Skip to content

v15.3.0 - Internet-safe install (KillSwitchArmed gate, DNS lock manual-only)

Choose a tag to compare

View all tags
@ryderlacin-pixel ryderlacin-pixel released this 08 Jun 21:58
· 3 commits to main since this release
v15.3.0
5bd8d96

v15.3.0 — Internet-Safe Install

Critical fix: install and reboot no longer brick internet

Root causes eliminated

  1. DNS lockdown removed from auto chain — dns-lockdown-guard.ps1 no longer runs from install.ps1, repair.ps1, or deferred guards. Use scripts/enable-dns-lockdown.ps1 manually when ready.
  2. repair.ps1 fail-open expanded — exits early during InstallInProgress, PostInstallGrace, BootGrace, UnbrickActive, or KillSwitchArmed=0.
  3. KillSwitchArmed gate — catch-all firewall blocks only after tunnel+internet stable for 60s at end of install (KillSwitchArmed=1).
  4. DryRun zero-side-effect — steps 7-20 skipped entirely; no monitor, tasks, WMI, or guards.
  5. Post-install grace extended — 15 minutes to 60 minutes.
  6. Zombie debounce extended — 15x30s to 30x60s before block.

Install flow (STEP 19)

  1. KillSwitchArmed=0, PostInstallGrace=60min, BootGrace=90s
  2. Stability gate: 3x20s SafeToOpen checks
  3. On success: KillSwitchArmed=1, clear install lock, start monitor
  4. On failure: lock cleared but armed stays 0 — internet stays open

Manual DNS lockdown

.\scripts\enable-dns-lockdown.ps1

Test gate

1013+ assertions, 0 ERROR/WARN final line audit.

Assets 2
Loading