Make capture attestation and journal observation deterministic

[coneilen]

Summary

Make Windows capture-core process attestation and journal observation fail closed without treating a short-lived owned process or transient journal Open failure as malformed ownership evidence. This draft contains the transferred CIM/kernel-EOF candidate and immutable numbered-journal repair; it is not complete G2, a live-capture lease, native-window qualification or parity acceptance.

Changes

• Preserve strict live-incomplete CIM refusal, retained-generation/image/parent/session checks and production rollback. A genuinely-gone result requires retained kernel exit and bounded EOF on both redirected streams. Keep the approved 12-row decision seam and three selected faithful test-only main-mutant distinctions.
• Replace the mutable process journal with unique closed/flushed same-directory staging files published through non-overwriting numbered moves. Writer errors fail without retry; no replacement/latest alias, sidecar framework, new native import or published-file deletion.
• Read only the same or a newer observed sequence, with Open-only transient retries bounded by count and deadline. ACL, schema, parse, encoding, hash/length, foreign identity and confirmed namespace faults fail explicitly. Live predecessor-sequence verification is not presented as full-chain proof; the full predecessor hash chain is required at quiescent final verification.
• Bind the exact terminal sequence/name/length/hash, immutable COMPLETE or FAILED manifest, canonical worker stdout record and release inventory after actual worker exit and both EOF. Retain published proof artifacts; classify and retain worker temp/partial leftovers instead of deleting them to pass. Preserve valid failed-job FAILED_ZERO_SURVIVORS versus invalid-cleanup CLEANUP_UNPROVEN.
• Preserve all 51 previous semantic cases with one explicit journal-case rename and add eight groups: full direct 59, focused 10. API16 is an exact export-only set check, not native GUI evidence. Keep existing harmless-console setup and the mocked-only scene component; no provider/App/UI/workflow files change.
• Correct the new helper $home spelling before runtime, preserve primary job-assertion errors after valid cleanup proof, and remove only the newly introduced mandatory historical sourceLeaseId comparison. The independent producer-provenance gap is recorded as an out-of-scope follow-up note, with existing current-lease/run/source and numbered-proof identity/hash guards intact.
• Refs Windows capture core: journal check-then-open race fails UiCaptureDriver tests intermittently on main #826. Refs Windows: Share the pinned local UI verifier and capture driver #822. This draft does not establish issue completion or authorize parked adapters/executors.

Test plan

RED: pwsh -NoProfile -File C:\gcs\j5\Test-NumberedJournal.ps1 -Mode Red -SourceRoot D:\depot\copilot-worktrees\GraphCode\coneilen-miniature-pancake -BaselineCommit 96950ce -OutputRoot C:\gcs\j5\journal-red1 -> real unchanged Refresh said "Worker process journal is malformed" for an actual Open sharing failure; separate actual unchanged Open recorded 80070020 and actual writer Replace recorded 80070020 under the held lock; exit 1, intentional behavioral 2 executed/1 passed/1 failed, QUALIFIED by six incorrect observer-role labels, not clean-all-provenance or a compile/missing-API failure.
GREEN: pwsh -NoProfile -File C:\gcs\j5\Test-NumberedJournal.ps1 -Mode Green -SourceRoot D:\depot\copilot-worktrees\GraphCode\coneilen-miniature-pancake -OutputRoot C:\gcs\j5\journal-green1 -> exit 0, frozen driver PASS, exactly 10 unique executed/10 passed/0 failed, unchanged five source hashes, actual seq1 Open 80070020 then retry and verified seq2 before unlock with unchanged bounds; 128 retained publications, API-export-only16, terminal20 and successful harmless worker integration.
REGRESSION: pwsh -NoProfile -File D:\depot\copilot-worktrees\GraphCode\coneilen-miniature-pancake\Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcs\j5\journal-regression1 -> exit 0, exactly 59 unique executed/59 passed/0 failed: original 49-case floor plus two CIM cases plus eight journal groups with one explicit existing journal-name mapping; real nonzero/timeout FAILED tuples preserve FAILED_ZERO_SURVIVORS, expected logging/receipt negatives remain distinct, five source hashes unchanged, GUI/images/backend turns/native compatibility not executed.

Source and command provenance

The RED command is the historical command as actually run with source SHA 80E3E4619D75B3174911F88BB03CFA595EFF388B2ECDCF57862600299B1223D8. Its byte-identical source is preserved at C:\gcs\j5\journal-red1-frozen-source\Test-NumberedJournal.ps1; it was not rerun or repaired. The active scratch path later became the GREEN-only driver SHA B966DEA966FF3D6B929ED4CB89DF441017A1A5F1B7AA045A27F699E7EF5E728B.

Focused 10 and full 59 ran on actual HEAD 96950ce7184eb46854aac1c54b1fb502f6688a89 with the reviewed four-file candidate dirty. That one Phase A commit was mechanically rebased to 7ce730709e4ab770a1201caf63d215c107baa814 on exact base 661f283798986dd7f919ada60cc6dbfc34130845; the byte-identical four-file candidate was then signed off in new commit 944ee565ed2e36885b8cf1087fc5fbe2d05d38b6. All four baseline Git blobs were identical between old base 29160994 and the admitted new base. Raw working-tree, staged-index and committed Git blobs match without line-ending/filter transformation; this is source equivalence, not a claim of local runtime reruns at the new head.

The exact path-limited preservation stash is retained, not dropped: 10f746378379aef93601f50b7a83fdb422ae1004. All earlier heads, source snapshots, bodies, reviews and raw reports remain historical evidence. Scratch B966 is unchanged and deliberately retains its 96950 HEAD guard; it is not runnable at the rebased head and was not rewritten or invoked again.

Proved/published source	SHA256
Module	7898D213468EB51CD5217ACE3BED7EDC2B5AC2F3FBBF1192A61270396EAE7DEC
Supervisor	4772C1F359A0769C891EC5CD391C2B07C4E8F07EC3AABDE8CD73288FDC71E393
Worker	DB114CD3C6E4776BF7C2B54908EBC12E33E15AB70A34A6128C5DB975F82D5411
Existing driver tests	1CF8061F380899E8DB5A7F79864DBF215EDC77A492F3F50B66B38764CF46D60B

Retained runtime evidence and qualifications

• Qualified real journal RED: raw report SHA 43F461E62FA9AB4EBC60BE9E1FE02056033C2F9947E7B00EB790316521183B0C, qualified packet SHA 0E83452D669700CBF815356225E5DE7D121453CE249AC15E50DC92CD63D48CB5. Actual observer PID 30332, reader 20484 and writer 36440 are independently bound by actual managed-launch/held-generation/EOF/function/UTC+monotonic receipts. Six observer records incorrectly say role Reader and remain wrong/immutable; no observer kernel-creation value was recorded or invented. Raw unexpectedFailures0 is not claimed as clean whole-harness provenance. The operator admitted only the real I/O and process-cleanup facts with this qualification. The baseline failed-Replace .tmp remains preserved, not claimed absent.
• Focused GREEN: report SHA 0158E05953DB4D3DEC6B448047D46DFA80995D954344D780EA2AFAB550D18114, driver-after SHA 0AD9DF412ECB47E5F4D3B3C331AF6575CFB611665000E1BC569123FFCF57BFE3. Production diagnostics show actual first seq1 Open 80070020, global retry1, verified/accepted2 before lock release, with ordinary diagnostic receipts rather than hooks. The concurrent actor read live6 during the 128-publication burst; caller latest128/held-snapshot assertions passed. This is not a claim that that actor read all128 or verified their full hash chain. Final chain proof is quiescent and separate.
• Full direct regression: report SHA 84B8E7D9A4263D5287E1D85063B1D5A41F19F637B8CE4A2AB1C5B41CA2EEC7E5, actual59 inventory SHA 4D89D2CBA8BCBDF6A650BA299002D11FCA9B73EC7FB64461C2C8A2050A1801B2, retained release/namespace evidence SHA B2146847B61264786B942C7FC1B5D54B0277E05149C881BE182D57AF44EFD972. Real nonzero/timeout workers emitted immutable FAILED manifests, exact Terminal3 and canonical stdout/release bindings, with kernel/bothEOF and zero survivors/pending. Timeout still requires TERMINATED_GUARDED_HANDLE; it is not relabelled target exit0.
• Expected failure preservation: 30 actual official releases comprise 5 RELEASED_ZERO_SURVIVORS, 2 FAILED_ZERO_SURVIVORS, 21 REFUSED_NO_WORKER and 2 CLEANUP_UNPROVEN. Primary-cleanup retains one intentional log fault; trace-readonly retains22 cleanup/trace faults and raw workerExitCode null, not fabricated0/1. Receipt-block intentionally leaves a directory instead of an official release file, with the original worker failure and release-write error retained. These are passing negative controls, not all-release/logging success. Zero worker-transient evidence is scoped to actual worker namespaces, not negative fixtures intentionally retaining corrupt/collision/residual artifacts.
• Evidence limits: terminal20 classification subcontrols are actual file/source/data controls, not coupled negative ReadQ integration; separate normal and FAILED-worker integration paths did execute. API16 matched the static named export set, but individual raw export-return rows were not serialized; it is not native-window evidence. The exact torn-CIM/just-exited micro-race remains unforced; the12-row seam and three faithful selected-main mutant distinctions are test-only, distinct from an observed main execution.

Review and historical accounting

Requested different-vendor review selection was claude-sonnet-5.5 / high. Original broad source static ACCEPT receipt SHA BBD8818DE1B52CBDDE616DE02DC548BF2E2E33408BEBCB03F3454EE8962D4347 and corrective narrow static ACCEPT SHA 85FF0DD78FDB39703C2B08542B263979B41479768D1ACD059900F34A824259EA are preserved with their actual request/result metadata and disclosed unread/coverage limits. No agent ID, independent runtime model/effort or unknown review time is fabricated. The HOME function-local-safety theory was not adopted: the new locals were mechanically renamed before GREEN. The job/cleanup split and out-of-scope source-lease-field removal were reviewed before runtime.

Original required CI run 38699220915, Windows2022 job 116303129929, remains attempt1 with inherited journal Open sharing violation plus dependent report refusal, 51/49/2; Windows2025 passed51. The operator classified that inherited blocker uncounted and specifically admitted Phase B work without rerunning it; required fresh green CI remains mandatory before merge. J5's counter is 2/5, solely the first plan REJECT and observer-label provenance defect; pre-runtime source corrections did not fabricate a failed GREEN or reset the count. Earlier actual J3 CIM49/48/1, older CI journal49/47/2 and J4 final5/3/2 remain distinct, preserved histories, not invented failed entire59 runs.

Not verified

No local candidate tests, imports, parser checks, builds or probes were rerun after the controlled base update. Fresh automatic exact-head PR CI is pending at publication; no predicted green or required-count result is asserted here, and no manual workflow dispatch/job rerun is authorized.

No make test/make check, local full ValidationRunner/windows-shell, actual GraphCode/daemon/zmx/provider build or launch, native-window/UIA/input/PrintWindow/WGC/WinApp qualification, screenshots, paid/backend turns or visual parity ran under these grants. Mocked scene output is not images. Non-rehearsal seed producer/preflight and live GUI/zmx-descendant ownership qualification are not established. The separate producer-provenance follow-up and parked adapters still need their own authority; this draft is not a blanket lifecycle, G2 or capture approval.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

The final checkbox describes the actual Phase B real-file RED observed before its journal implementation, with the provenance qualification retained above. The CIM portion was transferred frozen, not claimed as a new test-first baseline cycle. The macOS make checkboxes remain unchecked; only the exact admitted Windows-console commands and their stated limits are claimed.

[coneilen]

Phase B v2 — revision only, not implementation or review authority

Operator authority: original Windows2022 51/49/2 remains preserved/uncounted; Windows2025 51/51/0. No rerun. Budget 1/5 solely for first plan rejection. Frozen v1/review and interrupted NotRun v2 draft are preserved; restart adds no authority.

Scope: unchanged 96950ce7184eb46854aac1c54b1fb502f6688a89; prospective writes only existing Tools\windows\UiCaptureDriver.psm1, Invoke-UiCapture.ps1, Invoke-UiCaptureWorker.ps1, Tests\UiCaptureDriver.Tests.ps1. No new framework, rebase, driver/runtime or push.

B1 — outcome and final-evidence contract

Normal finalization publishes immutable Terminal + manifest.json (COMPLETE or FAILED) + final stdout binding. FAILED may prove cleanup, not capture success. Replace disk partial/progress manifests with numbered progress snapshots. Final authority waits for held-worker kernel exit and both EOF.

Outcome	Terminal / manifest / final stdout record	Supervisor validation → official release
COMPLETE, exit0/no faults	Valid COMPLETE tuple	Exact binding/inventory, zero survivors/pending/transients, both EOF → RELEASED_ZERO_SURVIVORS.
Controlled target nonzero	Valid FAILED tuple + original failure	Same cleanup proof → FAILED_ZERO_SURVIVORS, never COMPLETE.
Controlled target timeout, guarded stop succeeds	Valid FAILED tuple + stop receipt	Same proof → FAILED_ZERO_SURVIVORS.
Supervisor deadline, worker finalizes within reserve	Valid tuple; deadline stays primary	Same proof → FAILED_ZERO_SURVIVORS, not capture success.
Worker killed/no tuple, unknown ownership or missing EOF	Missing/incomplete authority	All remaining guarded stops still run; CLEANUP_UNPROVEN.
Admission refused before worker attempt	No worker tuple required	REFUSED_NO_WORKER / NO_WORKER_STARTED.
Worker fails before first publication	FAILED tuple if safe finalization possible	Exact cleanup proof → FAILED_ZERO_SURVIVORS; no tuple → CLEANUP_UNPROVEN. Bootstrap precedes child launch.
Terminal publication fails	No valid tuple	Preserve error → CLEANUP_UNPROVEN.
Manifest/control write fails, partial or mismatched	Terminal alone insufficient	Preserve errors/bytes → CLEANUP_UNPROVEN.
Injected cleanup/log/trace fault or leftover worker temp/partial	FAILED tuple if possible	Preserve fault → CLEANUP_UNPROVEN; separately record proven kernel/EOF facts. Published retention alone is not failure.
Official release write blocked	No alternate success-shaped receipt	Preserve LEASE_RELEASE_WRITE_FAILED and worker cause; no official release.

Preserve all existing failure-status assertions. Timeout reads bound immutable FAILED manifest instead of manifest.partial.json; keep TERMINATED_GUARDED_HANDLE. No progress/FAILED state is COMPLETE.

B2 — publication, grammar, floor, errors and deadlines

Contract	Exact rule
Publish	One writer, fresh owned directory. Unique same-directory CreateNew temp → strict UTF8/flush/close → non-overwriting File.Move. No Replace/overwrite/skip/wrap/latest/deletion. Target80/183 = SequenceConflict; writer sharing32/33, ACL and other errors hard-fail, never retry.
Names	\A[0-9]{6}\.json\z, ASCII1..999999/lowercase. Reject zero/width/case/trailingdotspace/ADS/colon/aliases/duplicates. No 8.3 path input; alternate short name is not another publication. Legal unpublished temps only anchored .cap-journal-NNNNNN-32lowerhex.tmp or .cap-final-32lowerhex.tmp. Published corrupt/partial .json fails, not ignored as temp.
Floor	Explicit per-run state; HighestObserved advances before Open and survives errors/calls. Only same/newer selected state can return/apply. No corrupt-highest fallback or pre-first-publication empty cleanup success.
Confirm gaps	Listing is discovery, not atomic. Direct-Open canonical missing prefix names for validation, never older state application. Actual transient Open follows bounded rule; unresolved hole blocks result with JournalUnavailable. Confirmed predecessor/sequence mismatch or sealed post-quiescence inventory gap = immediate SequenceGap. Never tolerate confirmed gaps or claim an unobserved NTFS omission.
Retry	Only reader Open FileNotFound/DirectoryNotFound or 0x80070020/0x80070021; same sequence or newer. Max8 attempts/object, 7 retries/refresh, 1,000ms/refresh,100-ms clipped waits. Successful first Opens of distinct prefix-audit objects are counted separately; all share deadline, no reset by sequence change.
Faults	ACL, other I/O, encoding, parse/duplicate JSON, hash/length, foreign identity, schema, confirmed gaps/aliases/duplicates/published-temp masquerade fail immediately with explicit classes, never blanket malformed/retry.
Deadlines	Every first/retry Open before hard deadline, no late success. Live=min(start+1s,workerDeadline); cleanup/final=min(start+1s,leaseExpiry) within existing90-second reserve. No-attempt expiry explicit; exhaustion records sequence/attempts/native HRESULT/deadline. No EOF/watchdog extension.

One envelope binds exact payload bytes/length/SHA, sequence/predecessor and typed identity. Hash/parse the same held stream, not hash-path/reopen. Verify bytes after Move: detect mismatches, not prevent arbitrary same-user substitutions. No native-file-ID guarantee.

B3 — matched actual RED/GREEN, not sleep-race evidence

Both protocols: real publish1 → exclusive scanner/indexer-substitute lock1 → actual reader Open error → real writer attempts publish2 under lock1 → bounded observations → release/join/owned cleanup. Record actual old writer outcome/HRESULT; never assume Replace fails.

RED requires unchanged96950 reader's real sharing/lock error and malformed classification, not writer/API/compile failure. If wrapping loses native detail, label a separate real unchanged Open call under lock1; never misattribute it. GREEN requires actual seq1/HRESULT, retry and valid2 before unlock; starting directly at2 fails.

External observers read seq/attempt/HRESULT receipts and open setup barriers, no production pause/return hooks. Missing telemetry/observer timeout is harness failure. No sleep-race or forced WinAPI-internal-race claim.

N1–N7 — exact binding, retention and integration

• Native: no additions or delete/disposition plumbing. Keep actual16 declarations/live gate16; add exact named Type/Method/Library/EntryPoint-set assertion, not20-count assumption.
• Final record: last nonempty ASCII stdout line CAP_JOURNAL_FINAL_V2 + canonical-base64 compact UTF8 binding version/run/lease/worker generation, manifest name/length/SHA and terminal sequence/name/length/SHA. Logging precedes it. Parse only after kernelExit/bothEOF; duplicate/partial/noncanonical/missing/foreign/binding faults refuse.
• Inventory: manifest binds all exact contiguous sequence/name/length/SHA entries including Terminal; stdout hashes manifest, release repeats both exact references+inventory. Namespace must match, no extras/missing/above-Terminal. Pin non-write/non-delete-sharing streams through verification; no highest-at-release substitution or self-hash recursion.
• Retention resolved: published proof retained through release/verification, never individually deleted. Root uses normal artifact lifecycle. Explicit quiescent owned-run/output enumeration must show zero worker temps/partials. Leftovers/foreign/unknown artifacts preserved+classified; no ownership inferred from temp names, no delete-to-pass. Successful Move naturally consumes its temp.
• Integration: named LegacyJournalProtocol refusal and accepted new exact numbered-terminal proof. Wire auth/live/failure/seed/progress/final/release/mock-scene paths in four files. Preserve every generation/exe/parent/session/role/lease/EOF/live-unknown rollback guard and all remaining guarded stops.

Cases/gate: map old mutable-replacement case to actual immutable journal reader preserves held snapshots across concurrent numbered publications plus admission literal. Preserve other51 semantics/CIM cases;8 new groups (collision/retry/floor/faults/terminal/inventory+zero-transients/16exports/legacy) propose59 full,10 focused GREEN; subrows do not inflate counts. Correction map supplies exact assertion changes. C:\gcs\j5\journal-red1, journal-green1, journal-regression1 and temp/console paths remain unused. IDLE for separate Sonnet5.5/high v2 review grant; no review/edit/driver/execution/push now.

[coneilen]

Confirmed A–G pins for the accepted v2 plan

Linked accepted v2 plan; frozen plan13A3D4EB/corrections4AF3EF38 and original static ACCEPT D6502D7A remain preserved. Coordinator explicitly confirmed these choices; no third review or runtime authority is inferred. Counter 1/5 unchanged; inherited CI is uncounted.

Pin	Confirmed decision
A	Live reader validates current envelope bytes/hash/typed identity and predecessor sequence linkage, not the locked/unread predecessor hash. Full predecessor hash chain is mandatory in the quiescent final inventory. Live chain hashes remain explicitly unverified; no older state or actual listing-hole/identity/schema fault is accepted.
B	Ordinary owned-output diagnostics\journal-read-observations.jsonl records run/seq/attempt/UTC/monotonic timestamp/native HRESULT/decision/deadline. Diagnostic only, not authority or hook. Flush/close each whole record; observers ignore unfinished lines and only signal external setup barriers. Sink failure is explicit, not swallowed. No temp/partial files.
C	After nonoverwrite Move the writer retains its in-memory canonical bytes/length/SHA; no writer post-Move re-Open/retry. Consumers/final inventory verify actual published bytes on the same held stream. Claim expected bytes published versus actual bytes consumer-verified, not adversarial namespace prevention. All writer errors hard-fail.
D	Live refresh <=1s/max7 global retries/max8 attempts per object. Final inventory may use multiple <=1s object transactions, but total ends by existing leaseExpiry/reserve; no late first Open or late success. Live JournalUnavailable exhaustion is fatal, not Pending or a next-poll budget reset. Pre-first-publication Pending has separate bounded startup semantics, never zero-ownership success. Partial inventory cannot pass.
E	Unrelated seed-receipt Write-CapJsonAtomic remains unchanged. Any worker-owned legacy $Path.tmp leftover is explicit ResidualJournalArtifact/CLEANUP_UNPROVEN, not a foreign item to skip. Supervisor's intentional receipt-block release.tmp is separately the official-release-write failure. No deletion, mutable progress partial or registry.
F	Keep actual16 imports, no additions. Static expected exports: GraphCodeUiaGateState user32 PostMessage→PostMessageA, EnumWindows→EnumWindows, GetWindowThreadProcessId→same, GetClassName→GetClassNameW. CapNative kernel32 GetProcessId/GetProcessTimes/QueryFullProcessImageNameW/WaitForSingleObject/TerminateProcess/WaitNamedPipeW→same; user32 GetWindowThreadProcessId/GetWindowRect/GetClientRect/GetDpiForWindow/SetWindowPos/PrintWindow→same. Both types' GetWindowThreadProcessId are separate declarations. Expected set is not generated from its own first run. No native probe now.
G	Prestart/warm harmless actors before lock/setup. Record actor-ready, reader-error, observer-seen, writer-attempt/published2, reader-accepted, deadline and unlock timestamps. Never extend production retry bounds or use sleeps as ordering proof. Observer-latency timeout is explicit HARNESSFAIL/counts, not intentional RED. Old writer-under-lock outcome is observed, not assumed. Future GREEN requires actual seq1 native error/retry→accepted2 under held lock1.

Current grant is scratch RED-harness source preparation ONLY, against unchanged96950: exact baseline reader/writer functions, real file lock/barriers, actual Open error, writerpublish2 attempt under lock, two expected RED/cleanup endpoints and bounded owned cleanup. No four-file repository edit, execution/import/parser validation/probe/compile/child, run/TEMP root creation, native/UI/provider work or CI push. A separate exact one-RED-run grant is required.