sysadmin 3f1ea6aa63 fix(bitlocker): add recovery-password protector + save the key (was unrecoverable) ...

VM e2e: full wizard ran end-to-end and enrolled TPM+PIN, but BitLockerService only
created TPM+PIN with NO recovery protector — a forgotten/mistyped PIN bricks the
drive (hit exactly that on the VM). Add a RecoveryPassword protector and save the
48-digit key to ProgramData AND the unencrypted EFI System Partition (readable even
when the OS volume is locked, e.g. for offline recovery/verification).

PRODUCT TODO (follow-up): escrow the recovery key to SilverSync + display it in the
wizard's Done step so the end-user records it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-09 20:15:49 +01:00

..

src

fix(bitlocker): add recovery-password protector + save the key (was unrecoverable)

2026-06-09 20:15:49 +01:00

tests/SilverOS.Welcome.Tests

fix(kiosk): pivot to Explorer + policy lockdown (WebView2 wizard renders blank as the SL shell)

2026-06-09 18:52:15 +01:00

SilverOS.Welcome.sln

fix(welcome): extract wizard components to Razor Class Library so bUnit tests don't load WindowsAppSDK (fixes CI DllNotFound on clean runner)

2026-06-09 08:12:37 +01:00