phase-01: git hygiene, lint fix, config cleanup, ROADMAP

- Fix 7 ruff I001 import-sort issues (auto-fix) across cli.py,
  test_corpguard, test_hwinfo, test_registry, test_tweaks_init
- Rewrite .gitattributes for Python project (was ExplorerLens C++ copy);
  add *.py text eol=lf to end CRLF warnings
- Remove redundant .flake8 (ruff is the primary linter)
- Add [project.urls] to pyproject.toml (Homepage, Repository, Bug Tracker, Changelog)
- Move PROJECT_SPEC_PROMPT.md -> .github/docs/project-spec.md
- Add ROADMAP.md: 5-sprint plan, 50-task backlog, velocity table
- Add unwantedRecommendations to extensions.json (ms-python.black-formatter)
- Commit Sprint 8 (C13-C23) pending changes: corpguard, ratings,
  registry, tweaks/__init__, tests/test_cli, tests/test_config, docs/API
- Verify: ruff clean, 276 key tests pass

Author: aeger

.flake8

@@ -1,57 +1,38 @@
-# Git Attributes for ExplorerLens.io
+# Git Attributes for RegiLattice (Python project)
 
-# Auto detect text files and perform LF normalization
+# Auto-detect text files and normalise to LF in the repo
 * text=auto
 
-# Source code
-*.cpp text eol=crlf
-*.h text eol=crlf
-*.c text eol=crlf
-*.hpp text eol=crlf
-*.cs text eol=crlf
-*.csx text eol=crlf
+# ── Python ───────────────────────────────────────────────────
+*.py text eol=lf
+*.pyi text eol=lf
 
-# Scripts
+# ── Shell / Scripts ──────────────────────────────────────────
+*.sh text eol=lf
 *.ps1 text eol=crlf
 *.bat text eol=crlf
 *.cmd text eol=crlf
-*.sh text eol=lf
+*.psm1 text eol=crlf
 
-# Configuration files
+# ── Config / Data ────────────────────────────────────────────
+*.toml text eol=lf
+*.cfg text eol=lf
+*.ini text eol=lf
 *.json text eol=lf
 *.yml text eol=lf
 *.yaml text eol=lf
-*.xml text eol=crlf
-*.config text eol=crlf
-*.props text eol=crlf
-*.targets text eol=crlf
-
-# Visual Studio files
-*.sln text eol=crlf
-*.csproj text eol=crlf
-*.vcxproj text eol=crlf
-*.vcxproj.filters text eol=crlf
-*.vcxproj.user text eol=crlf
 
-# Documentation
+# ── Documentation ────────────────────────────────────────────
 *.md text eol=lf
-*.txt text eol=crlf
-*.rtf text eol=crlf
+*.rst text eol=lf
+*.txt text eol=lf
 
-# Binary files
-*.dll binary
-*.exe binary
-*.lib binary
-*.obj binary
-*.pdb binary
-*.ilk binary
-*.exp binary
+# ── Binary ───────────────────────────────────────────────────
 *.png binary
 *.jpg binary
 *.jpeg binary
 *.gif binary
 *.ico binary
 *.zip binary
-*.7z binary
-*.rar binary
 *.gz binary
+*.whl binary

.gitattributes

@@ -11,5 +11,8 @@
     "eamodio.gitlens",
     "gruntfuggly.todo-tree",
     "usernamehw.errorlens"
+  ],
+  "unwantedRecommendations": [
+    "ms-python.black-formatter"
   ]
 }

PROJECT_SPEC_PROMPT.md .github/docs/project-spec.mdPROJECT_SPEC_PROMPT.md renamed to .github/docs/project-spec.md

@@ -0,0 +1,173 @@
+# RegiLattice — Roadmap
+
+> Living document — updated after every sprint.
+> Last updated: 2026-03-08 · v1.0.0 · 1 292 tweaks · 69 categories · 17 511 tests
+
+---
+
+## Current State (as of 2026-03-08)
+
+| Metric | Value |
+|--------|-------|
+| Tweaks | 1 292 across 69 categories |
+| Tests | 17 511 (all passing) |
+| Python | 3.10 – 3.14 |
+| Lint | ruff (E, F, W, I, UP, B, SIM, RUF) |
+| Type check | mypy --strict |
+| Coverage | ~high (target ≥ 90 %) |
+| GUI | tkinter + 4 themes |
+| Profiles | 5 (business, gaming, privacy, minimal, server) |
+| Platforms | Windows (primary); Linux/WSL (partial) |
+
+---
+
+## Long-Term Vision
+
+Make RegiLattice the **reference Windows registry tweak toolkit**:
+
+- Zero-dependency runtime (stdlib-only at runtime)
+- Production-grade packaging distributed via pip, winget, and scoop
+- GUI that rivals dedicated Windows tools
+- Full corporate-environment safety
+- Extensible plugin marketplace
+- CI/CD on every commit, cross-platform where possible
+
+---
+
+## Sprints
+
+### Sprint 1 — Foundation & Hygiene ✅ (2026-03-08)
+
+| Theme | Goal |
+|-------|------|
+| Git hygiene | Fix lint, commit Sprint 8 pending changes |
+| Config cleanup | `.gitattributes`, formatter (ruff not black), remove `.flake8` |
+| CI | Consolidate duplicate workflows |
+| Docs | ROADMAP.md, move PROJECT_SPEC_PROMPT, update stale architecture stats |
+
+### Sprint 2 — Documentation Deep-Dive (planned)
+
+| # | Task |
+|---|------|
+| 1 | Refresh stale stats in `architecture.md` (now 1 292/69) |
+| 2 | Update `README.md` badge for 17 511 tests |
+| 3 | Move Sprint 8 in `CHANGELOG.md` from `[Unreleased]` to `[1.0.1]` |
+| 4 | Add `docs/DEVELOPMENT.md` — local setup, Windows + WSL guide |
+| 5 | Review and update all issue templates in `.github/issue_template/` |
+| 6 | Add PR template checklist (tests, lint, docs) |
+| 7 | Refresh `CONTRIBUTING.md` with current workflow |
+
+### Sprint 3 — Test Quality & Coverage (planned)
+
+| # | Task |
+|---|------|
+| 1 | Measure current coverage per-module; identify gaps |
+| 2 | Add tests for `gui.py` (widget lifecycle, search, filter) |
+| 3 | Add tests for `menu.py` edge cases |
+| 4 | Add cross-platform stubs (Linux path handling) |
+| 5 | Add property-based tests for registry path splitting |
+| 6 | Add mutation-style tests for tweak apply/remove idempotency |
+| 7 | Push overall coverage ≥ 90 % on critical paths |
+
+### Sprint 4 — Refactoring & Performance (planned)
+
+| # | Task |
+|---|------|
+| 1 | Dead-code audit — remove unused functions/imports |
+| 2 | Refactor `tweaks/__init__.py` — split by concern (loader, profiles, engine) |
+| 3 | Profile startup time; identify and defer heavy imports |
+| 4 | Move to `src/` layout for better packaging isolation |
+| 5 | Add `__all__` to all public modules |
+| 6 | Harden `marketplace.py` — plugin signature check |
+| 7 | Audit all `subprocess` calls for command-injection safety |
+
+### Sprint 5 — Production Readiness & Release (planned)
+
+| # | Task |
+|---|------|
+| 1 | Validate PyPI packaging (`hatch build`, `twine check`) |
+| 2 | WSL-compatibility pass (ensure all cross-platform tests pass) |
+| 3 | Verify pre-commit hooks work end-to-end |
+| 4 | Add GitHub Actions for coverage upload to Codecov/Coveralls |
+| 5 | Add `SECURITY.md` with responsible disclosure policy |
+| 6 | Tag and release v1.0.1 with all Sprint 1–4 improvements |
+| 7 | winget manifest update for v1.0.1 |
+
+---
+
+## Prioritized Backlog
+
+_~50 concrete tasks derived from the roadmap above, ordered by priority._
+
+### P0 — Critical / Immediate
+
+- [x] Auto-fix ruff I001 import-sort issues
+- [x] Commit Sprint 8 pending changes
+- [x] Fix `.gitattributes` header + add `*.py text eol=lf`
+- [x] Fix `.vscode/settings.json` — use ruff-format not black-formatter
+- [x] Remove redundant `.flake8`
+- [x] Add `[project.urls]` to `pyproject.toml`
+- [x] Move `PROJECT_SPEC_PROMPT.md` → `.github/docs/project-spec.md`
+- [ ] Consolidate `ci.yml` + `python.yml` into one canonical workflow
+- [ ] Update stale stats in `architecture.md` (1 228→1 292, 64→69)
+- [ ] Run mypy and fix any strict errors
+
+### P1 — High Value
+
+- [ ] Update `README.md` test-count badge (17 511)
+- [ ] Move `CHANGELOG.md [Unreleased]` → `[1.0.1]`
+- [ ] Add `docs/DEVELOPMENT.md` (setup, run, test, contribute)
+- [ ] Add `__all__` to `registry.py`, `tweaks/__init__.py`, `config.py`
+- [ ] Review `pyrightconfig.json` — ensure it matches `pyproject.toml [tool.pyright]`
+- [ ] Add `coverage.xml` to `.gitattributes` (binary check — it's xml/text)
+- [ ] Measure per-module coverage; document gaps
+- [ ] Add `hypothesis` + `pytest-mock` to `[dev]` dependencies
+
+### P2 — Medium Value
+
+- [ ] Add `docs/DEVELOPMENT.md` (Windows + WSL setup guide)
+- [ ] Refresh `CONTRIBUTING.md` — current PR/issue workflow
+- [ ] Review all `.github/issue_template/` files for accuracy
+- [ ] Add `Makefile` or `just` runner for common dev commands
+- [ ] Add `CODEOWNERS` rationale comment
+- [ ] Audit `gui.py` for thread-safety (tkinter + Background threads)
+- [ ] Add `typing.TYPE_CHECKING` guards for expensive imports
+- [ ] Profile `all_tweaks()` load time; add benchmark
+- [ ] Add `TweakDef.risk_level` field to complement `tweak_risk_level()`
+- [ ] Consolidate duplicate `_SCOPE_CACHE` logic into helper
+
+### P3 — Nice to Have
+
+- [ ] `src/` layout migration
+- [ ] Pre-commit CI stage (lint + smoke tests on PR)
+- [ ] Add Codecov/Coveralls integration
+- [ ] Dark mode auto-detection for GUI (follows Windows system theme)
+- [ ] CLI completions (bash/zsh/PowerShell via argcomplete)
+- [ ] `regilattice export --format json/ps1/reg` unified export
+- [ ] Plugin sandbox — limit filesystem/network access for third-party plugins
+- [ ] Scoop bucket publish for RegiLattice
+- [ ] winget manifest automated update via GitHub Actions
+- [ ] Add `logging` module integration (replace ad-hoc SESSION.log)
+- [ ] Localization: add 2nd locale (German or Spanish as proof-of-concept)
+- [ ] REST API layer (FastAPI) for remote management
+- [ ] Web dashboard (read-only) for tweak status visualization
+- [ ] Benchmark suite in CI (track performance regressions)
+- [ ] Add tweak `changelog` field (last modified date)
+- [ ] Add tweak `source_url` field (docs/KB article reference)
+- [ ] Auto-generate per-category Markdown docs from `TweakDef` fields
+- [ ] Package for Chocolatey
+- [ ] `regilattice diff` — compare two snapshots in human-readable format
+- [ ] `regilattice doctor` — sanity-check for common misconfigurations
+- [ ] Support for custom user-defined registry tweaks (TOML-based)
+
+---
+
+## Sprint Velocity Tracking
+
+| Sprint | Dates | Tasks Planned | Tasks Done | Notes |
+|--------|-------|--------------|-----------|-------|
+| Sprint 1 | 2026-03-08 | 10 | 8 | Foundation & hygiene |
+| Sprint 2 | TBD | 7 | — | Documentation |
+| Sprint 3 | TBD | 7 | — | Test coverage |
+| Sprint 4 | TBD | 7 | — | Refactoring |
+| Sprint 5 | TBD | 7 | — | Production readiness |

.vscode/extensions.json

@@ -183,6 +183,7 @@ Corporate network detection.
 | `assert_not_corporate(force=False)` | Raises `CorporateNetworkError` if corp |
 | `corp_guard_status()` | `→ dict` — Detailed detection results || `corp_guard_reasons()` | `→ list[str]` — Copy of reasons list from last detection |
 | `reset_corp_cache()` | Clear cached detection result (useful in tests/hot-reload) |
+
 ---
 
 ### `regilattice.elevation`

ROADMAP.md

@@ -36,6 +36,12 @@ classifiers = [
     "Topic :: System :: Systems Administration",
 ]
 
+[project.urls]
+Homepage = "https://github.com/aeger/RegiLattice"
+Repository = "https://github.com/aeger/RegiLattice"
+"Bug Tracker" = "https://github.com/aeger/RegiLattice/issues"
+Changelog = "https://github.com/aeger/RegiLattice/blob/main/CHANGELOG.md"
+
 [project.scripts]
 regilattice = "regilattice.cli:main"
 

docs/API.md

@@ -239,7 +239,9 @@ def _has_group_policy() -> bool:
                         count += 1
                         idx += 1
                         if count >= 3:  # 3+ policy sub-keys = likely GP-managed
-                            SESSION.log(f"Corp-guard: {count}+ policy sub-keys under HKLM\\SOFTWARE\\Policies")
+                            SESSION.log(
+                                f"Corp-guard: {count}+ policy sub-keys under HKLM\\SOFTWARE\\Policies"
+                            )
                             return True
                     except OSError:
                         break
@@ -414,7 +416,10 @@ def _run_single(name: str, label: str, fn_name: str) -> tuple[str, str, bool]:
             return name, label, False
 
     with concurrent.futures.ThreadPoolExecutor(max_workers=5) as pool:
-        futures = [pool.submit(_run_single, name, label, fn_name) for name, label, fn_name in _CHECK_NAMES]
+        futures = [
+            pool.submit(_run_single, name, label, fn_name)
+            for name, label, fn_name in _CHECK_NAMES
+        ]
         for future in concurrent.futures.as_completed(futures, timeout=30):
             _name, label, detected = future.result(timeout=15)
             if detected:

pyproject.toml

@@ -53,7 +53,9 @@ def rate_tweak(tweak_id: str, stars: int, note: str = "") -> None:
 def _to_rating(entry: Any) -> TweakRating:
     """Convert a raw dict entry to a TweakRating."""
     if isinstance(entry, dict):
-        return TweakRating(stars=int(entry.get("stars", 3)), note=str(entry.get("note", "")))
+        return TweakRating(
+            stars=int(entry.get("stars", 3)), note=str(entry.get("note", ""))
+        )
     return TweakRating(stars=3)
 
 
@@ -69,7 +71,9 @@ def get_rating(tweak_id: str) -> TweakRating | None:
 def all_ratings() -> dict[str, TweakRating]:
     """Return all ratings."""
     data = _load_all()
-    return {tid: _to_rating(entry) for tid, entry in data.items() if isinstance(entry, dict)}
+    return {
+        tid: _to_rating(entry) for tid, entry in data.items() if isinstance(entry, dict)
+    }
 
 
 def remove_rating(tweak_id: str) -> bool:

regilattice/corpguard.py

@@ -38,7 +38,9 @@
 _ROOTS: dict[str, int | None] = {}
 
 # Pre-sorted prefix list: longest prefix first so the first match is always correct
-_PREFIX_LIST: list[tuple[str, int]] = []  # (prefix_upper, root_handle) — built at import
+_PREFIX_LIST: list[tuple[str, int]] = (
+    []
+)  # (prefix_upper, root_handle) — built at import
 
 if winreg is not None:
     _ROOTS = {
@@ -124,7 +126,9 @@ class RegistrySession:
     _dry_run: bool = field(default=False, repr=False)
     _dry_ops: int = field(default=0, repr=False)
     _read_cache_enabled: bool = field(default=False, repr=False)
-    _read_cache: dict[tuple[str, str, str], object] = field(default_factory=dict, repr=False)
+    _read_cache: dict[tuple[str, str, str], object] = field(
+        default_factory=dict, repr=False
+    )
     _read_cache_lock: threading.Lock = field(default_factory=threading.Lock, repr=False)
 
     def __post_init__(self) -> None:
@@ -205,7 +209,11 @@ def backup(self, keys: Iterable[str], label: str) -> Path:
         _ensure_windows()
         ts = datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
         onedrive = os.environ.get("ONEDRIVE", "")
-        backup_root = Path(onedrive) / "RegistryBackups" if onedrive and Path(onedrive).is_dir() else Path.home() / "Documents" / "RegistryBackups"
+        backup_root = (
+            Path(onedrive) / "RegistryBackups"
+            if onedrive and Path(onedrive).is_dir()
+            else Path.home() / "Documents" / "RegistryBackups"
+        )
         backup_path = backup_root / f"{label}_{ts}"
         backup_path.mkdir(parents=True, exist_ok=True)
 
@@ -549,7 +557,9 @@ def assert_admin(required: bool = True) -> None:
     import ctypes
 
     if not bool(ctypes.windll.shell32.IsUserAnAdmin()):
-        raise AdminRequirementError("Administrator privileges are required for this operation.")
+        raise AdminRequirementError(
+            "Administrator privileges are required for this operation."
+        )
 
 
 # ── Module-level singleton ───────────────────────────────────────────────────