NexusSystem 1.8.0

Changed

• The pack's installation moved from PowerShell to the native engine: get-nexus.ps1 (about 1,500 lines before) is
  now a minimal bootstrap that downloads NexusMaintenance.exe of its own release, checks its SHA-256 (and its build
  provenance when gh is signed in) and runs it in the same console. NexusMaintenance.exe --install does
  everything else, with the same options, plan, messages, checks and summary as before: AI app detection, the plugins
  of Claude Code and Codex, each product's official installer (its release's get.ps1, checked, now with its build
  provenance too when gh is there), the exact removal of Codex's old direct declarations, and the hourly task.
  --install-maintenance, --maintain and --status replace the script's maintenance part; the hand-over
  contract of the 1.6 PowerShell worker (-Maintain -MaintenanceCurrent) is kept.
• The "NexusSystem Update" task is registered through the Task Scheduler API (source-generated COM interop, also in the
  native engine) instead of PowerShell's cmdlets, with the same settings; a task its owner disabled stays disabled.
• Installing the engine never stops one that runs: it is renamed aside (under a unique name while an older one still
  runs), put back if the new file cannot take its place, and engines set aside are removed once nothing runs them.
• Tests: the PowerShell tests of the pack (test_pack.ps1, test_codex_pack.ps1, test_maintenance.ps1) became
  xUnit tests of the engine (PackInstallerTests, MaintenanceSetupTests: fresh installation, update while an
  engine runs, failed replacement restored, a real Task Scheduler round trip), and ScriptTests runs the bootstrap
  with this commit's engine on a throwaway profile.

Fixed

• A product release's build provenance was refused when the official gh tool was installed but not signed in
  (exit code 4: it cannot read attestations), so the hourly maintenance failed every product update on such a PC and
  the new pack check failed on GitHub's runners. That case now checks nothing, as without gh; the SHA-256 is
  verified anyway, and a real attestation failure stays fatal.
• get-nexus.ps1 removes the PowerShell worker of releases up to 1.6.54 (~\.nexus\nexussystem\maintenance\get-nexus.ps1)
  when a development engine is selected as well: on the author's workstation it stayed, and the workstation sync kept
  installing products with that 1.6 script (07/11/2026). The public installation already removed it.
• app/tools/sandbox.ps1 stops with the reason when the Windows Sandbox is gone before the guest's result (closed,
  connection lost, never started: app/tools/sandbox-watch.ps1, checked every 5 s through wsb list, 15 s of grace)
  instead of waiting until its 30-minute timeout. On 07/11/2026 the Sandbox's connection was lost before the guest's
  user logon (its logon command never ran) and the script kept waiting.
• app/tools/sandbox.ps1 can start an unsigned Store package: the Sandbox guest enforces Smart App Control whatever
  the host's setting and refused app 1.0.18.0, test-signed in the guest, with 0x800711C7. With -Certification on
  an unsigned package (or -DisableSmartAppControlInGuest) the guest turns it off for itself only before installing
  and records it in result.json; the host's state must be the same after the run (app/tools/sandbox-policy.ps1,
  app/tests/test_sandbox_policy.ps1).
• Tests: no test can show a Windows error box. The test process sets the error mode (no critical-error, crash or
  missing-file box) when it loads, and every process it starts inherits it; a test checks it in a child process.

NexusSystem 1.7.3

Fixed

• Maintenance engine: an AI app command line (claude plugin marketplace update, codex plugin ...) could run with
  no limit, so one stuck command kept the hourly run going until Task Scheduler stopped it at 30 minutes
  (ExecutionTimeLimit, result 0x41306) and the receipt stayed checking for the next hour. Each command now gets
  5 minutes, then is stopped with its child processes and reported with its last output; its standard input is closed
  instead of inherited. A failed command says why (Claude plugin update failed (exit code N: <its last error line>)) instead of a bare "failed".
• A cancelled run writes failed (retryable) instead of leaving checking, and a run that finds a checking
  receipt (its predecessor was stopped outright) says it resumed it.

Changed

• CHANGELOG.md follows Keep a Changelog again: each Store app version since 1.0.13.0 has its own dated
  [app a.b.c.d] section instead of "(app ...)" subsections of catalog versions, every section has its link at the
  end of the file, and the header no longer promises nexussystem-v* tags (the site reads the app's version from the
  Microsoft Store since 2026-11-04). ChangelogTests checks the format, the links and that the app's <Version> has
  its section; RELEASING.md says so.

Security

• CodeQL runs from a workflow file (codeql.yml: actions and csharp, build mode none, actions pinned by SHA)
  instead of GitHub's default setup, now turned off: OpenSSF Scorecard credits SAST only through a workflow when
  commits land without pull requests (it scored 0), as for the products since 2026-11-07.

NexusSystem 1.7.2

Added

• tests/NexusSystem.Tests/PromoteGateTests.cs: the promotion's checks step, run exactly as the workflow runs it,
  against a local stand-in for the GitHub API (red refused at once, running awaited, absent or unfinished refused, the
  latest run of each workflow counted, the calling workflow and dynamic workflows left out, paginated check runs).
• tests/test_engine_replacement.ps1, run on every push after the native build: the real NexusMaintenance.exe is
  started, its file is renamed aside and replaced before any of its code runs (as its self-update does), and it must
  still complete its cycle. Native AOT maps the whole image at start, so a running engine never reads its path again,
  unlike the .NET single-file bundle of NexusFree 1.3.2 (the same test fails on a single-file build of this engine).

Changed

• product-promote.yml publishes a product's stable release only once every check of the build's commit is green
  (NexusBrowser 2.35.28 was promoted with its Tests workflow red: the promotion depended on its own build only). A new
  read-only job checks reads the commit through the GitHub API (actions, checks, contents, statuses: read):
  the latest run of each product workflow except the calling one, other apps' check runs and commit statuses. It
  waits for those still running (checks-timeout-minutes, 60 by default) and refuses, naming each, a red or cancelled
  one, a workflow declared in required-workflows (default tests.yml security.yml codeql.yml) that is missing or
  never ran, or a wait that runs out. The caller's job now grants actions: read, checks: read, statuses: read.
• The release's pack check runs the maintenance engine with exactly the command line its task registered, against
  the release being checked rather than the one already published: get-nexus.ps1 -MaintenanceFrom (tests only) now
  registers the task with --test-catalog <local catalog> --test-engines <folder>, and the engine then takes that
  catalogue as the release, after checking that it carries the engine's version and that the engine is the one the
  folder's SHA256SUMS.txt lists (SHA-256); it never replaces itself and Codex reads that catalogue in place.
• The pack check no longer accepts every pending result: exit code 0, or 2 only when each pending product is
  NexusWindows with no AI app running or NexusBrowser with its daemon on the installed engine and no Chrome running.
• app/tools/package.ps1 builds in ~\.nexus\build\NexusSystem\store<version> (-Store) or ...\msix by default,
  no longer under %LOCALAPPDATA%, which an MSIX app such as Claude redirects into its private cache (the cause of
  the 0-byte package sent to Partner Center on 2026-11-05). The reports of app/tools/sandbox.ps1 and
  app/tools/wack.ps1 go there too by default (sandbox-<id>, wack).

Changed (app 1.0.17.0)

• The app installs and maintains the Nexus products with catalog 1.7.2: the hourly maintenance is the native
  NexusMaintenance.exe engine (no PowerShell, no console host), product installers keep working from a
  PowerShell 7 window, and a signed-out GitHub CLI no longer stops an installation.
• Windows App SDK 2.6.5 and current NuGet packages; the install script is embedded from the catalog at build time
  (see the app changes of 1.7.0).
• Its embedded maintenance engine also carries two catalog changes of this release: a Codex catalogue from another
  source is kept without failing the product (see Fixed below), and the engine's test options (--test-catalog,
  --test-engines, used by the pack check only, see Changed above; a registered task without them is unchanged).

Fixed

• Maintenance no longer fails a product when Codex's Nexus catalogue comes from another source (a local folder, a
  fork): that route is kept, not refreshed, and the product's status names the source instead of "Codex catalogue
  refresh failed".

NexusSystem 1.7.1

Changed

• A catalog release is published only after the full installation passes on a clean Windows runner from its tagged
  commit, with the very maintenance engines it publishes (pack.yml, now also run by hand instead of test.yml):
  every product installed, every declared server reached, a second run green, and the installed engine started from
  PowerShell 7 (--current --force) with no product failed. get-nexus.ps1 -MaintenanceFrom (tests only, with a local -Catalog) takes that engine
  from a folder with its SHA256SUMS.txt, checked the same way, since its release does not exist yet.

Fixed

• Maintenance started from a PowerShell 7 window no longer breaks product installers: Windows PowerShell inherited
  the PowerShell 7 module path, lost Get-FileHash and stopped the update (seen with NexusFree 1.3.0).
• get-nexus.ps1 no longer fails when the GitHub CLI is installed but not signed in: the maintenance engine's build
  provenance is then reported as not checked (its SHA-256 is still verified), as when gh is absent.

NexusSystem 1.7.0

Changed

• The hourly maintenance is now NexusMaintenance.exe, a native Windows engine (C#, ahead-of-time compiled for x64
  and ARM64, no .NET to install) that the NexusSystem Update task starts directly: no PowerShell, no execution
  policy override, no console host. Each catalog release publishes it beside get-nexus.ps1, in SHA256SUMS.txt
  and in its build provenance. It keeps the same rules: published releases only, installed products and existing
  active routes only, running AI sessions preserved, the same ~\.nexus\status\nexussystem-update.json. It replaces
  itself with the newest published engine (never an older one); product installers run with RemoteSigned.
• get-nexus.ps1 installs the engine of its own release, checked, and registers the task on it; -Maintain runs it
  then registers it, which also hands over from the PowerShell worker of releases up to 1.6.54. Its other modes are
  unchanged.
• One detection for the app and the maintenance: the AI apps found (Claude Desktop's signed Code engine included),
  each AI app's declared state of a product and Codex's config.toml (a lexical reader that refuses what it does not
  understand) are read by the same C# code. The process list is read natively instead of through WMI.
• On the author's workstation, developmentCoordinator now names an engine built from the repository
  (app/tools/maintenance-dev.ps1).

Changed (app)

• Windows App SDK 2.6.5 (was 2.5.1) and Windows SDK Build Tools 10.0.28000.2957; System.Management is no longer used.
• The app embeds the repository root's get-nexus.ps1 itself: the app/pack copy and its sync.ps1 are gone, and a
  missing script now fails the build instead of the running app.
• Every project builds with the same rigor from Directory.Build.props: warnings as errors, the recommended .NET
  analyzers and code style at build (the app, its tests and the probe were missing some of them).
• NexusWindows checks accept a single-file Native AOT engine (NexusWindows.exe alone, attested by its own hash in
  the installation and in the runtime receipt) as well as the framework-dependent one, whose NexusWindows.dll,
  .deps.json and .runtimeconfig.json must be recorded together; a partial set is not an installation.

Fixed

• get-nexus.ps1 ran each product's checked get.ps1 with -ExecutionPolicy Bypass since 1.6.31, although 1.6.2
  had narrowed it to RemoteSigned: it is RemoteSigned again, as in the maintenance engine (local files saved
  without a mark of the web, so the same effect with the narrowest setting).
• Dependabot never proposed a NuGet update: on its Linux runner USERPROFILE is unset, so the build folder became
  /.nexus and every restore was denied. The build folder now comes from .NET's own user profile path.
• app/tools/capture.ps1 stopped with "capture fr dark did not finish": its fixed 90 s no longer covered nine
  products' pictures. The deadline now follows the number of products in products.json.

NexusSystem 1.6.54

Fixed

• A product update that failed during the hourly maintenance only said "The product update failed.": the published
  installer's output and errors are now kept in ~\.nexus\nexussystem\maintenance\logs (UTF-8, the 20 newest),
  and the product's entry in ~\.nexus\status\nexussystem-update.json names that file (log) and the installer's
  exit code in its message. The same applies when the installer exits cleanly without reaching the published version;
  a successful run removes its log.
• NexusFree showed "Installed · version 1.2.5" instead of "Up to date": the app never read its latest release, as
  neither products.json nor the app's list of GitHub repositories named NexusFree. Both do now, and a test requires a
  release repository for every ready product. The catalog fix reaches the Store app already installed.

Fixed (app 1.0.16.0)

• On the Updates page the state column starts at the same place on every row: the button column has one width, so a
  Microsoft Store product's "Open in the Store" no longer pushes its state left, and the busy ring of an update takes
  the dot's slot.

Changed (app 1.0.15.0)

• Home laid out like the Microsoft Store's: the banner shows each product's poster across the whole slide, with its
  icon, name and button over it, and two product tiles beside it; each group is one panel of compact rows (icon,
  name, sentence, state, button).
• An update is seen at a glance: a count on "Updates" in the menu, a dot on every product that has one, and a banner
  at the top of the home page naming them with "See updates". The published versions are read at start and every
  30 minutes.
• Every installed product's page has "Check for an update" under its state, the same check as the Updates page.
• NexusKeypad and NexusAGYmail pages show what the AI apps did with them (24 h), like the other AI products.

Fixed

• NexusKeypad 1.8.30 pinned to its connecteurs folder again in both AI plugin catalogs (it pointed at the
  Logitech plugin folder). The catalog tests reuse or rebuild a cached checkout instead of failing on Git's
  read-only files.

Fixed (app 1.0.15.0)

• Long ✓ / ✗ lines and the "On this PC" summary wrap instead of being cut (NexusWpp's "Installed from the
  Microsoft Store" line).

Changed

• Pin NexusKeypad 1.8.30 in both AI plugin catalogs: each Marketplace edition's release now carries a ready profile
  (.lp5) to import in Logi Options+.
• Pin NexusBrowser 2.35.14 in both AI plugin catalogs: Chrome's toolbar icon is the site medallion without its
  lettering.
• App icons at 32 px and less (Square44x44Logo target sizes, nexus.ico): the same julienpiron.fr medallion
  as the large icon, with only its unreadable lettering erased, instead of the plain silver ring.
• Pin NexusBrowser 2.35.13 (task rename steps written to install.log), NexusKeypad 1.8.29 (relay conversations
  recognized under both names) and NexusRelay 1.13.3 in both AI plugin catalogs.
• Pin NexusRelay 1.13.4 in both AI plugin catalogs: the commit guard defaults to the repositories under C:\Nexus.
• Pin NexusBrowser 2.35.12 and NexusWindows 3.16.17 in both AI plugin catalogs: product names without a space
  everywhere; NexusBrowser's scheduled tasks are renamed "NexusBrowser Bridge/MCP/Update" on update.

NexusSystem 1.6.53

Changed

• Product names are written without a space everywhere, like their repositories: pin NexusAndroid 0.23.9,
  NexusInDesign 4.1.5 and NexusRelay 1.13.2 in both AI plugin catalogs; the installer, the app and INSTALL-AI.md
  name the Codex project "NexusRelay" (NexusRelay 1.13.2 still finds a project named "Nexus Relay").
• Pin NexusAndroid 0.23.8, NexusBrowser 2.35.9, NexusFree 1.2.5, NexusInDesign 4.1.4, NexusKeypad 1.8.28,
  NexusRelay 1.13.1 and NexusWindows 3.16.15 in both AI plugin catalogs: plugin display names without a space.
• Same .gitattributes as every Nexus repository (2026-11-04): LF in Git and on disk, CRLF only for .cmd/.bat; files stored with CRLF were renormalized once.

Fixed

• Pin NexusBrowser 2.35.7 in both AI plugin catalogs: small toolbar icon at 16 and 32 px.
• Pin NexusAndroid 0.23.7, NexusBrowser 2.35.5, NexusFree 1.2.4, NexusInDesign 4.1.3, NexusKeypad 1.8.27,
  NexusRelay 1.12.12 and NexusWindows 3.16.12 in both AI plugin catalogs: product icons on a transparent background,
  with the knot badge of the medallion kept whole.
• Pin NexusBrowser 2.35.4 in both AI plugin catalogs: the spinning toolbar logo is cut to its circle and flashes at start.
• Pin NexusBrowser 2.35.3 in both AI plugin catalogs: property-based robustness tests and the fixes they found.
• products.json: NexusInDesign links to its new site page; NexusFree no longer points to a missing banner.
• INSTALL-AI.md lists the free key (NexusFree) in the product table.
• Pin NexusWindows 3.16.10 in both AI plugin catalogs: plain sends without an expect stay out of its error log.
• Pin NexusAndroid 0.23.6 in both AI plugin catalogs: a readable phone checkup with an accurate store-origin check.
• Pin NexusWindows 3.16.9 in both AI plugin catalogs: its diagnostic logs keep the engine's fixed failure reasons.
• Pin NexusRelay 1.12.4 in both AI plugin catalogs so the installed skills describe equal peers under host: all.

Changed (app 1.0.14.0, icons)

• The app and its package logos (Start, taskbar, Store, tiles) show the julienpiron.fr medallion on a transparent
  background at every size, like the site: no dark square around it, and the knot badge at the bottom of the ring is
  kept whole (it was dimmed with the inner circuits). NexusFree, NexusInDesign and NexusWpp cards now come from the
  same kit as the other products (tools/icon-from-site.ps1).
• At 32 px and less (taskbar, Start, Alt+Tab, Explorer, small nexus.ico entries) a small icon replaces the
  medallion: the silver ring drawn plain, without the "JULIENPIRON.FR" lettering unreadable at that size, and the
  pictogram enlarged. Ships with the app version after 1.0.14.0 (already in certification).

Fixed (app 1.0.14.0)

• A Microsoft Store product (NexusWpp) shows its installed version and the version the Store serves, with "New version
  X" and an "Update" button like the AI products. It said only "Installed · Microsoft Store" while a PC stayed on
  1.0.45.0 with 1.0.51.0 published. The served version comes from the Store's display catalog (its MSIX package), not
  from GitHub (its release lags behind the submission) nor winget's msstore source (it reports "Unknown", so
  winget upgrade saw nothing). "Update" and "Get updates" take the Store's package with
  winget install --source msstore --force.

NexusSystem 1.6.52

Fixed

• JSON settings updates use a flushed adjacent file and a same-volume replacement rename. Killing the previous
  File.Replace writer could leave settings.json missing. Existing permissions are applied to temporary files
  and distinct backups before writing any data. Tests interrupt real repeated replacements after writer startup,
  and verify protected permissions, complete JSON and refusal without data loss when the target is locked.
• Local deployment recycles only verified, unused NexusSystem copies; active copies and unrecognized folders stay
  intact. Links are refused and recycling is confirmed. If recycling is unavailable, no permanent-delete fallback
  is used. Installer and crash-test fixture cleanup follow the same rule.

Changed

• Pin the audited stable releases of NexusAndroid 0.23.5, NexusWindows 3.16.8, NexusBrowser 2.34.5,
  NexusInDesign 4.1.2 and NexusFree 1.2.3 in both AI plugin catalogs. NexusFree routing covers every operation
  requiring Administrator / SYSTEM privileges, independently of command names.

NexusSystem 1.6.51

Added

• NexusFree in the pack: get-nexus.ps1 -Only free runs its published installer (one UAC prompt the first time) for
  Claude Code, Codex and Antigravity, and maintenance updates an installed NexusFree like the other engines. It is
  opt-in: it gives the account SYSTEM commands without UAC, so a run without -Only free never installs it. The app
  showed NexusFree since 1.6.50's catalog, but its "Install by the AI" reached a pack that did not know it.
• A catalog test fails when a ready product of products.json or a catalog plugin is missing from the pack.

Changed

• test.ps1 no longer suggests Install-Module -Scope CurrentUser when PSScriptAnalyzer is missing: that scope
  installs into Documents, which OneDrive often syncs. It suggests Save-PSResource -Path to a module folder outside
  Documents.

Fixed

• Pin NexusWindows v3.16.5 in both catalogs, allowing direct semantic actions on stable controls while unrelated
  parts of the interface update.

NexusSystem 1.6.50

Fixed

• Codex no longer asks again for the hooks of NexusRelay and NexusKeypad after a maintenance update. Refreshing the
  catalog updates every installed Nexus plugin, but only the plugin being installed (NexusWindows, NexusBrowser,
  which have no hooks) had its new hook versions approved. The catalog refresh now approves the hooks of every
  installed plugin of this catalog, through Codex's own app server; other catalogs and disabled hooks are untouched.
• Pin NexusInDesign v4.1.1 in the Claude Code and Codex catalogs, correcting the skill description's YAML syntax.
• Parse skill front matter as YAML in catalog tests so folded descriptions retain their text and malformed YAML fails validation.
• Local app install (app/tools/install-local.ps1): earlier local copies (other versions and payloads, the older flat
  layout and old publish-* folders) are removed once the new copy is installed, unless a running NexusSystem uses
  them. They had grown to 6.6 GB on the author's PC.