Authenticate staged updates before Windows CFA replacement

[frathe]

Windows updates now accept only stage metadata authenticated by the creating PicFetch process and install from a retained, verified source handle. Stages from earlier processes must be downloaded and attested again.

• Seal persisted metadata with a process-local HMAC.
• Extract directly from the verified archive buffer and derive payload paths/digests from archive entries.
• Hold the Windows source with writes/deletes denied until installation finishes; verify the installed digest before relaunch.
• Exercise the production install/rollback path through the existing failure, retry, backup and relaunch tests.
• Update native Windows fixtures for authenticated stages and Windows handle-sharing rules.

Validation: updater package race tests; focused autoupdate and root UI tests; Windows amd64/arm64 test cross-compiles; formatting, vet and build. Full Linux race suites and native Windows/macOS platform guards passed in GitHub CI. All nine changed Go files passed GoLand inspection with warnings enabled. Final review and CI evidence is tracked in the review record and PR discussion.

Review record: finished_refactorings/2026-09-16-pr32-review.md.

[github-actions]

Qodana for Go

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T21:29:52.084489Z	eebfe9a	New commits
🔒 Security Review	✅ Completed 2026-09-16T21:33:13.478582Z	eebfe9a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[frathe]

Initial review fixes are in 85fac5e.

• Repaired all three native Windows failures: authenticated fixtures, preflight error expectations, and platform-appropriate retained-handle assertions.
• Derive payload identity and digests directly from the verified archive buffer.
• Deny Windows source writes/deletes throughout retained-handle installation.
• Consolidate the production authenticated swap and the tested rollback/retry/relaunch path.

Validation passed: complete updater package with race detection; focused automatic/manual updater and root UI regressions; Windows amd64/arm64 test cross-compiles and amd64 updater vet; make fmt-check, make vet, make build. Archive manifest selection was observed red then green, and archive digest assertions were negatively verified. Native Windows and full Linux race verification are now running in CI.

Initial Qodana post-suppression SARIF contained zero results, and no open CodeQL alerts were associated with the PR merge ref. Every changed Go file was submitted to GoLand inspection, but the IDE's untrusted project state prevented analysis; that limitation is recorded and will be retried if the project becomes available.

PR marked ready after these fixes. Awaiting fresh configured Codex code/security reviews and CI on this commit.

[frathe]

Follow-up eebfe9a makes the extraction test adapter return errors before reading the success result. This resolves the Qodana warning without a suppression; focused extraction tests, formatting and GoLand re-inspection pass.

GoLand inspections now complete for all nine changed Go files after the project was trusted, with no findings. Native Windows CI also passed all three previously failing tests and both new admission guards. The first full CI run passed all platform jobs and Linux race partitions. The first Codex code/security round completed with the connector's thumbs-up and no review threads.

The final commit automatically started fresh code/security reviews and CI; no duplicate review request was posted. The accepted implementation record is now finished_refactorings/2026-09-16-pr32-review.md.

A separate GitHub-generated “Code scanning AI findings” job failed on the preceding commit before analysis: its model request returned HTTP 400, “The requested model is not supported.” This is distinct from CodeQL and Codex security review. Its final-commit run is being checked too; repository security settings were not changed.

[frathe]

Final review-loop evidence for eebfe9a:

• PR is Ready for review. Fix commits: 85fac5e (authenticated archive/source handling, shared rollback coverage, native Windows fixes) and eebfe9a (explicit test-helper error path and verification record).
• Fresh Codex summary: code review completed at 21:29:52 UTC and security review at 21:33:13 UTC on this exact head; connector returned thumbs-up. No review findings or unresolved threads remain.
• CI 35152404673: all eight jobs passed, including native Windows, both macOS architectures, all Linux race partitions, and validation.
• CodeQL 35152404564: Go and Actions analyses passed; no open alerts returned for the PR merge ref.
• Qodana 35152404754: passed; downloaded post-suppression qodana.sarif.json contains zero results. The earlier test-helper warning is resolved.
• GoLand inspected all nine changed Go files with warnings enabled and returned no findings; the final test-helper edit was re-inspected. Focused local tests and required local formatting/vet/build checks passed.

External limitation: the separate GitHub-generated Code scanning AI findings run failed before analysis because its service returned HTTP 400, “The requested model is not supported.” The preceding commit had the same service failure. That auxiliary scanner remains unverified; no repository required-status rule requires it, and no security configuration was weakened. Codex security review and CodeQL completed independently as recorded above.

Implementation evidence is archived in finished_refactorings/2026-09-16-pr32-review.md; todos.md is current. The PR remains open for human review; no merge or release was performed.