fix(003): reconcile T068 independent review findings

.github/workflows/quality.yml

@@ -8,6 +8,9 @@ on:
 permissions:
   contents: read
 
+env:
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
 jobs:
   rust:
     strategy:
@@ -16,9 +19,14 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Checkout exact candidate head
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           persist-credentials: false
+          ref: ${{ env.CANDIDATE_SHA }}
+      - name: Verify checkout identity
+        shell: bash
+        run: test "$(git rev-parse HEAD)" = "$CANDIDATE_SHA"
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
           toolchain: 1.97.1

.github/workflows/release-candidate.yml

@@ -133,14 +133,80 @@ jobs:
         run: |
           set -euo pipefail
           BASELINE_SHA="8e92c5612a9ddc32996ed5e08475e3c9baa5e161"
-          git show "${BASELINE_SHA}:tests/walking_skeleton.rs" > tests/walking_skeleton.rs
-          python3 scripts/ci/run_exact_cargo_test.py \
-            verifies_blocks_and_promotes_without_touching_primary_checkout \
-            -- cargo test --locked --test walking_skeleton \
-            verifies_blocks_and_promotes_without_touching_primary_checkout \
-            -- --exact --test-threads=1 --nocapture
-          git restore --source=HEAD --worktree -- tests/walking_skeleton.rs
-          git diff --exit-code -- tests/walking_skeleton.rs
+          TEMP_PARENT="$(cd .. && pwd)/winds-t064-baseline-${GITHUB_RUN_ID}-${RANDOM}"
+          TEMP_WORKTREE="$TEMP_PARENT/candidate"
+          BASELINE_FIXTURE="$TEMP_PARENT/walking_skeleton.rs"
+          CARGO_TARGET_DIR="$TEMP_PARENT/target"
+          mkdir "$TEMP_PARENT"
+          cleanup_historical_worktree() {
+            original_status="${1:-0}"
+            cleanup_status=0
+            if git worktree list --porcelain | grep -Fqx "worktree $TEMP_WORKTREE"; then
+              git worktree remove "$TEMP_WORKTREE" >/dev/null 2>&1 || cleanup_status=1
+            fi
+            rm -rf -- "$CARGO_TARGET_DIR" || cleanup_status=1
+            rm -f -- "$BASELINE_FIXTURE" || cleanup_status=1
+            rmdir "$TEMP_PARENT" >/dev/null 2>&1 || cleanup_status=1
+            if [ "$original_status" -ne 0 ]; then
+              if [ "$cleanup_status" -ne 0 ]; then
+                echo "historical verification failed with status $original_status; cleanup also failed and evidence was retained where possible" >&2
+              fi
+              return "$original_status"
+            fi
+            return "$cleanup_status"
+          }
+          trap 'status=$?; trap - EXIT; cleanup_historical_worktree "$status"; exit $?' EXIT
+          git worktree add --detach "$TEMP_WORKTREE" "$CANDIDATE_SHA"
+          git show "${BASELINE_SHA}:tests/walking_skeleton.rs" > "$BASELINE_FIXTURE"
+          python3 - "$TEMP_WORKTREE/tests" "$BASELINE_FIXTURE" <<'PY'
+          import os
+          import stat
+          import sys
+          from pathlib import Path
+
+          parent = Path(sys.argv[1])
+          fixture = Path(sys.argv[2])
+          target = parent / "walking_skeleton.rs"
+          parent_stat = os.lstat(parent)
+          target_stat = os.lstat(target)
+          if not stat.S_ISDIR(parent_stat.st_mode) or stat.S_ISLNK(parent_stat.st_mode):
+              raise SystemExit("historical test parent is not a real directory")
+          if not stat.S_ISREG(target_stat.st_mode) or stat.S_ISLNK(target_stat.st_mode):
+              raise SystemExit("historical test target is not a real regular file")
+          data = fixture.read_bytes()
+          directory_flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0)
+          directory_fd = os.open(parent, directory_flags)
+          try:
+              target_flags = os.O_WRONLY | os.O_TRUNC | getattr(os, "O_NOFOLLOW", 0)
+              target_fd = os.open(target.name, target_flags, dir_fd=directory_fd)
+              try:
+                  if not stat.S_ISREG(os.fstat(target_fd).st_mode):
+                      raise SystemExit("historical test target changed type during safe open")
+                  with os.fdopen(target_fd, "wb", closefd=False) as handle:
+                      handle.write(data)
+                      handle.flush()
+                      os.fsync(handle.fileno())
+              finally:
+                  os.close(target_fd)
+          finally:
+              os.close(directory_fd)
+          PY
+          (
+            cd "$TEMP_WORKTREE"
+            export CARGO_TARGET_DIR
+            python3 scripts/ci/run_exact_cargo_test.py \
+              verifies_blocks_and_promotes_without_touching_primary_checkout \
+              -- cargo test --locked --test walking_skeleton \
+              verifies_blocks_and_promotes_without_touching_primary_checkout \
+              -- --exact --test-threads=1 --nocapture
+          )
+          git -C "$TEMP_WORKTREE" restore --source="$CANDIDATE_SHA" --worktree -- tests/walking_skeleton.rs
+          git -C "$TEMP_WORKTREE" diff --exit-code
+          test -z "$(git -C "$TEMP_WORKTREE" status --porcelain=v1 --untracked-files=all)"
+          cleanup_historical_worktree 0
+          trap - EXIT
+          test "$(git rev-parse HEAD)" = "$CANDIDATE_SHA"
+          git diff --exit-code
           echo "T064_PINNED_WALKING_SKELETON_PROVEN=$BASELINE_SHA"
 
       - name: Prove partial-worktree recovery is non-destructive
@@ -230,14 +296,77 @@ jobs:
         run: |
           set -euo pipefail
           SOURCE_SHA="ad4625ecd7f9a933613890cca74129857d0b4166"
-          git show "${SOURCE_SHA}:tests/walking_skeleton.rs" > tests/walking_skeleton.rs
-          python scripts/ci/run_exact_cargo_test.py \
-            native_windows_refuses_authoritative_required_checks_without_mutation \
-            -- cargo test --locked --test walking_skeleton \
-            native_windows_refuses_authoritative_required_checks_without_mutation \
-            -- --exact --test-threads=1 --nocapture
-          git restore --source=HEAD --worktree -- tests/walking_skeleton.rs
-          git diff --exit-code -- tests/walking_skeleton.rs
+          TEMP_PARENT_POSIX="$(cd .. && pwd)/winds-t064-windows-${GITHUB_RUN_ID}-${RANDOM}"
+          TEMP_WORKTREE_POSIX="$TEMP_PARENT_POSIX/candidate"
+          BASELINE_FIXTURE_POSIX="$TEMP_PARENT_POSIX/walking_skeleton.rs"
+          TEMP_WORKTREE_TESTS_WIN="$(cygpath -w "$TEMP_WORKTREE_POSIX/tests")"
+          BASELINE_FIXTURE_WIN="$(cygpath -w "$BASELINE_FIXTURE_POSIX")"
+          CARGO_TARGET_DIR="$(cygpath -w "$TEMP_PARENT_POSIX/target")"
+          mkdir "$TEMP_PARENT_POSIX"
+          cleanup_historical_worktree() {
+            original_status="${1:-0}"
+            cleanup_status=0
+            if [ -d "$TEMP_WORKTREE_POSIX" ] && git -C "$TEMP_WORKTREE_POSIX" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+              git worktree remove "$TEMP_WORKTREE_POSIX" >/dev/null 2>&1 || cleanup_status=1
+            fi
+            rm -rf -- "$TEMP_PARENT_POSIX/target" || cleanup_status=1
+            rm -f -- "$BASELINE_FIXTURE_POSIX" || cleanup_status=1
+            rmdir "$TEMP_PARENT_POSIX" >/dev/null 2>&1 || cleanup_status=1
+            if [ "$original_status" -ne 0 ]; then
+              if [ "$cleanup_status" -ne 0 ]; then
+                echo "historical Windows verification failed with status $original_status; cleanup also failed and evidence was retained where possible" >&2
+              fi
+              return "$original_status"
+            fi
+            return "$cleanup_status"
+          }
+          trap 'status=$?; trap - EXIT; cleanup_historical_worktree "$status"; exit $?' EXIT
+          git worktree add --detach "$TEMP_WORKTREE_POSIX" "$CANDIDATE_SHA"
+          git show "${SOURCE_SHA}:tests/walking_skeleton.rs" > "$BASELINE_FIXTURE_POSIX"
+          python - "$TEMP_WORKTREE_TESTS_WIN" "$BASELINE_FIXTURE_WIN" <<'PY'
+          import os
+          import stat
+          import sys
+          from pathlib import Path
+
+          parent = Path(sys.argv[1])
+          fixture = Path(sys.argv[2])
+          target = parent / "walking_skeleton.rs"
+          parent_stat = os.lstat(parent)
+          target_stat = os.lstat(target)
+          if not stat.S_ISDIR(parent_stat.st_mode) or stat.S_ISLNK(parent_stat.st_mode):
+              raise SystemExit("historical Windows test parent is not a real directory")
+          if not stat.S_ISREG(target_stat.st_mode) or stat.S_ISLNK(target_stat.st_mode):
+              raise SystemExit("historical Windows test target is not a real regular file")
+          data = fixture.read_bytes()
+          flags = os.O_WRONLY | os.O_TRUNC | getattr(os, "O_NOFOLLOW", 0)
+          target_fd = os.open(target, flags)
+          try:
+              if not stat.S_ISREG(os.fstat(target_fd).st_mode):
+                  raise SystemExit("historical Windows test target changed type during safe open")
+              with os.fdopen(target_fd, "wb", closefd=False) as handle:
+                  handle.write(data)
+                  handle.flush()
+                  os.fsync(handle.fileno())
+          finally:
+              os.close(target_fd)
+          PY
+          (
+            cd "$TEMP_WORKTREE_POSIX"
+            export CARGO_TARGET_DIR
+            python scripts/ci/run_exact_cargo_test.py \
+              native_windows_refuses_authoritative_required_checks_without_mutation \
+              -- cargo test --locked --test walking_skeleton \
+              native_windows_refuses_authoritative_required_checks_without_mutation \
+              -- --exact --test-threads=1 --nocapture
+          )
+          git -C "$TEMP_WORKTREE_POSIX" restore --source="$CANDIDATE_SHA" --worktree -- tests/walking_skeleton.rs
+          git -C "$TEMP_WORKTREE_POSIX" diff --exit-code
+          test -z "$(git -C "$TEMP_WORKTREE_POSIX" status --porcelain=v1 --untracked-files=all)"
+          cleanup_historical_worktree 0
+          trap - EXIT
+          test "$(git rev-parse HEAD)" = "$CANDIDATE_SHA"
+          git diff --exit-code
           echo "T064_PINNED_WINDOWS_AUTHORITY_PROVEN=$SOURCE_SHA"
 
   soak:
@@ -455,4 +584,4 @@ jobs:
             dist/winds-v${{ steps.metadata.outputs.version }}-${{ matrix.target }}.tar.gz
             dist/winds-v${{ steps.metadata.outputs.version }}-${{ matrix.target }}.tar.gz.sha256
           if-no-files-found: error
-          retention-days: 14
+          retention-days: 14

.github/workflows/windows-terminal.yml

@@ -26,6 +26,9 @@ on:
 permissions:
   contents: read
 
+env:
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
 jobs:
   unix-terminal-integration:
     name: unix-terminal-integration (${{ matrix.os }})
@@ -38,9 +41,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Checkout exact candidate head
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           persist-credentials: false
+          ref: ${{ env.CANDIDATE_SHA }}
+      - name: Verify checkout identity
+        shell: bash
+        run: test "$(git rev-parse HEAD)" = "$CANDIDATE_SHA"
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
           toolchain: 1.97.1
@@ -50,12 +58,21 @@ jobs:
         run: cargo test --locked --test t057_cli minimal_cli_proves_workspace_profiles_execution_and_terminal_paths -- --test-threads=1
 
   native-windows-terminal:
-    runs-on: windows-latest
+    runs-on: windows-2025
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Checkout exact candidate head
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           persist-credentials: false
+          ref: ${{ env.CANDIDATE_SHA }}
+      - name: Verify checkout identity
+        shell: pwsh
+        run: |
+          $actual = (git rev-parse HEAD).Trim()
+          if ($actual -cne $env:CANDIDATE_SHA) {
+            throw "checkout identity mismatch: actual=$actual expected=$env:CANDIDATE_SHA"
+          }
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
           toolchain: 1.97.1
@@ -86,15 +103,14 @@ jobs:
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           persist-credentials: false
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ env.CANDIDATE_SHA }}
 
       - name: Verify checkout identity
         shell: pwsh
         run: |
-          $expected = "${{ github.event.pull_request.head.sha || github.sha }}"
           $actual = (git rev-parse HEAD).Trim()
-          if ($actual -cne $expected) {
-            throw "checkout identity mismatch: actual=$actual expected=$expected"
+          if ($actual -cne $env:CANDIDATE_SHA) {
+            throw "checkout identity mismatch: actual=$actual expected=$env:CANDIDATE_SHA"
           }
 
       - name: Install pinned Rust toolchain
@@ -161,7 +177,7 @@ jobs:
             throw "T062 evidence JSON was not produced"
           }
           $evidence = Get-Content -LiteralPath $evidencePath -Raw | ConvertFrom-Json
-          $expected = "${{ github.event.pull_request.head.sha || github.sha }}"
+          $expected = $env:CANDIDATE_SHA
           if ([int]$evidence.schema_version -ne 1) { throw "unexpected T062 evidence schema_version" }
           if ($evidence.evidence -cne "T062_REAL_WINDOWS_WSL2_INTEGRATION") { throw "unexpected T062 evidence marker" }
           if ($evidence.repository_head -cne $expected) { throw "T062 evidence is not bound to exact candidate head" }

SECURITY.md

@@ -33,6 +33,8 @@ Reports that only demonstrate behavior explicitly outside these security claims
 
 PTY/ConPTY ownership is lifecycle ownership for resources Winds can prove it owns. It is not proof that Winds confines every descendant process, filesystem effect, network connection, or credential reachable by the launched process.
 
+Local-history confidentiality also depends on the configured state-root boundary. On Unix, Winds-created history directories/files request owner-only modes. On Windows, the current Spec 003 implementation inherits ACLs from `WINDS_HOME` and does not create or validate an owner-only ACL. A permissive Windows `WINDS_HOME` is therefore not a cross-local-account confidentiality boundary; users who require that isolation must restrict the state root with operating-system ACLs or disable history for sensitive sessions.
+
 See [`specs/003-workspace-execution-spine/terminal-trust-boundary.md`](specs/003-workspace-execution-spine/terminal-trust-boundary.md) for the detailed workspace-terminal trust boundary.
 
 ## Platform boundary

scripts/ci/run_exact_cargo_test.py

@@ -7,16 +7,38 @@
 
 
 def fail(message: str) -> None:
-    print(f"T063 exact-test guard failed: {message}", file=sys.stderr)
+    print(f"exact-test guard failed: {message}", file=sys.stderr)
     raise SystemExit(1)
 
 
 def main() -> None:
-    if len(sys.argv) < 4 or sys.argv[2] != "--":
-        fail("usage: run_exact_cargo_test.py <expected-test-name> -- <cargo command...>")
+    try:
+        separator = sys.argv.index("--", 1)
+    except ValueError:
+        fail(
+            "usage: run_exact_cargo_test.py <expected-test-name> "
+            "[--marker-prefix <prefix>] -- <cargo command...>"
+        )
 
-    expected = sys.argv[1]
-    command = sys.argv[3:]
+    options = sys.argv[1:separator]
+    if len(options) == 1:
+        expected = options[0]
+        marker_prefix = "T063"
+    elif len(options) == 3 and options[1] == "--marker-prefix":
+        expected = options[0]
+        marker_prefix = options[2]
+    else:
+        fail(
+            "usage: run_exact_cargo_test.py <expected-test-name> "
+            "[--marker-prefix <prefix>] -- <cargo command...>"
+        )
+
+    if not expected:
+        fail("expected test name must not be empty")
+    if not re.fullmatch(r"[A-Z][A-Z0-9_]*", marker_prefix):
+        fail("marker prefix must match [A-Z][A-Z0-9_]*")
+
+    command = sys.argv[separator + 1 :]
     if not command or command[0] != "cargo":
         fail("guard only accepts an explicit cargo command")
     if "--exact" not in command:
@@ -59,8 +81,8 @@ def main() -> None:
     if len(summaries) != 1:
         fail(f"expected exactly one one-test success summary, found {len(summaries)}")
 
-    print(f"T063_EXACT_TEST_PROVEN={expected}")
+    print(f"{marker_prefix}_EXACT_TEST_PROVEN={expected}")
 
 
 if __name__ == "__main__":
-    main()
+    main()