[lidge-jun]

Summary

• Resolve the ACL principal SID and account name in-process on Windows x64, reusing the native token reader introduced by fix(windows): read the effective SID in-process so service install does not wait on a cold PowerShell #7548. A cold PowerShell child is no longer needed for this lookup during service-lock hardening.
• Preserve successful identity caching, explicit test-runner precedence, trusted PowerShell fallback on unsupported native platforms, and fail-closed identity errors. No service is installed on the development host.
• Closes [Windows] service install still starts a cold PowerShell for the ACL principal lookup (follow-up to #7544) #7547.

Verification

• Pre-change supported-runner baseline: bun run test tests/windows/windows-user-principal.test.ts tests/windows/windows-user-principal-nonascii.test.ts tests/codex-integration/codex-windows-current-sid.test.ts --parallel=1, using OCX_TEST_RUNNER_BUN pinned to Bun 1.4.3: exit 0, 30 pass / 0 fail.
• Fresh PowerShell child measurements before the change: 109.47, 105.42, 112.75 ms; uncached default principal resolution 109.57 ms. These are process-start measurements on this Windows x64 host; the hosted 30-second stall was not reproduced and no OS caches were cleared.
• Regression first: both uncached default no-PowerShell tests failed on the unfixed code (EACLIDENTITY, 16 pass / 2 fail), then passed with the native implementation. Focused boundaries/layout/worker guards: exit 0, 79 pass / 0 fail across 7 files. Full Windows domain plus the affected fixture/auth/routing suites: exit 0, 766 pass / 0 fail across 32 files. The new native suite was rerun after changing its Microsoft-account fixture to the scanner-approved example.com domain: exit 0, 18 pass / 0 fail.
• bun run typecheck, bun run privacy:scan, bun run structure:check: exit 0. Tests use the repository-pinned Bun 1.4.3; the bundled runtime is 1.4.4.
• Compiled native-worker smoke on Bun 1.4.4: pre-bundle the actual worker, embed it in a standalone harness, and execute it with both child-spawn functions forbidden inside the worker realm. Exit 0; SID/name match the native sync control and the embedded worker completes (18.79 ms locally). The Windows suite separately compares the native identity to independent trusted Unicode PowerShell, without printing real identity values.
• bun run test:changed failed at the unchanged 900s limit: 2,187/2,599 files selected, 23,905 pass events / 44 fail events observed before termination, exit 124 (incomplete suite). It is not passing evidence. The spill-child failure it exposed is repaired below; other failures remain. Focused Desktop/link/routing diagnostics returned 21 pass / 24 fail. Two representative Desktop/link failures reproduced unchanged on pristine dev (ceef4889e) in a detached control checkout: 0 pass / 2 fail, exit 1, including the same desktop_lifecycle_busy_or_unsafe response and 5s timeout. The remaining failures are not all classified. No timeouts, assertions, skips or runner policy were weakened.
• Current head e1338bb75b476726e7f5c9406eef8c87bec083e9: updated focused Windows/fixture/response-state/layout/worker/ratchet set passed 949/949 tests across 37 files; typecheck, privacy and structure exited 0. Fresh independent gpt-6.1-sol/high source/security review round 2 reviewed all 10 changed files and the complete interdiff: PASS, zero blockers. It did not run tests or clear runtime gates.
• bun run test on that head also hit the unchanged 900s cap: exit 124, 26,741 pass events / 44 fail events observed, incomplete suite. The repaired spill case passes in this run. A zero-byte coordinator case that failed in the broad changed run passes in fresh isolated current-head and pristine-base controls (1/0 each); that does not classify every broad failure. Neither broad invocation produced a passing Check receipt. This PR stays draft; no suite or timeout policy was relaxed.
• Current exact-head manual ci.yml lane=all: run 40056591526, headSha=e1338bb75b476726e7f5c9406eef8c87bec083e9, queued with no conclusion at the latest inspection. Initial dispatch covers superseded 4e34eb9f and is not current-head passing evidence. Full GUI/desktop packaging, live service installation and real domain/Microsoft-account host parity are NOT RUN; account-name formats have synthetic boundary coverage.

Decisions

• Use a small src/lib/windows-native-principal.ts helper, the minimum source-scope extension permitted by the lane brief, to reuse readWindowsCurrentSid without changing its SID-only consumers. Resolve the account from the live token SID before formatting it; this avoids a SID string round trip and leaves allocation cleanup with the existing reader.
• Run async native translation in one owned Bun Worker. Each caller has its own monotonic deadline; expiry never caches a late result or starts icacls, and the shared worker slot is retained until native cleanup and worker closure. Synchronous lookup remains synchronous and rejects an elapsed budget before caching. A permanently blocked native job is not replaced by an unbounded stream of workers.
• Add the native worker entry to the existing standalone embedding registry so compiled installations use the same path. The helper, worker entry and single build-registry line are the smallest source/tooling scope extensions needed to preserve the async budget contract identified by the independent plan audit.
• Unit 1 is superseded by the manager: test: settle Windows ACL work and owner locks before fixture removal #7528 is merged and the inclusive-root wording is handled on fix(qoder): provider-only catalog, replay-envelope refusal and isolated status #7545. This PR carries neither change.
• Include one additional test-helper lifetime repair in tests/helpers/responses-state-never-settling-acl-child.ts: native on/off/on probes showed that faster identity resolution reaches its intentionally stalled icacls runner, which remained unowned during blocking teardown. Keep the selected runner held through queue settlement, assert that it was reached, then release and drain before removal. The existing parent assertions and deadlines stay unchanged. Regression red-to-green: focused case 0/1 before, 1/0 after; entire original response-state file 145/0. This does not claim to explain [Bug][CI]: Windows fixture teardown exhausts the remove retry budget (EBUSY/EPERM) in two existing tests #7515's production empty-DACL interleaving.

Security summary

The effective process token remains the authority for the ACL grant and cached account name. Native DLLs load only from the trusted OS system directory. API/translation/worker failures refuse; only unavailable native support selects the existing trusted helper, using the remaining budget. Token, allocated SID and DLL cleanup finish before worker completion. Negative tests cover native failures, bounded buffers, Unicode/name shape, explicit fallback, late-result refusal and ACL-timeout memo isolation. There are no dependency, workflow, credential-format or ACL-policy changes. The C4 plan and current-head implementation passed independent sol source/security review. This source verdict does not clear the failed broad checks or incomplete CI.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Integration evidence for exact head 25a4a5d (dev merge on top of the reviewed bcd6522, made to remove an overlap in structure/ops/test-sandbox-cleanup.md) (lane L3, run on the Windows host mini; C4 Windows identity/ACL change, Security summary in the description):

• Independent review: fresh gpt-6.1-sol source + security review PASS on the final lane head (plan also independently audited).
• Lane verification on Windows: new regressions red before and green after (caller expiry, shared worker, spill helper); focused suites 949 / 949 pass; typecheck, privacy:scan, structure:check exit 0.
• Full Windows suite on mini hit the unchanged 900 s cap (26741 pass / 44 fail observed); the representative Desktop/link failures reproduce on pristine dev and the zero-byte coordinator case passes in isolation on both, so none is attributed to this change. Broad changed/full validation is therefore incomplete (NOT RUN to completion) and is left to dev push CI.
• Closes [Windows] service install still starts a cold PowerShell for the ACL principal lookup (follow-up to #7544) #7547.

Static merge simulation on current dev 4e2940e (this Mac): dev=4e2940e5134dcbb138b47bbed5f65d5ce9ddd414 base=4e2940e5134dcbb138b47bbed5f65d5ce9ddd414 pr_files= 10 overlap=[]; merge clean; install exit=0; gui install exit=0; tsc exit=0; tsc doctor exit=0; structure:check exit=0; privacy:scan exit=0; layout+ratchet guards exit=0 52 pass 0 fail ;

Merged by the triage manager as maintainer integration (MAINTAINERS.md, dev only) under the owner's static-judgment rule while GitHub Actions is degraded; dev push CI will be checked when Actions recovers.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T12:50:47.976165Z	25a4a5d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.