Add fail-closed Windows ConPTY containment

.github/workflows/ci.yml

@@ -66,3 +66,6 @@ jobs:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.88.0
       - run: cargo test --all-targets --all-features
+      - name: Windows containment runtime evidence
+        if: runner.os == 'Windows'
+        run: cargo test --test contained_spawn -- --nocapture

Cargo.toml

@@ -90,7 +90,7 @@ version = "1.1"
 
 [dependencies.sysprims-timeout]
 git = "https://github.com/3leaps/sysprims"
-rev = "1e56e8b7fbe004a0a1b028b81ba11193e1dd71ff"
+rev = "7e5cc03847029dbd316d9f8c0887997bf64a247c"
 version = "=0.2.2"
 
 [dev-dependencies.futures]
@@ -131,5 +131,5 @@ version = "0.10"
 
 [target."cfg(unix)".dependencies.sysprims-session]
 git = "https://github.com/3leaps/sysprims"
-rev = "1e56e8b7fbe004a0a1b028b81ba11193e1dd71ff"
+rev = "7e5cc03847029dbd316d9f8c0887997bf64a247c"
 version = "=0.2.2"

Makefile

@@ -1,8 +1,9 @@
-.PHONY: help check test-owned-pty-empty test-diabolical
+.PHONY: help check check-candidate test-owned-pty-empty test-diabolical
 
 help:
 	@printf '%s\n' \
 		'check                 Run formatting, lint, and host-safe tests' \
+		'check-candidate       Check the exact sibling sysprims candidate' \
 		'test-owned-pty-empty  Prove explicit-close and natural-exit PTY cleanup' \
 		'test-diabolical       Run hostile containment scenes in disposable Docker'
 
@@ -11,6 +12,9 @@ check:
 	cargo clippy --all-targets --all-features -- -D warnings
 	cargo test --all-targets --all-features
 
+check-candidate:
+	./scripts/run-candidate-check.sh
+
 test-owned-pty-empty:
 	./scripts/run-owned-pty-empty.sh
 

README.md

@@ -38,9 +38,13 @@ task runner that:
 5. reads containment, completion, and reap evidence with no process-group,
    Job, or wait glue of your own.
 
-On Unix today, `SlavePty::spawn_contained_command` installs the prepared
-sysprims acquisition hook in the PTY-owned spawn, validates its sealed
-same-spawn receipt, and returns an owned `ContainmentGuard<ContainedPtyChild>`.
+On Unix, `SlavePty::spawn_contained_command` installs the prepared sysprims
+acquisition hook in the PTY-owned spawn and validates its sealed same-spawn
+receipt. On Windows, the ConPTY adapter creates the child suspended exactly
+once, assigns and verifies that exact process in a prepared non-breakaway Job,
+transfers sole process/Job authority to the guard, and resumes the primary
+thread exactly once. Both paths return an owned
+`ContainmentGuard<ContainedPtyChild>`.
 
 ## What this is not
 
@@ -62,10 +66,11 @@ Generic process identity, Job/group evidence, and receipts live in
   lifecycle transition.
 - Completion evidence is reported independently as `Empty`, `Survivors`,
   or `Unknown`.
+- Boundary strength is independent too: Unix reports `cooperative_group`; the
+  pre-execution Windows Job path reports `kernel_enforced_job`.
 - A cooperative Unix descendant can still leave its acquired group.
   Guaranteed acquisition is not an OS-enforced non-escape guarantee.
-- Unsupported implementations, including Windows in this tree, reject the
-  guarded API before spawning.
+- Unsupported PTY implementations reject the guarded API before spawning.
 
 ## Owned real-PTY examples
 

UPSTREAM.md

@@ -15,13 +15,15 @@ The compatibility delta is intentionally narrow:
 - an object-safe guarded-spawn method on `SlavePty`;
 - a Unix implementation whose prepared sysprims acquisition hook replaces
   portable-pty's internal `setsid` slot;
+- a Windows ConPTY transaction that creates one child suspended, assigns and
+  verifies that exact process in a non-breakaway Job, then resumes once;
 - an exact-child adapter owned by `sysprims_timeout::ContainmentGuard`;
 - a pre-spawn parent recovery owner that retains the opaque exact child for
   bounded failure attempts and nonblocking error destruction;
-- pre-spawn rejection for unsupported implementations, including Windows;
+- pre-spawn rejection for unsupported PTY implementations;
 - lifecycle, real-PTY, allocator-lock, and compatibility tests; and
 - mechanical current-Clippy fixes that do not change behavior.
 
 The minimum sysprims contract is `v0.2.2`, commit
-`1e56e8b7fbe004a0a1b028b81ba11193e1dd71ff`. Compatibility is also checked
+`7e5cc03847029dbd316d9f8c0887997bf64a247c`. Compatibility is also checked
 against that exact sysprims revision before a companion release is cut.

scripts/run-candidate-check.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+set -eu
+
+companion_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+sysprims_root=${SYSPRIMS_ROOT:-"$companion_root/../sysprims"}
+reviewed_sysprims_rev=7e5cc03847029dbd316d9f8c0887997bf64a247c
+
+actual_sysprims_rev=$(git -C "$sysprims_root" rev-parse HEAD)
+if [ "$actual_sysprims_rev" != "$reviewed_sysprims_rev" ]; then
+    echo "sysprims must be at reviewed revision $reviewed_sysprims_rev" >&2
+    echo "found $actual_sysprims_rev" >&2
+    exit 2
+fi
+if [ -n "$(git -C "$sysprims_root" status --short)" ]; then
+    echo "sysprims worktree must be clean" >&2
+    exit 2
+fi
+
+work_root=$(mktemp -d "${TMPDIR:-/tmp}/sysprims-pty-candidate.XXXXXX")
+trap 'rm -rf "$work_root"' EXIT HUP INT TERM
+
+mkdir -p "$work_root/companion"
+tar -C "$companion_root" \
+    --exclude .git \
+    --exclude target \
+    -cf - . | tar -C "$work_root/companion" -xf -
+
+awk \
+    -v timeout_path="$sysprims_root/crates/sysprims-timeout" \
+    -v session_path="$sysprims_root/crates/sysprims-session" \
+    '
+    $0 == "[dependencies.sysprims-timeout]" {
+        print
+        print "path = \"" timeout_path "\""
+        replacing_timeout = 1
+        next
+    }
+    replacing_timeout {
+        if ($0 == "") {
+            print
+            replacing_timeout = 0
+        }
+        next
+    }
+    $0 == "[target.\"cfg(unix)\".dependencies.sysprims-session]" {
+        print
+        print "path = \"" session_path "\""
+        replacing_session = 1
+        next
+    }
+    replacing_session { next }
+    { print }
+    ' "$work_root/companion/Cargo.toml" >"$work_root/Cargo.toml"
+mv "$work_root/Cargo.toml" "$work_root/companion/Cargo.toml"
+
+echo "sysprims candidate: $reviewed_sysprims_rev"
+cd "$work_root/companion"
+CARGO_TARGET_DIR="$companion_root/target/candidate-check" \
+    cargo fmt --all -- --check
+CARGO_TARGET_DIR="$companion_root/target/candidate-check" \
+    cargo clippy --all-targets --all-features -- -D warnings
+CARGO_TARGET_DIR="$companion_root/target/candidate-check" \
+    cargo test --all-targets --all-features
+CARGO_TARGET_DIR="$companion_root/target/candidate-check-windows-x64" \
+    RUSTFLAGS=-Dwarnings \
+    cargo check --all-targets --all-features --target x86_64-pc-windows-msvc
+CARGO_TARGET_DIR="$companion_root/target/candidate-check-windows-arm64" \
+    RUSTFLAGS=-Dwarnings \
+    cargo check --all-targets --all-features --target aarch64-pc-windows-msvc

scripts/run-diabolical-docker.sh

@@ -3,7 +3,7 @@ set -eu
 
 companion_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 sysprims_root=${SYSPRIMS_ROOT:-"$companion_root/../sysprims"}
-reviewed_sysprims_rev=1e56e8b7fbe004a0a1b028b81ba11193e1dd71ff
+reviewed_sysprims_rev=7e5cc03847029dbd316d9f8c0887997bf64a247c
 
 if ! docker info >/dev/null 2>&1; then
     echo "docker daemon unavailable; start the reviewed disposable runtime" >&2

scripts/run-owned-pty-empty.sh

@@ -3,7 +3,7 @@ set -eu
 
 companion_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 sysprims_root=${SYSPRIMS_ROOT:-"$companion_root/../sysprims"}
-reviewed_sysprims_rev=1e56e8b7fbe004a0a1b028b81ba11193e1dd71ff
+reviewed_sysprims_rev=7e5cc03847029dbd316d9f8c0887997bf64a247c
 
 case "$(uname -s)" in
     Darwin|Linux) ;;