feat: add Windows layered connection entry

[EitanWong]

Closes #2

Summary:

• Add the Windows layered connection entry and Task 8 acceptance contract.
• Enforce bootstrap-only delivery, shared fallback attempt state, signed assets, route reselection, and the 1 MiB handoff gate.
• Add strict evidence packaging and Windows private-path protection.

Verification:

• go test ./... -count=1
• go vet ./...
• scripts/check.sh
• scripts/audit-public-surface.sh
• Windows amd64 focused/default vet and cross-build checks

Windows 11 evidence is recorded. Windows 10 and complete signed HTTPS cold/warm evidence remain explicitly unchecked.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 129 files, which is 29 over the limit of 100.

To get a review, narrow the scope:
• coderabbit review --committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2823b40c-1ad0-40f7-a5c6-1551c9b62926

📥 Commits

Reviewing files that changed from the base of the PR and between 9d16e5a and 413878c.

📒 Files selected for processing (131)

• README.md
• TASKS.md
• cmd/rdev-bootstrap/main.go
• cmd/rdev-bootstrap/main_test.go
• cmd/rdev-bootstrap/main_windows.go
• docs/operations/ACCEPTANCE.md
• docs/operations/AGENT_BOOTSTRAP_PROMPT.md
• docs/operations/BOOTSTRAP.md
• docs/operations/DEV_GATEWAY.md
• docs/project/ACCEPTANCE_TESTS.md
• docs/superpowers/plans/2026-07-15-windows-layered-connection-entry.md
• docs/superpowers/plans/2026-07-16-windows-layered-entry-delivery.md
• docs/superpowers/specs/2026-07-15-fast-reliable-connection-entry-design.md
• docs/superpowers/specs/2026-07-15-formal-release-acceptance-gate-design.md
• docs/superpowers/specs/2026-07-16-windows-layered-connection-entry-v2-design.md
• internal/acceptance/fresh_agent_support_session.go
• internal/acceptance/fresh_agent_support_session_test.go
• internal/acceptance/managed_mac.go
• internal/acceptance/managed_mac_service.go
• internal/acceptance/relay_adapter_package.go
• internal/acceptance/relay_adapter_package_test.go
• internal/acceptance/windows_layered_entry_evidence_test.go
• internal/acceptance/windows_layered_entry_test.go
• internal/acceptance/windows_temporary.go
• internal/acceptance/windows_temporary_package.go
• internal/acceptance/windows_temporary_package_test.go
• internal/acceptance/windows_temporary_test.go
• internal/acceptance/windows_temporary_verify.go
• internal/acceptance/windows_temporary_verify_test.go
• internal/agentinvite/invite.go
• internal/agentinvite/invite_test.go
• internal/assetdownload/atomic_replace_other.go
• internal/assetdownload/atomic_replace_windows.go
• internal/assetdownload/atomic_replace_windows_focused.go
• internal/assetdownload/downloader.go
• internal/assetdownload/downloader_test.go
• internal/assetdownload/http_transport.go
• internal/assetdownload/transport.go
• internal/bootstrapcmd/bootstrapcmd.go
• internal/bootstrapcmd/bootstrapcmd_test.go
• internal/bootstrapcmd/layered_runtime_open_other.go
• internal/bootstrapcmd/layered_runtime_open_windows.go
• internal/bootstrapcmd/layered_test.go
• internal/bootstrapcmd/windowsentry/app.go
• internal/bootstrapcmd/windowsentry/app_test.go
• internal/bootstrapcmd/windowsentry/attempt.go
• internal/bootstrapcmd/windowsentry/attempt_security_other.go
• internal/bootstrapcmd/windowsentry/attempt_security_windows.go
• internal/bootstrapcmd/windowsentry/attempt_test.go
• internal/bootstrapcmd/windowsentry/attempt_test_path_other_test.go
• internal/bootstrapcmd/windowsentry/attempt_test_path_windows_test.go
• internal/bootstrapcmd/windowsentry/cache.go
• internal/bootstrapcmd/windowsentry/cache_postvalidation_other_test.go
• internal/bootstrapcmd/windowsentry/cache_security_other.go
• internal/bootstrapcmd/windowsentry/cache_security_windows.go
• internal/bootstrapcmd/windowsentry/cache_security_windows_test.go
• internal/bootstrapcmd/windowsentry/cache_test_path_other_test.go
• internal/bootstrapcmd/windowsentry/cache_test_path_windows_test.go
• internal/bootstrapcmd/windowsentry/core_lifecycle_other.go
• internal/bootstrapcmd/windowsentry/core_lifecycle_windows.go
• internal/bootstrapcmd/windowsentry/core_lifecycle_windows_test.go
• internal/bootstrapcmd/windowsentry/curl_protocol.go
• internal/bootstrapcmd/windowsentry/curl_protocol_test.go
• internal/bootstrapcmd/windowsentry/curl_transport_stub.go
• internal/bootstrapcmd/windowsentry/curl_transport_windows.go
• internal/bootstrapcmd/windowsentry/curl_transport_windows_test.go
• internal/bootstrapcmd/windowsentry/private_path_other.go
• internal/bootstrapcmd/windowsentry/private_path_windows.go
• internal/bootstrapcmd/windowsentry/temp_security_windows.go
• internal/bootstrapcmd/windowsentry/winapi_windows.go
• internal/cdnopt/plan.go
• internal/cdnopt/plan_test.go
• internal/cli/cli.go
• internal/cli/cli_test.go
• internal/cli/coverage_surface_test.go
• internal/connectionentry/plan.go
• internal/connectionentry/plan_test.go
• internal/connectionentry/windows_layered.go
• internal/connectionentry/windows_layered_archive.go
• internal/connectionentry/windows_layered_archive_permissions_other.go
• internal/connectionentry/windows_layered_archive_permissions_other_test.go
• internal/connectionentry/windows_layered_archive_permissions_windows.go
• internal/connectionentry/windows_layered_archive_permissions_windows_test.go
• internal/connectionentry/windows_layered_archive_test.go
• internal/connectionentry/windows_layered_command_windows_test.go
• internal/connectionentry/windows_layered_test.go
• internal/connectionrunner/runner.go
• internal/connectionrunner/runner_test.go
• internal/controlplane/store.go
• internal/gateway/session.go
• internal/hostcmd/hostcmd.go
• internal/hostcmd/hostcmd_test.go
• internal/hostcmd/route_pool.go
• internal/hostcmd/route_pool_concurrency_test.go
• internal/hostcmd/route_pool_test.go
• internal/httpapi/layered_assets_test.go
• internal/httpapi/server.go
• internal/httpapi/server_test.go
• internal/httpapi/session_test.go
• internal/release/bundle.go
• internal/release/bundle_test.go
• internal/release/candidate.go
• internal/release/candidate_test.go
• internal/release/canonical_time_other.go
• internal/release/focused_errors.go
• internal/release/layered_asset_path.go
• internal/release/layered_asset_path_focused.go
• internal/release/layered_assets.go
• internal/release/layered_assets_codec.go
• internal/release/layered_assets_codec_focused.go
• internal/release/layered_assets_decode.go
• internal/release/layered_assets_focused_test.go
• internal/release/layered_assets_sign.go
• internal/release/layered_assets_test.go
• internal/release/layered_assets_verify.go
• internal/release/manifest.go
• internal/release/manifest_test.go
• internal/release/provenance.go
• internal/release/sbom.go
• internal/supportsession/plan.go
• internal/supportsession/plan_test.go
• internal/tunnel/manager.go
• scripts/bootstrap/windows-temporary.ps1
• scripts/bootstrap/windows_temporary_test.go
• scripts/ci/release-smoke.sh
• scripts/github/bootstrap-project.sh
• scripts/release/build-artifacts.sh
• scripts/release/prepare-platform-candidates.sh
• scripts/release_contract_test.go
• skills/remote-vibe-coding/SKILL.md
• skills/safe-remote-support/SKILL.md

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Review on demand using usage pricing

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/2-windows-layered-connection-entry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}