[hanthor]

Adds a read-only boot/session observer and a disabled Windows duplex pipe adapter for the VM-first source stack. The observer measures the current Linux boot, ordinary session leader and selected GPT root graph. Requests accept no command, path or write operation; missing or changed observations refuse.

The Windows adapter checks the actual pipe server against the retained process identity and binds replies to the run, install, disk, session, request and reviewed source hashes. Owned pipe I/O has deadlines and cancellation closes the connection. A source-only Windows workflow exercises positive exchange, blocked read/write, cancellation, expected process death and foreign peer controls; skips fail the job.

Validation: 11 Python controls, full Linux Go suite, focused guest/QMP/display controls and actionlint pass. Actual Windows controls run36333433660 PASS with no skips: positive exchange, blocked read/write, cancellation, expected process death and foreign peer. Tested merge b71d7b3 is retained with OS/Go versions, raw artifact and exact Git-to-Windows CRLF source mapping. Original054f run36333288398 refused before test execution because PowerShell treated normal native Go download stderr as an error; the workflow now inspects native exit explicitly. Durable logs and dependency hashes are in docs/experiments/evidence/2026-09-27-vm-guest-observer/.

This draft stacks on #495 with current main13c integrated. Neither service nor adapter is enabled in the product route. Independent host graph acceptance, authenticated service installation, actual target desktop and ordinary editor save/reopen/restart persistence remain owed. This does not close #178.

[hanthor-hive-agent]

68a916b

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 68a916b14126) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 5 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/linux-package-execute.yml
  • .github/workflows/linux-package-runtime.yml
  • .github/workflows/readonly-cli-status.yml
  • .github/workflows/vm-guest-observer-controls.yml
  • .github/workflows/winui-preview.yml
• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • .github/workflows/linux-package-execute.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor-hive-agent]

68a916b

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 68a916b14126) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 5 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/linux-package-execute.yml
  • .github/workflows/linux-package-runtime.yml
  • .github/workflows/readonly-cli-status.yml
  • .github/workflows/vm-guest-observer-controls.yml
  • .github/workflows/winui-preview.yml
• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • .github/workflows/linux-package-execute.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor-hive-agent]

68a916b

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 68a916b14126) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 5 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/linux-package-execute.yml
  • .github/workflows/linux-package-runtime.yml
  • .github/workflows/readonly-cli-status.yml
  • .github/workflows/vm-guest-observer-controls.yml
  • .github/workflows/winui-preview.yml
• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • .github/workflows/linux-package-execute.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.