P0: signed mandatory-update policy and cross-version portable Windows recovery #31

Problem

Users can leave Agent2 resident for days. Known-bad clients must be upgraded before starting new affected local-view/edit operations, including legacy builds that do not understand a new policy. Ordinary managed Windows 10 and 11 users frequently have no admin/install permissions and may not have CMD/PowerShell access. Existing force flags override task-exit guards and MUST NOT be repurposed as a forced upgrade. PR #30 provides periodic checks, precise errors and safe portable Windows groundwork; it does not deliver forced updates.

Suggested minimal protocol (P0)

1. Dedicated signed policy v1, e.g. cloudfile-agent2-policy.json, independently P-256 signed with a distinct domain string and the existing pinned trusted public key. Do not extend the legacy signed release JSON (deny_unknown_fields in old Rust Agent). Reuse the current signed release artifacts + hashes + per-version staging/health check. Validate bounded payload, schema, platform, expiry, target version and release availability; define monotonic anti-rollback/expiry behavior for cached policy, and support domain and IP fallback channels without untrusted redirects. Need a matching signer/publisher in the release pipeline.
2. Capability-based routing rather than comparing the old status.version unconditionally: prefer build_version, otherwise check explicitly reported capabilities/host path and report unknown build when old version is merely family marker 2.2.0. New Agent advertises a policy-capability bit. Keep old Chrome native messages/Host ID.
3. Resident Agent: startup + 4h checks as in fix(agent2): periodic update checks, portable Win10/11 compatibility and clearer V2 errors #30; when new open is requested and last successful policy check is more than 15 minutes old, refresh safely before acquiring new file ticket, bounding wait and protecting offline failures. On a signed block of this actual running build, do not open affected new file operations. Reuse signed update pipeline, stage and health-test under user directory. Do not kill or discard work copies, pending uploads, Intent/Guard, active Checkouts, or other users' processes. Distinguish installed/registered/running versions; gate reopening on new running build, not a successful download/manifest rewrite. Request fresh scoped file ticket after restart; do not replay an expired original token.
4. Cross-version fallback: clients without signed-policy support but with existing update API are coordinated by a new Chrome extension/web entry; clients with only downloader/old resident require safe quit/restart or signed bootstrap; old .NET / missing Native Host / unavailable updater need an explicit portable ZIP + native bootstrap EXE, with stable HKCU registration/ownership checks and preservation of previous manifest/working files. Old extension or Host not communicating must show the web fallback, never display simply “not installed.”
5. Low-privilege Windows: all install/update/start in current-user writable directory and HKCU only, native process spawn by absolute executable path, no CMD, PowerShell, reg.exe, taskkill, PATH, UAC, Windows Service, or forced machine-wide components. Fail with IT-facing instructions if WDAC/AppLocker/GPO denies running the signed portable EXE; never bypass enterprise policy.
6. User-facing diagnostics: distinguish normal upgrade, mandatory but safely blocked, waiting for unfinished tasks, installed/not yet activated, signature/network/permission failure, incompatible OS/runtime and unknown legacy version. Bounded redacted support logs (do not record tickets).

Acceptance / release gates

• Windows 10 x64 and 11 x64 real ordinary-user scenarios: WebView2 present/missing; no PowerShell/CMD/PATH; Unicode/space/& install paths; signed release download on domain and backup IP; long-lived old desktop; multiple Chrome profiles; guarded active edit/upload; offline and invalid signature; security-software locked EXE; WDAC deny.
• V2 file sizes 35.8 MB, 151.3 MB and 1 GiB boundary; local-view vs local-edit vs exclusive; verify correct error and safe continuation; end-to-end server identity and file hashes.
• old Agent capable of native update, old Agent only downloadable, old .NET, unknown family-marker version, old extension; verify browser and website fallback and running-version proof.
• No automatic release to Etech production; after CI, test with small dev pilot, targeted bad-version rollout, then wider fleet. Publish artifacts with monotonically increasing versions; same-version replacement does not activate.
• No schema or server changes solely to support this without separate compatibility review.

Related groundwork: #30.