test(control): make owner helper integration context-aware

[LogicDuke]

Nested validation repair for PR #85.

Finding:

• CURRENT P2 test/CI defect.
• GitHub-hosted elevated Windows runner may create the temp directory with a non-operator owner.
• Previous test assumed temp directory owner SID == whoami /user SID.
• Product owner==operator security invariant remains unchanged.

Repair:

• Test now obtains the actual directory owner SID from the real owner helper.
• If owner == operator SID, verifyAnchorOwner must ACCEPT.
• If owner != operator SID, verifyAnchorOwner must fail closed with the expected rejection.
• SYSTEM ownership remains rejected.
• No production file changed.

Exact identity:

• base: 756fb5e
• head: dc10880
• one commit
• one changed file
• patch SHA256:
  b51cacafcd5f461fe0c79564b53883da44e51aaac68e7fa7bbaed2fe8204808b
• patch bytes: 2798

Validation:

• fresh independent validation PASS
• focused Windows owner-helper test PASS
• tests/control 119/119
• full suite 2010/2010
• typecheck PASS
• lint PASS
• build PASS
• git diff --check PASS

No F1 production change.
No F2/F3 repair.
No runtime/deployment mutation.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PPAMmQpdQbunE8kGbezgih

Summary by CodeRabbit

• Tests
  • Updated Windows ownership validation coverage to determine the temporary directory’s actual owner.
  • Added checks for matching operator ownership, system ownership, and other mismatched owners.
  • Improved test reliability across both standard and elevated Windows environments.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 88b71581-3a52-47b2-bf82-ac9fbe63a1bf

📥 Commits

Reviewing files that changed from the base of the PR and between 756fb5e and dc10880.

📒 Files selected for processing (1)

• tests/control/owner-helper.win.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Windows owner verification test now reads the temporary directory’s actual owner SID with the build-provenanced helper. It accepts operator ownership and checks fail-closed error codes for system or other foreign ownership.

Changes

Owner verification

Layer / File(s)	Summary
Owner SID validation tests/control/owner-helper.win.test.ts	The test discovers the directory owner SID with the real helper binary. It accepts matching operator ownership and expects OWNER_IS_SYSTEM or OWNER_MISMATCH for foreign ownership.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to dc108

The Windows owner-verification test now handles elevated and non-elevated runner ownership correctly while retaining rejection checks for SYSTEM and foreign owners. No current merge-blocking risk remains.

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: making the owner-helper integration test context-aware for elevated runner environments.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/pr85-windows-owner-test-context

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T18:22:28.434820Z	dc10880	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc108807da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.