# EchoCapsule v6.3 PR-7 Windows Release QA

**Release**: v6.3 PR-7 Windows unsigned RC
**EXE build commit**: f3410a0
**Documentation/release metadata commit**: not committed (package-only red-team remediation)
**Build**: 2026-07-06 · Windows 10 · PyInstaller 6.20.0 · Python 3.9.12
**Package remediation date**: 2026-07-07

## Red-team disposition

The original `EchoCapsule-v6.3-PR7-Windows-unsigned-f3410a0.zip` was marked **NO-GO as packaged** because the prior new-user QA launched `D:\MagicPhoto\dist\EchoCapsule.exe`, which can resolve back into the development project and does not represent a real user's extracted zip path.

This remediation did **not** rebuild the EXE. The binary hash remains unchanged:

```text
EchoCapsule.exe SHA256 = 65411e86ee79de0d5f3db4494fa7d0e9702b7d963c7ce88f630bf3696bddf987
```

Only package documentation / QA artifacts were updated, then the release zip was regenerated. The zip filename keeps `f3410a0` because that is the EXE build commit. If these package metadata files are later committed to git, replace `Documentation/release metadata commit` above with that new commit SHA.

## Verification matrix

| Category | Item | Result |
|---|---|---|
| PR-7 core | pytest 7/7 | PASS |
|  | identity map builder, Windows real manifest | PASS |
|  | manifest validator | can_ingest=true |
|  | semantic diff, old vs new manifest | PASS, only unique rows changed `is_representative: true -> false` |
|  | SQLite ingest drill | PASS |
|  | grep consumer risk | PASS, no full-resolution consumer using `is_representative=1` alone |
| Binary chain | EXE SHA256 | PASS, unchanged from signed-off binary hash |
|  | PyInstaller binary | Existing binary retained; no rebuild in this remediation |
|  | `git diff e392682 f3410a0 -- sort.py build.py` | PASS, empty diff |
|  | `git diff -- AGENTS.md CLAUDE.md` | PASS, empty diff |
| Defender | release zip scan | PASS, Windows Defender found no threats |
|  | EXE scan | PASS, Windows Defender found no threats |
| Real zip new user | Extracted zip to `C:\Temp\EC-RC` | PASS |
|  | Existing `%APPDATA%\EchoCapsule` backed up/renamed before launch | PASS |
|  | Launched `C:\Temp\EC-RC\EchoCapsule.exe` with working directory `C:\Temp\EC-RC` | PASS |
|  | First `/api/state` showed `has_library=false` | PASS, did not attach to `D:\MagicPhoto` development library |
|  | AppData initialized | PASS, `%APPDATA%\EchoCapsule\authority.db`, `runtime_error.log`, `crash.log` created |
|  | EXE directory runtime data initialized | PASS, `C:\Temp\EC-RC\library`, `thumbs`, `core.js`, `static`, `index.html`, `tailwind_cache.css`, status/log jsonl files |
|  | Added a photo folder | PASS (`C:\Temp\EC-RealPhoto-QA`, 6 JPG files) |
|  | Scan completed | PASS (`scan_stage=done`, `build_status=idle`, `photo_count=6`) |
|  | Mark + export | PASS, 1 file moved to `C:\Temp\EC-RealPhoto-QA归档\珍藏\...` |
|  | Restart continuity | PASS, folder/config/exported_ids persisted after restarting the extracted EXE |
| Console | Browser page loaded | PASS (`EchoCapsule · 回响胶囊`) |
|  | Console errors/warnings | PASS, captured page logs had 0 error/warn entries |
|  | `ReferenceError` | PASS, not observed |
|  | `FolderStore is not defined` | PASS, not observed |
|  | `isCommitted is not defined` | PASS, not observed |
| Logs | isolated new-user `%APPDATA%\EchoCapsule\runtime_error.log` | PASS, 0 bytes |
|  | isolated new-user `%APPDATA%\EchoCapsule\crash.log` | PASS, 0 bytes |
| Release docs | README no longer claims external key file | PASS |
|  | README explains exact runtime data locations from real zip test | PASS |
|  | README includes unsigned/SmartScreen/Defender notes and SHA256 command | PASS |

## Real new-user storage locations

During the isolated extracted-zip test, the app created runtime data beside the EXE:

```text
C:\Temp\EC-RC\library\
C:\Temp\EC-RC\thumbs\
C:\Temp\EC-RC\core.js
C:\Temp\EC-RC\index.html
C:\Temp\EC-RC\static\
C:\Temp\EC-RC\tailwind_cache.css
C:\Temp\EC-RC\metadata_cache.json
C:\Temp\EC-RC\photos_new.json
C:\Temp\EC-RC\footprints.json
C:\Temp\EC-RC\scan_status.json
C:\Temp\EC-RC\export_overlay.json
```

It created config/log/database files in AppData during the isolated run:

```text
%APPDATA%\EchoCapsule\authority.db
%APPDATA%\EchoCapsule\runtime_error.log
%APPDATA%\EchoCapsule\crash.log
```

After QA, the user's original `%APPDATA%\EchoCapsule` was restored.

## Additional red-team evidence

### sort.py / build.py diff

Command:

```powershell
git diff e392682 f3410a0 -- sort.py build.py
```

Result: empty output. No `sort.py` or `build.py` source delta exists between `e392682` and EXE build commit `f3410a0`.

### AGENTS.md / CLAUDE.md diff

Command:

```powershell
git diff -- AGENTS.md CLAUDE.md
```

Result: empty output. No local release remediation edits were made to `AGENTS.md` or `CLAUDE.md`.

### Defender scan

Commands used Windows Defender platform `4.18.26050.15-0`:

```powershell
MpCmdRun.exe -Scan -ScanType 3 -File D:\MagicPhoto\release\EchoCapsule-v6.3-PR7-Windows-unsigned-f3410a0.zip -DisableRemediation
MpCmdRun.exe -Scan -ScanType 3 -File D:\MagicPhoto\dist\EchoCapsule.exe -DisableRemediation
```

Results:

```text
Scanning D:\MagicPhoto\release\EchoCapsule-v6.3-PR7-Windows-unsigned-f3410a0.zip found no threats.
Scanning D:\MagicPhoto\dist\EchoCapsule.exe found no threats.
```

## Observations

- The RC opens a command-line window. This is expected for the unsigned RC package.
- The application creates photo library / thumbnails / `core.js` beside the EXE in the extracted directory, and creates config/log/database files in `%APPDATA%\EchoCapsule`.
- Users should keep the extracted folder together and should not move only `EchoCapsule.exe` after first run.
- Export API moved the selected file successfully and persisted `exported_ids`. The library API continued to report the historical indexed count; this is recorded as observed behavior and was not treated as a packaging blocker because the export side effect and restart persistence were verified.

## Artifacts

| File | SHA256 |
|---|---|
| EchoCapsule.exe | `65411e86ee79de0d5f3db4494fa7d0e9702b7d963c7ce88f630bf3696bddf987` |
| sort_encrypted.dat used for the retained EXE build | `d13407e514f8813fddbf4d5bf41a24c7366f09fa3c1f58915353f899b9705511` |
| Windows PR-7 manifest | `ad4278e9a4ff27b4afc3cc4a403e069e613bfed145b1b44cfcd1f1a55bb25865` |
| Windows PR-7 validation | `3ce5649aa5133f7b60e4ff665d4575694e30d06ca57d9d4b8766e93480d4d3ad` |

## Not done

- Authenticode signing.
- Timestamp signing.
- OSS upload / download-back verification.
- EXE rebuild. The EXE was intentionally not rebuilt.
- Git commit for package-only release metadata. Current source HEAD remains `f3410a0`.

## Conclusion

**GO for unsigned RC package handoff after documentation remediation and real extracted-zip new-user QA.**

The previous NO-GO condition was package QA/documentation truthfulness, not binary hash integrity. The regenerated zip has a new zip SHA256 because README/QA files changed, while `EchoCapsule.exe` SHA256 remains unchanged.
