instructions. The original source remains tagged as swan-single-company-baseline-1.4.9.

Installation and updates verify signed metadata, package hashes, publisher policy and installed identities. Recovery retains verified previous releases, preserves enrollment and consent, quarantines failed releases, and coordinates with session activity. Technician portable removal cancels recovery while retaining company state for explicit reinstall. Optional encrypted deployment backup now includes generated installer artifacts so restored servers retain public customer and authenticated technician downloads.

Validation is recorded by exact source and fixture in docs/ACCEPTANCE.md:

• Native Windows CI run 37103083258 passed all four jobs for 11faae30b0dac275c7d8c795ca3c3c134ded36c9; all 23 archive entries passed authenticated provenance, bounded ZIP/CRC extraction and payload checksums. Its server setup embedded resources, source receipt, six fixed public source inputs and component pins passed verification. Earlier artifacts passed authenticated archive provenance, bounded ZIP/CRC extraction and payload checksums. Server setup resource hashes and fixed public source inputs were verified; its dirty-tree receipt prevents claiming whole-tree cleanliness.
• The same build's native MSVC agent passed twelve offline cached-profile/bootstrap trust checks: valid acceptance plus time, tampering, wrong-key/company, revision replay, and bootstrap company/edition/key/endpoint rejection. Specific errors and unchanged fixture bytes were verified. This is synthetic offline CLI evidence, not rendered branding or a remote session.
• Isolated Server 2016 lab fixtures demonstrated fresh company setup/MFA, worker generation over trusted guest HTTPS, public customer and protected technician downloads, worker revocation, signed profile/endpoint rotation, portable technician installation/repair/removal/reinstall, and native authentication/replay denial. Technician inventory/history were empty; these checks do not prove graphical login or an actual session.
• Lab-signed customer MSI updates committed sequence 7/version 1.5.6, preserved identity and consent, recovered from an interrupted pre-install attempt, and retained state after reboot. Native backup/restore with installer artifacts preserved company trust and authorization state; the current MSVC server also restored four real bundle downloads with matching hashes and denied unauthenticated technician downloads, with unauthenticated technician downloads denied.
• Isolated Linux container and encrypted restore evidence, component tests, ownership guards, negative signature/authorization checks and script checks are documented separately. Lab certificates and mixed-source fixtures are explicitly distinguished from production releases. Host production services, firewall, DNS and trust were not replaced.

The current matched-source MSVC server and worker also generated an eleven-entry technician MSI bundle over trusted guest HTTPS, with matching bootstrap/hash and denied unauthenticated download. The lab fixture retains older signed endpoint/MSI inputs; it is not a production source release. An initial Caddy startup crashed with fatal: morestack on g0; its cause remains unresolved despite a later successful isolated run. A separate failed worker attempt used an unavailable old lab download endpoint; new signed test metadata pointed the successful run to the isolated endpoint without restarting existing services.

Current failed test: the eleven-entry technician MSI bundle reached installation under an actual fresh standard Windows user but returned 1601. Explicit failed-setup retry after starting the guest Windows Installer service returned the same error. Its recovery marker and private diagnostics were retained; temporary SSH test access was removed with original SSH/WinRM access and company service statuses verified. Standard-user MSI installation, repair and uninstall remain unproven.

This PR remains draft. Required release evidence includes the complete Windows 10/11 and Server 2016/2019/2022/2025 Desktop Experience matrix; graphical company/technician flows; real authorized and rejected remote sessions, consent, expiry, UAC/logon, transfer, clipboard and multiple monitors; public direct NAT traversal and relay fallback without Tailscale; complete installer/update interruption and rollback behavior; migration recovery; production signing approval; and exact corresponding release source. No production release or full-product completion is claimed.

Additional changes and verification:

• Server and worker installers enable SCM recovery for reported nonzero error stops. An isolated Server 2016 fixture verified actual restart after an error stop and no restart after a successful stop. Existing product service settings were preserved; fresh product service installation/reboot remains unverified.
• A fresh unsigned server setup package from clean installer checkout 87a1b7f contains the recovery flag and passed embedded payload verification. Its unchanged management runtime is the CI 11faae3 build; this is packaging evidence, not full runtime reproducibility.
• The Windows build now publishes a checksummed exact build-input archive including pinned submodule sources and six generated bridge files. Four focused tests cover private-file exclusion, repeatable archive hashes, submodule pin enforcement, and link rejection. Native Windows build c7d118c passed all four jobs: https://github.com/rijff24/SwanRemoteSupport/actions/runs/37110881152 . The downloaded 24-file artifact passed its authenticated GitHub digest, ZIP CRC and published checksums. The source archive matched 1,101 public Git files and six generated bridge inputs; server setup resource hashes, source inputs and component pins passed. Binary reproducibility and release acceptance remain outstanding.

Technician MSI lifecycle verification passed on a disposable Windows Server 2022 Datacenter runner, build 20348 (run https://github.com/rijff24/SwanRemoteSupport/actions/runs/37112721733). Fixture 76e89b6 used pinned unsigned MSI/application/agent inputs from verified build 11faae3. Actual installation, repair after deleting the owned executable, and uninstall each returned 0. Payload hashes and registry checks passed; retained invocation records and native MSI logs were downloaded and verified against the evidence artifact digest and ZIP CRC. Earlier checksum/invocation fixture failures remain separate evidence.

This proves unsigned MSI payload lifecycle under the CI account. Standard-user company setup, signature acceptance, graphical sessions and the complete Windows compatibility matrix remain unverified. The Server 2016 standard-user MSI error 1601 remains unresolved.

Latest native verification: build 37120044435 passed from 01d24ab, rebuilding the two technician launcher fixes into distribution components. Its independently downloaded evidence archive confirms actual unsigned technician MSI installation, repair and uninstall on Server 2022 Datacenter build 20348, with zero native returns, payload/registration checks, verified artifact digest and ZIP CRC. The six generated bridge inputs also passed independent provenance and integrity checks. Main package download and source/payload verification are pending; these are unsigned test artifacts.

Both component checks at d724321 passed, including the Windows PowerShell launcher cases and Linux deployment/HTTPS/transport/complete encrypted restore rehearsal. The Linux fixture now probes the owned private bridge endpoint, waits for its actual listener, and performs three distinct exports from stopped read-only transport/TLS volumes. The read-only transport WAL regression subsequently reproduced SQLite code 14 and was fixed using private writable staging, retaining committed WAL data without changing the source. Source f71773b passed both full Windows/Linux component runs and deployment restore rehearsals; the regression verifies retained rows, unchanged source bytes and plaintext cleanup. A full native build including this fix is running: 37123744363. Earlier export failures remain historical evidence; their original logs did not identify the failed operation.

The combined development launcher rendered the company technician GUI under the standard lab account using unchanged signed lab binaries and real installed-publisher verification. GUI MFA and native sessions remain unverified because the computer-use helper failed to activate the viewer modal. Public NAT/relay sessions, customer consent/UAC/clipboard/transfer/multi-monitor behavior, the full clean Windows matrix, migration recovery and production signing remain release gates. See docs/ACCEPTANCE.md for exact evidence and scope.