Experimental non-secret Windows managed startup #11
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue/5-windows-launch"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Related to #5. Experimental non-secret managed Windows startup only. This does not provide first-admin onboarding, browser trust or M0 acceptance.
HEAD
dbbdcf6975d556111a7e7a7f81ec2d4039669731does not issue administrator claims from the managed workflow, regardless of terminal or consent. On an onboarding redirect it reportsSERVER_RUNNING — ADMIN_ONBOARDING_INCOMPLETEwith status 2; an observed existing administrator returns 0 without claiming authenticated readiness. The legacy WSL-bind path remains unconditionally blocked. The public certificate comes from the trusted local Docker volume independently of HTTPS; browser trust is not installed.Independent fresh GPT-6.1 Sol High returned APPROVE_EXPERIMENTAL_NONSECRET_MERGE for source commit
d5d3828, and after a narrow exact-head follow-up carried that verdict todbbdcf6; see the anchored PR comment. The review is conditional on a trusted coordinated host, operator, Docker and independently inspected image. It is not production, private-claim, browser, M0 or M1 acceptance.Validation: exact HEAD full suite 87 run, 80 passed, 7 skipped. Corrected opt-in managed Docker suite 15/15 passed with source-inspected immutable image
sha256:1225eacbec52d7ef0e5f039e1b5d2fdf64069c9774cc23aaa4d9379c15f71c32. Prior native Windows-Filetest of9e23e0fpassed pinned HTTPS fresh/repeat/same-container stopped recovery; the only later production change removes managed claim issuance. Wrong TLS volume was rejected with an actual stopped-container Docker inspect and unchanged fixture resources; wrong engine was rejected using mocked production-function calls before image inspection or managed startup. No real claims or trust/global settings were changed.WIP: Guarded Windows first-run workflowto WIP: Windows first-run blocked on TLS key custodyIndependent reviews of
225a4772bb85f49da1675365cadce3216810ceaaand follow-up84f9cb1e0fa20cd872da0c986b31e583c6faaebafound and exercised three P2 issues: aliased data volume, privileged/noncanonical adoption, and unproven Docker Desktop private-key custody. Subsequent guards address tested volume/privilege cases. Sol High reproduced, in private namespaces with synthetic keys, (1) a same-inode alias whose accessible ancestry bypasses the original 0700 parent for a group member, and (2) a remapped current shared path that passes an inode check while an earlier container-like bind holds a different key inode. This is not a demonstrated exploit against an actual Docker Desktop installation, but it prevents claiming custody.b69983244d27475a182fa5aae4fbe907c043c141now fails closed before project discovery/start/adoption or claim when custody is not established. Do not merge or advertise it as a first-run workflow. GLM review also found and prompted fixes for CRLF checkout, PowerShell errors and EOF handling. Full final-head suite 64 run, 59 passed, 5 skipped; positive-flow mocks bypass the blocker and are not acceptance evidence. Prior native target-host successes were on an earlier candidate, before the custody block; they cannot establish final-head first-run acceptance. Native interactive claim handoff and browser onboarding remain unverified. Exact final-head narrow Sol review is pending.Narrow independent Sol High follow-up on exact HEAD
b69983244d27475a182fa5aae4fbe907c043c141found no ordinary path around the unconditional custody blocker: fresh and adoption probes stopped before resource discovery/start, HTTP, prompt or claim. Python optimization and injected failure cases did not continue past it. Named-user helper negative tests refused root and inconsistent identities, but that helper is unreachable in normal workflow while blocked. This mitigates the reviewed P2 by disabling the Windows path; it does not resolve key custody or establish native trust. Direct standalonelocal_tls_up, Docker, and SR CLI paths remain outside this blocker. Do not merge as a working first-run feature.WIP: Windows first-run blocked on TLS key custodyto WIP: Windows first-run with managed TLS volumeFresh independent Sol High review of exact
d31c6c502cfdaa7f261a53805e2c0d19bc419860found no reproduced in-scope P1/P2 key disclosure or reachable gate bypass. On this Docker Desktop host a non-Docker WSLnobodyuser could neither connect to the daemon socket nor resolve the test named volume's backing key path; real helper mounts and non-root read-only access were inspected. These are host-specific observations, not release-wide proof. Docker/host administrators and the selected image remain trusted.Finding P3: managed volume verifier accepts a
CA:TRUEcertificate despite the initializer's leaf-only policy. Fix and exact-delta review are required. Gate decision: do not lift the shared unconditional custody gate: it also protects the unresolved WSL-bind path, and test-only managed-flow execution does not establish independent trust, interactive claim handoff, native browser onboarding, or completion. A future managed-only enablement requires separate reviewed changes and acceptance. Partial initialization remains manual/ambiguous; a Docker client timeout can leave a daemon-side helper running. Full suite at reviewed HEAD: 68 passed, 7 skipped; managed suite with explicitly selected disposable image: 11 passed. No merge requested.Follow-up independent Sol High review of exact
0216477d4c0483fc3be63e2d99fc030e98a890f4againstd31c6c502cfdaa7f261a53805e2c0d19bc419860closed the prior P3 Basic Constraints finding; no new findings in the two-file delta. On disposable fixtures, the previous verifier accepted CA:TRUE and missing-Basic-Constraints certificates while the revised verifier rejected both; critical and non-critical CA:FALSE leaves were accepted. The unchanged native managed entrypoint still refuses at the shared custody gate, including under Python optimization. The review does not establish independently authenticated trust, native interactive onboarding or authority to lift that gate. Real helper suite passed 6/6 usingsha256:1225eacbec52d7ef0e5f039e1b5d2fdf64069c9774cc23aaa4d9379c15f71c32; target-host generalization and reproducible image provenance are not claimed. PR remains WIP and unmerged.WIP: Windows first-run with managed TLS volumeto WIP: Windows first run with managed TLS volumeAdditional exact-proposal validation at
33c1600544b12467c4301b7169910e9fe4f5c51c: combined suite with bothFOUNDRY_TEST_SR_IMAGEandFOUNDRY_TEST_MANAGED_TLS_IMAGEset to source-verifiedsha256:adcba8a8c65ceb23103c6de7629948ef0e51e8a092eddec9ec8b5f963cec5fd8ran 82 tests, 81 passed and 1 opt-in native diagnostic skipped. The separate native PowerShell diagnostic suite ran 9/9 withFOUNDRY_WINDOWS_LIVE_TEST=1. Managed Docker integration invokes dormant internal flow with synthetic mocked confirmation and is not an enabled native entrypoint, private claim handoff, browser onboarding or acceptance. The managed and legacy gates remain disabled pending independent review.Review in progress for exact proposed HEAD
33c1600544b12467c4301b7169910e9fe4f5c51c: independent Sol High has reported do not enable due to unresolved claim confidentiality. Checking foreground/same TTY does not demonstrate a private Windows terminal or prevent PowerShell transcription/terminal recording from capturing the claim;-NoProfileis not a privacy control. This is an activation concern for the hypothetical managed path, not a reachable exploit whileMANAGED_ACTIVATED=False. Volume handling and certificate confirmation are being evaluated under the explicitly trusted/coordinated Docker and host boundary. Final reviewer result is pending; the gate remains closed and this PR remains WIP.Fresh independent GPT-6.1 Sol High review of exact
33c1600544b12467c4301b7169910e9fe4f5c51cvs0216477d4c0483fc3be63e2d99fc030e98a890f4: DO NOT ACTIVATE. The hypothetical managed flow's same-foreground-TTY checks do not establish privacy; claim output inherits terminal stdout and can be captured by PowerShell transcription or terminal recording.-NoProfileis not a privacy control. This is an activation blocker, not reachable disclosure withMANAGED_ACTIVATED=False.Review found deterministic volume/nonce/labels/marker logic refuses collisions, unattached complete or partial volumes and unexpected consumers; real named-volume read-only mounts and pinned HTTPS identity are checked. These are point-in-time checks relying on trusted, coordinated Docker/host administrators, not atomic ownership or proxy-proof evidence. The public leaf is obtained over trusted local Docker control, independently of the HTTPS peer; browser trust is not established.
ImageIdis still a required verified-image input, so the no-internal-identifiers UX goal remains incomplete.Reviewer independently ran 26 selected tests without bypassing either gate, 10 native PowerShell parameter-routing checks, 11 in-memory stopped-container mutation probes and 2 creation race/timeout probes. The full exact proposed commit suite with source-inspected image ran 82 tests: 81 passed, 1 skipped. Native Windows
-Filenegative invocation refused without creating resources; this is not enabled-entrypoint or private-claim acceptance. Private Windows terminal, claim handoff, browser onboarding and successful final-ready state remain unverified. PR remains WIP and unmerged.Narrow independent Sol High follow-up reviewed exact
229f04dafe3739c5f271b8b07bdf82be4473efe0vs33c1600544b12467c4301b7169910e9fe4f5c51c. No new findings in the privacy-attestation delta. The earlier P2 design gap is conditionally mitigated under a trusted, informed-operator boundary: separate issue consent and private/local/unrecorded terminal attestation, refusal for unknown/mandatory recording, no bypass of monitoring, terminal and resource rechecks, one uncaptured issuance call with no retry. A mistaken attestation or later recording remains a residual risk; this is not technical detection of recording.Reviewer ran five focused tests, ten real helper-predicate fixtures and nine mocked flow cases without real claims. This is not approval to activate the gate or native private-terminal acceptance. Both activation gates remain closed. Actual native claim handoff, login, browser trust, enabled-entrypoint restart and completion remain unverified; PR remains WIP and unmerged.
A managed-only non-secret-startup activation proposal exists only in a detached, non-executed review worktree, commit
9e23e0fa1e910e18cb229a7d18e15d7c4834ffd5, parent current PR HEAD229f04dafe3739c5f271b8b07bdf82be4473efe0. PR #11 itself remains disabled. The proposal permits public-certificate confirmation without a private TTY, retains the terminal/privacy/authorization checks solely for claim issuance, and returnsSERVER_RUNNING — ADMIN_ONBOARDING_INCOMPLETEwithout a claim when no foreground terminal exists. The legacy gate stays closed.At the isolated proposal, the full unit suite ran 85 tests: 78 passed and 7 opt-in/runtime tests skipped. These mocked/unit tests did not execute the enabled entrypoint against Docker. Fresh independent Sol High review of exact proposal commit is in progress before any activation or target execution. No browser trust, policy, global Docker settings or real claims changed.
Independent fresh Sol High security review of exact detached activation proposal
9e23e0fa1e910e18cb229a7d18e15d7c4834ffd5(parent229f04d) found no blocking security issue for isolated nonsecret target testing under trusted, coordinated local operator/host/Docker assumptions. It approved only that testing; not production use, real claim issuance, browser trust, deployment or release. Legacy bind-mount path remains unconditionally blocked. The no-foreground-terminal onboarding case returns status 2 withSERVER_RUNNING — ADMIN_ONBOARDING_INCOMPLETEand no claim.Reviewer identified a low-severity test reliability issue: an opt-in Docker acceptance test mocks stdin/stdout as TTY but leaves stderr non-TTY, so it expects claim refusal instead of the actual no-TTY status. This needs correction and targeted review. Checks are point-in-time and rely on coordination; partial initialization remains manual inspection, not rollback. Sol ran 35 selected unit tests with external calls/sockets blocked, no real Docker or claims. Local full proposal suite ran 85 tests: 78 passed, 7 skipped.
After that review, the local PR branch was fast-forwarded to the exact reviewed commit for authorized disposable native Windows non-secret testing. This is not a production approval or M0/M1 acceptance; PR remains WIP and unmerged. Interactive claim output and browser trust remain untested.
Native Windows target test of Sol-reviewed local proposal
9e23e0fa1e910e18cb229a7d18e15d7c4834ffd5did not reach SR startup: invalid image was refused without resources; fresh invocation created a test-owned TLS volume and displayed its public certificate, then exited 1 rather than expected incomplete-onboarding status. No router, data volume, network, claim, browser or trust change occurred. A separate synthetic input-forwarding probe worked, so the cause has not been attributed to stdin. Test-owned volume and staging artifacts were cleaned after inspection. Diagnostic investigation is in progress; PR HEAD remains disabled229f04dand must not be considered ready.Sol High narrow follow-up reviewed test-only commit
aa8aaffcdb500ede02af3f73b7d44478df340101, parent9e23e0fa1e910e18cb229a7d18e15d7c4834ffd5. It resolved the headless test's incorrect TTY expectation; production files and gate semantics are unchanged. Sol's limited approval carries toaa8aafffor isolated nonsecret target testing only, not production, real claim issuance, browser trust or merge. Twelve pure checks passed. PR's published head remains disabled pending actual target results.WIP: Windows first run with managed TLS volumeto WIP: Managed Windows startup with protected onboardingWIP: Managed Windows startup with protected onboardingto Experimental non-secret Windows managed startupFor the proposed non-secret merge scope, managed onboarding at
d5d3828c973b3e43af1e11af1bdfff58f59f5ba6no longer has a reachable claim issuance branch: it reports incomplete regardless of terminal or affirmative input. Legacy bind path still hits the unconditional custody blocker. Exact-head fresh Sol High review is in progress; no merge verdict yet.Negative evidence: wrong engine ID was rejected by the production Python function using mocked context/engine results before image inspection or managed flow (not a native engine-mismatch run). Production
verify_projectinspected a real disposable stopped Docker container and rejected the wrong TLS volume, while accepting the exact same fixture when its expected volume matched. Inspected container, network and three test volumes were unchanged, then removed. A separate live unexpected-volume-consumer fixture was also refused without modification. No claims or trust/global settings were touched.Local full suite: 85 run, 78 passed, 7 skipped. Native non-secret fresh/repeat/stopped recovery evidence from
9e23e0fpredates only the removal of the managed claim branch; it is not native private-terminal, browser, authenticated readiness or M0 acceptance.Fresh independent GPT-6.1 Sol High review returned APPROVE_EXPERIMENTAL_NONSECRET_MERGE for exact source commit
d5d3828c973b3e43af1e11af1bdfff58f59f5ba6vs main7039f0f6080b62ebbd1e7169095e1cbf562b8f5f, under trusted, coordinated local host/operator/Docker/image assumptions. It verified the managed claim path is removed, legacy bind issuance remains blocked, volume and mount checks, recovery constraints, and trusted-local public certificate confirmation. It is not approval of production, real claim issuance, browser trust, M0 or M1.The reviewer found one P3 test defect: the opt-in real-Docker regression test silently skips for any image ID other than a stale hard-coded fixture. A minimal correction and exact-head follow-up review are in progress. The README-only scope clarification after the reviewed source commit also needs narrow review. Review's remote-head snapshot was stale; PR was pushed to
d5d3828and then README-onlyadf830cwhile it ran.Reviewer verification: 85 tests run (78 passed, 7 skipped); 21 first-run tests passed under Python
-O; 11 managed-entrypoint and 8 legacy negative probes; real stopped Docker container wrong-volume positive/negative inspect unchanged. No native wrong-engine test, real claims, trust-store changes, or browser acceptance claimed.Final independent Sol High verdict: APPROVE_EXPERIMENTAL_NONSECRET_MERGE at exact HEAD
dbbdcf6975d556111a7e7a7f81ec2d4039669731, conditional on the documented trusted/coordinated host, operator, Docker and inspected image boundary. The fresh full review coveredd5d3828vs canonical main7039f0f; the narrow exact-final follow-up reviewed the README and tests delta, confirmed the entire productionscriptstree and Compose blob unchanged, and carried the verdict todbbdcf6. This is not M0, production, private claim, browser or inference acceptance.The P3 stale hard-coded test image finding is fixed: explicitly supplied malformed IDs fail, an immutable local image ID is inspected, and the managed Docker suite ran 15/15 with
sha256:1225eacbec52d7ef0e5f039e1b5d2fdf64069c9774cc23aaa4d9379c15f71c32, including real isolated startup, negative consumers and recovery. The full suite at final head ran 87 tests: 80 passed, 7 skipped. Wrong-engine refusal remains a mocked production-function test, while wrong TLS mount was rejected on an actual inspected stopped Docker fixture, unchanged after refusal. Native Windows non-secret startup/repeat/recovery evidence comes from9e23e0f; the only subsequent production change removes the managed claim path.No Windows trust, policy or global Docker settings were changed. Claims are unavailable from the managed entrypoint; legacy bind remains blocked. Keep issue #5 open.