fix(secret): preserve admitted directory permissions and identity

[steipete]

Summary

Make secret-directory admission match the documented non-repair policy. Existing roots and parents, including EEXIST winners, must already have the exact requested POSIX mode; the writers no longer chmod those pathnames. Mismatches report insecure-permissions without writing the secret. New-directory initialization uses guarded descriptor authority tied to the admitted identity and effective UID, with ancestry checks and full 07777 mode verification.

Retain lossless bigint directory identities through admission, private lock roots, and native/fallback writes. This corrects the Windows failures on the first PR revision without rounding identities or loosening swap checks. Private JSON locking prepares directories before sidecar acquisition, binds the lock to that admitted parent, and now normalizes Root-backed target keys without creating directories. A deleted or replaced parent is rejected rather than recreated.

Current head: cf2b9b1be99c8b59c91cae22da55e08c64fb22b6; tree: d053dc472dda638a5a588bee00d6931207765f17. Runtime src/, native sources, package manifests, and dependency pins are unchanged since 614ff9d; subsequent commits correct test ownership and add durable packaged-consumer proof. The earlier pnpm artifact 6591b090ed1c501114f6b9fd4264c85a281a9c4ae2b871f64ab7cbc9c4385de5 was rebuilt byte-identically at the test-only 5f02fc2 revision. Current CI receipts separately record the collected root tarball integrity, compiled module hashes, actual checkout commit/tree, and loaded host binary; the new changelog/proof-tooling revision is not mislabeled as that earlier tarball.

Boundaries and compatibility

• Existing directories are inspected, not repaired. Explicit directory modes such as 02750 retain their special bits. Invalid mode values fail with invalid-path before creation; changed initialization ownership reports not-owned.
• Directory creation and descriptor admission remain separate operations, not an atomic create-and-pin guarantee. Matching mode bits are not a substitute for trusting the selected root and owners.
• There is no pathname-chmod fallback. A non-root macOS process cannot pin a new 000 directory under umask(0777); actual O_SEARCH and SDK-verified O_EVTONLY probes failed. That case fails closed without repair or secret publication. Search-preserving masks remain usable; Linux retains guarded O_PATH/procfs initialization.
• Exact directory inspections retain known identity components through one Windows zero-identity retry. Definite mismatch or persistent ambiguity fails closed. Default numeric guards and public stat shapes remain unchanged.
• Private preparation is not lasting authorization; the writer checks again. Async Root-backed normalization is read-only, but ordinary missing lock descendants are still created through Root.create. External arbitration targets with explicit in-root sidecars, parent aliases, leaf-symlink key semantics, lock-option precedence, and stale recovery remain supported. Non-Root and synchronous acquisition policies are not redesigned.
• The separate explicit file-mode parity issue remains a campaign follow-up: JS write ordering can clear special bits and the file verifier still masks 0777. Those observations are not counted as fixed here.

Executed defect and regression proof

The original physical non-root baseline exercised 24 cases: both writers silently changed existing 0750/02750 roots or parents to 0700 in 8 documented-contract violations. Four additional late-replacement regressions showed why the admitted guard chain must survive traversal and handoff instead of being reconstructed.

The first PR head, b1247bcb, failed actual Windows Node 22/24 CI and Windows coverage. Two synthetic high-inode tests reproduced stable-directory refusal at the mixed bigint/numeric comparison. The corrected tests cover exact admission and private Root identities, two distinct inode values with the same numeric projection, real writes through fallback/native and simulated Windows branches, and bounded unknown-identity handling. These synthetic identity projections are not presented as naturally occurring macOS inode values or actual Windows-host proof.

ClawSweeper also identified the pre-lock deletion race. A new real-filesystem regression and installed-package probe confirmed it: a separate process deleted an admitted parent; the old package recreated it at 0755, then rejected path-mismatch without running the JSON callback. The corrected source leaves the parent absent. Compatibility tests cover external target keys, explicit in-root locks, aliased missing parents, target-leaf symlinks, and stale-Root rejection before reentrant reuse.

Existing adversarial fixtures now start with valid private modes so their attacks reach the intended boundary. Swap witnesses remain mandatory. No attack assertion, workload, timeout, or source-size budget was weakened.

Current-head verification

• Focused identity/native/publication neighborhood: 88 passed. Focused lock-deletion, normalization, private JSON, and identity neighborhood: 46 passed; these selections overlap and are not summed.
• Security suite: 84 passed. Build, source-size/boundary checks, documentation examples, package checks, and git diff --check passed.
• Complete-scope Codex autoreview after both repairs: scoped-clean at P0. This is not a claim of an exhaustive P1 correctness certificate.
• Fresh installed package on physical macOS arm64: 186 in-scope observations across exact Node 22.0.0, 22.23.2, and 24.20.0, each in off/require configuration: 132 directory-policy cases, 24 private-JSON cases, 24 separate-process late replacements, and 6 separate-process deleted-parent cases. Require lanes loaded the native binding during normal-write controls; directory admission itself remains JavaScript-owned. Twelve explicit file-mode observations are retained separately and not counted as fixed.
• Replacement/deletion probes use instrumented lookup scheduling while a separate Node process performs real renames or removal. Actual bytes, modes, presence, and callback execution are checked. They are deterministic race-window probes, not claims of probabilistic scheduling or power-loss recovery.
• Full parallel validation still failed: 7,223 passed / 5 timeouts / 80 skipped, in archive publication and process-exit tests. The frozen full serial run also failed: 7,227 passed / 1 dispatch-fixture timeout / 80 skipped. The unchanged dispatch suite passed 4/4 in isolation afterward. Earlier failed attempts are retained; none is relabeled as passing. Focused isolation and hosted validation remain separate evidence.
• The 614ff9d CI and coverage failed in a new held-root fixture, not the earlier bigint comparisons. Its unconditional cleanup masked the original Windows failure. The test now physically replaces the Root before opening a fresh holder, then proves that a stale supplied Root cannot reuse that held entry. It retains real identity witnesses and closes any unexpected second handle; no Windows skip or weaker assertion was added.
• That test-only revision, 5f02fc2, passed CI and coverage, including actual Windows Node 22/24 and native coverage. Its complete serial suite passed 7,228 tests / 80 skipped. The corresponding parallel attempt still failed in five timing-sensitive tests.
• The newest proof-tooling candidate passed local root-only npm/pnpm secret traces: 36 observations, covering off/require stable controls, real root/parent replacements, and private JSON replacement/deletion. The existing bundled-package smoke now records these traces, real bigint identities, source commit/tree/dirty state, compiled-module hashes, root tarball integrity, and the host binary actually loaded. No workflow or permission expansion was needed. A reproduced output-selection bug was also fixed so an explicit --output overrides the package-script default without overwriting earlier artifacts.
• Latest local parallel attempt: 7,197 passed / 32 failed / 80 skipped, predominantly timeouts plus cleanup fallout and two unhandled extraction-deadline errors. It remains a failed run. The final complete serial run passed 7,229 tests / 80 skipped across 211 passing suites, with two suites skipped; final package/build/diff checks passed. No workload or deadline changed. The complete-scope P0 autoreview after the proof-tooling changes is scoped-clean.
• At 5f6a442, all Node checks and coverage passed, and Linux/macOS packaged traces each passed 36 cases. Their actual checkout was merge ref 8b83e1f27892c5d43125d36027dd781c2ded42a6, with a clean tree exactly matching reviewed tree 55d207084f2212898c35c16d4fdc1de8d2efc236. Windows completed its require-mode API assertions but its native-load recorder failed on a loader namespace path; Alpine's recorder failed because Git was absent. Neither failed job is counted as passing.
• The current proof-only correction uses native realpath for loader paths and records Git metadata as explicitly unavailable in minimal containers, rather than making Git a new runtime requirement. It passed 13 focused tooling tests, 36 local packaged cases, final package checks, and a complete serial suite of 7,235 tests / 80 skipped. Latest parallel validation still failed in 3 timeouts, with 7,232 passed / 80 skipped. The earlier 32-failure attempt remains retained. Complete-scope P0 autoreview is scoped-clean.
• Current-head CI and merged coverage passed, including the corrected Windows and Alpine package recorders. Benchmarks and CodeQL also passed; optional dispatch/autofix checks were skipped, not represented as test passes. The downloaded receipts passed independent validation: 36 cases each on Windows x64, macOS arm64, Linux glibc x64, and Linux musl x64 (144 hosted observations). npm and pnpm each exercised off and require; every require process actually loaded its freshly built host binding, and every off process did not.
• The Windows receipt is actual Windows / Node 24.19.0, not a simulated platform. It records clean checkout commit 19d3563a8d1427ae41a8b849cde12f42a1b658da (CI merge ref) and tree d053dc472dda638a5a588bee00d6931207765f17, exactly matching the reviewed head. macOS/glibc receipts prove the same tree. The musl container explicitly marks Git metadata unavailable; artifact and native-load proof remain valid, but no Git receipt is invented.
• Windows root tarball integrity: sha512-dGc1+UXv5wuAwatBGEjj73tGuKyNLxaOg/TY0NQS0yIFqxXA1mgywwTqo1cZNwC30oT4w7D3r9CtbAokD4yO2A==; loaded binary SHA-256: 228e5de7651d3ffe9ea7ae5cd9054ed105677b07c833f117f6c22c5b2189e76f. Unix root tarball integrity: sha512-AcIxm4f2fvXvqx9FjQ5N236PUQPepClcmFbCPH8PODjC/kU4cSY55daxO1UVkh5ltCFZr/kfawEPizGHL5+j7A==. Distinct platform artifacts are retained rather than assumed byte-identical.
• Real Windows replacement example: device 3606225537, parent inode 562949954764918 replaced by 562949954764920; the writer rejected path-mismatch with zero observed open dispatches and no publication. Deleted-parent JSON admission left the parent absent and invoked no callback. These real IDs are below 2^53; large-integer collision tests remain separately labeled synthetic evidence. The final ClawSweeper review, stamped 2026-09-04 03:37:03.978 UTC for this exact head, found no actionable code/security findings and accepted the Windows proof. Its remaining compatibility-acceptance flag is accepted for this repair because the non-repair behavior restores the existing documented contract and the fail-closed initialization limit is explicitly documented.

The direct AWS Windows attempt (run_a5d9bc53313b) never brought up SSH: the first lease hit its 20-minute bootstrap deadline, then the CLI allocated a second. The job was stopped, and both leases were explicitly released. No Windows test command ran there; its original held-directory rename behavior remains undiagnosed. The existing hosted Windows package job is the proof route instead.

Linux evidence provenance

The fresh final artifact completed AWS run run_deeba84b91e5, lease cbx_44de4fb4bbef, on Linux x64 / exact Node 24.20.0 as UID 1000. All tarball/probe hashes were verified before execution. Native bindings were omitted; real strace -f -yy API markers separated library mutations from fixture setup/cleanup.

Observed behavior	Baseline	Final candidate
Documented non-repair violations	8	0
Chmod calls on caller-selected paths during API calls	30	0
Guarded O_PATH / authenticated procfd initializations	0	2
Recreated parent after separate-process deletion of admitted private parent	1 (0775 in the held PR artifact)	0; parent remains absent

The run covered 24 policy observations per main/final revision (two file-mode observations per revision remain deferred), four private-JSON cases, four final-candidate late replacements, and the deletion case in both the held PR artifact and final candidate. All final replacement/deletion cases rejected path-mismatch, ran no forbidden JSON callback, and published no secret. Both Linux umask(0777) initializations succeeded through descriptor authority. Explicit lease cleanup confirmed release after the broker initially reported cleanup pending. This is syscall/behavior proof, not a power-loss claim.

Earlier b1247bcb Linux evidence from run run_e3b05dac38bf remains recorded separately; it is not substituted for this final-artifact run.

No release, version bump, tag, registry publication, dependency addition, or generated-output commit is included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 3, 2026, 11:47 PM ET / September 4, 2026, 03:47 UTC.

ClawSweeper review

What this changes

The PR stops secret and private JSON writes from chmod-repairing existing directories, retains exact directory identity through writes and locks, and adds packaged cross-platform regression proof.

Regression provenance

Possible regression — probable (reviewed change; reproduction). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open for an explicit repository-maintainer decision: the patch is a well-tested security repair, but it deliberately changes established write paths to fail closed when directory modes differ or a new directory cannot be safely pinned.

Priority: P1
Reviewed head: cf2b9b1be99c8b59c91cae22da55e08c64fb22b6
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Strong cross-platform packaged behavior proof and focused security regressions support a good patch, with maintainer ownership of the deliberate upgrade behavior still required.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): The changed secret admission, pinned-write, and private-lock paths are exercised through public APIs in packaged consumers on Windows, macOS, and Linux; the supplied receipts report stable success and replaced/deleted-parent rejection without publication or callback execution.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The changed secret admission, pinned-write, and private-lock paths are exercised through public APIs in packaged consumers on Windows, macOS, and Linux; the supplied receipts report stable success and replaced/deleted-parent rejection without publication or callback execution.
Evidence reviewed	7 items	Current-main defect: The current-main base chmods every private directory pathname before checking only its low permission bits, despite the documented contract requiring matching existing directory modes. Documented contract: Before this PR, the public secret-file documentation already said every directory component must match dirMode and that wider existing permissions cause refusal. Fail-closed implementation: The introduced implementation rejects an existing mismatched directory with insecure-permissions and only initializes a directory through a pinned, identity- and UID-checked descriptor.
Findings	None	None.
Security	None	None.

How this fits together

Secret-file writes and private FileStore JSON updates create or use directories before publishing credentials or state. This change admits those directories with exact identity and mode checks, then carries that admission into pinned writes and sidecar locking.

flowchart LR
A[Caller secret or private JSON write] --> B[Directory admission]
B --> C{Existing mode and identity valid?}
C -->|No| D[Fail closed]
C -->|Yes| E[Retained directory guard]
E --> F[Pinned secret write or sidecar lock]
F --> G[Published secret or JSON update]

Loading

Decision needed

Question	Recommendation
Should this repository accept fail-closed secret/private-store writes for existing mode mismatches and unpinnable newly created directories, rather than retaining pathname chmod repair?	Accept the fail-closed contract: Explicitly approve the documented upgrade behavior and merge the security repair.

Why: The implementation restores the documented security contract and has strong proof, but it can stop previously successful caller write paths; a contributor-authored assertion of approval is not verified maintainer authorization.

Before merge

• Resolve merge risk (P1) - Existing callers whose root or parent directory mode differs from dirMode will now receive insecure-permissions instead of having that directory chmod-repaired.
• Resolve merge risk (P1) - On platforms where a newly created directory cannot be safely pinned, including the documented non-root macOS umask(0777) case, a secret write can fail and leave caller-managed empty directory cleanup.
• Complete next step (P1) - Have a repository maintainer explicitly approve the documented fail-closed upgrade behavior before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production versus test scope	production +235/-87, tests +827/-8	The large security-boundary change is accompanied by substantial focused regression coverage.
Changed surface	35 files affected	The repair spans secret admission, private locking, native/fallback writes, documentation, and packaged proof.

Merge-risk options

Maintainer options:

1. Accept the documented fail-closed behavior (recommended)
   A repository maintainer explicitly approves the incompatible refusal behavior, allowing the security fix to land as documented.
2. Pause for compatibility policy
   Keep the PR open until maintainers decide whether affected callers need an upgrade path beyond the documented manual permission correction.

Technical review

Best possible solution:

A repository maintainer should explicitly accept the documented fail-closed upgrade behavior, then land the repair with its identity and packaged-consumer regressions intact.

Do we have a high-confidence way to reproduce the issue?

Yes. Current-main source unconditionally chmods selected private directories despite the documented non-repair contract, and the supplied packaged baseline/proof describes the resulting mode-mutation cases.

Is this the best way to solve the issue?

Yes, subject to explicit maintainer acceptance of the upgrade behavior. Retaining descriptor-bound admission rather than pathname chmod repair is the narrowest solution consistent with the existing contract and security boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b4322efc07e2.

Labels

Label justifications:

• P1: This repairs secret-write security behavior while intentionally changing existing caller failure modes.
• merge-risk: 🚨 compatibility: Existing directories that do not exactly match dirMode will now fail instead of being chmod-repaired.
• merge-risk: 🚨 security-boundary: The diff changes capability admission, retained filesystem identity, and publication of secret files.
• merge-risk: 🚨 availability: Some previously successful secret writes can fail closed when directory pinning or mode admission cannot be proven.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The changed secret admission, pinned-write, and private-lock paths are exercised through public APIs in packaged consumers on Windows, macOS, and Linux; the supplied receipts report stable success and replaced/deleted-parent rejection without publication or callback execution.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed secret admission, pinned-write, and private-lock paths are exercised through public APIs in packaged consumers on Windows, macOS, and Linux; the supplied receipts report stable success and replaced/deleted-parent rejection without publication or callback execution.

Evidence

What I checked:

• Current-main defect: The current-main base chmods every private directory pathname before checking only its low permission bits, despite the documented contract requiring matching existing directory modes. (src/secret-file.ts:139, b4322efc07e2)
• Documented contract: Before this PR, the public secret-file documentation already said every directory component must match dirMode and that wider existing permissions cause refusal. (docs/secret-file.md:162, b4322efc07e2)
• Fail-closed implementation: The introduced implementation rejects an existing mismatched directory with insecure-permissions and only initializes a directory through a pinned, identity- and UID-checked descriptor. (src/secret-file.ts:152, cf2b9b1be99c)
• Regression coverage: Focused tests cover unchanged existing modes, EEXIST winners, setgid modes, descriptor swaps, and the private JSON replacement/deletion path before the callback can run. (test/secret-directory-admission.test.ts:24, cf2b9b1be99c)
• Packaged behavior proof: The contributor's September 4 receipt links successful Windows, macOS, Linux glibc, and Linux musl packaged-consumer runs, including real replacement/deletion cases with no secret publication or JSON callback. (cf2b9b1be99c)
• Feature history: Secret-file history shows Peter Steinberger as the recurring author of the current admission and retained-descriptor work, including the prior main-branch repairs and this follow-up. (src/secret-file.ts:152, 614ff9d090e9)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain an explicit repository-maintainer approval of the documented fail-closed compatibility boundary.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-09-04T01:35:22.696Z sha b1247bc :: blocked before merge. :: [P2] Avoid raw parent creation after private admission
• reviewed 2026-09-04T02:00:45.652Z sha b1247bc :: needs real behavior proof before merge. :: [P1] Preserve bigint directory identities through admission | [P2] Avoid raw parent creation after private admission
• reviewed 2026-09-04T02:08:39.596Z sha 614ff9d :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T02:13:15.693Z sha 614ff9d :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T02:33:47.830Z sha 5f02fc2 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T03:01:58.827Z sha 5f6a442 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T03:24:00.735Z sha cf2b9b1 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T03:37:03.978Z sha cf2b9b1 :: blocked before merge. :: none

[steipete]

@clawsweeper re-review

Updated head: 614ff9d090e91deb666176d0145fd8611faf1bce.

The pre-lock deletion finding is reproduced and repaired. The old installed package recreated a deleted admitted parent at 0755 before rejecting; current Root-backed normalization is read-only and validates the retained Root before and after canonicalizing the target parent. Missing lock descendants still belong to Root.create, and explicit in-root sidecars continue to support external arbitration targets. New tests cover deletion, replacement, aliases, leaf-symlink keys, and stale-Root reentrant reuse.

The same revision also repairs the actual Windows CI bigint/numeric identity mismatch by retaining lossless identities through secret admission, private lock roots, and native/fallback writes. Strict identity comparisons and Windows unknown-component bounds remain intact.

Fresh packed macOS proof passed 186 in-scope observations across exact Node 22.0.0/22.23.2/24.20.0 and off/require modes, including separate-process replacement and deletion. Security and package checks passed; complete-scope Codex autoreview is scoped-clean at P0. Full local parallel/serial failures are recorded in the updated body, not hidden. New exact-head CI/coverage and the fresh Linux syscall run are still pending, so this is a review request, not an automerge request.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[steipete]

@clawsweeper re-review

The requested real Windows public-API proof is now complete for reviewed head cf2b9b1be99c8b59c91cae22da55e08c64fb22b6.

Windows packaged-consumer receipt · successful CI run

The job built the Windows binding, packed the root and host packages, and installed root-only consumers using both npm and pnpm. Fresh off/require processes ran 36 public-API observations on actual Windows x64 / Node 24.19.0. Returned filesystem stats were unchanged; replacements and deletion were performed by separate Node processes. Stable writes/creates/private JSON updates succeeded. Root/parent replacements and deleted-parent lock admission rejected path-mismatch, with no observed open dispatch in forbidden cases, no JSON callback, no secret publication, and no parent recreation.

The receipt records actual checkout commit 19d3563a8d1427ae41a8b849cde12f42a1b658da (the CI merge ref), dirty: false, and tree d053dc472dda638a5a588bee00d6931207765f17, exactly matching the reviewed head's tree. The require lanes actually loaded the consumer's freshly built .node binary; off lanes did not.

• Windows root tarball integrity: sha512-dGc1+UXv5wuAwatBGEjj73tGuKyNLxaOg/TY0NQS0yIFqxXA1mgywwTqo1cZNwC30oT4w7D3r9CtbAokD4yO2A==
• Loaded Windows binary SHA-256: 228e5de7651d3ffe9ea7ae5cd9054ed105677b07c833f117f6c22c5b2189e76f
• Compiled-module and proof-script hashes are retained in the receipt.

Selected npm/require observations, using real Windows identities:

[
  {"operation":"write","scenario":"stable","dev":"3606225537","parentIno":"562949954764910","published":true},
  {"operation":"write","scenario":"replace-parent","beforeIno":"562949954764918","afterIno":"562949954764920","error":"path-mismatch","openDispatches":0,"published":false},
  {"operation":"private-json","scenario":"deletion","beforeIno":"562949954764943","after":null,"error":"path-mismatch","callbacks":0,"openDispatches":0}
]

These real IDs are below the safe-integer boundary; the >53-bit collision regression remains a separately identified synthetic test, not a claim about these observed IDs.

The same root-only proof passed 36 cases each on macOS arm64, Linux glibc x64, and Linux musl x64: 144 hosted observations total. macOS/glibc receipts also prove the clean matching checkout tree. The minimal musl container explicitly records Git as unavailable; it still records the collected artifact integrity and actual loaded binary. No missing source metadata is promoted into a verified Git receipt.

The direct Windows VM attempt executed no tests and both of its leases were released; it is not used as proof. The latest complete local serial suite passed 7,235 tests / 80 skipped. Earlier parallel/timeouts and the two proof-recorder portability failures remain recorded in the PR body. No library runtime changed after the identity/normalization repair; subsequent changes are tests and proof tooling.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[steipete]

Maintainer decision for this repair: accept the documented compatibility boundaries called out by the final review.

Rejecting an existing directory whose mode differs from dirMode restores the existing non-repair contract; silently chmod-repairing an attacker-raceable pathname was the defect. Failing closed when a newly created directory cannot be safely pinned is preferable to restoring that pathname-chmod fallback. Creation and descriptor admission remain separate, and an empty created directory may require caller-managed cleanup; the docs and changelog state those limits explicitly.

The final review of cf2b9b1be99c8b59c91cae22da55e08c64fb22b6 reports no actionable code/security findings and accepts the real Windows packaged-consumer proof. CI, merged coverage, benchmarks, and CodeQL are now green. The clean CI checkout tree matches the reviewed tree, and the 144 hosted package observations have been independently checked from the downloaded receipts. Proceeding with the requested landing; no release or registry publication is included.

[steipete]

Merged as 128bf1f863cb6cbf03edca555d8dea56eee2e980, then pulled and verified from actual main.

The landed tree is d053dc472dda638a5a588bee00d6931207765f17, exactly the reviewed and CI-proven tree. Fresh JS and native builds on merged main passed; the focused secret/directory/private-JSON/Root/native/tooling neighborhood passed 232 tests / 1 skipped across 15 suites. Fresh root-only npm/pnpm consumers passed another 36 public-API observations in off/require modes. Their receipt records the actual merged commit/tree with dirty: false, and all six recorded compiled guard-module hashes match the reviewed macOS CI receipt. The freshly built main native binding was actually loaded in require mode.

Main's collected root tarball integrity is sha512-UBKTP0KfVFSTkIsg5b16+e04yUUh2dAt9VnluCGgniK67zBtvekF1n2gcg+KvjN4FTPBEkN2HN/HDx48gf0rMw==; its native binary SHA-256 is 6179e193a0d2b696d4afdf2e9b2e021989437439741faa3fdf9b37e9a48da424. These are recorded independently of earlier tarballs instead of assuming every packaging run produces identical bytes.

Pre-merge proof remains: 7,235 tests / 80 skipped in the final complete serial suite; 144 hosted package observations on Windows, macOS, Linux glibc, and Linux musl; actual non-root Linux syscall proof; green CI, merged coverage, benchmarks, and CodeQL. The final review accepted the Windows authority-chain proof and found no actionable code/security findings. Documented compatibility boundaries were accepted before merge. All failed attempts and platform limitations remain qualified in the body.

Two CLI merge attempts returned rate-limit errors despite healthy same-account API observations. The standard GitHub REST merge endpoint succeeded through bare gh with the same verified steipete identity and expected-head SHA guard. No stored credentials, accounts, proxies, or global settings changed; the CLI discrepancy remains a separate tooling investigation.

Post-merge main CI and coverage are being tracked separately; their pending results are not counted above. No release, version bump, tag, or registry publication was performed. The explicit file-mode parity finding remains the next separate campaign repair.