fix(control): self-heal invalid native helper pairs

[LogicDuke]

Final coherent D062 helper-lifecycle reconstruction for PR #85.

Evidence refreshed for exact head e8397128 after integrating child PR #91
(concurrent-helper-rebuild isolation). Earlier blocks for 134b513 / aa2ae22
are retained as history and are superseded by the current exact state below.

Current exact state (authoritative)

• base: aaa7ddc4b625ca4aa5d192585daa4ce824a72be6
• head: e8397128ce7d24cf9ab2074f2a9dd612c073a609
• state: OPEN / Draft / unmerged
• exact-head CI on e8397128: SUCCESS (verify + windows-owner-helper)
• fresh parent audit: PASS_PR90_POST_CHILD_MERGE_FRESH_PARENT_AUDIT

Integrated child — PR #91 (concurrent-helper-rebuild isolation)

• child PR: fix(control): isolate concurrent helper builds #91 (MERGED)
• child head: c954d0feed8ff87f889e18e65ae439fec9830ac9
• merge commit: e8397128ce7d24cf9ab2074f2a9dd612c073a609 (create-a-merge-commit; no squash/rebase)
• merge parents:
  • 134b513e15a056d037cc51b794d72c1a9891a4b4
  • c954d0feed8ff87f889e18e65ae439fec9830ac9
• child patch: F0159E6766F9A5DFFFBA8EB7CC74FC5A53F70A6387140A00EFB0D4B85B86E244 (13246 bytes), exactly two files:
  • tools/control-owner/build.mjs
  • tests/control/launch-lifecycle.test.ts
• the merged tree is byte-identical to the independently validated candidate c954d0f.

Finding ledger

1. Codex "Reject truncated provenance modules"

   • original: CURRENT / P2 at aa2ae22…
   • at e8397128…: FIXED
   • canonical whole-file byte equality replaced regex/field-extraction acceptance;
     the exact truncated-module witness is INVALID → rebuild/self-heal; exhaustive
     truncation-at-every-byte matrix passes; fresh parent audit PASS; exact-head CI green.

2. Codex "Serialize concurrent helper rebuilds"

   • original: CURRENT / P2 at 134b513…
   • at e8397128…: FIXED (via child PR fix(control): isolate concurrent helper builds #91)
   • build.mjs now compiles each build in a process-unique private mkdtemp
     workspace and publishes only by atomic rename of the validated result; the
     shared obj/exe compile state is gone. Fresh parent regression: 2/3/4-builder
     rounds all succeed (27/27 concurrent invocations exit 0), final pair canonical
     every round, no shared compile state, deterministic digest preserved.

3. PR fix(control): isolate concurrent helper builds #91 cleanup claim (build.mjs:251, "Clean the private workspace on every error path")

   • NOT REPRODUCIBLE AS DEFECT — the error-path workspace leak is real behavior
     but explicitly permitted by the adopted mechanism (best-effort cleanup; abandoned
     .build-* is private, non-authoritative, self-healing on next launch; no automatic
     retry loop; the triggering ENOSPC/EACCES already fails the launch closed). A
     try/finally would be optional hygiene, not a required correctness repair.

Current mechanism evidence (at e8397128)

• lifecycle representation: FALSE_VALID_SET == EMPTY (accepted set is the singleton
  encodeProvenance(SHA256(helper))), proven by exhaustive truncation at every byte
  offset, exhaustive single-byte mutation, and duplicate/extra/format variants;
• concurrency: 27/27 concurrent invocations succeed in the fresh parent audit;
• deterministic helper digest preserved;
• F1 FIXED, F2 FIXED, F3 FIXED;
• protected authority/runtime files unchanged (src/control/control-store.ts,
  src/control/control-runtime.ts, agentbridge-win-owner.c, and the six D062 files) — 0-diff;
• tests/control: 168 passed / 1 skipped;
• full suite: 2059 passed / 1 skipped;
• typecheck PASS; lint PASS; build PASS; git diff --check PASS.

Mechanism invariants (circuit-breaker record)

The canonical-provenance predicate redesign was the final permitted predicate redesign
on PR #90 — no third regex / field-extraction refinement is allowed. The concurrency
family is a distinct family closed by isolation (child PR #91); no lock/serialization
lifecycle was introduced.

LIFECYCLE_VALID  IFF  actualProvenanceBytes == encodeProvenance(SHA256(actualHelperBytes))
NO TWO BUILDERS SHARE MUTABLE COMPILATION STATE.

One side-effect-free canonical encoder (tools/control-owner/provenance-format.mjs) is the
single producer used by both build.mjs (publish) and ensure-helper.mjs (accept). The
runtime's own import() + hash-before-exec verification is unchanged and remains the final
security authority (no trust transfer from the lifecycle gate). If the canonical invariant is
later falsified on a supported path: STOP — no local predicate patch — escalate to the
pre-agreed JSON provenance redesign.

---

History — superseded state and reconstruction lineage

Superseded exact state at 134b513 (pre-#91)

• head 134b513e15a056d037cc51b794d72c1a9891a4b4; PR commits 2; exact-head CI #279
  (run 34122017059) SUCCESS.
• Canonicalization commit 134b513 (parent aa2ae22, subject
  fix(control): canonicalize helper provenance lifecycle, patch
  BD63236A244AD3E538652C71EFCCAB61190708716799E49E55BDBE445DD03AF2 / 39063 bytes) over 5
  files (provenance-format.mjs, build.mjs, ensure-helper.mjs, ensure-helper.d.mts,
  launch-lifecycle.test.ts). Fresh independent validation
  PASS_PR90_CANONICAL_PROVENANCE_FRESH_INDEPENDENT_VALIDATION; full suite 2054 passed / 1 skipped.

Original findings / supersession

• PR fix(control): provision native helper before launch #89 attempted the lifecycle repair but was closed unmerged after a CURRENT P2 showed its
  existence-only skip could accept a torn helper/provenance pair; it was not repaired or stacked.
• This replacement was reconstructed directly from protected parent
  aaa7ddc4b625ca4aa5d192585daa4ce824a72be6 under the PR55/PR74 circuit-breaker.
• Original CURRENT P2: supported Windows launch did not guarantee the native helper and generated
  provenance existed before control-channel verification.
• PR fix(control): provision native helper before launch #89 CURRENT P2: helper and provenance could exist but be mutually inconsistent; existence-only
  fast path skipped rebuild; runtime then returned HELPER_HASH_MISMATCH; channel unavailable until
  manual recovery.
• First reconstruction commit (SUPERSEDED): head aa2ae22bc4090195e03c39bb96b6bc50e62616d1,
  1 commit / 5 files, patch CEDC0605F0B5CED7139EC6F29DA45D96516E1A37928D313934206B57DA0D432A
  (24657 bytes); validated provenance by field-extraction; the truncated-module witness motivated
  the canonicalization commit 134b513.

Quarantine

• F1 FIXED and untouched; F2 FIXED and untouched; F3 FIXED and untouched;
• atomicity residual DUPLICATE/resolved/untouched;
• effective-rights P3 remains CARRY_OBLIGATION/untouched;
• PR fix(control): provision native helper before launch #89 remains CLOSED/unmerged and is evidence only.

Authority

PR #90 remains Draft. This evidence refresh grants no Ready authority and no merge
authority. Human merge authority is preserved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XbdCwWt1oUsGvybbqUxwJp

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 12abd1e1-c9e3-464b-98a2-ba9ecb1f772e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T19:25:14.829420Z	e839712	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa2ae22bc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 134b513e15

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8397128ce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the read-only cockpit when helper provisioning fails

On Windows when the helper pair needs rebuilding but MSVC/SDK is unavailable or the build otherwise fails, ensure-helper.mjs exits 1 and this && chain prevents live-cockpit.js from starting at all. That regresses the explicit behavior in src/runtime/live-cockpit.ts:274-289, where control-channel startup is deliberately non-blocking and failures must leave the read-only Cockpit available; keep provisioning failure fatal for control, but allow cockpit:live to continue without the channel.

Useful? React with 👍 / 👎.