#Requires -Version 5.1
<#  SilverMetal Enhanced - Windows | Domain H: Privacy minimisation & update integrity
    Trim telemetry tasks/services at GP+service+firewall layers. Do NOT block
    Microsoft domains in the hosts file (breaks Windows Update; violates
    design-principle #13). Keep Windows Update ON. Publish residual telemetry.
    Spec: ../hardening-spec.md (H)   |   SCAFFOLD (M1).
#>
[CmdletBinding()] param()
Set-StrictMode -Version Latest; $ErrorActionPreference = 'Stop'
Write-Host '[H] Privacy minimisation & update integrity'

# Disable telemetry/feedback scheduled tasks (keep update/time/security tasks).
$tasks = @(
  '\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser'
  '\Microsoft\Windows\Application Experience\ProgramDataUpdater'
  '\Microsoft\Windows\Customer Experience Improvement Program\Consolidator'
  '\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip'
  '\Microsoft\Windows\Feedback\Siuf\DmClient'
)
foreach ($t in $tasks) { Disable-ScheduledTask -TaskPath (Split-Path $t) -TaskName (Split-Path $t -Leaf) -EA SilentlyContinue | Out-Null }

# CEIP off.
$sqm = 'HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows'
New-Item $sqm -Force | Out-Null; Set-ItemProperty $sqm -Name CEIPEnable -Type DWord -Value 0

# Windows Update STAYS ON (update-or-die). We minimise telemetry, never patching.
Get-Service wuauserv | Set-Service -StartupType Automatic
# Guard: assert the hosts file contains no Microsoft update/licensing domains (anti-footgun).
$hosts = Get-Content "$env:windir\System32\drivers\etc\hosts" -EA SilentlyContinue
if ($hosts -match 'microsoft\.com|windowsupdate|msftncsi|login\.live') {
  Write-Warning '   hosts file blocks Microsoft domains - REMOVE (breaks Windows Update).'
}

# TODO-M1: run tests\telemetry-leak test; document the irreducible residual (we publish, not claim zero).

Write-Host '   [H] telemetry tasks/CEIP off; Windows Update preserved.'
