WOR-120 Windows continuation handoff: finish native CI portability

[Ldsystem]

Purpose

Continue WOR-120 on a native Windows machine from the exact unmerged candidate. The macOS host has completed the Python installer, platform primitives, stdin-JSON credential transport, and three-platform CI wiring. Ubuntu and macOS pass; Windows now exposes native filesystem, Git, path, and test-fixture defects that should be diagnosed and repaired on Windows.

Exact handoff state

• Source development branch: dev/wor120-windows-handoff
• Source commit: 29c43a663090956be04b76b204f141abecc8cb7a
• Existing integration branch / PR: work/wor120, PR feat: add native Windows WorkBundle support #42
• Control-plane branch: dev/wor120-windows-handoff in Ldsystem/work-bundle-control-plane
• Control-plane commit: ceb6d0a
• Canonical specification: .work-bundle/orchestration/spec/active/spec-20260920-002.spec.md
• Canonical plan: .work-bundle/orchestration/plan/active/plan-20260920-002.plan.yaml
• Active Task 4 result: .work-bundle/orchestration/result/executor/active/plan-20260920-002/task-wor120-ci-convergence/result-wor120-ci-convergence.executor-result.yaml

Tasks 1-3 are accepted. Task 4 and the overall workflow are not accepted or finalized.

Hosted evidence

GitHub Actions run: https://github.com/Ldsystem/work-bundle/actions/runs/35548744201

• deterministic-ubuntu-latest: passed
• deterministic-macos-latest: passed
• deterministic-windows-latest: failed in the canonical gate
• Windows source-archive creation, Python installation, idempotent reinstall, skill junction activation, hook execution, public CLI checks, and focused runtime tests passed before the canonical gate.
• Home-isolation cascade was repaired by pairing HOME and USERPROFILE only in fixtures that intentionally create isolated homes.
• Remaining Windows failure surface: 11 modules.

First-owner repair map

1. Control-plane Windows production semantics

   • Recognize drive-letter and UNC local Git remotes in scripts/work-bundle/control_plane.py.
   • Remove owned Git trees containing read-only object files during rollback without broad destructive behavior.
   • Restore exact pre-operation bytes during failed-publish rollback; do not allow CRLF rewriting.
   • Review these as separate concerns: remote classification, owned-tree cleanup, and byte-exact rollback.

2. Portable rule serialization

   • scripts/work-bundle/rules.py emits backslashes in canonical index paths and diagnostic identifiers.
   • Serialize repository-relative rule paths in POSIX form.

3. Evaluation source identity

   • validation_source_identity hashes CRLF-smudged working-tree bytes even when Git considers the file clean, producing a tree different from HEAD^{tree}.
   • Correct the identity owner; do not patch expected hashes.

4. Bounded test portability only

   • Replace POSIX mode-bit and chmod-failure assumptions with capability-aware checks or explicit injected failures.
   • Compare Windows short/long paths by filesystem identity, not raw spelling.
   • Escape dynamic Windows paths passed into regexes.
   • Render valid YAML when fixture values contain Windows backslashes.
   • Use native absolute escape paths instead of /tmp.
   • Replace the shell-only fake uv fixture with a native executable fixture, or mark only that shell emulation case inapplicable.
   • Assert the supported Windows junction contract rather than is_symlink().
   • Derive commit-byte expectations from Git, not CRLF-smudged working-tree reads.
   • Feed unmerged-index fixtures to Git as binary LF data.

Affected modules in the latest run include test_blocking_fact_skill, test_control_plane_v4, test_execution_artifact_placement, test_keep_summarizing_query, test_multi_repository_member, test_orchestration_artifact_foundation, test_orchestration_evaluations, test_orchestration_stage5_current_path, test_registry_layout_migration, test_rule_contracts, and test_workspace_lifecycle. Use the run log for exact failing cases.

Authority and restrictions

• User purpose and accepted decisions are authority; as-is code is evidence, not proof of correctness.
• Correct each defect at its first owning layer. Do not introduce compatibility layers, migration ceremony, or broad skips.
• Scripts own strict necessary pre-write mechanics. Agents own semantic judgment and acceptance.
• Post-write checks remain lightweight; tests and CI are evidence, not semantic verdict authority.
• Reviewer findings are advisory. The controller/orchestrator retains scope, repair routing, acceptance, and closure authority.
• Accuracy and observable behavior outrank incidental state-file deltas.
• Preserve active canonical artifacts in place and remove obsolete logic/orphan symbols rather than retaining legacy variants.
• Do not inspect or migrate historical orchestration artifacts.
• Do not touch credentials or print secret values.
• Do not accept Task 4 or finalize WOR-120 until the exact repaired candidate has native Windows evidence and an independent semantic review.

Suggested continuation

1. Clone/check out both dev/wor120-windows-handoff branches on Windows.
2. Reproduce the failed modules individually using the canonical Python interpreter.
3. Repair one first-owner batch at a time, with focused tests and independent review.
4. Run the exact hosted three-platform matrix after focused behavior is stable.
5. Fast-forward work/wor120 to the reviewed development head so PR feat: add native Windows WorkBundle support #42 validates the final candidate; do not force-push.
6. Update the active Task 4 result in place, perform final semantic review, then let the controller decide acceptance and finalization.

This issue is a factual handoff, not an acceptance record.