test: add fail-closed Windows observer research gates

[abruption]

Scope

Refs #151 and #152 (v0.4.7); does not close either evidence gate.

Research-only observer groundwork, an offline evidence evaluator, counterexample tests and a Windows static CI gate. The production CLI, dependencies, package allowlist, JSON v1, release metadata and operations are unchanged. Experimental files are not shipped in the npm artifact.

All observer modes (preflight, observe, fixture-meta) are now hard-refused at the first setup statement, before path lookups, compilation or observation. No bypass or Windows support is added. safeToUnlock remains false. W7 cannot pass while coordination range is unmeasured; fixture pairing remains unbound/unknown.

Latest review fixes — bf1d001

Addresses all eight findings from Code Review on b28328a. This is an implementation/verification report, not a claim that the reviewer has approved the new head.

Finding	Resolution
P1 elevation metadata (#discussion_r4306236890)	Self and target token records require actual enum elevationType 1/2/3. Missing/invalid queries are unknown. W6 compares measured elevation values; self tokens bind to file/preflight metadata and target elevation stays stable across samples/after. Medium/High labels never imply Full/Limited types.
P2 fixture-meta boundary (#discussion_r4306236898)	Mode-independent hard refusal is first in setup, covering all three modes before path checks. AST mutations reject mode omissions, delayed guards and weakened exits.
P1 range error classification (#discussion_r4306236904)	Only Win32 0/33 represent measured range states; unsupported/invalid/missing-file and other operational failures are unknown, including the tail probe.
P1 share error classification (#discussion_r4306236908)	Only Win32 0/32 represent measured sharing results; other failures are unknown. Valid contrary measurements still remain mismatches.
P2 NTFS precondition (#discussion_r4306236911)	host.volume requires NTFS; ReFS/other/unknown filesystems cannot satisfy W7's environment evidence.
P1 unguarded RM/share probes (#discussion_r4306236916)	Removed their producer calls entirely. Even the dormant producer records unknown/deferred: guarded_handle_binding_not_implemented until a common synchronous guard and bound-handle design exists. It does not pretend the range-only guard covers them. Static tests detect call reinsertion.
P2 failed execution-policy observation (#discussion_r4306236919)	Pure policy validation propagates error/partial/unknown/missing fields into Abort before dormant binary hashing, disposable-home creation or version execution. No host policy is changed.
P2 extra expectation keys (#discussion_r4306236922)	Every step requires the exact canonical key/value union of raw hypotheses plus the closed legacy derived metadata. Extra/missing/wrong-shaped/wrong-valued expectations are drift, including derived/recorded rows. Advisory producer booleans/verdicts still never establish measured evidence.

Earlier follow-ups remain intact: conservative tilde/8.3 rejection; case-insensitive disposable matching; exact Refuse/Stop-Unknown termination contracts; content-free internal exception unknown/2; C# documentation corrections; and backslash-before-pipe Markdown escaping. At b28328a CodeQL reported no new alerts and alert #5 fixed. No alert was suppressed or manually dismissed.

Validation of this revision

• npm ci, npm run check, npm run lint: passed.
• npm test: 266 tests, 263 pass / 3 Linux-only skips / 0 failures on macOS arm64, Node 24.16.0.
• Explicit experimental tests: 87/87 passed, including malformed elevation, unexplained elevation differences, per-file/instance drift, range/share operational errors versus valid mismatches, non-NTFS, exact expectation unions and all-mode/deferred-call source assertions. Approved temporary root selected on macOS.
• npm run smoke:package and git diff --check: passed.
• Designated Windows 10 22H2 / NTFS host, elevated SSH session, PS 5.1.19041.6456, existing RemoteSigned unchanged: both scripts parsed; all-mode-first refusal, termination and deferred-call AST mutations passed; nine pure-helper groups (including policy-failure cases) passed; C# compiled; exit 0. Inputs were hashed before execution, with private disposable staging and compiler TEMP. No observer mode/native method, real Codex or real Codex home/lock operation was executed.
• Exact Windows-tested SHA-256:
  • check.ps1: 738d4fdd8278602f2e32faa35b6d501264a8c300c27a715b501c87acae4d3360
  • observer.ps1: 85a84194bef9b781a8ff3b059a87616bd0e3e46d6ae8e6b3c5eb4e4a3d477c28
  • WinObserver.cs: 9b44dc7403368857fd7c55cdf4a596310b7b501c1343755f3adc08758f3eb83c
  • Static output: 3d642797f734d144fdaf559ed4e2806a119b009cae6a26198f531c27c6eebaed
• New-head CI: 41/41 checks passed on bf1d001, including Windows static/evaluator CI and CodeQL. The eight b28328a threads have implementation-specific replies and are resolved. Automatic Code Review and Security Review both completed on bf1d001 with no findings/unresolved findings after a Ready event, with no separate mention. This is distinct from the earlier b28328a review and from implementation-author thread resolution.

Independent review history and limits

Claude Code 2.1.302 authored the E3 handoff with self-reported claude-opus-5-5 (authoring response model not independently verified). Codex inspected and integrated it.

The original E3 dual-CLI review used the same frozen bundle (SHA-256 d735c732459732f37b887fd0aabd85f28cf57bfd9aff0cf16815a204cfadf05e). Codex CLI 0.163.0 returned a substantive source review, isolated default model not separately reported. Claude Code 2.1.302 requested/reported claude-opus-5-5 but explicitly reported a safety-classifier interruption and supplied no substantive review. Its exit 0 was not counted as review success; the failure remains recorded.

The user then explicitly requested claude-opus-5 as the single reviewer of c728e82. Tools-disabled non-interactive review used a frozen 11-file bundle (SHA-256 896e418102979f146d57d4fccee4cd03f61d69fa2c3aa24dc0f60df205e99743), with no credentials or other reviewer results. The first call was stopped after 10 minutes without output. After the user's explicit 30-minute wait instruction, a second identical-input/model call returned in about 15 minutes, exit 0, subtype=success, is_error=false, response model metadata claude-opus-5. That metadata is not independent proof of provider routing. No fallback model or split input was used.

That CLI review covers c728e82, not subsequent fixes. GitHub Code/Security reviews then covered b28328a. Codex verified the latest fixes with source inspection, regression tests and the exact Windows static run above. No independent-model approval of bf1d001 is claimed. The PR is ready for review; normal current-head review and human approval remain required. No separate reviewer mention was posted.

Remaining no-go conditions

• All observer modes stay refused: compare-twice ancestry/creation checks do not pin paths. No authentication, native host observation or activation is authorized here.
• The dormant producer's sample ordering remains unfinished. RM/share observations now additionally remain deferred pending a common guarded, identity-bound implementation. The evaluator is not weakened to make these omissions pass.
• No actual Codex interoperability, Medium/High real-host pair, hash-bound fixture producer, coordination-range measurement, holder attestation or cooperative release is proven.
• Sampled handles, launched-image bytes versus preflight hash, same-user forgery and provenance origin remain limitations. Static compilation is not native safety or product support.

No merge, release, tag, package publication or operational setting change is performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T08:11:42.356917Z	bf1d001	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-18T08:11:19.388642Z	bf1d001	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b28328a9f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".