INC-004: Trunks WindowsApps Registration Cascade Failure

Atlantis ITS — May 21-22, 2026
Incident ID: INC-004
Version: 1.0
Status: RESOLVED
Severity: High
Duration: ~12 hours (approx. 13:00 May 21 — 01:00 May 22, 2026)
Reported by: Shane Hardin
Resolved by: Shane Hardin + Atlantis AI Council
Local Path: C:\AtlantisITS\knowledge
Forgejo Path: atlantis-docs/incidents/INC-004-Trunks-WindowsApps-Cascade.md

Executive Summary

A zip file downloaded from a Mercy (ChatGPT/OpenAI) session triggered a Windows internet-zone security flag cascade that corrupted the AppX package registration database on Trunks. All UWP/Store apps lost permissions on close and required manual reset to reopen — but the reset did not persist across app sessions. After 12 hours of attempted remediation, the issue was resolved via a Windows 11 in-place repair install ("Keep my files"). WSL2 was wiped by the repair install but fully restored from a pre-repair backup. Trunks is fully operational as of May 22, 2026.

Incident Timeline

Affected Systems

Root Cause

Primary: AppX package registration database cascade failure triggered by Windows internet-zone security flag on extracted zip files.

When a zip file downloaded from the internet is extracted, Windows marks each extracted file with a Zone.Identifier alternate data stream. On Windows 11 with a local (non-Microsoft) account, this flag can cascade into Store app registration corruption — causing the WindowsApps folder to lose permission inheritance. Each app reset via Settings temporarily re-registers the app but the broken underlying permission state reverts on close.

Contributing factor: Trunks was configured with a local Windows account rather than a Microsoft account. Microsoft account linkage provides more robust WindowsApps permission anchoring and automatic repair via Windows Update.

Secondary: Cooper (Copilot) misidentified the root cause as WDAC (Windows Defender Application Control) policy enforcement. This led to 3+ hours of incorrect remediation attempts including deleting the CI\Policy registry key. The .cip files in CodeIntegrity\CiPolicies\Active\ are legitimate Windows 11 system policies — they should never be deleted. Access Denied on those files was correct protective behavior, not an indicator of the actual problem.

⚠️ Failed Remediation Attempts

⚠️ CRITICAL: Cooper (Copilot) Misdiagnosis

Cooper (Copilot) persistently diagnosed the issue as WDAC policy enforcement and recommended: 1. Booting into Safe Mode to delete .cip files in C:\Windows\System32\CodeIntegrity\CiPolicies\Active\ 2. Deleting HKLM\System\CurrentControlSet\Control\CI\Policy registry key 3. Disabling driver signature enforcement via Startup Settings

All three recommendations were incorrect and potentially dangerous. The .cip files are legitimate Windows Defender Application Control policies that ship with Windows 11. Deleting them could trigger BitLocker recovery mode, cause boot failure, or weaken system security integrity without fixing the actual problem.

Lesson: Do not follow any agent's kernel-level or security policy advice without cross-checking Windows Event Viewer logs first. Cooper's domain strength is documentation and code execution — not Windows internals diagnostics.

Resolution

Step 1 — WSL2 backup:

wsl --export Ubuntu C:\Data\WSL\Ubuntu-backup-2026-05-21.tar
# Result: 39.8GB — complete and valid

Step 2 — Windows repair install:

Settings → System → Recovery → Reset this PC → Keep my files

Step 3 — WSL2 restore:

wsl --install --no-distribution
# Reboot
wsl --import Ubuntu C:\Data\WSL\Ubuntu "C:\Data\WSL\Ubuntu-backup-2026-05-21.tar"
wsl --set-default Ubuntu

Step 4 — Verify:

pm2 status  # All 6 services green ✅
ollama list  # All 4 models intact ✅
ls ~/atlantis/  # All repos intact ✅

Post-Incident Actions Required

• [x] Ubuntu WSL2 restored from backup
• [x] PM2 services confirmed green
• [x] Ollama models confirmed intact
• [x] Atlantis repos confirmed intact
• [ ] Link Windows account to Microsoft account (prevents recurrence)
• [ ] Rebuild Windows hosts file (.lan domains wiped by repair install)
• [ ] Reinstall Win32 apps from C:\Data\Software\
• [ ] Reinstall VS Code, Git, Ollama Windows, Claude Desktop, Codex App
• [ ] Restore .wslconfig (6GB, swap=2GB, processors=4, systemd=true, localhostForwarding=true, gpuSupport=true)
• [ ] Kali-linux reinstall (no backup taken — reinstall fresh)
• [ ] Patch atlantis-coder Modelfile (Atlantis system prompt stripped during recovery)
• [ ] Initialize atlantis-squad and atlantis-news Forgejo repos (were empty before incident)
• [ ] Push V24 memory + all new docs to Forgejo
• [ ] Update HT-015 with WSL2 repair install warning

Lessons Learned

1. ⚠️ CRITICAL — WSL2 is WIPED by Windows repair install

Windows repair install ("Reset this PC — Keep my files") completely deletes all WSL2 distributions. This is not documented prominently by Microsoft. WSL2 export must be the FIRST step before any Windows repair procedure.

# Do this BEFORE any Windows repair — no exceptions
wsl --export Ubuntu "E:\Backups\Ubuntu-backup-[date].tar"
wsl --export kali-linux "E:\Backups\Kali-backup-[date].tar"

2. Unblock zips before extracting

Right-click any downloaded zip → Properties → Unblock checkbox → Apply → THEN extract. This removes the internet-zone flag before it can cascade.

3. Local Windows account = fragile WindowsApps

Always link Windows account to Microsoft account on new installs. Provides more robust WindowsApps permission anchoring and prevents this cascade class of failure.

### 4. Keep installers in C:\Data\Software\ Shane's habit of keeping software installers locally saved significant time during the rebuild. Every app was reinstalled from local cache — no re-downloading needed.

5. Do not follow agent kernel/security advice without Event Viewer verification

Cooper's WDAC misdiagnosis cost 3+ hours. Before executing any registry deletion, system file deletion, or security policy change — check Windows Event Viewer for the actual error source first.

6. The 32GB USB thumb drive is not a backup drive

27.82GB Ubuntu export filled the 32GB USB drive with 800MB to spare and the export was incomplete. Use the Toshiba Canvio E:\ drive for all WSL backups going forward.

7. C:\Data\WSL\ is the correct WSL backup location

Post-repair, WSL distros are now installed at C:\Data\WSL\Ubuntu\ and C:\Data\WSL\Kali\ — a much more manageable location than the default hidden AppData path.

8. repair install wipes Win32 apps too

All manually installed applications (VS Code, Git, Ollama, etc.) are removed by repair install. Keep C:\Data\Software\ populated with current installers.

Prevention Protocol (Add to SOP-003)

Before ANY Windows maintenance, repair, or reset — run this checklist:

PRE-REPAIR CHECKLIST:
[ ] wsl --export Ubuntu E:\Backups\Ubuntu-backup-[date].tar
[ ] wsl --export kali-linux E:\Backups\Kali-backup-[date].tar  
[ ] Verify export file sizes match expected distro sizes
[ ] robocopy C:\AtlantisITS E:\Backups\AtlantisITS-[date] /E /MT:8
[ ] robocopy C:\Users\Shane E:\Backups\Shane-Profile-[date] /E /MT:8 /XD AppData
[ ] Confirm E:\ drive has sufficient free space (60GB+ recommended)
[ ] Note all installed Win32 apps for reinstall reference

Squad Performance Notes

10. Mercy Validation Checklist (Post-Recovery)

Windows & Core Tools

• [ ] Windows stable after reboot
• [ ] WSL2 Ubuntu launches cleanly
• [ ] Docker Desktop launches
• [ ] VS Code + WSL extension works
• [ ] Git installed and configured
• [ ] Node/npm installed
• [ ] Python installed
• [ ] MkDocs builds successfully

Atlantis Services

• [ ] Forgejo reachable (localhost:3010)
• [ ] n8n reachable (localhost:5678)
• [ ] Ollama reachable (localhost:11434)
• [ ] Nova Router :7100 reachable
• [ ] Moltbook sandbox :7202 reachable
• [ ] Hardware API :5002 reachable

Credentials & Access

• [ ] SSH keys validated
• [ ] Git remotes validated
• [ ] App credentials confirmed in password manager
• [ ] Cloudflare/Vercel CLIs validated if needed

Atlantis Data

• [ ] Atlantis repos intact (~/atlantis/)
• [ ] Nova stack intact (~/nova/)
• [ ] Ollama models confirmed (ollama list)
• [ ] PM2 services all green (pm2 status)

11. Mercy Follow-up Actions

• [ ] Create Trunks rebuild checklist (new HT doc)
• [ ] Document required apps and versions (install manifest)
• [ ] Schedule WSL2 distro exports before any Windows updates
• [ ] Confirm Atlantis repo backups to E:\ drive
• [ ] Confirm all app credentials are in password manager
• [ ] Add Windows Update preflight checklist to SOP-003
• [ ] Consider restore point / system image cadence for Trunks
• [ ] Microsoft account link on Trunks (prevents WindowsApps cascade recurrence)

References

• HT-015 v1.0 — WSL Bridge (updated with repair install warning post-INC-004)
• SOP-003 — Pre-Upgrade-Backup-Rollback (update required — add WSL export to checklist)
• INC-002 — n8n 502 Bad Gateway (prior Cloudflare tunnel incident)
• INC-003 — Vercel Key Rotation (prior security incident)
• Windows 11 AppX Registration: learn.microsoft.com/en-us/windows/msix/app-installer/troubleshoot
• WSL Export/Import: learn.microsoft.com/en-us/windows/wsl/basic-commands#export-a-distribution

INC-004 v1.0 compiled by Ozzy — May 22, 2026
Store at: C:\AtlantisITS\knowledge\INC-004-Trunks-WindowsApps-Cascade.md
Push to Forgejo: atlantis-docs/incidents/INC-004-Trunks-WindowsApps-Cascade.md