fix: harden Phase 1 real-authority conformance

[BunsDev]

Summary

• repin the real-authority harness to exact Chat, SDK, Cave, Coven, and canonical package artifacts
• exercise production Chat coven_health and production keyring custody with crash-safe cleanup and restart handoff
• add deterministic SDK #73 evidence, bounded cross-platform process supervision, and required real Windows supervisor tests
• isolate and reproducibly freeze the Windows Job Object supervisor at SHA-256 372b3e8b5b860e0759da8fa10ddfb6ec338e26d83616254c816a456ae2e1b7c5

Test plan

• 440 Vitest tests
• TypeScript and Biome
• Rust fmt, check, 111 tests, 12 native RPC tests, and strict Clippy
• Windows GNU cross-check
• Standalone supervisor fmt/check/test/clippy and two clean reproducible release builds
• Exact SDK evidence parser and lock validation

This supersedes and hardens the initial conformance implementation merged in #30.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This PR hardens the Phase 1 real-authority conformance gate by pinning and validating exact producer artifacts (Chat/SDK/Cave/Coven), switching to a stricter cross-repo evidence record format, and adding bounded cross-platform process supervision (including a frozen Windows Job Object supervisor with CI behavioral tests).

Changes:

• Split “heavy” Phase 1 Vitest suites into a serial one-worker config and exclude them from the default unit run.
• Introduce supervised execution + status framing, plus a frozen Windows supervisor crate/artifact with verification and required Windows behavioral CI coverage.
• Replace the retained Phase 1 artifact schema with an SDK-compatible “platform evidence record” contract and tighten lockfile/authority pinning and validation.

Reviewed changes

Copilot reviewed 46 out of 48 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vitest.heavy.config.ts	Adds a dedicated serial Vitest config for Phase 1 heavy Git/process tests.
vitest.config.ts	Excludes heavy Phase 1 tests from the default unit test project.
tools/phase1-process-supervisor/src/main.rs	Adds the frozen Windows Job Object supervisor implementation.
tools/phase1-process-supervisor/Cargo.toml	Defines the standalone supervisor crate with pinned Windows deps and reproducible release profile.
tools/phase1-process-supervisor/Cargo.lock	Locks the supervisor crate dependency graph for reproducible builds.
tools/phase1-process-supervisor/.cargo/config.toml	Sets Windows GNU rustflags to improve build reproducibility.
src/specification-guards.test.ts	Updates repo “spec guard” tests to enforce new CI/scripts/lock invariants.
src/phase1-windows-supervisor.test.ts	Adds Windows behavioral tests for the frozen supervisor and safe command resolution.
src/phase1-evidence-contract.test.ts	Adds tests for the new cross-repo evidence contract utilities.
src/phase1-conformance-lock.test.ts	Expands lock tests for v5 structure, canonical ordering, and pinned authorities/tools.
src/phase1-conformance-artifact-root.test.ts	Strengthens process-owned artifact root cleanup semantics and supervision tests.
src/phase1-artifact-secret-scan.test.ts	Updates secret-scan tests to validate the new evidence-record schema and redaction rules.
src-tauri/src/lib.rs	Removes a test-only CovenHealth override hook from NativeConnectionState.
src-tauri/src/coven.rs	Adds tests ensuring private causes are not leaked via diagnostics and fail-closed mapping is correct.
src-tauri/src/connection.rs	Adds a conformance-only authorized instance ID accessor.
src-tauri/src/bin/phase1-native-rpc.rs	Adds internal reservation-output handling before stdio RPC mode.
src-tauri/Cargo.toml	Enables additional windows-sys features required for Windows supervision behavior.
scripts/supervisor-status.mjs	Adds canonical parsing of bounded supervisor status frames.
scripts/supervisor-status.d.mts	Declares the supervisor status frame parser types.
scripts/supervised-exec.mjs	Adds supervised synchronous command execution with cleanup and status validation.
scripts/process-owned-artifact-root.mjs	Revises process-owned artifact root cleanup + evidence record validation for retention.
scripts/process-owned-artifact-root.d.mts	Updates the artifact root TS typings to match API changes.
scripts/phase1-process-supervisor.mjs	Adds the POSIX process-group supervisor with bounded status channel.
scripts/phase1-process-supervisor.d.mts	Adds an empty module declaration for the supervisor script.
scripts/phase1-evidence-contract.mjs	Introduces the evidence contract helpers (registry parsing, assertion binding, evidence building).
scripts/phase1-evidence-contract.d.mts	Declares types for evidence-contract helpers.
scripts/phase1-conformance.d.mts	Updates the conformance harness typings to reflect new APIs and evidence plumbing.
scripts/phase1-conformance-lock.mjs	Updates lock parsing/normalization, adds v5 structure validation, and runs git via supervised exec.
scripts/phase1-conformance-lock.d.mts	Updates lock/checkout verifier typings for new v5 lock structure and optional harness root.
scripts/phase1-conformance-launcher.sh	Adds a trusted POSIX outer launcher that clears injection env before starting Node.
scripts/phase1-conformance-launcher.ps1	Adds a trusted Windows PowerShell launcher validating helper/node/corepack state.
scripts/phase1-artifact-secret-scan.mjs	Updates secret scan rules to validate the evidence record schema and reject private content.
scripts/phase1-artifact-secret-scan.d.mts	Updates secret-scan report types to the new evidence record schema.
scripts/executable-resolution.mjs	Adds safe cross-platform executable resolution (esp. Windows PATH/PATHEXT/COMSPEC handling).
scripts/executable-resolution.d.mts	Declares executable resolution helper types.
README.md	Updates developer-facing docs to run Phase 1 via trusted launcher and reflect new evidence format.
phase1-conformance.lock.json	Updates Phase 1 lock to v5 with pinned authorities, tools, manifests, and evidence metadata.
package.json	Adds heavy/normal unit split, adds windows-gnu check script, updates lint/format/test scripts.
docs/superpowers/plans/2026-08-20-phase-1d-real-authority-conformance.md	Updates the Phase 1d plan to use trusted launchers and new workflow steps.
docs/superpowers/plans/2026-08-15-opencoven-chat-program-tracking.md	Updates program tracking docs to reference the trusted launcher + SDK #38 evidence record.
docs/phase1-conformance.md	Substantially updates Phase 1 operator guide for new lock/evidence/supervision design.
docs/developer-toolchains.md	Updates toolchain docs to reference trusted launcher and windows-gnu compile gate.
.github/workflows/ci.yml	Updates CI to run trusted launcher, add frozen supervisor build + Windows behavioral job, and new evidence checkout.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BunsDev]

Release-gate scope note: commit e373519 adds an unrelated ~2,000-line demo UI overhaul and a new runtime dependency to this conformance-hardening PR. Please move that work to a separate PR (or otherwise remove it from this branch) before merge so the security/conformance diff remains reviewable and the immutable evidence change is not coupled to unrelated product UI.

Also, a green macOS job here will only restore the darwin-arm64 record; OpenCoven/sdk#38 still requires genuine linux-x64 and win32-x64 real-authority records.