Skip to content

Harden TimePrism project showcase - #2

Draft
Air000000 wants to merge 113 commits into
mainfrom
chore/harden-project-showcase
Draft

Harden TimePrism project showcase#2
Air000000 wants to merge 113 commits into
mainfrom
chore/harden-project-showcase

Conversation

@Air000000

@Air000000 Air000000 commented Sep 8, 2026

Copy link
Copy Markdown
Owner

Scope

Hardens the public TimePrism repository without another broad architecture rewrite, adds explicit first-run tracking consent / persisted pause semantics, improves Idle correction/attribution, and fixes the Windows high-DPI pet prompt clipping found during real installer smoke.

Implemented

  • cleaned Tauri starter metadata and strengthened SQLite lifecycle / legacy migration coverage;
  • corrected fresh category seeds to 学习 / 休息 while narrowly repairing only known mojibake values on existing DBs;
  • added persisted first-run tracking state: fresh DBs start onboarding-incomplete + capture-off; recognizable legacy DBs migrate to onboarded + capture-on without overwriting later explicit choices;
  • made onboarding completion atomically enable capture, moved capture policy out of the sampler, and persisted Pause/Resume across restarts;
  • removed the DB/WebView startup race by creating product WebViews only after DB initialization succeeds; DB init now fails closed;
  • made the desktop pet reflect persisted tracking state while keeping 学 / 休 counters classification-based;
  • added compare-and-clear error ownership so a recovered Home poll cannot erase a newer tracking error;
  • improved Idle correction: the candidate app is anchored to the foreground app at the last real user input, never the app visible when the user returns; app attribution is explicit and preserves the app's existing LEARN / REST / IGNORE rule;
  • simplified Idle choices to Continue <App> / Away / Other… when a candidate exists, or Learn / Break / Away otherwise; Decide later is secondary text;
  • added app_usage_logs.source provenance (FOREGROUND vs IDLE_CONFIRMED) and preserved that evidence boundary during foreground segment coalescing;
  • made provenance migration one-shot so already-migrated history is not rescanned/reclassified on later startup;
  • fixed high-DPI pet prompt clipping: pet runtime size is now 220 x 262 logical pixels in both settle/summon paths instead of PhysicalSize, and tauri.conf.json is aligned to the same logical height;
  • upgraded Windows CI and added draft-first NSIS + MSI packaging validation;
  • updated README/testing/release docs with privacy-safe media guidance and explicit fresh-install / legacy-upgrade gates.

Verification

Current hardening branch HEAD: cb95d2a5ff3e9e5b6462c9bad853134345e6ec78

Windows CI

Run #142: https://github.com/Air000000/timeprism/actions/runs/34743763621

Passed on the current PR HEAD:

  • pnpm install --frozen-lockfile
  • pnpm run typecheck
  • pnpm run build:check
  • cargo check --all-targets
  • cargo test
  • existing Rust unit suite: 52 passed / 0 failed
  • DPI integration suite: 2 passed / 0 failed

The new DPI tests pin both required invariants:

  • runtime pet resizing uses logical rather than physical pixels;
  • configured pet height matches the runtime logical height.

Known pre-existing warnings remain for unused ForegroundSnapshot and Manager; this PR does not claim a warning-free build.

Windows installer packaging

Run #84: https://github.com/Air000000/timeprism/actions/runs/34743763617

Passed on the current PR HEAD:

  • synchronized version validation ✅
  • frontend typecheck ✅
  • Rust tests ✅
  • NSIS + MSI installer build ✅
  • installer artifact upload ✅

Generated artifact:

  • name: TimePrism-0.1.0-windows-installers-pull_request
  • artifact id: 10312894288
  • archived size: 15,951,885 bytes
  • artifact digest: sha256:c01c5f9bd8467d2b267393486bf5f53f7538a773784854b6cef0072069a73e16
  • NSIS SHA-256: d59cc59374b5d0017240be1e6a98febd7a121a99e4e48808a1909127aada6ee9
  • MSI SHA-256: fa5fdd667ab8624553a48b9be2cc2106e266e223a0a7b7e92be1f0d236ca1ae4

Automated evidence proves the DPI sizing contract and installer production. The exact visual clipping case still requires the same real Windows scaled-display smoke that originally exposed it.

Remaining manual gates

This PR intentionally remains Draft.

  1. Fresh-install acceptance (S-050): verify no pre-init SQLite error, no capture before onboarding, correct disclosure, immediate activation, persisted Pause/Resume, pet tracking state, and existing lifecycle behavior.
  2. Idle correction acceptance: reproduce a real idle interval; verify candidate identity, explicit app attribution, generic fallbacks, secondary Decide later, and that the pet prompt is fully visible at the user's actual Windows DPI scaling.
  3. Legacy-upgrade acceptance (S-060): verify existing data survives, onboarding does not reappear, legacy tracking state/provenance migrate correctly, and later explicit pause persists.
  4. Interactive installer smoke: Home, Insights, Focus Guard, reminders/privacy, pet, restart/data persistence, and uninstall.
  5. Product media: capture sanitized screenshots/GIF only from the accepted Windows build.
  6. Public release: only after the interactive gates succeed and the user explicitly approves integration to main.

The app is unsigned, so Windows SmartScreen may report an unknown publisher.

Fold the approved compact Idle attribution behavior and explicit usage provenance into the hardening branch after Windows CI #137 passed with 52 Rust tests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant