refactor: inline Windows hardening with WAPT helpers

README.md

@@ -1,19 +1,27 @@
-# Com itari Windows hardening safe v1 (WAPT source)
+# Comitari Windows hardening safe v1 (WAPT source)
 
 SOURCE ONLY: must build and sign with the organization's WAPT tooling. Not yet Windows/WAPT-tested.
 
 ## Scope
 Five HKLM registry settings: disable AutoRun and AutoPlay (including non-volume devices), disable lock-screen camera and slideshows. No account / password / LAPS change. No WAPT, firewall, network, SMB, BitLocker, Microsoft Defender, antivirus, remote desktop, printing or power settings change.
 
+## Implementation
+- `setup.py` now contains the complete install, audit and conditional rollback logic.
+- Registry reads and writes use WAPT 2.6 `setuphelpers` (`reg_key_exists`, `reg_value_exists`, `reg_openkey_noredir`, `reg_getvalue`, `registry_set`, and `reg_delvalue`). No PowerShell process or external command is launched.
+- The approved setting table is centralized in `SETTINGS`. A future `update_package.py` can validate operator-selected settings and serialize them as package data; this refactor keeps the current five-setting policy fixed.
+- If a future package configuration changes a setting’s target, its update flow must migrate the saved uninstall target while preserving the original pre-install value. That migration is not part of this refactor.
+- The WAPT package source currently has no `WAPT/control` or `update_package.py`; it is code-only and is not yet a complete buildable WAPT package.
+
 ## Safeguards
-- Initial values saved once in `%ProgramData%\Comitari\HardeningSafe\original-values.json` before any modifications.
+- Initial values are saved once in `%ProgramData%\Comitari\HardeningSafe\original-values.json` before any modifications. The JSON layout remains compatible with the prior PowerShell package.
+- If the baseline is absent, malformed or incomplete, uninstall refuses to make registry changes.
 - Reinstallation idempotent; uninstall conditional: restores only values still equal to package target, leaving externally modified values unchanged.
 - No reboot forced. Audit implemented.
 - State persists after uninstall intentionally, so repeated uninstall does not overwrite third-party edits.
-- Policy owner can override package; audit then reports WARNING.
+- Audit is read-only. A non-compliant or unreadable setting returns `WARNING`; successful collection with all five values at target returns `OK`.
 
 ## Deployment
-1. Inspect `setup.py` and `hardening.ps1` in an isolated preproduction repository.
+1. Inspect `setup.py` and the five `SETTINGS` entries in an isolated preproduction repository.
 2. Validate registry settings and resulting behavior on a Windows 11 25H2 representative workstation, especially AutoPlay workflow.
 3. Build/sign WAPT package with organization's key. Do not distribute unsigned sources as a ready-to-deploy binary.
 4. Deploy to 1 test PC, verify WAPT agent/check-in, LapsByWAPT password rotation and recovery, business apps, USB workflows.