conformance: identify Windows status writer operations

.github/workflows/client-v1-conformance.yml

@@ -8829,14 +8829,14 @@ jobs:
             @('scripts\owned-temp-directory.mjs', 6965, 'a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095'),
             @('scripts\phase1-artifact-secret-scan.mjs', 21183, 'be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a'),
             @('scripts\phase1-conformance-lock.mjs', 48961, '54c960fac12737013ebf2490c9cae121e7e77c027138eba9e4e3a882bd48c389'),
-            @('scripts\phase1-conformance.mjs', 204500, 'f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5'),
+            @('scripts\phase1-conformance.mjs', 204949, 'c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41'),
             @('scripts\phase1-evidence-contract.mjs', 15088, '24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f'),
             @('scripts\phase1-evidence-runtime.mjs', 6078, '3d227c354e6d908c5912d2b8244336e3b79c3bbd4dec79b0ad219ed65b8cb159'),
             @('scripts\phase1-linux-secret-service.mjs', 4270, 'ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92'),
             @('scripts\phase1-macos-keychain.mjs', 5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4'),
             @('scripts\phase1-process-supervisor.mjs', 3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c'),
             @('scripts\phase1-schema-v2-evidence.mjs', 52505, '0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8'),
-            @('scripts\phase1-schema-v2-producer.mjs', 185403, '5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e'),
+            @('scripts\phase1-schema-v2-producer.mjs', 186184, '0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce'),
             @('scripts\process-owned-artifact-root.mjs', 11788, '426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624'),
             @('scripts\supervised-exec.mjs', 2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b'),
             @('scripts\supervisor-status.mjs', 854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e')
@@ -9557,14 +9557,14 @@ jobs:
             ['scripts/owned-temp-directory.mjs', [6965, 'a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095']],
             ['scripts/phase1-artifact-secret-scan.mjs', [21183, 'be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a']],
             ['scripts/phase1-conformance-lock.mjs', [48961, '54c960fac12737013ebf2490c9cae121e7e77c027138eba9e4e3a882bd48c389']],
-            ['scripts/phase1-conformance.mjs', [204500, 'f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5']],
+            ['scripts/phase1-conformance.mjs', [204949, 'c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41']],
             ['scripts/phase1-evidence-contract.mjs', [15088, '24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f']],
             ['scripts/phase1-evidence-runtime.mjs', [6078, '3d227c354e6d908c5912d2b8244336e3b79c3bbd4dec79b0ad219ed65b8cb159']],
             ['scripts/phase1-linux-secret-service.mjs', [4270, 'ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92']],
             ['scripts/phase1-macos-keychain.mjs', [5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4']],
             ['scripts/phase1-process-supervisor.mjs', [3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c']],
             ['scripts/phase1-schema-v2-evidence.mjs', [52505, '0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8']],
-            ['scripts/phase1-schema-v2-producer.mjs', [185403, '5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e']],
+            ['scripts/phase1-schema-v2-producer.mjs', [186184, '0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce']],
             ['scripts/process-owned-artifact-root.mjs', [11788, '426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624']],
             ['scripts/supervised-exec.mjs', [2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b']],
             ['scripts/supervisor-status.mjs', [854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e']],

docs/phase1-conformance.md

@@ -15,19 +15,22 @@ the final bytes.
 
 ## Latest protected result
 
-[Run 34431068139](https://github.com/OpenCoven/chat/actions/runs/34431068139)
-used Chat #198 at `83518c85605a69089ef96fe31206cfa25741d5e4` and SDK #195
-validator `c02993c468808c84e39255caa185f2399db16ba0`. Linux and Darwin records
+[Run 34435223248](https://github.com/OpenCoven/chat/actions/runs/34435223248)
+used Chat #199 at `724690e64c4be820bdf4e0e1f8c568db516ba490` and SDK #196
+validator `a5c7e38ecc905a6fdb9c9a3e704c6395ec2df02a`. Linux and Darwin records
 passed identity, digest, timing, scan, and all 197 assertion checks. Windows
-failed at `phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error`.
-The repaired Coven test preserves the writer result; this category establishes
-an error, but does not identify its OS code or the failing writer operation.
-Final validation, attestation, and aggregation were skipped. No aggregate is accepted.
-
-The staged diagnostic change classifies six fixed Windows OS codes from an
-attributed, structurally valid writer panic. Unsupported codes or string forms
-retain the generic category. Raw error messages are never emitted. A matching
-SDK binding and fresh protected run remain required before acceptance.
+failed at
+`phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error.access-denied`.
+The bounded result identifies Windows OS code 5 but not the failing writer
+operation. Final validation, attestation, and aggregation were skipped. No
+aggregate is accepted.
+
+Coven #985 merged operation-specific fixed labels at
+`c0c979cdee96327bf24218bc7c7ecb90d719cb27` after native Windows and Linux
+checks passed. The staged Chat classifier combines one of those nine labels
+with the six reviewed OS-code categories. Unsupported operations, codes, or
+string forms retain the generic category, and raw messages are never emitted.
+A matching SDK binding and fresh protected run remain required before acceptance.
 
 ## Exact inputs
 
@@ -39,7 +42,7 @@ SDK binding and fresh protected run remain required before acceptance.
 - SDK package candidate `1597835325cf3762b51408ff0a565037eeb25f64`;
 - Cave authority `d20d83c46ba0c32433ce8dc6a358fb14b6bd0e45`, tree
   `7ff358ac42a9d94ae5feb1f08e2af64a5513e78e`, release `0.3.12`;
-- Coven daemon and observation-test source `705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4`;
+- Coven daemon and observation-test source `c0c979cdee96327bf24218bc7c7ecb90d719cb27`;
 - Chat native client remains at `721437b84026c042e431b0882dcd14fdb29ac07d`
   in its frozen Cargo manifest and lock;
 - Chat conformance driver support at the exact `harness.revision` and
@@ -1209,20 +1212,20 @@ The later SDK validator repin must use these exact committed file bytes:
 
 | File | Bytes | SHA-256 |
 | --- | ---: | --- |
-| `.github/workflows/client-v1-conformance.yml` | 465,045 | `6f1eebccd436914523fc6fe7f7ef97e34da65b4e313bb3aa37626218ce199fef` |
+| `.github/workflows/client-v1-conformance.yml` | 465,045 | `da836653133fde665d886ea1d049c53c7d128c92660a8983d098f6b28de41275` |
 | `scripts/contract-canary.mjs` | 40,116 | `1683e2484a228b89ee241b9b434f277895bb6113fa1c2f7051267563b2582380` |
 | `scripts/executable-resolution.mjs` | 9,154 | `31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430` |
 | `scripts/owned-temp-directory.mjs` | 6,965 | `a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095` |
 | `scripts/phase1-artifact-secret-scan.mjs` | 21,183 | `be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a` |
 | `scripts/phase1-conformance-lock.mjs` | 48,961 | `54c960fac12737013ebf2490c9cae121e7e77c027138eba9e4e3a882bd48c389` |
-| `scripts/phase1-conformance.mjs` | 204,500 | `f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5` |
+| `scripts/phase1-conformance.mjs` | 204,949 | `c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41` |
 | `scripts/phase1-evidence-contract.mjs` | 15,088 | `24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f` |
 | `scripts/phase1-evidence-runtime.mjs` | 6,078 | `3d227c354e6d908c5912d2b8244336e3b79c3bbd4dec79b0ad219ed65b8cb159` |
 | `scripts/phase1-linux-secret-service.mjs` | 4,270 | `ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92` |
 | `scripts/phase1-macos-keychain.mjs` | 5,091 | `ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4` |
 | `scripts/phase1-process-supervisor.mjs` | 3,820 | `16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c` |
 | `scripts/phase1-schema-v2-evidence.mjs` | 52,505 | `0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8` |
-| `scripts/phase1-schema-v2-producer.mjs` | 185,403 | `5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e` |
+| `scripts/phase1-schema-v2-producer.mjs` | 186,184 | `0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce` |
 | `scripts/process-owned-artifact-root.mjs` | 11,788 | `426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624` |
 | `scripts/supervised-exec.mjs` | 2,875 | `a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b` |
 | `scripts/supervisor-status.mjs` | 854 | `ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e` |

docs/roadmap.md

@@ -2,24 +2,24 @@
 
 ## Protected validation checkpoint, 2026-09-10 UTC
 
-[Run 34431068139](https://github.com/OpenCoven/chat/actions/runs/34431068139),
-attempt 1, used merged Chat #198 at `83518c85605a69089ef96fe31206cfa25741d5e4`
-and SDK #195 validator `c02993c468808c84e39255caa185f2399db16ba0`. Both validator
+[Run 34435223248](https://github.com/OpenCoven/chat/actions/runs/34435223248),
+attempt 1, used merged Chat #199 at `724690e64c4be820bdf4e0e1f8c568db516ba490`
+and SDK #196 validator `a5c7e38ecc905a6fdb9c9a3e704c6395ec2df02a`. Both validator
 scopes matched before protected approval. Coven daemon and observation source
 was `705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4`, including Coven #982's test repair.
 The frozen Chat native client remains at Coven `721437b8`.
 
-Linux artifact `10134896616` and Darwin artifact `10135000700` were downloaded
+Linux artifact `10136315804` and Darwin artifact `10136396539` were downloaded
 and verified against this attempt: all 110 Cave, 46 SDK, and 41 Chat assertions
-passed with matching identities, digests, timing, and clean scans. Windows failed
-at `phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error`.
-This identifies a returned writer error, superseding the earlier timing-assertion
-failure. The underlying OS error and operation remain unclassified.
-
-Bounded OS-code diagnostics are being prepared without changing the status
-writer, observation selection, resource limits, or dependency settings. They
-require updated harness authority, workflow digests, and a matching SDK validator
-before fresh protected validation. Ordinary CI is not protected acceptance.
+passed with matching identities, digests, timing, and clean scans. Windows failed at
+`phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error.access-denied`.
+This identifies Windows OS code 5 while preserving the writer operation as the
+remaining unknown. Coven #985 merged nine fixed operation labels at
+`c0c979cdee96327bf24218bc7c7ecb90d719cb27`; native Windows and the retried
+Linux suite passed. The staged Chat binding selects that source and classifies
+only the reviewed operation/code combinations without exposing raw output.
+Updated harness authority and a matching SDK validator are required before
+fresh protected validation. Ordinary CI is not protected acceptance.
 
 The run is terminal failed. Validation, attestation, and aggregation were skipped;
 publishing remains disabled and [SDK #38](https://github.com/OpenCoven/sdk/issues/38)

phase1-conformance.lock.json

@@ -14,20 +14,20 @@
   },
   "coven": {
     "repository": "OpenCoven/coven",
-    "revision": "705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4"
+    "revision": "c0c979cdee96327bf24218bc7c7ecb90d719cb27"
   },
   "harness": {
     "repository": "OpenCoven/chat",
-    "revision": "1063456c397dea3b871862d3cc3a70a0b8e2392a"
+    "revision": "d27fe99d6d75f94962ddff1a3c24d1a0b21e56c2"
   },
   "harnessAuthority": {
-    "revision": "1063456c397dea3b871862d3cc3a70a0b8e2392a",
-    "tree": "01d77e5cb856c4ce05f55f260d78563df924d2be",
+    "revision": "d27fe99d6d75f94962ddff1a3c24d1a0b21e56c2",
+    "tree": "141c35fbd37f252d5b274f91963227c0b946e857",
     "files": [
       {
         "path": "scripts/phase1-conformance.mjs",
-        "blob": "82dc46726a7d10f23ec435d7ed81cd7065aad1bc",
-        "sha256": "f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5"
+        "blob": "d6dfbf230fda3dd5a1734d9369b72a35f4e77804",
+        "sha256": "c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41"
       },
       {
         "path": "scripts/phase1-conformance-launcher.sh",
@@ -81,8 +81,8 @@
       },
       {
         "path": "scripts/phase1-schema-v2-producer.mjs",
-        "blob": "67814e324dcd7f71f43b809ef057dff57765c9f2",
-        "sha256": "5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e"
+        "blob": "6c392ec4c76c4bee091ffe7a5f7b44f4bc9500e7",
+        "sha256": "0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce"
       },
       {
         "path": "scripts/phase1-linux-secret-service.mjs",
@@ -146,8 +146,8 @@
       },
       {
         "path": ".github/workflows/client-v1-conformance.yml",
-        "blob": "a4e609df4c31ec1360d5229c03c618f7b6f865b3",
-        "sha256": "6f1eebccd436914523fc6fe7f7ef97e34da65b4e313bb3aa37626218ce199fef"
+        "blob": "34a22f9d7caf9244cd31315d0b6066a133aed744",
+        "sha256": "da836653133fde665d886ea1d049c53c7d128c92660a8983d098f6b28de41275"
       }
     ],
     "productionDeltas": [

scripts/phase1-conformance.mjs

@@ -83,6 +83,25 @@ const caveBuildNodeOptions = '--max-old-space-size=6144';
 const caveBuildReportedCpuTotal = '2';
 const rpcTimeoutMs = 10_000;
 const caveConformanceTimeoutMs = 15 * 60_000;
+const statusWriterFailureStages = [
+  'create-temporary-file',
+  'write-contents',
+  'write-newline',
+  'sync-temporary-file',
+  'convert-security-descriptor',
+  'open-process-token',
+  'read-process-token',
+  'apply-owner-only-security',
+  'replace-status-file',
+];
+const statusWriterErrorCategories = [
+  'access-denied',
+  'sharing-violation',
+  'privilege-not-held',
+  'invalid-owner',
+  'file-not-found',
+  'path-not-found',
+];
 const approvedCommandFailureReasons = new Set([
   'spawn',
   'tracking',
@@ -562,12 +581,10 @@ const publicPhase1DiagnosticIds = new Set([
     'result-timeout',
     'result-disconnected',
     'writer-error',
-    'writer-error.access-denied',
-    'writer-error.sharing-violation',
-    'writer-error.privilege-not-held',
-    'writer-error.invalid-owner',
-    'writer-error.file-not-found',
-    'writer-error.path-not-found',
+    ...statusWriterErrorCategories.map((category) => `writer-error.${category}`),
+    ...statusWriterFailureStages.flatMap((stage) =>
+      statusWriterErrorCategories.map((category) => `writer-error.${stage}.${category}`),
+    ),
     'writer-join',
     'readback',
     'content',

scripts/phase1-schema-v2-producer.mjs

@@ -112,6 +112,25 @@ const schemaV2NativeFailureStages = new Set([
   'isolation-proof',
 ]);
 const boundedSpawnErrorCodes = ['ENOENT', 'EACCES', 'EPERM', 'EINVAL', 'E2BIG', 'ENOMEM'];
+const statusWriterFailureStages = [
+  'create-temporary-file',
+  'write-contents',
+  'write-newline',
+  'sync-temporary-file',
+  'convert-security-descriptor',
+  'open-process-token',
+  'read-process-token',
+  'apply-owner-only-security',
+  'replace-status-file',
+];
+const statusWriterErrorCategories = [
+  'access-denied',
+  'sharing-violation',
+  'privilege-not-held',
+  'invalid-owner',
+  'file-not-found',
+  'path-not-found',
+];
 const cargoBuildFailureCategories = [
   'timeout',
   'output-limit',
@@ -314,12 +333,10 @@ const publicFailureDiagnosticSet = new Set([
     'result-timeout',
     'result-disconnected',
     'writer-error',
-    'writer-error.access-denied',
-    'writer-error.sharing-violation',
-    'writer-error.privilege-not-held',
-    'writer-error.invalid-owner',
-    'writer-error.file-not-found',
-    'writer-error.path-not-found',
+    ...statusWriterErrorCategories.map((category) => `writer-error.${category}`),
+    ...statusWriterFailureStages.flatMap((stage) =>
+      statusWriterErrorCategories.map((category) => `writer-error.${stage}.${category}`),
+    ),
     'writer-join',
     'readback',
     'content',
@@ -1182,16 +1199,17 @@ export function schemaV2FailureDiagnostic(error, activeStage) {
             // Inspect only the structured OS code at the start of this exact writer error.
             // The localized message and any private trailing output never become diagnostics.
             const writerRecord =
-              /^replace status after reader closes: Io \{ operation: "failed to write owner-only Windows daemon status", source: Os \{ code: (2|3|5|32|1307|1314), kind: [A-Za-z]+, message: "((?:[^"\\\r\n]|\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{[0-9a-fA-F]{1,6}\}))*)" \} \}$/u.exec(
+              /^replace status after reader closes: Io \{ operation: "failed to write owner-only Windows daemon status(?:: (create-temporary-file|write-contents|write-newline|sync-temporary-file|convert-security-descriptor|open-process-token|read-process-token|apply-owner-only-security|replace-status-file))?", source: Os \{ code: (2|3|5|32|1307|1314), kind: [A-Za-z]+, message: "((?:[^"\\\r\n]|\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{[0-9a-fA-F]{1,6}\}))*)" \} \}$/u.exec(
                 message,
               );
-            const writerCode = writerRecord?.[1];
+            const writerStage = writerRecord?.[1];
+            const writerCode = writerRecord?.[2];
             // Scan complete escape tokens so a literal backslash before "u" is not
             // mistaken for a Unicode escape. Rust strings exclude surrogate scalars.
             const validScalars =
               writerRecord &&
               [
-                ...writerRecord[2].matchAll(
+                ...writerRecord[3].matchAll(
                   /\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{([0-9a-fA-F]{1,6})\})/gu,
                 ),
               ].every((escapeToken) => {
@@ -1208,7 +1226,8 @@ export function schemaV2FailureDiagnostic(error, activeStage) {
               1314: 'privilege-not-held',
             };
             if (writerCode && validScalars) {
-              return `${base}.assertion.writer-error.${writerCategories[writerCode]}`;
+              const stageCategory = writerStage ? `.${writerStage}` : '';
+              return `${base}.assertion.writer-error${stageCategory}.${writerCategories[writerCode]}`;
             }
             const categories = [
               [/^(?:create status replacement home|write current status):/u, 'setup'],