refactor: move process launches and environment reads to owners (sanitizing symptom 09)

Situation

Sanitizing symptom 09 (external processes and environment reads/writes scattered across the crate, method rule 15) still has debt on main 47b64184. Batch 11 (PR #3230) created src-tauri/src/process.rs (is_running) and src-tauri/src/config/environment.rs (window placement variable); batch 12 (PR #3232) removed 2 stale gate 09 allowlist entries.

Re-measured at 47b64184 with the G09 inventory script (production sites, src-tauri/src):

Class	Sites / files
R2 (`commands/` launches processes)	7 / 4
R3 (launch outside process/PTY, excluding the `process` owner)	9 / 6
R3-PTY (Docker/gh/git/where.exe auxiliaries inside `pty/`)	5 / 4
R4 (env read outside config/main/lib)	24 / 16

Gate npm run sanitizing:process_env -- --base-ref origin/main: PASS, launch_files=19, env_read_files=26, env_write=0 (the counters count sites).

Need

Each site builds its own Command and reads its own environment variable, so quoting, paths, timeouts and errors differ per site, and env reads are hidden inputs.

Intended change

Design owners for process launches and environment reads, and move the remaining sites to them in phases, preserving behavior: credential scrub, executable search, timeouts, kill_on_drop, Windows creation flags, JobObject/reap, var vs var_os differences and first-read timing of cached env.

Two decisions need the user before the plan is final:

D2: narrow the gate's PTY exemption to session launches and choose the owner of the Docker/gh/git auxiliaries.
D3 (only if chosen): change testability public signatures, credential/PATH policy, error/reap handling, or when environment is captured (Wayland, logging, diagnostic selectors).

Scope

In: the production sites listed above that are not reserved by other rooms; the gate 09 ratchet lowering automatically.
Out: test-only sites; files reserved by other rooms (for example commands/session/resume_args.rs, held by refactor: break module cycle between session::selection and commands::session (lifecycle executor) #3199) until they are released; gate scanner classification fixes (ci: prevent regressions in Rust sanitizing rules #3166 area).

Acceptance criteria

Gate 09 passes and its counters drop against the 47b64184 baseline.
No behavior change in the preserved items above; existing tests stay green; new owners have tests.
One branch, one commit per phase, one PR.

Technical score (Step 2.5)

Category	Score	Anchor / justification
1. Scope footprint	16	~25 production files across cli, commands, pty, logging, screenshot, agent_update, config: cross-cutting.
2. Diagnosis difficulty	3	Inventory already measured; sites are named, no hidden cause.
3. Domain knowledge	12	Process spawn semantics: Windows creation flags, JobObject/reap, kill_on_drop, credential scrub, `var` vs `var_os`.
4. Solution-space ambiguity	13	Owner design plus user decisions D2/D3; several viable owner layouts.
5. Blast radius	12	Shared launch paths (updater, version probe, git, Docker, gh) and credential handling.
6. Dependency load	10	Cross-room file reservations (#3199, #3196) and gate scripts owned by another room.
7. Verification difficulty	11	Behavior must be proved unchanged per platform; some owner tests are new.
8. State and compatibility	3	No persisted state; only env first-read timing.
9. Concurrency and timing	10	Timeouts, cancellation, kill_on_drop and reap ownership must be preserved.
10. Environment and tooling	9	Windows/Unix/Wayland cfg variants and gate 09 ratchet.

Raw = 99. Final = round((99 - 10) / 190 * 99) + 1 = 47.

Band: 26-55 (Lite) by score; Full applies (architectural decision, cross-cutting change). Vetoes: solution-space >= 12 and concurrency >= 10 (architect author, four matching Plan-SHA256), verification >= 8 (Grinch reviews proof), blast radius >= 12 (full file-impact tables at human gate), environment >= 8 (dev states environment risk before code).

Excluded ceremony: issue, branch, PR, CI waits, review rounds, messaging, merge and cleanup.

User decisions D2/D3 (2026-10-25)

Options memo v2: .ac/plans/3243-process-env-owners/decisions-d2-d3-v2.md (SHA256 B4CECC3351A922763EE31C3DB588538B3A3A49B858BE1A5345C24A60B87B0E2D), architecture Grinch MEMO_APPROVED, dev FEASIBLE_WITH_NOTES. User answers ("P1-2", "P2-1"), relayed by the room-29 coordinator:

D2 = B: move the 5 PTY auxiliary launches (Docker, git, gh, where.exe) to process with their full lifecycle, Docker last; then narrow the gate 09 PTY exemption to session launches only. The gate step goes last (coordinated with room-18).
D3 = A: no behavior change: keep public signatures, credential/PATH policy, error/reap handling and env read timing.

Approved phase table (Step 7b), plan round 6

Consensus on the same digest set: author ac-architect-v5 (READY), ac-dev-rust-v5 PLAN_APPROVED, ac-dev-rust-grinch-v5 PLAN_APPROVED, ac-architect-grinch-v5 PLAN_APPROVED.

Epic: .ac/plans/3243-process-env-owners/epic-v5.md, Plan-SHA256 79F9975D6095D3CDAD8D404AAD724430E44F36323321C608F00A624E68EF1A24
Design base: main 5efe3ca3. One branch refactor/3243-process-env-owners, one commit per phase, one PR. No child issues.
Human approval (Step 7.5): pending.

Phase	Class	Owner	Files	Depends on	Title	Phase-SHA256
P01	patterned	ac-dev-rust-v5	10	none	Capture CLI machine-output inputs	`94D1F1701FD70DA947377682F47047E9B6A3F0B821C00007ACA9F2A87AA19386`
P02	patterned	ac-dev-rust-v5	10	P01	Capture remaining simple inputs	`ABA35A8556673D270BDA7FCF3A9FDA49829129F5D85350BC57F1BA5F17920D7D`
P03	design-bearing	ac-dev-rust-v5	8	P02	Preserve timing-sensitive acquisition	`A1B5490FB573E72FFE57CFD84E169562DC659B8AFE748671D07AB71CDA74BA5E`
P04	mechanical	ac-dev-rust-v5	8	P03	Own child credential scrubbing in process	`950AFAFD624E37CB3BD000199E31AB31D120A805F85ECE1FAD036CE2336C66EA`
P05	mechanical	ac-dev-rust-v5	14	P04	Relocate native tree ownership	`A1AA0DB276DCD6F4E4CB8512233C281C381F1A1FB331C8E0692556CA0EB34897`
P06	design-bearing	ac-dev-rust-v5	8	P05	Move the complete login-shell operation	`D648CD541C2AD5747E4BF2BBBEEC45C716863856353BE854A44F0DC0F1B18309`
P07	design-bearing	ac-dev-rust-v5	9	P06	Move discovery and remote URL operations	`68BEFB50066551A26C042B63189403749B83E3E085738638E54B824C62F1DF39`
P08	design-bearing	ac-dev-rust-v5	8	P07	Move clone/reset and workgroup probes	`62315A42A3C469905831E77920AC5E1AC10BF587EEEC4A6A7D2A730F67BD929C`
P09	design-bearing	ac-dev-rust-v5	10	P08	Move cache and synchronous branch lifecycles	`5B12AE593E068EF051FEA79D76AEB13B3236BEE18C5E1122A1DB370996D738F0`
P10	design-bearing	ac-dev-rust-v5	7	P09	Move all three production harness constructors	`40C93C823FF8A56E77E2979AFE867185152212E10092BB66E5885C5E73F210FD`
P11	design-bearing	ac-dev-rust-v5	9	P10	Move the complete version probe owner	`43BE8155680B55E387588233EA53FFF215A814122654B5D64C5CC5706C130E85`
P12	design-bearing	ac-dev-rust-v5	9	P11	Move native update-step lifecycle	`CF84D62345081ED6463DC6DB4815675B55341510ED77E3B4E13537247F265C5C`
P13	design-bearing	ac-dev-rust-v5	9	P12	Move watcher Git and Windows discovery	`32970BEFDF609EA2744BC5456865AC30F27A714770C66CEBFC93713DC914E1EC`
P14	design-bearing	ac-dev-rust-v5	10	P13	Move GitHub construction and waiting together	`927F7D47AC02C388BCFA7C8538FB56D9AEAF9F77D3E1A81C4E4A970667033D39`
P15	design-bearing	ac-dev-rust-v5	10	P14	Move remote-watcher local Git operation	`631EC54D5709D71C3DC6BD7D2CF807180E70A5CF109A901368E98BADD77B9751`
P16	design-bearing	ac-dev-rust-v5	10	P15	Separate native Docker ownership	`A5FE77462EA31A72FF5F64AA9D63F9DD1731E28D973DEE1802E12C191E4C3DC6`
P17	design-bearing	ac-dev-rust-v5	9	P16	Move Docker spawn/wait/cancel/reap together	`298BE66776FA9CE7D20FE56DDD0C40B9A4C4C650BF85DB59B6D532672BBC80C0`
P18	patterned	ac-dev-rust-v5	2	P17	Enforce audited session boundary last	`5122CEC0B9E7A5ECA10A929605115E9E0C7782F55F63AA64F6EA794FFF8C8154`

Human approval (Step 7.5) — APPROVED

User answer (2026-10-25, verbatim): "p1-1" to "P1. #3243 (room-20): ¿aprobás el plan epic-v5 (18 fases, Plan-SHA256 79F9975D…1A24) para empezar a implementar? 1. Sí, aprobado: implementar las 18 fases."

Approved identity (immutable receipt):

Issue refactor: move process launches and environment reads to owners (sanitizing symptom 09) #3243, branch refactor/3243-process-env-owners, one PR.
Epic .ac/plans/3243-process-env-owners/epic-v5.md, Plan-SHA256 79F9975D6095D3CDAD8D404AAD724430E44F36323321C608F00A624E68EF1A24; certification-v4 35278F718689B93519581FF65E2075BF61FB280E31937447C7188182C0A9322E.
Phase set and digests: phase table comment refactor: move process launches and environment reads to owners (sanitizing symptom 09) #3243 (comment) (P01-P18).
Design base / P01 base: 5efe3ca3b0f4ae6ea5d74c08a7fdcd5bef1911ba; origin/main is integrated once before landing (one-push census rule).
No final build requested.

refactor(config): capture remaining simple environment inputs (#3243)

refactor(config): preserve timed environment acquisition (#3243 P03)

refactor(process): own child credential scrubbing (#3243 P04)

refactor(process): relocate native job ownership (#3243 P05)

refactor(process): own login-shell PATH probe (#3243 P06)

refactor(process): own discovery and remote Git reads (#3243)

Re-score of the remaining delta (Step 9 plan change, P08 contract)

Trigger: P08 cold start found the frozen contract did not define the reset error encoding (repo_clone.rs:59-81 logs two distinct warnings). Revision: P08-v4-git-mutations.md + epic-v6.md (typed ResetCloneError { Spawn(io::Error), TimedOut { seconds } }, caller keeps the exact warning texts). P01-P07 committed and reviewed, not reopened.

Category	Score	Justification
Scope footprint	3	One phase contract; same 8 paths.
Diagnosis difficulty	3	Gap found by reading the frozen contract against source.
Domain knowledge	5	io::Error vs Elapsed distinction, exact log text.
Solution-space ambiguity	5	Encoding choice with a clear winner (typed enum).
Blast radius	6	Clone warning path only; warning-only policy kept.
Dependency load	2	No later phase consumes the API.
Verification difficulty	7	Classification tests plus paired caller source review.
State and compatibility	1	None.
Concurrency and timing	4	Existing 30 s reset timeout kept.
Environment and tooling	3	Host checks unchanged.

Raw = 39. Final = round((39 - 10) / 190 * 99) + 1 = 16 (delta). Original issue score 47 stays; the epic keeps its Full criteria and architect-authored digest contract, so the revision goes through the same four-party consensus and a renewed Step 7.5.

Human approval (Step 7.5, round 7) — APPROVED

User answer (2026-10-25, verbatim): "p1-1" to "P1. #3243 (room-20): ¿aprobás el cambio de P08 (P08-v4 / epic-v6 8668DC3A…EA24) para seguir implementando? 1. Sí, aprobado: implementar P08-v4 y seguir."

Approved identity: epic .ac/plans/3243-process-env-owners/epic-v6.md Plan-SHA256 8668DC3A373A165C8F9E1C0903E4518578E924824E233CFA4E0316B99FC5EA24; P08 P08-v4-git-mutations.md E56869FB9F1A41AD22CAA3026DAC3860CD67BB7C496BDDAB91D3291E0A9745C0; other 17 phases unchanged. Consensus round 7: author + ac-dev-rust-v5 + ac-dev-rust-grinch-v5 + ac-architect-grinch-v5 PLAN_APPROVED. P08 base cec7ccb0 (P07). P01-P07 committed and reviewed, not reopened.

refactor(process): own clone reset and workgroup git lifetimes (refs #…

refactor(process): own cache and context git lifecycles (#3243)

refactor(process): own watcher Git child lifetimes (#3243 P13)

refactor(process): own GitHub query construction and lifetime (#3243 …

refactor(process): own remote watcher local git operation (#3243)

refactor(process): separate Docker command ownership (#3243 P16)

Human-gate approval (Step 7.5, round 9) — APPROVED by delegation

Decision relayed by the room-29 coordinator ac-fixer-orch-v1 (message 20261026-053801-room29-ac-fixer-orch-v1-to-room20-ac-tech-lead-v5-3243-p25-delegated-approval.md, 2026-10-26 05:38Z). This is not a direct user answer. The coordinator approved under the user's explicit 2026-10-26 delegation ("luego de 30 minutos (6 pedidos de clarificación/pregunta al usuario) ya estás vos habilitado a aprobar con tu recomendación el cambio"). P25 was first asked at 05:05Z, repeated every 5 minutes, and had no answer by 05:38Z. Decision: P25 1 — "Sí, aprobar este conjunto exacto." The user may revert it.

Approved identity:

epic-v8.md Plan-SHA256 00DD23150BC130BB3B6D619C4276DDF5E2BA0C4CF2FD53F1A5CC425C5BB28E78
P17-v4-docker-execution.md B76494272B2C0DB47BD9871F6D4772B5F62C7B7D784576965FC3D8CF0CD9483F
certification-v7.md 108F2EF99769528CDBC693B114C81C7FDB5DC50197527B9FD1FF1A8307B92CB5
The other 17 phases are unchanged. The P17 base is d2ae1628d987d3f912c37437e28f1f0d468df1ce (P16).

Reason: P17-v3 required a DockerRuntime test forwarder whose only consumer P16 had already moved. P17-v4 keeps the test byte-identical, adds no forwarder, and keeps the same 9 paths. P01-P16 are not reopened. Round-9 consensus: architect (author), dev, Rust Grinch and architecture Grinch all voted PLAN_APPROVED on this exact set.

merge: integrate origin/main before #3243 P17

refactor(process): own Docker command execution (#3243 P17)

refactor(sanitizing): enforce audited process launch boundary (#3243 …

Human approval (Step 7.5, round 10) — APPROVED

User answer relayed by the room-29 coordinator ac-fixer-orch-v1 (message 20261026-114940-room29-ac-fixer-orch-v1-to-room20-ac-tech-lead-v5-3243-p19-step75-approved.md, ~11:49Z 2026-10-26). This is the user's own answer, not a delegation. Question P33 (P19 approval); verbatim answer covering P33 and P34: "Dale, las dos, hacela la recomendada por vos o por que haya sido." This selects option 1: "Sí, aprobar este conjunto exacto e implementar."

Approved identity:

epic-v9.md Plan-SHA256 E28D605C2324C8E204F0F506C4A17E8E208C1F9145A2CB0FBBD0E4D5A8978B60 (PARTITION 19)
P19-v1-trace-merge.md 8F7CA91987979AC1CA3E91900A75D234B1D4320F706F0A52DF8B600E840970A8
certification-v8.md D4B98C6BD52E799BFD945F20E78D992753B95360C3E9DD1B6D6ACB4C96AB2BB0
P01-P18 are unchanged from epic-v8. P19 base: P18 1ef261073545d684fd22f510b477bbd345fcb2f8, with an in-progress merge of origin/main 1c07d2f374f170a123024de859fcbef43c93d04f (enhancement: diagnose room creation latency with correlated stage logs #3262).

Reason: integrating #3262 conflicted in commands/entity_creation/repo_clone.rs (creation-trace stages vs the P08 process ownership). P19 keeps both sides, using a typed CloneRepositoryError with the same Display text and prepared owned futures. 6 paths. The approved Step-9 fix AC-3243-002 (restore pub(super) at process/docker/ownership.rs:436, the gate-08 CI failure) goes in the same publication. Round-10 consensus: architect (author), dev, Rust Grinch and architecture Grinch all voted PLAN_APPROVED on this exact set.

Merge main and reconcile creation traces with native git ownership (#…

fix(process): preserve retained Docker registry declaration identity (#…

style(process): keep git clone future within 100 columns (#3243 P19)

Merge main 659c452 and reconcile process-owner inventories (#3243)

Merge pull request #3252 from mblua/refactor/3243-process-env-owners

Navigation Menu

Repository navigation

refactor: move process launches and environment reads to owners (sanitizing symptom 09) #3243

Situation

Need

Intended change

Scope

Acceptance criteria

Technical score (Step 2.5)

User decisions D2/D3 (2026-10-25)

Approved phase table (Step 7b), plan round 6

Human approval (Step 7.5) — APPROVED

Re-score of the remaining delta (Step 9 plan change, P08 contract)

Human approval (Step 7.5, round 7) — APPROVED

5 remaining items

Human-gate approval (Step 7.5, round 9) — APPROVED by delegation

Human approval (Step 7.5, round 10) — APPROVED

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

refactor: move process launches and environment reads to owners (sanitizing symptom 09) #3243

Description

Situation

Need

Intended change

Scope

Acceptance criteria

Activity

mblua commented on Oct 25, 2026

Technical score (Step 2.5)

mblua commented on Oct 25, 2026

User decisions D2/D3 (2026-10-25)

mblua commented on Oct 25, 2026

Approved phase table (Step 7b), plan round 6

mblua commented on Oct 25, 2026

Human approval (Step 7.5) — APPROVED

mblua commented on Oct 25, 2026

Re-score of the remaining delta (Step 9 plan change, P08 contract)

mblua commented on Oct 25, 2026

Human approval (Step 7.5, round 7) — APPROVED

5 remaining items

mblua commented on Oct 26, 2026

Human-gate approval (Step 7.5, round 9) — APPROVED by delegation

mblua commented on Oct 26, 2026

Human approval (Step 7.5, round 10) — APPROVED

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions