conformance: identify Windows status writer operations - #205
Closed
BunsDev wants to merge 3 commits into
Closed
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It updates protected-conformance diagnostic classification and embedded workflow/harness digests, which warrants a final human verification pass before approval.
Pull request overview
Updates the Phase 1 conformance harness diagnostics to classify Windows status-writer failures by operation stage plus bounded OS-code category, then propagates the new authority/digest pins and documents the latest protected run context.
Changes:
- Extend writer-error diagnostics to include
writer-error.<stage>.<category>for reviewed Windows status-writer operations and bounded OS codes. - Update harness authority lock metadata and embed updated script digests in the conformance workflow.
- Refresh conformance documentation to reflect the latest protected run and updated diagnostic classification.
File summaries
| File | Description |
|---|---|
| src/phase1-conformance.test.ts | Adds regression cases for stage-specific writer-error classification and fallback behavior. |
| src/phase1-conformance-lock.test.ts | Updates expected harness/Coven revisions and blob/SHA-256 pins for the adopted harness bytes. |
| scripts/phase1-schema-v2-producer.mjs | Implements stage+category writer-error parsing and expands public diagnostic allowlist accordingly. |
| scripts/phase1-conformance.mjs | Expands public diagnostic IDs to include the new stage-specific writer-error categories. |
| phase1-conformance.lock.json | Repins harness and Coven revisions and updates authority file digests. |
| docs/roadmap.md | Updates the protected validation checkpoint entry to the latest run and diagnostic status. |
| docs/phase1-conformance.md | Updates latest protected result narrative and exact input pins/digests. |
| .github/workflows/client-v1-conformance.yml | Updates embedded harness file size/hash assertions to match the repinned scripts. |
Review details
- Files reviewed: 8/8 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
1201
to
1204
| const writerRecord = | ||
| /^replace status after reader closes: Io \{ operation: "failed to write owner-only Windows daemon status", source: Os \{ code: (2|3|5|32|1307|1314), kind: [A-Za-z]+, message: "((?:[^"\\\r\n]|\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{[0-9a-fA-F]{1,6}\}))*)" \} \}$/u.exec( | ||
| /^replace status after reader closes: Io \{ operation: "failed to write owner-only Windows daemon status(?:: (create-temporary-file|write-contents|write-newline|sync-temporary-file|convert-security-descriptor|open-process-token|read-process-token|apply-owner-only-security|replace-status-file))?", source: Os \{ code: (2|3|5|32|1307|1314), kind: [A-Za-z]+, message: "((?:[^"\\\r\n]|\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{[0-9a-fA-F]{1,6}\}))*)" \} \}$/u.exec( | ||
| message, | ||
| ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Protected run 34435223248 narrowed the remaining Windows failure to status-writer OS error 5 but could not identify the failing operation. Coven #985 merged nine fixed operation labels at c0c979cdee96327bf24218bc7c7ecb90d719cb27 after native Windows and retried Linux CI passed.
This change adopts that merged Coven source, strictly parses only the reviewed operation labels plus six bounded OS-code categories, and retains generic fallback for unsupported or malformed records. Raw error messages, paths, SIDs, and status contents are never emitted. Existing generic writer-error.
categories remain supported.The workflow embeds the exact updated harness bytes, and the lock pins behavior commit d27fe99d6d75f94962ddff1a3c24d1a0b21e56c2 by tree, blob, and SHA-256. Resource limits, owner-only security, replacement retries, observation selection, SDK candidate, Cave source, and frozen Chat native client are unchanged.
Validation: 494 authority/diagnostic tests passed with two platform skips; 75 workflow tests passed with 19 platform skips; targeted operation regression passed 47 cases; Biome and diff checks pass. Independent review found one documentation provenance mismatch, corrected in e15208e. Full Coven adoption review found no protected-conformance risk beyond the diagnostic source.
A matching SDK validator binding and fresh protected run remain required; this PR does not claim the access-denied root cause is fixed.