Repository navigation
ci(windows): qualify host-hardened control-plane suites on native Windows - #6639
Conversation
…oopx-project#6639) Signed-off-by: JasonBuildAI <jasonbuildai@gmail.com>
f0a243d to
4454cbf
Compare
4454cbf to
7bd2f81
Compare
JasonBuildAI
left a comment
JasonBuildAI
left a comment
There was a problem hiding this comment.
Independent review record — exact head 7bd2f81ff
Reviewed through an independent adversarial sub-agent session (separate worktree, its own command runs) plus my own re-verification at this head. The sub-agent's verdict was APPROVE WITH NOTES for the intermediate head 4454cbffd; every note it raised was applied in the delta to 7bd2f81ff, and that delta is re-verified below.
Value. Premises verified independently: the base lane (dda6f7ef7) really ran only 6 of the 266 suites in tests/control_plane_ts/ (test_python_runtime, scheduler_heartbeat_commit, scheduler_heartbeat_commit_cli, sqlite_authority_store, local_authority_provider, sqlite_runtime_admission), and none of the added suites appears anywhere in the base workflow's run strings (zero matches). Provenance checks: #6258 touched sqlite_backup.test.ts, #6356 touched the nine host-hardened suites, and #6566 (fix for #6562) touched checkpoint_artifacts.test.ts; the follow-up sentence quoted from the #6566 review exists in that review.
Scope. Additions only (git diff realupstream/main..HEAD --stat → 25 + 75 lines, two files), confined to the windows-powershell job. Job if/needs/runs-on/timeout-minutes and the merge-gate job are untouched; no deletions.
Logic and edge cases. The guard is now load-bearing rather than a textual tripwire. Six mutated workflow copies were run against it, restoring the workflow byte-identically each time (SHA256 equal after the battery, git diff --exit-code HEAD clean): baseline green; deleting one suite line red; step-level if: false red; step continue-on-error: true red; echo in place of node red; flipping the activation condition to == 'false' red.
Over-abstraction. None: a 75-line standard-library unittest that reuses the existing scripts/ci discovery (which runs in the changes job), no new vocabulary, configuration surface, or framework.
Test and verification sufficiency. The 11 suites reproduce at node v22.22.3: 271 tests / 246 pass / 0 fail / 25 skipped / 48.1s, exit 0, and a per-suite loop shows every suite contributes tests (no suite silently absent or wholly skipped). Named blind spots: GitHub's Windows runner is privileged, so the 3 symlink-privilege-skipping tests here will execute there; total lane budget usage is not measured end-to-end, only the added run (~48s locally, lane limit 30 min).
Check-output plausibility. Counts reproduced. Every "pre-existing failure" claim was checked head vs base: the five catalog-canary failures and the scripts/ci unittest failures/errors have identical identities at base dda6f7ef7 without this diff.
Findings raised by the review, and their disposition at this head
- The guard only detected removal (it stayed green for step
if: false,continue-on-error: true,echo-for-node, and a flipped activation condition) → fixed by the hardening above; the battery is the evidence. - The body said "4 catalog-canary failures" while listing five, and the
scripts/cidiscovery noise was under-described → corrected in the body (five, with identities). - "each carries a
win32branch" was inaccurate → corrected (nine of the ten #6356-touched suites carry an explicit branch;goal_acceptance_authority.test.tswas hardened with a CRLF-aware fence). checkpoint_provider_head.test.tswas attributed to the #6562 family without support in that diff → removed from both the lane and the list, leaving the 11 suites that each have a recorded Windows fix.- "#6356-host-hardened 10 suites" counted a suite listed under #6258 → wording corrected.
- The lane installed no root dependencies, so
goal_acceptance_authority.test.tscould not resolvepg; the first CI run failed exactly there → reproduced locally by movingnode_modulesaside (sameERR_MODULE_NOT_FOUND), fixed with the rootnpm ci --ignore-scriptsstep that the ubuntutypescript-corelane already performs.
Remaining verification gap, stated explicitly. The windows-powershell run for this head was still in progress when this record was written; the check list on this PR is the final readback. Nothing else about this change is unverified.
Verdict for this head: APPROVE WITH NOTES — the coverage addition and contract test are genuine and independently reproduced, all review notes are applied, and only the final CI confirmation is outstanding.
Drafted with AI assistance at my request, under my direction and review.
…rd + final head (2026-10-16T13:48:10Z) Signed-off-by: JasonBuildAI <jasonbuildai@gmail.com>
7bd2f81 to
b8b446c
Compare
JasonBuildAI
left a comment
JasonBuildAI
left a comment
There was a problem hiding this comment.
Independent review record (update) — exact head b8b446c69
This record updates the previous review on head 7bd2f81ff (#6639 (review)) after a second adversarial pass.
What the second pass found. The delta from 4454cbffd to 7bd2f81ff was confirmed correct (11-suite set == guard list, all files exist, guard strictly stronger than before, suites reproduce at 271 / 246 / 0 / 25, exit 0). It also demonstrated three bypasses that still kept the guard green:
- a
#prefix before the suite list in the foldedrun:scalar (one line, so the whole command — flags and file list — is commented out while every suite remains a token; node then falls back to default discovery); - a trailing
; exit 0after the last suite token (suites run but the step can never fail); - a
false &&prefix on the jobif(the activation substring is still present, but the lane never activates).
What changed in this head. scripts/ci/test_windows_lane_coverage.py now pins the whole contract instead of substrings: the qualifying step's token list must be exactly node --no-warnings --experimental-sqlite --experimental-strip-types --test <the listed suites>, the step must have no if and no continue-on-error, and the lane activation must equal needs.changes.outputs.python_tests == 'true'.
Evidence at this head (nine single-edit mutated workflow copies; the workflow was restored byte-identically after each, SHA256 equal, git status clean apart from the intended guard edit).
| Mutation | Guard |
|---|---|
| unmodified workflow | GREEN |
delete sqlite_backup.test.ts line |
RED |
step if: false |
RED |
step continue-on-error: true |
RED |
echo instead of node |
RED |
job if flipped to == 'false' |
RED |
comment out the first suite line (# ) |
RED |
trailing ; exit 0 |
RED |
job if prefixed with false && |
RED |
Re-ran after the battery: the 11 suites still reproduce (271 tests / 246 pass / 0 fail / 25 skipped, exit 0) and ruff is clean; the guard itself is unchanged in behavior except for the added strictness above.
Residual, stated explicitly. The guard is a lexical contract over the workflow text; it is not a sandbox against someone deliberately restructuring the file (for example reintroducing an equivalent runner elsewhere while rewriting this contract test too). That limit is inherent to a workflow-contract test and is why the real merge gate (scripts/ci/review_gate.py, which maps windows-powershell to python_tests and requires success) stays the authority for "the lane actually ran and passed". The lane's own CI run for this head is the final end-to-end readback and is still in progress at the time of writing.
Verdict for this head: APPROVE WITH NOTES — the previously demonstrated bypasses are closed and re-verified red; the only open item is the CI readback for this head.
Drafted with AI assistance at my request, under my direction and review.
b8b446c to
4566751
Compare
JasonBuildAI
left a comment
JasonBuildAI
left a comment
There was a problem hiding this comment.
Independent review record (second update) — exact head 456675163
This record updates the reviews on 7bd2f81ff and b8b446c69 after a third adversarial pass.
What the third pass found. The delta to b8b446c69 was confirmed correct (guard v2 pins the full node --test token list and the activation string; all mandated red cases red, workflow restored byte-identically). It also demonstrated one silent-skip hole that mattered, plus three structural green paths:
run: |(literal block) with the suite list split across shell lines: Pythonsplit()flattens the newlines, so the guard stayed green, while on the runner a bare trailing relative path is a silent no-op in PowerShell — the last suite would simply not execute (268tests instead of271, no failure).runs-on: windows-latest→ubuntu-latest(the same files already run on ubuntu elsewhere, so the win32 branches would never execute while the lane stayed green).- dropping
changesfromneeds(the activation expression then resolves against a null output, silently skipping the lane). - a YAML merge key (
<<: {if: false}) —PyYAMLBaseLoaderdoes not expand merges, so the guard never saw the injectedif.
What changed in this head. The guard now also requires the qualifying step's command to be a single line (no newline inside the pinned run scalar), the lane to run on a windows* runner, the lane's needs to include changes, and the step to carry no YAML merge key.
Evidence at this head (twelve single-edit mutated workflow copies; after every case the workflow was restored byte-identically, SHA256 unchanged, and each failure is an explicit assertion rather than a parse error).
| Mutation | Guard |
|---|---|
| unmodified workflow | GREEN |
delete sqlite_backup.test.ts line |
RED (assertion) |
step if: false |
RED (assertion) |
step continue-on-error: true |
RED (assertion) |
echo instead of node |
RED (assertion) |
job if → == 'false' |
RED (assertion) |
# comment on the first suite line |
RED (assertion) |
trailing ; exit 0 |
RED (assertion) |
job if prefixed with false && |
RED (assertion) |
run: >- → run: | block scalar (bare trailing path) |
RED (assertion) |
runs-on: ubuntu-latest |
RED (assertion) |
needs without changes |
RED (assertion) |
<<: {if: false} merge key on the step |
RED (assertion) |
Residual, stated explicitly. A lexical workflow contract cannot be a complete sandbox: someone who rewrites the contract test in the same edit can always defeat it, and the third pass still found that a duplicated run key is resolved last-wins by both PyYAML and Actions (harmless here, since both read the same effective command), and that a job-level defaults.run.working-directory would fail loudly rather than silently skip. The authority for "the lane ran and passed" remains the required check itself plus scripts/ci/review_gate.py, which maps windows-powershell to python_tests and requires success. The lane's CI run for this head is the final end-to-end readback and is still in progress at the time of writing.
Verdict for this head: APPROVE WITH NOTES — the demonstrated silent-skip and structural bypasses are closed and re-verified red; the only open item is the CI readback for this head.
Drafted with AI assistance at my request, under my direction and review.
…dows The required windows-powershell lane ran a curated subset of tests/control_plane_ts, so the suites the project hardened or fixed specifically for native Windows (loopx-project#6356 host-hardened assertions, loopx-project#6258 backup durability flush, loopx-project#6562 checkpoint durability flush) never executed on a Windows host in CI; the checkpoint regression confirmed that gap by shipping with green qualification. Run those suites in the lane under its qualified SQLite runtime, install the root dependencies the lane was missing so their provider imports resolve, and pin the coverage with a contract test: the qualifying step must stay one single-line node --test command over exactly those files with no environment override, and the lane must stay a pinned Windows runner depending on the change classification, activating on python_tests and gating the merge. Signed-off-by: JasonBuildAI <jasonbuildai@gmail.com>
4566751 to
45f20f8
Compare
JasonBuildAI
left a comment
JasonBuildAI
left a comment
There was a problem hiding this comment.
Independent review record (third update) — exact head 45f20f8f7
This record updates the reviews on 7bd2f81ff, b8b446c69 and 456675163 after a fourth adversarial pass.
What the fourth pass found. The delta to 456675163 was confirmed correct (all four structural bypasses from the previous pass now red with explicit assertions, workflow restored byte-identically, list identity intact). It also demonstrated one empirically silent skip that mattered, plus two structural green paths:
env: NODE_OPTIONS: --test-only(or--test-name-pattern) on the step: the guard stayed green, node exited 0, and no test body executed — verified on the lane's own node version (1..0, exit 0). The guard never inspectedenv.runs-on: ${{ 'ubuntu-latest' || 'windows-latest' }}: thewindowssubstring check passed while the expression can resolve to ubuntu, losing native Windows execution silently.- lane-level
continue-on-error: true: suites still run, but the lane can fail while the workflow run concludes successfully.
What changed in this head. The guard now rejects an expression in runs-on (the lane must pin a Windows label), rejects continue-on-error at lane level as well as step level, and rejects NODE_OPTIONS in the workflow, lane and qualifying-step environment — the three scopes that could turn the node --test command into a no-op.
Evidence at this head (eighteen single-edit mutated workflow copies; the verdict is taken from the process exit code, and after every case the workflow is restored byte-identically with SHA256 identity verified).
| Mutation | Guard |
|---|---|
| unmodified workflow | GREEN (exit 0) |
| delete a suite line | RED (assertion, exit 1) |
step if: false |
RED (assertion) |
step continue-on-error: true |
RED (assertion) |
echo instead of node |
RED (assertion) |
job if → == 'false' |
RED (assertion) |
# comment on the first suite line |
RED (assertion) |
trailing ; exit 0 |
RED (assertion) |
job if prefixed with false && |
RED (assertion) |
run: >- → run: | block scalar |
RED (assertion) |
runs-on: ubuntu-latest |
RED (assertion) |
needs without changes |
RED (assertion) |
<<: {if: false} merge key |
RED (assertion) |
NODE_OPTIONS: --test-only in the step env |
RED (assertion) |
NODE_OPTIONS: --test-only in the lane env |
RED (assertion) |
NODE_OPTIONS: --test-only in the workflow env |
RED (assertion) |
runs-on expression resolving to ubuntu |
RED (assertion) |
lane-level continue-on-error: true |
RED (assertion) |
Residual, stated explicitly. A lexical workflow contract cannot be a complete sandbox, and the fourth pass still listed green paths that are not silent skips: a YAML anchor added to the run scalar, a folded job if (after folding and stripping it is byte-identical to the pinned expression), a trailing NBSP, a duplicated windows-powershell: key (last-wins in both PyYAML and Actions, so both read the same job), timeout-minutes: 0 and an unknown IF: key (expected to be rejected loudly by the Actions parser rather than ignored). Someone who rewrites this contract test in the same edit can always defeat it; that is inherent to a text-level guard. The authority for "the lane ran and passed" remains the required check plus scripts/ci/review_gate.py, which maps windows-powershell to python_tests and requires success. The lane's CI run for this head is the final end-to-end readback and is still in progress at the time of writing.
Verdict for this head: APPROVE WITH NOTES — the demonstrated silent-skip vector and the structural gaps are closed and re-verified red; the only open item is the CI readback for this head.
Drafted with AI assistance at my request, under my direction and review.
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max
Exact head: 45f20f8f764390fb6ecf43feae3e9ac4020c990f
动机
维护 Windows 兼容性、依靠必需 CI lane 判断控制面改动能否合入的贡献者。
已有十一组测试包含 Windows 修复，却没有进入原生 Windows lane；后续回归仍可能在绿灯下漏过。提案把这些既有测试真正接入该 lane，并让移除、跳过或把执行改成空跑的常见编辑立即失败。
当前工作流通过十九项 CI 单测，旧工作流不能通过新增覆盖检查；十七种破坏性工作流变体全部被拒绝。按工作流解析出的同一条 Node 22.22.3 命令在 base 和 head 均得到 251 通过、20 个可选 PostgreSQL 跳过、零失败。
这是十一组已登记测试的持续 Windows 接入，不是所有 Windows 分支的全面认证；本机运行 macOS，未运行原生 Windows runner，也未查询、等待或重跑远端 CI。
独立判定依据：https://github.com/loopx-project/loopx/issues/6638；revision 2026-10-16T13:45:41Z。按 What happens 的十一项已知缺口逐项核对；Expected 的全部 Windows 行为覆盖是更广目标，本次只认定一个可独立验收的增量。
其余尚未登记的 Windows 分支、Python backup 验证及独立 worktree 观察测试仍由各自实现和 Windows lane 维护者接续；本 PR 不宣称一并完成。
改动思路
已有工作流和 CI unittest owner 足以承载这个缺口。固定列表对应已登记的真实套件，维护成本是后续同步更新列表；不需要动态发现框架、产品运行时开关或新权限模型。
当前 PR 交付既有十一组测试在 Windows lane 中的接入与防失效检查；测试实现、其他 Windows 分支和独立新测试仍由原维护边界负责，避免把 CI 接线扩大成跨平台框架。
具体改动
工作流仍使用 python_tests 的原有触发条件、windows-powershell required job、Windows runner 和原本用于 SQLite 的 Node 22.22.3。在该 Node 准备完成后增加根目录 npm ci --ignore-scripts，再以一条 YAML folded command 调用十一条实际 suite 路径，补足包括 pg 导入所需的依赖；没有修改测试实现或生产运行时。
workflow() 使用 BaseLoader 读取实际 YAML；test_windows_lane_still_qualifies_every_code_change() 核对 literal Windows runner、changes 依赖、原激活条件、job 的失败传播以及 workflow/job 的 NODE_OPTIONS。test_windows_qualified_suites_are_unconditionally_executed_in_the_lane() 检查十一条文件真实存在、完整 node token 序列、单行命令，并拒绝 step 的 if、continue-on-error、YAML merge 和 NODE_OPTIONS。它们进入现有 scripts/ci unittest discovery，无需另设测试入口。
独立验证运行同一套 discovery：base 17 项通过，head 19 项通过。把实际 base YAML 交给新增检查时因缺少执行步骤失败；移除 suite、echo/comment、尾随 exit 0、多行裸路径、跳过/吞错、激活条件、非 Windows/表达式 runner、缺 changes，以及三层 NODE_OPTIONS 等十七种负例均失败；无关 step 自己的环境变量通过。另以真实 Node marker 证明普通测试执行了函数体，而 NODE_OPTIONS=--test-only 会退出 0 却不执行函数体，避免只证明字符串匹配。
按当前 YAML 解出的十一套命令，在 base/head 的 Node 22.22.3 各得到 271 total、251 pass、20 optional PostgreSQL skip、0 fail；十一套源文件逐字节相同。因此交付增量是可靠接线，不是声称又修了测试内部行为。Ruff、语义 advisory 后完整语义检查通过；premerge 执行 4 项 direct、7 项 selected，无 blocking failure。
对主干的风险
固定十一条列表需要随真正新增的 Windows suite 一起维护；它不自动发现未来所有平台分支。此检查防止当前列举的常见失效编辑，不是对任意 shell、其他 action 或 GitHub 配置的安全沙箱。额外依赖安装与测试会增加 lane 时间，本次没有伪造完整远端 job 的耗时或成功证明。
本机实际执行环境是 macOS。上面的 251/20 数据不能替换 issue 中作者的原生 Windows 246/25 记录；作者记录只是外部证据。本次没有查询、轮询或等待 GitHub CI，也未执行原生 PowerShell runner。PostgreSQL 可选项的跳过不计作通过，且本 PR 不改其存储实现。实际 base/head 的 maintainability ratchet 均只报告相同 DSH 既有 oversized function，失败全文与因果文件字节一致，作为 inherited advisory 单列，不拿它掩盖新检查失败。
我的整体评价
APPROVE。已登记十一组套件的必需 lane 接入、失败传播及空跑防护形成一个完整、可回退的交付增量，没有发现当前 head 的阻断问题。其余尚未登记的 Windows 分支、Python backup 验证及独立 worktree 观察测试仍由各自实现和 Windows lane 维护者接续；本 PR 不宣称一并完成。
未来改动可维护性复核：现有 CI discovery 和局部清单足够，额外通用框架没有当前收益。评审结论不授予合并、部署或共享 CLI 升级权限。
English verdict: APPROVE - 45f20f8f764390fb6ecf43feae3e9ac4020c990f; the eleven recorded suites are wired into the required Windows lane and protected against tested skip/no-op mutations; local Node22 251 pass/20 optional skips per arm, native Windows unexecuted here.
2 participants
Goal And Delivered Outcome
windows-powershellCI lane, which is why this Windows-only regression escaped CI; adding it there is a reasonable follow-up"). Related Windows-only fixes whose suites never gained Windows coverage: fix(backup): flush state backup archives through writable handles on Windows #6258 (+2/-1 insqlite_backup.test.ts), [Bug]: native Windows: remaining 32 host-dependent control-plane TypeScript test failures after #6207 #6351/test: guard remaining host-dependent control-plane assertions on native Windows #6356 (host-hardened suite assertions).windows-powershellmerge-gate job ran a hand-curated list of 6 of the 266 suites intests/control_plane_ts/. The control-plane suites that the project explicitly hardened or fixed for native Windows sit outside that list, so their native Windows behavior is never exercised in CI and a Windows-only regression in them ships with green qualification.test_python_runtime,scheduler_heartbeat_commit,scheduler_heartbeat_commit_cli,sqlite_authority_store,local_authority_providerandsqlite_runtime_admission; none of the suites below appears in anyrunstring of that job (git show dda6f7ef7:.github/workflows/python-tests.yml, zero matches). After, the same job additionally runs the 11 suites below under its qualified SQLite runtime and installs the root dependencies those suites import. The new contract test fails when a suite leaves the lane, and also when the listing step stops executing unconditionally (if,continue-on-error, or a non-nodecommand).main.Change
.github/workflows/python-tests.yml(windows-powershelljob only):npm ci --ignore-scriptsin the repository root): the host-qualified suites import real packages, and this lane never installed the root dependencies, sogoal_acceptance_authority.test.tscould not resolvepg(the first CI run on this PR failed exactly there withERR_MODULE_NOT_FOUND: Cannot find package 'pg'). The ubuntutypescript-corelane already installs them.node 22.22.3and--experimental-sqlite.scripts/ci/test_windows_lane_coverage.py: pins the contract — the lane must run on a pinned Windows runner label (no expression), depend onchanges, activate on exactlyneeds.changes.outputs.python_tests == 'true'and not be made non-blocking; no scope (workflow, lane, step) may injectNODE_OPTIONS; every listed suite must exist in the checkout; and the step that mentions them must be one single-linenode --no-warnings --experimental-sqlite --experimental-strip-types --test <listed files>command with noif, nocontinue-on-errorand no YAML merge key. A suite therefore cannot stay "listed" while being skipped, muted, commented out, masked by shell plumbing, turned into a--test-onlyno-op, or split into a multi-line block where a bare trailing path is a silent no-op in PowerShell.checkpoint_artifacts.test.tssqlite_backup.test.tsagent_preferences.test.ts,authority_archive.test.ts,canonical_task_lease_renew.test.ts,cold_source_import.test.ts,coordination_runtime_shadow.test.ts,effect_runtime_snapshot.test.ts,goal_acceptance_authority.test.ts,quota_void_commit.test.ts,shadow_entry_delivery.test.tschecks/changescontext: the guard runs in the existingchangesjob discovery (python -m unittest discover -s scripts/ci -p 'test_*.py'), which passed on this PR.Author Declaration
@JasonBuildAI; the human operator directed the task, chose the topic from the recorded Windows-regression evidence, and reviewed every published artifact.Implemented against
main dda6f7ef7: PR fix(checkpoint): flush captured members through update handles on Windows #6566 review (named follow-up), [Bug]: native Windows: remaining 32 host-dependent control-plane TypeScript test failures after #6207 #6351/test: guard remaining host-dependent control-plane assertions on native Windows #6356 (host-hardened suites), [Bug]: native Windows: loopx backup-state --execute always fails because both durability fsync calls use read-only file handles #6252/fix(backup): flush state backup archives through writable handles on Windows #6258 (durability flush), plus.github/workflows/python-tests.ymlitself as the lane contract.windows-powershelllane.github/workflows/python-tests.yml(new step)node --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/checkpoint_artifacts.test.tstests/control_plane_ts/sqlite_backup.test.tsscripts/ci/test_windows_lane_coverage.pypython -m unittest discover -s scripts/ci -p 'test_*.py'(runs in thechangesjob)tests/test_state_backup.py, #6258)tests/test_state_backup.pyif: false, stepcontinue-on-error: true,echofornode, a flipped activation condition, a commented-out suite list, a trailing; exit 0, afalse &&activation prefix, a|block scalar splitting the list across shell lines, anubuntu-latestrunner swap, droppingchangesfromneeds, a YAML merge key injectingif: false,NODE_OPTIONS: --test-onlyat step, lane and workflow scope, aruns-onexpression that can resolve to ubuntu, and a lane-levelcontinue-on-error), restoring the workflow byte-identically after each (SHA256 unchanged); ranscripts/ciunittest discovery (identical failing identities at base and head); ruff clean; ran the 11 suites on native Windows undernode v22.22.3; ran the canary premerge gate. Read the lane end-to-end,review_gate.py, and the#6356/#6258/#6566diffs before editing. Deliberately not included: Python suites whose native Windows execution is privilege-gated on this host, and the other suites with awin32branch that carry no recorded Windows fix (listed below).Validation
node --no-warnings --experimental-sqlite --experimental-strip-types --test <11 suites>→# tests 271 / # pass 246 / # fail 0 / # skipped 25 / duration_ms 48102(exit 0). The 25 skips are 20 PostgreSQL-provider cases (noLOOPX_TEST_POSTGRES_URL), 3 "file symlink creation needs Windows host privileges" and 2 POSIX-only cases (mode 000 read denial needs a non-root POSIX host,the linux directory-sync boundary needs a POSIX host).python -m unittest discover -s scripts/ci -p 'test_*.py'→ the two new tests pass, and the mutation battery above shows the guard red with an explicit assertion for all seventeen single-edit bypasses (deletion, stepif: false, stepcontinue-on-error: true,echoinstead ofnode, flipped activation condition, commented-out suite list, trailing; exit 0,false &&activation prefix,|block scalar with a bare trailing path,ubuntu-latestrunner,needswithoutchanges, YAML merge key injectingif: false,NODE_OPTIONS: --test-onlyat step/lane/workflow scope,runs-onexpression, lane-levelcontinue-on-error) and green only for the unmodified workflow.python -m ruff check scripts/ci/test_windows_lane_coverage.py→All checks passed!windows-powershellrun (headf0a243dd8) failed the new step because that lane installed no root dependencies —ERR_MODULE_NOT_FOUND: Cannot find package 'pg' imported from tests/control_plane_ts/goal_acceptance_authority.test.ts(job-step conclusion read from the Actions jobs API; reproduced locally with the same node version by movingnode_modulesaside:# fail 1, same module error). The rootnpm ci --ignore-scriptsstep added in4454cbffdaddresses it. Thechangesjob (which executesscripts/ciunittests, i.e. the new contract test) and every other prerequisite lane passed on that run.loopx canary premerge --from-git-diff(after the forkmainwas fast-forwarded so the gate diffs against the real base): direct checks 3/3 passed,python3 -m py_compilepassed,examples/semantic-vocabulary-drift-smoke.pypassed, and the public boundary scan over the changed paths passed. Five catalog-canary checks fail, all of them identically at basedda6f7ef7without this diff (control-plane-maintainability-ratchet-smoke.py, which the gate itself reports asadvisory_inherited_failure"known baseline smoke failure did not mention changed files";cli-output-budget-regression-smoke.py, failing on its POSIX/tmpfixture path on Windows;benchmark-candidate-source-boundary-smoke.py;benchmark-artifact-path-filter-smoke.py;content-ops-public-handle-observation-smoke.py), and the fourscripts/ciunittest failures/errors (a Windows-invalid newline-in-path fixture, plus temp-directory teardown noise) are identical at base and head.Scope And Continuation
tests/test_state_backup.py— the Python twin of fix(backup): flush state backup archives through writable handles on Windows #6258 — still runs only on ubuntu; (2) suites with awin32branch but no recorded Windows fix (effect_runtime_io,effect_runtime_compile_cache,host_process,host_process_group,configuration_backup,source_transfer,shadow_management,turn_journal_query,delegation_preview_bridge,replan_history,zcode_guard) remain outside the lane.WINDOWS_QUALIFIED_SUITESand the lane step together when a native Windows fix lands; the contract test makes that the path of least resistance. A broader derived rule ("everywin32branch runs on Windows") is possible once those remaining suites are verified Windows-green.Drafted with AI assistance at my request, under my direction and review.