[lidge-jun]

Summary

Makes the Windows shards of the dev batch CI green again. In run 41491122166 (dev with #8103, #8104 and #8106), windows 7/11, 8/11 and 10/11 failed and 9/11 was cancelled at the 30-minute cap. The previous full Windows run on dev, 41262132337, was green on all eleven shards. Every failure traces to #8103 or to a test fixture that depends on Windows runner timing. None comes from #8106.

Shard	Failure	Root cause	Fix
windows 10/11	update-orchestrated-identity returns kind: "unknown"	The fixture used POSIX paths, which are not native on win32. The product also compared the source path character by character, so a valid Windows path written with / (which process.argv[1] can pass through unchanged) made a live install read as unknown.	Platform-rooted fixture. On win32 the product now treats / and \ as the same separator; dotted, doubled and wrong-suffix forms still fail closed.
windows 7/11	6 cases in update-bun-ownership-lease (exit 1/75, trace ancillary)	#8103 sends the Windows Bun replacement through runWindowsInstallerSync (--input-type=module -e, with the request on stdin). The fixture's spawnSync mock only knew the POSIX supervisor, so it answered with an unconfirmed result.	The fixture recognizes the exact bridge call (executable, script, request shape) and validates it as strictly as the POSIX branch.
windows 8/11	claude-intercept-acl-barrier: two cases ended at the 1 s ACL budget	The fixture stubbed icacls but not the PowerShell owner-ACL probe, which shares the same 1 s budget during lifecycle-lock preparation. The log shows deadline_before_spawn with budgetMs: -12.	Stub the owner runner, as claude-config-root-writer-barrier already does.
windows 9/11	update-mutation-guard reported 1258 unclassified findings, then the shard was silent until the cap	This lint only runs on Windows: on POSIX, Bun cannot start the TypeScript 7 sync client, so the cases skip. #8103 therefore landed with its scan never run.	Every #8103 site is reviewed into the existing tables, plus two orchestrated-module sidecars (tests/helpers/update-review-*.ts).

For windows 9/11, two more changes:

• The launcher rule now accepts exit 10 only for the exact enterMutation refusal branch. Seven mutants cover it.
• orchestrated-entry.ts launches its child through probeSpawn, the same function job.ts uses for its update worker, instead of a raw node:child_process import.

Windows timing:

• scripts/ci/test-durations.windows.tsv was refreshed by the tool from runs 41491122166 and 41462914814. Predicted load is even, about 1295 s per shard. Measured setup is 55–100 s. The worst completed job took 26.6 min.
• Fixed a needless wait. storage-policy's seedHome and two lab-read-surfaces cases left unfinalized db.prepare() statements, which keep the SQLite file open after close(). On Windows that blocked each afterEach removal for the full 15 s retry budget, and the swallowed error leaked the home: 14 cases, about 210 s. This was confirmed with lsof on macOS.

Rows for maintainer attention. These update-lint rows are classified by precedent, not by a guard. They are listed in the plan's Build outcome section:

• The orchestrated parent launches its update child. This is an ordinary launcher, like job.ts spawnGuiUpdateWorker; the child does its own mutex, lease, identity and home checks.
• orchestrated-child.mjs forwards signals to its own child, following the existing child.kill() rows.
• orchestrated-session.mjs writes its home marker while holding the mutex, by path (temp file, then rename). This assumes the OpenCodex home and its ancestors cannot be replaced by another principal; see the accepted residuals below. Result records go only through the descriptor validated against the parent's capability file.
• orchestrated-node-driver.mjs cleans up its own temp directory.
• The POSIX supervisor child's spawn, kill and marker sites are delegated from the guarded parent spawn at posix-install-supervisor.mjs:18.

No workflow, timeout or shard-count change. No test is skipped or loosened.

Plan, audit and evidence: devlog/_plan/261103_windows_batch_shards/010_plan.md.

Follow-ups (not in this PR):

• Run the update lint on POSIX CI, for example through Node, so a change like feat(update): orchestrated ocx update plan/apply contract (update.orchestrated/1) #8103 cannot land unscanned.
• Real Windows Job Object coverage for runWindowsInstallerSync.
• Two other Windows cases at about 15 s (routing-profile-management-editor "alias changes", routing-compatibility-boundaries CL-06).

Orchestrated update result handoff (pre-merge security review). #8103 let the orchestrated update child replace its preflight result at any absolute path it was given. The child now writes outcome records only through a descriptor it has validated against the capability document it was handed:

• The parent (createOrchestratedResultChannel()) creates a fresh temp directory holding one exclusively created capability file and passes the token in OCX_UPDATE_RESULT_CAPABILITY.
• Before any session write, mutex use or identity probe, the child accepts only a canonical, single-link, non-symlink regular file (owner-only on POSIX) whose size and entire content equal that capability document. It then publishes every record through the descriptor it validated: truncate, then write at explicit offsets. File identities are compared with BigInt stats.

The boundary is content-bound. A matching file shows that the destination holds the capability document; it does not prove which process wrote it. The child runs with the invoking user's authority.

Fixed in the final security round:

• Token scope. parseOrchestratedChildArgs deletes OCX_UPDATE_RESULT_CAPABILITY from the environment it parses, so probes, installers, sync and recovery subprocesses no longer inherit it. The Node launcher re-adds it only for the Bun CLI process that continues the same validated child (update is excluded from the Desktop handoff).
• Cleanup. The parent removes the result file and directory by path only on POSIX, and only when every ancestor is owned by the user or root and is not group- or other-writable, unless it is root-owned and sticky. Otherwise, and always on Windows, it leaves the channel in place. The channel then holds at most the parent's own capability or outcome record.
• Windows links. Canonical-path equality (realpathSync.native) rejects symbolic links and junctions in the destination path. A new test runs the check in both Node and Bun and leaves the target byte-identical. Other reparse-point kinds are not separately probed.

Accepted residuals, for maintainer acceptance:

• Cleanup still checks identity with lstat before a path-based unlink/rmdir. A swap inside the owner-only channel directory between those calls requires write access that already carries the user's authority.
• Marker publication in the OpenCodex home is path-based. It assumes the home and its ancestors cannot be replaced by another principal. That precondition is stated in structure/ops/service-and-sidecars.md but not enforced.

Independent Terra security review of the final round: NEAR-PASS, with no code-level blocker. Its remaining items were to push the reviewed commit, keep this description accurate, and get explicit acceptance of the home-ancestor precondition. The update-lint rows for these sites now state the same qualifications.

Verification

• Windows-only lint executed under Node through a bun:test shim. On dev HEAD, update-mutation-guard fails 2 of 4 (both lint cases), which reproduces windows 9/11. On this branch it passes 4 of 4, and update-mutation-scanner passes 193 of 193, including the exit-10 mutants. The Node scanner driver reports 0 failures, 0 policy violations, 0 contract mismatches and 0 unmatched sites.
• Identity: a scratch win32 simulation (node:path mapped to path.win32) returns unknown for C:/…/src/cli/index.ts on the old code and live on the new code. Dotted, doubled and wrong-suffix forms return unknown on both.
• ACL barrier, scratch red/green with the default owner runner stalled for 1.2 s: 10 of 30 cases fail with the old fixture, and 30 of 30 pass with the new one.
• Focused: bun test on the identity, bun-ownership-lease, acl-barrier, mutation-guard, mutation-scanner, ci-shard-balance, storage-policy, lab-read-surfaces, test-layout, test-layout-tooling, repo-hygiene and structure-ssot files: 216 pass, 191 skip (the Windows-only lint cases above), 0 fail. File-size and import-cycle ratchets: 25 pass.
• bun run typecheck, bun run structure:check and bun run privacy:scan pass.
• bun scripts/test.ts --changed=dev --parallel=1 has not exited 0 locally. The src/update/ change selects 1368 files through the server import graph, and the default 900 s cap is too short on this machine. With OCX_TEST_MAIN_TIMEOUT_MS=3600000, the run on 0fe6744 finished in 2238 s with 31,510 pass and 45 fail. All 45 failures are multi-second, timeout-shaped server HTTP cases (server-images, server-live, server-search, catalog-omit-disabled-native, live installation, plus the package-tree mtime cases that AGENTS.md lists as environment-only), seen at load average 4–7 with concurrent worktrees. server-search also fails on an exported dev HEAD tree, and none of these files is in this diff. On b4507ee, one run stalled in the tests/server/server-live* fixtures (main thread blocked on a lock inside Bun, with outbound HTTPS connections open). A rerun is in progress. The Ubuntu ci:full shards (test 1/4–4/4) passed on b4507ee in this PR's CI, so local coverage of those files is left to CI.
• Result handoff: the new session regressions cover:
  • rejected destinations, each left byte-identical: an arbitrary file, a padded or 4 MiB file, a wrong token, a hard link, symlinks, and group/other mode bits;
  • a path swapped after validation;
  • interrupted and oversized records, which classify as uncertain;
  • identity-bound cleanup;
  • real Bun and Node parent-to-child handoffs under a symlinked temp root.
  • final round: the token is absent from the parsed environment, from the npm fake installer and from the Bun-global fake npm/bun; the authorized child also runs through the Node launcher (bin/ocx.mjs) and reaches preflight; channels under a replaceable ancestor, or on Windows, are left in place; a destination reached through a directory link (a junction on Windows) is refused in both Node and Bun, with the target left byte-identical.
    The wp2 regressions fail on 51493e3 and the final-round token regressions fail on 6889003; all pass on this head. On b4507ee, the 21 focused files give 343 pass, 305 skip (Windows-only and root-only cases) and 0 fail. The update-lint scan reports 0 failures and 0 policy violations, with no contract mismatches or unmatched sites. update-capability-policy under the Node shim passes 108 of 109; the one failure is a macOS /var vs /private/var resolver artifact of the shim, and the file passes on Windows.
• Windows, final head: maintainer-authorized dispatch 41540752628 on b4507ee. All 11 Windows shards succeeded: 1/11 19.9, 2/11 24.9, 3/11 23.9, 4/11 21.6, 5/11 25.8, 6/11 24.6, 7/11 22.8, 8/11 25.4, 9/11 23.2, 10/11 23.7, 11/11 25.6 min. The new result-handoff tests ran and passed on Windows (windows 6/11): the junction refusal in both Bun and Node, the retained channel, and Bun and Node parent-to-child handoffs. Earlier dispatches: 41528054038 on 6889003 was green on all 11 Windows shards; 41510258811 on 0fe6744 failed only windows 2/11, which 51493e3 fixed.
• Intermittent pre-existing hang, outside this diff: in that dispatch, Linux test 1/4 was cancelled at its 20-minute cap (22:52:01–23:12:01Z). The last log line is at 22:58:41.87Z, in batch 48/73, in tests/responses/chat-completions-endpoint.test.ts: the proxy for "non-streaming /v1/chat/completions returns error status on upstream failure" had just started, and its un-timed fetch against a local upstream never returned. Nothing fix(ci): make the Windows batch shards green after #8103 #8109 changes is in that batch: its 12 files (xai, zai and zed provider tests and five tests/responses/chat-* files) do not reference update code. The batch runs in its own bun test process. The server's static import graph does reach src/update/, but the changed modules add only side-effect-free constants at load time, and the server calls only the unchanged detectInstall. The same shard passed in 13m05s in this PR's own CI on the same head.
• Local flake, outside this diff: on this macOS machine the update-orchestrated-entry "npm child fences..." case sometimes misses its fs.watch-driven overrun or completion event under load (about 3 of 13 runs). It is skipped on Windows and passed in the Ubuntu ci:full shards. Follow-up: replace those watch waits with polling.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (structure/ops/service-and-sidecars.md and structure/ops/update-supervised-recovery.md; the only user-visible change is that a Windows install launched with / separators is now recognized.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. (No auth, credential or workflow change. The orchestrated result handoff was hardened under independent Terra security review, final round NEAR-PASS with two accepted residuals listed above. The update-lint review rows are listed above for maintainer attention.)

Summary by CodeRabbit

• Bug Fixes

  • Improved Windows update identity checks to accept either path-separator style while rejecting unexpected source paths.
  • Improved update-launcher compatibility on Windows and installer handling across platform-specific scenarios.
  • Update results are written only through a file descriptor validated against the supplied capability document; this does not prove which process prepared the file.
  • Ensured SQLite test statements are finalized before databases close.

• Tests

  • Expanded checks for update-result validation, update-refusal handling, and platform-specific update behavior.
  • Updated Windows test-shard timing data and documented remaining verification work.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T19:09:53.708444Z	8234dc4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 6889003
• Latest commit, not reviewed: b4507ee

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: goat/fix-dev-batch-windows-shards
• File: .coderabbit.yaml
• Commit: 6889003
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3526e6f3-5d04-4af8-9ef3-4f577d1a82f7

Commits

Reviewing files that changed from the base of the PR and between 01799f3 and 6889003.

Files selected for processing: 2

• src/update/orchestrated-session.d.mts
• src/update/orchestrated-session.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

This change adds a capability-bound result channel for orchestrated update children. It also updates Windows path identity handling, test fixtures, and update-scanner review data, and records the investigation and outcomes for four Windows shard failures.

Changes: Orchestrated update result channel

Layer / File(s)	Summary
Result channel contract and validation src/update/orchestrated-session.mjs, src/update/orchestrated-session.d.mts	The parent creates a result channel and issues a capability tied to the result path. The child validates the destination and publishes outcomes through a validated descriptor. Channel reads and disposal check the recorded file and directory identities.
Child argument and driver wiring src/update/orchestrated-arguments.mjs, src/update/orchestrated-arguments.d.mts, src/update/orchestrated-entry.ts, src/update/orchestrated-node-driver.mjs, src/update/index.ts, bin/ocx.mjs	Child arguments require a valid result capability. The Node and Bun drivers pass the channel path and capability to children, read outcomes through the channel, and dispose of it when the child has stopped.
Channel integration and regression tests tests/update/update-orchestrated-arguments.test.ts, tests/update/update-orchestrated-entry.test.ts, tests/update/update-orchestrated-plan.test.ts, tests/update/update-orchestrated-session.test.ts, tests/cli/ocx-launcher-desktop-handoff.test.ts, tests/codex-integration/codex-shim-autorestore.test.ts	Tests cover capability parsing, child launch authorization, destination validation, result reads, cleanup, and Bun and Node child publication.

Windows shard compatibility and scanner coverage

Layer / File(s)	Summary
Windows identity and test fixtures src/update/orchestrated-identity.ts, tests/update/update-orchestrated-identity.test.ts, tests/helpers/update-bun-ownership-child.ts, tests/claude-integration/claude-intercept-acl-barrier.test.ts, tests/lab/lab-read-surfaces.test.ts, tests/storage/storage-policy.test.ts, structure/ops/service-and-sidecars.md	Identity comparisons treat / and \ as equivalent on Windows while retaining exact source-path matching. Tests use platform-native paths and cover mismatched and dotted paths. The installer fixture recognizes the Windows bridge, the ACL test stubs its owner-ACL runner, and SQLite tests finalize statements before database cleanup.
Update scanner review and refusal rule tests/helpers/update-review-table.ts, tests/helpers/update-review-orchestrated-*.ts, tests/helpers/update-helper-control-contracts.ts, tests/helpers/update-import-policy.ts, tests/helpers/update-primitive-allowlist.ts, tests/helpers/update-process-allowlist.ts, tests/helpers/update-mutation-scanner.ts, tests/update/update-mutation-scanner.test.ts, tests/update/update-capability-policy.test.ts, structure/ops/update-supervised-recovery.md	Review tables classify orchestrated-update imports, primitive operations, process operations, and helper contracts. The mutation scanner accepts the exit-10 refusal branch only after awaited mutation entry, lease release, and exit inside the refusal branch. Tests reject altered branch forms.
Windows shard investigation record devlog/_plan/261103_windows_batch_shards/010_plan.md	The plan records the four shard failures, repair and verification criteria, duration measurements, outcomes, and follow-ups. It reports that 16 of 20 missing duration entries were filled and that completed shard timings met the headroom target.

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant UpdateParent as Update parent
  participant ResultChannel as Orchestrated result channel
  participant UpdateChild as Update child
  UpdateParent->>ResultChannel: Create channel and issue capability
  UpdateParent->>UpdateChild: Pass result path and capability
  UpdateChild->>ResultChannel: Validate destination and publish outcome
  UpdateParent->>ResultChannel: Read outcome and dispose channel

Loading

Possibly related issues

• lidge-jun/opencodex#7967 — The issue concerns a worker remaining in running after supervisor stop. The provided change summary does not establish that this systemd cgroup scenario is addressed.

Merge Risk: Minimal · previous review 68890

No merge-blocking issue was established. Windows confirmation remains pending.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: fixing Windows batch-shard failures associated with #8103.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 15 functions across 30 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md maintainer-integration exception), requested by @lidge-jun. This fixes the four red Windows shards in batch run 41491122166 and closes a #8103 update-path defect found in pre-merge review. This is integration, not a self-approval or an independent review.

Exact-head verification for b4507ee4d81874967d740e2f28653c37a9c0eeec:

• PR CI with ci:full: all 18 reported checks passed, including the four Ubuntu shards.

• Windows dispatch on this exact head: 41540752628. All 11 Windows shards succeeded, along with macOS and the other platform jobs. The one exception is Linux test 1/4, which hung: the last log line was at 22:58:41 in tests/responses/chat-completions-endpoint.test.ts, and the job was cancelled at 23:12. That area is untouched by this PR, and the same shard passed in 13m05s in this PR's own CI on the same head. The lane traced it to a pre-existing problem in the server/chat-completions fixtures; I am tracking it separately.

• Reviews:

  • Pre-merge Terra review: REQUEST CHANGES (P1, the orchestrated child overwrote any absolute resultPath before taking the mutex), now fixed with a parent-issued, content-bound capability channel.
  • Fresh Terra security review: FAIL on 6889003be (token inherited by subprocesses, cleanup race, Windows reparse, marker race), addressed.
  • Final independent Terra security round: NEAR-PASS, no code-level blocker.
  • Codex and CodeRabbit findings are fixed, and all review threads are resolved.

• Maintainer acceptance of the stated residuals:

  • Cleanup checks identity with lstat before a path-based unlink/rmdir inside the owner-only channel directory, and it runs only when every ancestor directory is owner-safe and never on Windows.
  • Marker publication in the OpenCodex home is path-based and assumes the home and its ancestors cannot be replaced by another principal, as stated in structure/ops/service-and-sidecars.md.

  Both need an actor who can already write to the user's owner-only directories, which means they already hold the user's authority. That is the same boundary accepted for fix(codex): keep Codex pool session pins across proxy restarts #8098's affinity store and the existing private SQLite files. Accepted.

• The update mutation-guard rows that feat(update): orchestrated ocx update plan/apply contract (update.orchestrated/1) #8103 left unscanned on POSIX are now classified, with qualifications that match the enforced contract. A follow-up should run that lint on POSIX CI so this cannot recur.