Preserve historical router identity across installed layouts and avoid SACL writes in Windows private staging

[JeremyABurton]

Summary

Historical shadow validation currently assumes the source-layout router path. Support the canonical installed path as well while selecting exactly one regular router from the recorded historical head and checking its recorded digest before import. Reject missing, ambiguous, redirected and mismatched identities; retain historical class recomputation and sidecar/outcome validation.

Windows private staging can fail under a non-elevated token because the PowerShell Set-Acl path requests SeSecurityPrivilege. Use Directory.SetAccessControl for the new stage's owner and protected owner-only inheritable DACL. For exclusively created empty files, read Access|Owner, change only ownership, and use File.SetAccessControl. Preserve readback before sensitive writes, exclusive creation, failure descriptor closure and the existing helper timeout. No SACL, audit-rule, group or privilege changes.

Contribution type

• Shared-core change
• Flow-back proposal only
• Public efficiency receipt only
• Documentation or repository maintenance

Acceptance

• Resolve only .agents/skills/anti-dark-code/scripts/adc_route.py or anti-dark-code/scripts/adc_route.py, using recorded-head bytes for historical records. No current-worktree fallback.
• Require one regular candidate and the recorded SHA-256 before import. Keep missing, ambiguous, digest-mismatch and redirected/nonregular rejection.
• Secure only new staging objects; preserve existing-object refusal, owner-only staging, protected DACL, child inheritance, private readback and failure-before-sensitive-write ordering.
• Do not request SACL auditing, enable privileges, elevate execution, weaken checks, change timeouts or rewrite historical evidence.
• Preserve the exact four-file identities below; source changes require renewed review and verification.

Evidence and limits

Local Windows / Python 3.14.6: retained focused unittest evidence reports 32 tests, four skips, zero failures/errors and successful exit. The non-elevated Windows test actually passed without SeSecurityPrivilege. An external accounting defect caused by PowerShell line wrapping was corrected against the retained result without rerunning that focused command.

The complete serial upstream unittest suite then passed: 761 tests, 19 skips, zero failures/errors. Non-elevated exact ACL tests passed in that complete run too. Universal validation: zero errors/warnings. Clean distribution validation: zero errors/warnings. Plugin package validation and git diff --check passed. Independent read-only security audit found no substantive issue.

Tests cover installed/source layouts, historical-head isolation, missing/conflicting/identical-ambiguous routers, mismatched digests and nonregular entries; exact private owner/DACL/inheritance, explicit and inherited outsider refusals, unchanged existing ACLs, staging failure ordering and closed empty files after ownership/readback failure.

Limits: local Windows evidence does not replace hosted Linux/macOS/Windows coverage, hostile-environment jobs, Linux mutation replay or release validation. Platform/environment skips remain disclosed; a skipped non-elevated test is not proof of non-elevated compatibility. No release or installed update has occurred. Raw local logs and private consumer identifiers are intentionally absent from this public packet.

Exact candidate

Upstream base: 575afa1

Path	SHA-256
skills/anti-dark-code/scripts/adc_shadow.py	4cb89699c8282fdce265b898b0dbcc5a68b0022eadd24db490f1ddd6ee18dc28
skills/anti-dark-code/tests/test_route_cli.py	de91a95d36c6887165db416f2f56bfe3bcf383622377dbd5e9e82d4a473f1eca
skills/anti-dark-code/scripts/adc_usage.py	b075e6fce7ef37d9b5be626a80d12605440ee6759533a53d62aabe602ecb0c62
skills/anti-dark-code/tests/test_usage_privacy.py	91d9664c77fa9d429d15a7b7236a70883a80f525f7f3cbb3761d2dc2771d2a2e

Required hosted verification

Use the unchanged Tests workflow: Python 3.12 on Ubuntu/macOS/Windows and Python 3.13 on Ubuntu; clean distribution archive; C-locale and international-path jobs; all four Linux mutation replay shards and their aggregate; final Tests aggregate. Review the existing shadow artifact separately without turning its observational role into a new release gate. Retain head/run/attempt identities, results and skips. Stop on any failed gate or source drift; do not weaken tests or extend deadlines.

Public proposal attestation

N/A: no incoming proposal file is added. This is a four-file shared-core correction.

Efficiency-receipt attestation

N/A: no efficiency receipt or savings claim is included.

[JeremyABurton]

The Tests workflow for this PR head 51b9b36de620950b7ca2f8b9f4870533a7bb8b7a is awaiting maintainer action; no jobs have executed:

https://github.com/LynxTWO/anti-dark-code-skill/actions/runs/37993607375

Please approve the fork workflow run after reviewing the exact four-file diff. The requested checks are the existing platform suite matrix, clean distribution, hostile-environment jobs and Linux mutation replay shards/aggregate, followed by the Tests aggregate. Please retain the existing shadow-evidence behavior and approval boundaries. This request does not authorize bypassing checks, merging or releasing the correction.

The PR description records the accepted local Windows results and their limits. Hosted results remain pending; no hosted pass or merge readiness is claimed.