test: isolate Windows status writer ACL failures - #201
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
The change relies on low-level Windows ACL inheritance and P/Invoke behavior that’s difficult to validate for cross-environment stability without running the Windows CI/conformance suite.
Pull request overview
This PR adds a Windows-only diagnostic probe to the existing windows-job-supervisor.test.ps1 isolated-user suite to help pinpoint why a protected conformance run fails when owner-only file security is applied (per OpenCoven/coven#984). The changes introduce a small C# helper that verifies expected inherited ACL shape in the isolated TEMP directory, then attempts owner/DACL mutations in three distinct modes and reports results using a bounded vocabulary.
Changes:
- Add
StatusAclProbeC# helper to create disposable files, validate inherited owner/DACL expectations, and callSetNamedSecurityInfoWfor combined / owner-only / DACL-only mutations. - Extend
windows-job-supervisor.test.ps1to compile and run the probe both in an ordinary temp directory control and inside the isolated-user job, then parse and re-emit results as bounded diagnostics.
File summaries
| File | Description |
|---|---|
| scripts/windows-status-acl-probe.cs | New C# probe for verifying inherited ACL expectations and testing owner/DACL mutation outcomes. |
| scripts/windows-job-supervisor.test.ps1 | Integrates the probe into the isolated-user supervisor test, including a control run and bounded result parsing/emission. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Protected conformance run 34441519622 fails when Coven applies owner-only file security. Add a bounded diagnostic to the existing isolated-user supervisor test: verify the created file owner and expected inherited SID/access masks, then test combined owner/DACL, owner-only, and DACL-only operations on separate disposable files. An ordinary-directory control must succeed. Production permissions and frozen evidence bindings are unchanged.
Validation: PowerShell parse, C# compilation, TypeScript typecheck and git diff --check pass locally. The Windows-only suite skips all 33 tests on macOS; native ci:full execution is required. This PR diagnoses OpenCoven/coven#984 and does not claim a repair or close the conformance gate.
Current validation gaps
adfa7eaffa793ed5dd3b973e61ded260d1f70ec8. Explicit RunControl avoids PowerShell null-string coercion; direct dispatch checks pass. The first native attempt failed in the ordinary control before isolated ACL results.retention/phase1-harness-0ae0e90. A fresh remote fetch recovered the exact commit/tree. Attempt 2 Web CI passed after retention. The full run is terminal failure solely at the packaged authority check tracked by Repair packaged Phase 1 authority provenance for frozen candidates #202; Windows supervision, Rust, Unix supervisors, E2E, canary and desktop passed.cfe8137c07307dfa19f926152a74da83afec49e5), whose exact-head full CI passed packaged conformance. The diagnostic branch now incorporates that repair through signed merge91d0c90963a75e13150612b19b4842c3baae3c26; fresh packaged CI remains pending. Native ACL output was collected from successful Windows job 102767865632: combined, owner-only and DACL-only updates all returned access-denied; ordinary controls and inherited owner/SID/mask verification passed. Coven #988 now carries the native writer regression. Passing packaged CI is still required; no production repair or merge readiness is claimed.The branch was refreshed against merged main cfe8137 with a clean merge. Typecheck, lint, build, normal tests (597 passed / 61 skipped), and heavy tests (569 passed / 35 skipped) passed before commit. Require complete exact-head CI on 91d0c90 before considering merge. Its diagnostic-only scope remains separate from the unresolved Coven #988 production repair and SDK #38 protected aggregate gate. Preserve the active worktree.
Refreshed Windows CI failure
At head91d0c909, Windows supervisor job 102802195143 failed in Assert-TerminalFailureQuarantine for
directory-quota. The underlying error isWTS process primary token SID query was ambiguousduring EnumerateProcessPrimaryTokenSids / RevalidateFailedProcessOpen / DrainProcessesByPrimaryTokenSid. This is a terminal-quarantine identity observation failure, separate from Coven #984 status-file ACL application. No quarantine relaxation or resource increase is justified. Packaged job102800897369 remains running; no merge readiness is claimed.