[P2] Doctor/Windows: execute the confinement primitive and settlement corpus

[wsdt]

[P2] Doctor/Windows: execute the confinement primitive and settlement corpus

Review baseline and scope

Reviewed source: c9d32008e98d0e1711f47cb739f61c42376b884e on main, 22 September 2026.
Classification: REAL WINDOWS EXECUTION.
Predecessors: #236.
This replaces their remaining work; closing a predecessor during backlog migration is not a claim that its original scope was completed.

Already delivered — do not rebuild

The host-independent confinement/capsule/refusal tests exist. The latest evidence corrects the older never-compiled claim: Windows Server 2025 job 105948054658 in run 35462242188 compiled the cfg(windows) source at 7cab8aa. That selector executed no doctor::windows_confinement function, so restricted-token/child/job/ACL/settlement behavior is still unproved.

Remaining implementation / execution

• Use a real explicitly provisioned Windows host to execute the owning restricted-token, child launch, job-object, ACL and settlement tests.
• Fix any actual native failures and make the selected CI gate require nonzero execution of the relevant runtime functions, not incidental compilation.
• Retain exact host/toolchain/commit/job evidence and update the Windows support/nonclaim statement.

Acceptance evidence

• The real Win32 primitives execute under the declared host policy and hostile corpus.
• Timeout, cancellation, descendants, resource limits, cleanup and handle settlement meet the stated contract.
• Missing privileges or provisioning are explicit failures/blocks; a cross-compile or zero-function selector is not acceptance.

Boundaries

Do not reimplement the completed host-independent contract or misreport the current source as never compiled. A task description is not an authorization for provider spend, signing, publication, remote deployment or a change to support policy. Preserve existing stable identities, explicit profile limits, source authority and non-vacuous acceptance gates.

Evidence and implementation entry points

• Issue #236 update
• Repository entry point: crates/semaprax-native-rust-interop-platform-sys/src/doctor/windows_confinement (review at the pinned revision).
• Repository entry point: docs/DOCTOR-PRODUCTION-PROVISIONER-WINDOWS-V1.md (review at the pinned revision).

Test results described above are retained repository evidence, not a fresh full test run performed by this backlog review. Re-run the owning gates for the implementation being accepted.

[wsdt]

Coordinator update (2026-09-23)

Status: blocked on a native Windows runner; no cross-host acceptance claim.

The cfg(windows) source has historical compilation evidence, but the restricted-token/CreateProcessAsUserW/job-object/ACL primitive is not wired to a landed non-vacuous native gate on this macOS arm64 host.

Next step: provision the native Windows host/toolchain and operator authority, complete the bounded hostile runtime selector/gate, and retain exact settlement evidence. Cross-compilation is not a substitute. The issue remains open.

[wsdt]

R24 hosted Windows runtime milestone at exact main c6bf990: dispatch-only run 35986090171, Windows Server 2025 job 107588985436, compiled the cfg(windows) crate and executed both explicitly selected primitive tests: 2 passed, 0 failed, 0 ignored, 110 filtered. The normal path exercised restricted child launch, ACL scratch, job/descendant limit and settled cleanup; the timeout path exercised termination, cancellation and scratch cleanup. The gate self-test refuses missing Windows evidence, and the real gate fails on zero selected runtime tests. Two prior exact-head runs exposed genuine scratch-cleanup ordering bugs, fixed in 962f544 and c6bf990 before this green run. Local verification was limited to package rustfmt/diff and one sticky-settlement selector; no full local gate ran. This is a proven two-test hosted slice, not complete R24 acceptance: broader hostile cases, resource-limit and handle-settlement coverage, and public support policy remain open. Keep issue open.

[wsdt]

R24 implementation/hosted evidence update: main 3d4220b adds three live Win32 cases (actual job descendant at timeout using a test-only two-process override after asserting production limit one; exact nonzero-exit settlement/cleanup; repeated filesystem-stage refusal with stable handle count), a bounded post-kill empty-job drain, and an exact five-case fail-closed gate. Windows Server 2025 run 35988348061, job 107596231695 compiled the cfg(windows) crate and executed all five named tests: 5 passed, 0 failed, 0 ignored, 113 filtered. The independent review found no correctness blocker; local verification was limited to Python gate self-test/plan, crate rustfmt and diff checks, not a full local gate. This is strong physical evidence for the selected runtime cases, but the fixture capsule signature is unverified, the broader hostile corpus and restricted-token refinement remain, and no public Windows production-support promotion is claimed. Keep R24 open.

[wsdt]

Implementation and exact-host evidence update: main now contains the shared signed-capsule Windows admission batch (3b790471), its Windows-only fixture type fix (c608b8d8), and evidence documentation (49efb6ad). Capsule-v1 architecture bytes are explicitly OS-bound: Linux 1/2, Windows 3/4; Windows refuses signed Linux 1 and 2 before token/job/filesystem effects, and the production parser fails closed without a valid compile-time release key. The focused Windows Server 2025 job 107609259218 in run https://github.com/wavect/semaprax/actions/runs/35992373373 executed the exact nine-case selector at c608b8d: 9 passed, 0 failed, 0 ignored, 114 filtered. Six cases are live confinement/settlement runtime tests using a deterministic test-only key; three are missing-anchor, bad-signature, and both-Linux-code refusals. An earlier exact-head attempt at 3b79047 failed at compilation in the Windows-only test fixture and executed zero cases; it is not counted as a pass. The shared capsule architecture regression separately passed 1/1 locally. This is not release-anchor provisioning, artifact/executable digest binding, a complete hostile corpus, or public Windows support; issue remains open for those acceptance gaps. No full local gate ran.

[wsdt]

Additional bounded R24 progress on main: f4d3291f adds a tenth exact hosted Windows case that installs and verifies a broad inheritable ACE on a private parent, launches the actual restricted child, and reads back the protected scratch DACL to require only the intended explicit token-user ACE (no inherited flags), then settles and cleans the fixture. Windows Server 2025 run https://github.com/wavect/semaprax/actions/runs/35993882814, job 107614131433, at exact SHA f4d3291 passed all 10 selected tests, 0 failed, 0 ignored, 114 filtered. Evidence documentation 8d9e80f0 is also on main. This confirms only the named hostile-parent ACL case; it is not a general Windows filesystem-isolation proof. Exact signed artifact/executable binding remains open because the current spawn API has no held request/bundle/image carriers and reopens an exe pathname at launch. No production trust anchor or public Windows support is claimed; issue remains open. No full local gate ran.

[wsdt]

Coordinator update (2026-09-27, branch wavect/v070, not merged to main)

Status: blocked. Needs a Windows host. No code change.

Evidence is local (macOS arm64) only; no hosted run exists because Actions credits are exhausted. Tracked in PR #314 (wavect/v070 at b27f9cb2; full --lib 5061 passed, 0 failed locally). Handoff: semaprax-codex-execution-kit/HANDOFF-v070.md.

[wsdt]

Superseded by wavect/semaprax#333 (remaining work from #299), which contains only the remaining work after review of wavect/v070 at 1ae35afe83f62f405b979f57ac90772cfec9daca (PR #314).

Already delivered: There is real historical Windows Server 2025 runtime evidence, including ten selected tests for restricted launch, descendant termination, settlement and hostile-parent ACL handling. Do not reopen this as if the code had only cross-compiled.

Remaining: The last detailed implementation record leaves signed artifact/executable binding open: the spawn boundary reopens an executable pathname rather than consuming held request/bundle/image carriers. The full hostile/resource/handle-settlement scope is also not established.

This closure is a backlog migration, not a claim that the remaining work is completed or abandoned. The replacement remains open. Hosted-evidence-only gaps have not been carried forward.

This review did not rerun the repository's test suite, and closure does not merge the branch or authorize a release.