His PC runs a protected Windows service (GuardianService, as SYSTEM). It restarts itself if closed, and his standard account can't stop or remove it. It streams his screen, takes remote input, enforces app and website rules and screen time.

Parent apps run a small relay on port 8080 that his PC finds over the home network (UDP 47800 broadcast). The app window is the relay's page, wrapped in the desktop app with a tray icon and auto-updates.

Approving or blocking an app covers its whole install folder, so helpers and updaters keep working (e.g. C:\Program Files (x86)\Steam). Games inside launcher libraries (steamapps/common, Epic Games, Riot Games…) each count as their own app. A program name like discord.exe also works. Moving an item to the other list removes it from the first. Windows and Guardian's own programs can never be blocked.

Temporary Access lasts until that app is closed.

His PC's DNS points at Guardian's own filter (127.0.0.1). Approving youtube.com covers all its subdomains, and helper sites it loads in the next 60 seconds are learned automatically. Blocked and unknown sites get "no such site". Approved lookups go to Cloudflare for Families (1.1.1.3), which also blocks adult and malware sites, even in Unrestricted mode. Browser secure-DNS is switched off by policy so it can't skip the filter.

Temporary Access for a website lasts 1 hour. VPNs and proxy browser extensions can get around website filtering, so keep those blocked as apps.

Times are written like 16:00-20:00 or 07:30-08:30, 15:00-20:00. Outside them his PC locks every 15 seconds. An empty day stays locked all day. Paused while a parent has control.

While a parent has control, all restrictions are paused for them and come back the moment control is handed back or the connection drops. Unrestricted switches off every rule, request and the schedule until turned back on. Only one parent can watch his screen at a time.

The first parent app to pair is added automatically; others need approving. Removing a parent cuts them off straight away. The pairing code is checked by his PC (5 wrong tries locks it for 5 minutes). Each app's saved pairing code is encrypted with its password; a recovery copy is sealed by Windows for that Windows user and is only released by an emailed reset code or a passkey.

Accounts live on Guardian's server (a Cloudflare Worker with a D1 database). Signing up needs a code sent to that email, so only the real owner of cbevs@icloud.com can be admin. Passwords are stored hashed (PBKDF2). 5 wrong passwords locks the account for 15 minutes and emails a reset code. Each app also keeps its own encrypted copy so it can unlock offline.

The website (info and downloads) is served by the same Worker. Its address is set in desktop/config.js.

Every push to main on github.com/cbevss/Guardian builds release v1.0.<build>. Parent apps check every 30 minutes and install when the window is hidden or on quit. His PC checks every 3 hours, swaps in the new guardian-agent.exe and restarts the service. The repo must be public for downloads to work.

In home mode a parent PC with Guardian open must be on the same network as his PC. Remote input can't reach the Windows lock screen or admin prompts. Outside-the-home access needs a relay server with HTTPS.