Repository navigation
fix: repair native Windows paths and owner fixtures - #44
Merged
Merged
Conversation
intel352
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent PR44 now runs the full owner suite on
windows-2025and repairs the portability defects it exposed. Windows paths in shared policy glob matching now preserve deny-first behavior, including the TrustEngine path gate used by the real executor. Docker mount validation keeps native rules for host sources and Linux rules for container destinations, including the existing ten critical-directory denials. The scoped test fixtures use native executable, home, archive and mount paths; shell and file-security assertions reflect what the host actually reports. No API, dependency, release workflow, persistence call, ACL grant or credential changed.Verification is tied to source head
4466204ccdfff55f7c80e8aac844bb5e84bac55band unchanged base36882286121c93ad8b0974b0427025df2a191b56:9337e4bproved the original matcher let a denied.sshfile read execute and rejected a valid Linux/cachemount target. The corrected executable, provider, shell and session fixtures passed in that run.go vetand full race tests, Windowsgo vetand full serial race tests, and strict contract validation. The Windows checkout was synthetic mergeec8890593a414af48c1612e1076f645a22e9e2a9, with the exact reviewed source tree9d9094241ebff6e00304ed46d032d54c790dfa64.GOWORK=off go vet ./...and focused tests across seven affected packages passed. Independent source review of the exact head found no blocking issue (SHIP-IT).The matcher retains case-sensitive lexical rules and does not canonicalize Windows aliases or symlinks. Windows reported POSIX mode bits do not prove an owner-only ACL; the existing persistence calls and directory ACL inheritance are unchanged.
The source is ready for a squash-merge proposal. Branch protection currently requires one GitHub approval, which the independent source review does not supply; there are no unresolved threads. This phase does not merge, tag, release or deploy. Merging source would run master CI and configured CodeQL scanning. A separate
v*tag would start the release workflow and, after publishing, its Registry notification.