Windows Smart App Control blocks unsigned Electron development binary

[WebCrew]

Test environment

• Windows 11 with Smart App Control enabled
• Node.js 24.19.0
• Electron 43.4.0
• Parlyn Engine main after Core Data & Persistence Contract v1

Result

npm ci succeeds with 0 reported vulnerabilities.

npm run check succeeds:

Smart Systems data check passed (encounter: quiet-crossing).
Core persistence contract check passed.
Parlyn structure check passed (18 JavaScript modules checked).

npm run dev builds the renderer successfully, downloads the Electron runtime and then fails when node_modules/electron/cli.js attempts to spawn:

node_modules/electron/dist/electron.exe
Error: spawn UNKNOWN
errno: -4094

PowerShell verification:

Get-AuthenticodeSignature ".\node_modules\electron\dist\electron.exe" |
  Format-List Status,StatusMessage,SignerCertificate

returns Status: NotSigned with no signer certificate. Windows Smart App Control therefore blocks the executable.

Security decision

Do not instruct testers to disable Smart App Control or weaken system policy. This is not a Parlyn renderer/test failure and is not fixed by npm script approval.

Required resolution

Provide a packaged Windows test/release build whose Parlyn executable, installer and executable helpers are signed by a certificate trusted by Windows. Document the verified publisher and installation/test path.

Acceptance criteria

• signed Windows artifact produced by the controlled release workflow
• Authenticode status is Valid
• expected Parlyn publisher is displayed
• application launches with Smart App Control enabled
• existing npm run check suite remains successful
• signing credentials never enter source control or ordinary build logs

Scope

Distribution/signing work belongs to the desktop distribution phase. The issue records a confirmed test blocker and does not move that phase into active implementation.