test(windows): reproduce owner-directory quota access boundary - #220
Merged
Conversation
This was referenced Sep 11, 2026
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The fixture must use production wildcard discovery and Coven’s exact owner-only ACL descriptor.
Pull request overview
Adds a native Windows fixture reproducing owner-directory quota access denial without changing production accounting.
Changes:
- Adds terminal/background quota checks and overflow controls.
- Integrates the fixture into Windows tests and metadata validation.
- Documents reproduction scope, cleanup, and roadmap status.
File summaries
| File | Summary |
|---|---|
src/client-v1-conformance-workflow.test.ts |
Registers fixture metadata. |
scripts/windows-owner-directory-quota.test.ps1 |
Implements the native ACL and quota fixture. |
scripts/windows-job-supervisor.test.ps1 |
Runs the new fixture. |
docs/windows-quota-reproduction.md |
Documents the reproduction contract. |
docs/roadmap.md |
Records investigation status. |
docs/phase1-conformance.md |
Updates frozen metadata bindings. |
Review details
Suppressed comments (3)
scripts/windows-owner-directory-quota.test.ps1:145
- This quota points directly at the restricted directory, so it skips
ExpandQuotaPattern's wildcard discovery stage. The protectedharness execution aggregatequota usesJoin-Path $isolatedUser.TempPath 'phase1-conformance-run-*'(.github/workflows/client-v1-conformance.yml:9560-9563); keeping the direct path here would let a regression in that production stage go undetected. Use the production wildcard so this terminal/background reproduction covers both stages.
[OpenCoven.WindowsDirectoryQuota]::new('harness execution aggregate', $directory, 2048)
scripts/windows-owner-directory-quota.test.ps1:183
- The overflow control repeats the direct path, so even after the denial control is aligned it would still bypass the production wildcard-discovery path. Use the same
phase1-conformance-run-*pattern here to keep the readable byte-overflow control on the actual aggregate quota shape.
[OpenCoven.WindowsDirectoryQuota]::new('harness execution aggregate', $directory, 512)
scripts/windows-owner-directory-quota.test.ps1:117
- This does not apply Coven’s production owner-only directory descriptor. The native implementation creates directories with
O:{sid}D:P(A;OICI;FA;;;{sid})(src-tauri/src/cleanup_grant.rs:981-987), but the fixture substitutes anOWOwner Rights ACE andGA. Since the ACL boundary is the behavior under test, use the exact owner-SID/FAdescriptor or this result does not establish reproduction of the production boundary.
var descriptor = new RawSecurityDescriptor("O:" + ownerSid + "D:P(A;OICI;GA;;;OW)");
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Protected run 34611963297 failed while enumerating the harness aggregate quota. This adds a native fixture that assigns a real isolated account as directory owner and applies Coven’s owner-only directory DACL, then exercises the actual terminal and background quota paths. Readable-directory and byte-overflow controls distinguish access denial from a quota breach.
The fixture captures its original owner, DACL and inheritance protection through a noninheritable directory handle before restricting access. It restores security through that retained handle, aggregates independent failures, and requires account/root cleanup. The reproduction contract, exact fixture metadata and current roadmap gates are documented.
This advances #219. It does not identify the denied protected-run descendant or repair production accounting. Native fixture acceptance is recorded below; production repair remains #219.
Validation at b40ee09: 128 focused workflow/specification tests passed (19 platform skips), lint passed, eight existing quota diagnostic groups passed, and PowerShell syntax/C# compilation/reflection contracts passed. Independent fixture review found no blockers. All ten CI checks passed: https://github.com/OpenCoven/chat/actions/runs/34618970228. Native Windows logs confirm the terminal/background denial reproduction, readable/overflow controls and complete fixture cleanup; 33 real supervisor tests and 11 native E2E tests passed. This establishes the controlled reproduction, not attribution of the protected descendant or production acceptance.