feat(observation): qualify Windows Codex handoff storage and delivery observation #131

Current roadmap — 2026-10-13 KST

• Target milestone: 0.5.0 — Cross-platform observation and remote qualification.
• Planning priority: P2 (priority:P2).
• Dependencies/order: feat(codex): add a shared bounded app-server client #71/feat(codex): add opt-in delivery observation by client message ID #72 after 0.4.0. feat(observation): qualify Windows Codex handoff storage and delivery observation #131 also needs private Windows ACL/storage and owned-process-tree qualification. Linux/Windows tracks are independent.
• Remaining scope: Exact platform/native profiles and client-ID injection evidence. Other-platform, queue-only or fixture evidence cannot qualify native observation.

This section supersedes older milestone/version/priority statements below. Existing acceptance criteria, evidence limits and historical records remain applicable. Versioned milestones are provisional planning targets, not committed dates or implementation/live-test/merge/release authorization. P1 means a milestone prerequisite/current-release item; P2 a planned extension/research track; P3 later dependent work.

Scope and priority

P2 follow-up, Future — Agent integrations. User approved a qualified macOS observation scope for 0.4.0; this Windows extension is deferred without moving #69–#72 out of 0.4.0. Registration is not implementation or release authorization.

Physical Windows tests on PR #109 passed the fake-SSH contract and Windows suite using a Node-to-PowerShell fixture bridge. They do not establish Windows private handoff-ledger ACLs, native app-server observation or real receipt ACK. The original C# child AccessDenied cause remains unverified; no policy/ACL/production guard relaxation is allowed as a shortcut.

Acceptance criteria

• Implement and validate private Windows ledger/receipt state ownership and DACL/reparse protections, durable intent/fencing and concurrency/recovery without global permission changes.
• Qualify exact Windows native CLI/architecture/source/schema and storage/owner/generation evidence. Preserve native .exe execution and strict Windows SSH framing/exit semantics; never invoke shell-interpreted message text.
• Enforce bounded subprocess-tree cleanup within the original total budget; qualify process ownership and interruption/restart behavior rather than inheriting POSIX group guarantees.
• Observe only the original client ID/home/thread/generation through a proven bounded metadata source. No transcript/rollout API, implicit model turn/wake/new writer; document internal body-bearing storage access honestly.
• Add native Windows fixtures for ACL/reparse, writer PID reuse/change, storage redirect, schema/version drift, no-effect refusals, timeout/SIGINT, partial SSH, retained waits and no fallback/resubmission after attempt.
• Separately authorized isolated Windows native tests prove one queue and matching injection for each claimed profile. Existing fixture suite and old deployment F5 are not substitutes.
• Publish exact supported combinations and unsupported capability behavior in API/PARITY/all locales; no automatic ACK or exactly-once claim.

Related #71/#72, PR #109 and existing #23 provisioning design. Linux qualification is separate; receipt bootstrap is a separate follow-up. Do not change SSH trust, execution policy, services or production accounts implicitly.