ProtectionAI v1.8.1

101 registered [WorkspaceView] modules, 30 AI copilot tools, 4 AI providers, 7 UI languages,
3,056 tests. Ribbon: 17 tabs, 85 groups, 144 controls. No counts move.

Fixed

• The centred search box was crowding both the window edge and the ribbon tabs, and the
  measurement showed why. It looked tight, and it was worse than tight: the stock caption is about
  25 DIP tall and the box was 30, so the box overhung the tab row by 7.5 DIP — it was not merely
  close to the tabs, it was overlapping them — while clearing the top of the window by only 3 DIP.

  The window now sets TitleBarHeight="36" and the box is 24 high, vertically centred in it. Measured
  after the change: 9 DIP of air above the box and 6 DIP below it to the tab strip, with no
  overlap anywhere. Outlook's caption is likewise taller than the Windows default, for the same
  reason — a search field needs a band of its own, not the leftovers of a caption sized for text.

  The horizontal margin is also symmetric now (14 DIP each side) so the box is not visually pulled
  toward the quick-access side or the window buttons, and the interior padding grew slightly so the
  watermark is not against the border. The two numbers are coupled: shrink TitleBarHeight without
  shrinking the box and the overlap returns, which is noted where both are set.

---

Installer

ProtectionAI-Setup.msi is a Windows Installer (MSI) package. It installs ProtectionAI in Program Files, creates a Start Menu shortcut, registers Apps & Features uninstall support, and supports in-place major upgrades. ProtectionAI.App.exe is the same application as a self-contained single-file executable, for people who cannot run an installer.

This release is not Authenticode code signed. Windows SmartScreen will warn you when you run it, and that warning is expected. The checks below prove integrity (the bytes are the bytes we built) and source binding (the signed manifest came from this repository, tag and commit). They are not a Windows trust decision and do not stop SmartScreen warning.

Artifact digests (SHA-256)

9ab576c93d7863a20a025a830c32ba8c4a10e783da45ca31b24ad24e4a3ac31e  protectionai-1.8.1-cyclonedx.json
1fed76640c9c1ee1d7a7bf026ade2a9e014ccf37f81e2748b11f3dedfca115a7  protectionai-1.8.1-cyclonedx.json.sha256
68b82568d68007c7ffac0534f03d1772f3718e3b43f676eaa49f9f2af00a09ef  ProtectionAI-Setup.msi
8a970e1a131c146b036032b478cc5d0eefec1df6e17e6a47fc440abdc2a2ea34  ProtectionAI.App.exe

Published alongside the artifacts as SHA256SUMS, with a detached Sigstore signature (SHA256SUMS.sig), the ephemeral signing certificate (SHA256SUMS.pem) and a self-contained bundle (SHA256SUMS.cosign.bundle). The software bill of materials (protectionai-1.8.1-cyclonedx.json) and its checksum sidecar (protectionai-1.8.1-cyclonedx.json.sha256) are both attached and covered by the signed manifest.

1. Verify integrity — the files are what we built

PowerShell:

foreach ($line in Get-Content .\SHA256SUMS) {
  $expected, $name = $line -split '\s+', 2
  $actual = (Get-FileHash $name.Trim() -Algorithm SHA256).Hash.ToLower()
  "{0}  {1}" -f $(if ($actual -eq $expected) { "OK  " } else { "FAILED" }), $name.Trim()
}

POSIX shell:

sha256sum -c SHA256SUMS

2. Verify authenticity — the digest list itself is genuine

Step 1 only proves the files match the list. This proves the list was produced by this release workflow. Install cosign and run:

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig \
  --certificate SHA256SUMS.pem \
  --certificate-identity https://github.com/Cwgtshome/ProtectionAI/.github/workflows/release.yml@refs/tags/v1.8.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository Cwgtshome/ProtectionAI \
  --certificate-github-workflow-ref refs/tags/v1.8.1 \
  --certificate-github-workflow-sha 4988e6c2516e1345c4b6142afc89c47410c84ac8

Or with the bundle, which needs no separate certificate:

cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity https://github.com/Cwgtshome/ProtectionAI/.github/workflows/release.yml@refs/tags/v1.8.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository Cwgtshome/ProtectionAI \
  --certificate-github-workflow-ref refs/tags/v1.8.1 \
  --certificate-github-workflow-sha 4988e6c2516e1345c4b6142afc89c47410c84ac8

Pin all five certificate constraints exactly as shown: identity, issuer, repository, ref and SHA. Together they reject a signature from another workflow, repository, tag or commit. There is no long-lived private key: the certificate above was issued to this workflow's OIDC identity, is valid for minutes, and the signing event is recorded in the public Rekor transparency log.

3. Build provenance — not available for this release

No GitHub-hosted SLSA build-provenance attestation was recorded, so gh attestation verify will not find one. GitHub's attestation store is not offered to user-owned private repositories on this plan, and the source repository is private.

What still holds: the signed SHA256SUMS manifest binds every shipped content file by digest, and the Sigstore certificate in step 2 binds that manifest to this repository, tag ref and exact source SHA against a public transparency log. What is missing is GitHub's separate SLSA predicate and attestation-store record; no SLSA level is claimed.

Built from Cwgtshome/ProtectionAI@4988e6c. See docs/RELEASE-INTEGRITY.md for what each file is and why it exists.