Private Windows build authority omits compiler search inputs and reads mutable Cargo source

[pawellisowski]

The private Windows builder accepts a changed compiler search environment without changing its canonical build authority. This reproduces on integration commit 8e2d1a8, tree 418f4dce816bd4f7e70c059d684bfb614020f904.

Repro: generate a valid aware-windows-repro-builder/v1 manifest and its local locator. Call exported verifyBuildAuthority({manifest, locator, env:{}}). Clone only the locator, replace its environment PATH, INCLUDE, LIB, and LIBPATH, and call the function again. Both calls return the same verified authority. controlledEnvironment subsequently forwards those unbound locations to Cargo/MSVC. No compiler execution or unauthorized input modification was necessary for this authority-validation probe.

Observed: named executable hashes and dependency inventories bind to the build ID, but compiler headers, import libraries, loader dependencies, and search order do not. The local Rust tools also point to rustup shims, so hashing those files alone does not identify the actual compiler/sysroot.

Expected: logical compiler/search inputs and their complete relevant file inventories bind to the manifest; builds execute verified private copies using direct compiler binaries. Original cache changes after verification must not affect the build: Cargo currently reads the original verified vendor root, while npm already uses a verified private materialization.

Related existing review findings: #480 (comment) and #480 (comment). Separate from #487, which covers physical vendor path leakage and byte inequality. Work is continuing on PR #480; no signing or promotion has occurred.

[pawellisowski]

The candidate fix now inventories the direct Rust bin/sysroot, MSVC binaries/headers/libraries and selected SDK components, materializes independent private copies, derives the compiler search environment from a closed descriptor, and privately copies Cargo vendor inputs. It also binds executable helper sources before import and adds an owned Windows debugger/job audit for compiler process and module provenance. FloLess independently validates the corresponding manifest and receipt semantics.

The native gate exposed a separate portability footgun in the existing recursive copy primitive: on this Windows x64 Node 24.14.0 host, cpSync(source, '<temporary-root>/Łódź/copy', {recursive:true}) returns but creates the copied content under a mojibake directory; the requested destination does not exist. A one-file standalone repro confirms it. Explicit mkdirSync plus copyFileSync preserves both Unicode directories and filenames. The candidate now uses inventoried explicit file copies, with a real filesystem regression and post-copy digest verification. No Unicode exclusion or new test skip was added.

Current status: 25 AWARE focused tests pass (one unchanged Windows file-symlink skip), and 12 FloLess builder tests pass (one unchanged unstaged-runtime skip). The actual private native compiler proof and independent code review are still running. Full fresh paired builds remain blocked on additional disk capacity. This is implementation progress, not completed reproducibility, signing or release evidence.