[WRONG BRANCH] fix(windows): fail closed on principal resolver errors

[luvs01]

Motivation

• Prevent executing an untrusted PowerShell helper by removing a fixed C:\Windows fallback that could be pre-created on non-default installs and mistakenly trusted.
• Preserve the original fail-closed security posture: only a GetSystemDirectoryW-derived, FFI-backed system-directory resolution should establish the trusted executable path.

Description

• Remove the ARM64 fixed-path fallback and related helper code; the SID lookup now always uses resolveTrustedWindowsPowerShellExe() as the authority.
• Elide the DEFAULT_WINDOWS_ARM64_POWERSHELL constant and the resolution logic that returned it after arbitrary resolver failures.
• Replace focused tests that exercised the fallback with a regression test asserting that trusted-resolution failures fail closed by exercising setTrustedWindowsSystemDirectoryResolverForTests.
• Update the architecture/decision doc (structure/02_config-and-codex-home.md) to state that the ACL operation fails closed when trusted system-directory resolution is unavailable.

Testing

• ✅ Ran the focused Windows principal unit tests with bun test tests/windows-user-principal.test.ts, which passed.
• ✅ Ran type checking with bun run typecheck, which completed successfully.
• ✅ Ran the repository privacy scan with bun run privacy:scan, which passed.
• ⚠️ Ran the full test suite with bun run test; the broader suite produced unrelated failures/timeouts (lab automation, outbound proxy, attribution, and management API tests) that are not caused by this focused change.

---

Codex Task

Summary by CodeRabbit

• Security

  • Windows secret-file permission updates now use a trusted system PowerShell path.
  • Operations fail safely with a clear error when the trusted path cannot be resolved.

• Bug Fixes

  • Removed platform-specific fallback behavior that could select an untrusted PowerShell executable.
  • Improved error propagation when Windows principal or ACL operations cannot resolve PowerShell securely.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b7d66750-5ac2-45a2-8948-20017531b280

📥 Commits

Reviewing files that changed from the base of the PR and between 1193075 and d1c37dc.

📒 Files selected for processing (3)

• src/lib/windows-user-principal.ts
• structure/02_config-and-codex-home.md
• tests/windows-user-principal.test.ts

---

📝 Walkthrough

Walkthrough

The change removes the Windows ARM64 PowerShell fallback. Principal lookup and ACL identity queries now require trusted GetSystemDirectoryW resolution. Tests verify that resolver errors propagate.

Changes

Trusted PowerShell resolution

Layer / File(s)	Summary
Enforce trusted executable resolution src/lib/windows-user-principal.ts, structure/02_config-and-codex-home.md	Removed the ARM64 fixed-path fallback and related resolver API. Principal lookup now calls resolveTrustedWindowsPowerShellExe() directly. ACL operations fail closed with EACLIDENTITY when trusted resolution is unavailable.
Validate resolver error propagation tests/windows-user-principal.test.ts	Updated test hooks and cleanup. Added coverage that verifies trusted resolver errors propagate during PowerShell command construction.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to d1c37

The change removes an unsafe Windows PowerShell fallback and preserves fail-closed resolution behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• luvs01/opencodex#53: Both changes make Windows ACL handling fail closed instead of using fallback or soft-failure behavior.

Suggested reviewers: ingwannu, lidge-j

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the Windows change to fail closed when principal resolution errors occur.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-arm64-powershell-fallback-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}