feat(native): authenticated read-only consumer configuration (re-proposes #501 code)

.github/workflows/native-configuration.yml

@@ -0,0 +1,78 @@
+name: Native configuration observations
+on:
+  pull_request:
+    paths:
+      - 'app/native_configuration*'
+      - 'app/native_storage*'
+      - 'app/serve.go'
+      - 'app/status_location_windows.go'
+      - 'app/app.go'
+      - 'app/catalog.go'
+      - 'app/native_serve_windows.go'
+      - 'app/go.mod'
+      - 'app/go.sum'
+      - 'tests/native_configuration_controls.py'
+      - 'shell/Wootc.Shell.Native/NativeEngineSession.cs'
+      - '.github/workflows/native-configuration.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  native:
+    name: Actual Windows configuration and storage controls
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: app/go.mod
+          cache-dependency-path: app/go.sum
+      - name: Observe actual system storage and private refusal fixtures
+        shell: powershell
+        env:
+          CGO_ENABLED: '0'
+        run: |
+          $ErrorActionPreference='Stop'
+          $oldTemp=$env:TEMP
+          $oldTmp=$env:TMP
+          $base=[Environment]::GetFolderPath([Environment+SpecialFolder]::CommonApplicationData)
+          $directory=Join-Path $base "wootc-configuration-$([guid]::NewGuid().ToString('N'))"
+          if (Test-Path -LiteralPath $directory) { throw 'Refusing existing fixture' }
+          [IO.Directory]::CreateDirectory($directory) | Out-Null
+          & icacls.exe $directory /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' *> $null
+          if ($LASTEXITCODE -ne 0) { throw 'Private fixture ACL failed' }
+          try {
+            $env:TEMP=$directory
+            $env:TMP=$directory
+            & git rev-parse HEAD
+            foreach ($source in @('app/native_configuration.go','app/native_configuration_windows.go','app/native_storage_windows.go','app/native_storage_session_windows.go','app/native_storage_session_windows_test.go','app/native_storage_query.ps1','app/native_storage_windows_test.go','app/native_configuration_rpc_test.go')) {
+              Write-Output "SOURCE $source SHA256 $((Get-FileHash -LiteralPath $source).Hash)"
+            }
+            $assets=Join-Path 'app/frontend' 'dist'
+            if (Test-Path -LiteralPath $assets) { throw 'Refusing prebuilt assets' }
+            [IO.Directory]::CreateDirectory($assets) | Out-Null
+            [IO.File]::WriteAllText((Join-Path $assets 'index.html'),'<title>Unit-test embed placeholder</title>')
+            $priorPreference=$ErrorActionPreference
+            $ErrorActionPreference='Continue'
+            try {
+              & python tests/native_configuration_controls.py
+              $code=$LASTEXITCODE
+            } finally { $ErrorActionPreference=$priorPreference }
+            if ($code -ne 0) { throw 'Configuration runtime controls failed' }
+          } finally {
+            $env:TEMP=$oldTemp
+            $env:TMP=$oldTmp
+            Remove-Item -LiteralPath $directory -Recurse -Force -ErrorAction Stop
+          }
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        if: always()
+        with:
+          name: native-configuration-runtime
+          path: out/native-configuration/
+          if-no-files-found: error

.github/workflows/winui-preview.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - 'shell/**'
+      - 'tests/native_configuration_flush_controls.py'
+      - 'tests/windows_owned_process.py'
       - 'app/serve*'
       - 'app/native_peer*'
       - 'app/native_pipe*'
@@ -12,6 +14,8 @@ on:
       - 'app/native_serve*'
       - 'app/native_readiness*'
       - 'app/native_audit*'
+      - 'app/native_configuration*'
+      - 'app/native_storage*'
       - 'app/main.go'
       - 'app/status_location*'
       - 'app/tools/gendto/**'
@@ -152,6 +156,8 @@ jobs:
       - name: Test actual Windows adapter identities and private package controls
         working-directory: shell
         run: dotnet test Wootc.Shell.NativeTests --configuration Release -p:NativeBuildId=${{ github.sha }} --logger "trx;LogFileName=native-adapter.trx"
+      - name: Prove actual current configuration flush identity and restored counter
+        run: python tests/native_configuration_flush_controls.py
       - name: Observe the actual native startup window with UI Automation
         working-directory: shell
         shell: pwsh
@@ -191,6 +197,7 @@ jobs:
         with:
           name: winui-preview-diagnostics
           path: |
+            out/configuration-flush-controls/
             out/winui-source-diagnostics/
             out/winui-startup-events.json
             out/native-startup-state-observations.json

app/app.go

@@ -324,8 +324,14 @@ func supportChannel() string {
 
 // GetSupportPolicy returns the gating policy for the active channel.
 func (a *App) GetSupportPolicy() SupportPolicy {
+	return supportPolicyFor(supportChannel(), effectiveBranding(), os.Getenv("WOOTC_E2E_DRIVE") == "1")
+}
+
+// Shared policy calculation accepts observations from the caller. It performs
+// no filesystem discovery and does not authorize an operation.
+func supportPolicyFor(channel string, brand Branding, driveMode bool) SupportPolicy {
 	var pol SupportPolicy
-	switch supportChannel() {
+	switch channel {
 	case "beta":
 		// Full matrix green (the beta bar): everything is on the table; the
 		// axes that are still red stay explicitly false until their issue closes.
@@ -344,7 +350,7 @@ func (a *App) GetSupportPolicy() SupportPolicy {
 	// A branded installer installs its own distribution: no custom OCI ref,
 	// on any channel. This is the backend side of the brand's
 	// hideCustomImage — the frontend hiding the field is not enforcement.
-	if effectiveBranding().HideCustomImage {
+	if brand.HideCustomImage {
 		pol.CustomImageAllowed = false
 	}
 	// The E2E harness exists precisely to test images BEFORE they are green;
@@ -353,7 +359,7 @@ func (a *App) GetSupportPolicy() SupportPolicy {
 	// default instead (run 32581422435: "bazzite" installed bluefin-lts —
 	// the drive loop now also refuses on mismatch, this is the enabling
 	// half). Real users never run with this environment variable set.
-	if os.Getenv("WOOTC_E2E_DRIVE") == "1" {
+	if driveMode {
 		pol.ExperimentalImages = true
 	}
 	return pol

app/catalog.go

@@ -34,12 +34,18 @@ func (a *App) GetImages() ([]Image, error) {
 		}
 	}
 
-	catalog, err := catalogForBrand(brandFS, brandID)
+	return resolveImageCatalogue(brandFS, brandID, effectiveBranding(), a.GetSupportPolicy(), readBundleInfo())
+}
+
+// Resolve the existing catalogue with explicit metadata observations. Both
+// legacy and native callers use this policy; callers own trusted reads.
+func resolveImageCatalogue(assets fs.FS, id string, brand Branding, policy SupportPolicy, bundle *BundleInfo) ([]Image, error) {
+	catalog, err := catalogForBrand(assets, id)
 	if err != nil {
 		return nil, err
 	}
 
-	if b := readBundleInfo(); b != nil && b.Source != "predownload" {
+	if b := bundle; b != nil && b.Source != "predownload" {
 		for _, img := range catalog {
 			if img.ImageRef == b.Image {
 				return []Image{img}, nil
@@ -53,13 +59,13 @@ func (a *App) GetImages() ([]Image, error) {
 		}}, nil
 	}
 
-	if ids := effectiveBranding().Catalog; len(ids) > 0 {
+	if ids := brand.Catalog; len(ids) > 0 {
 		catalog = brandCatalogImages(catalog, ids)
 		if len(catalog) == 0 {
 			return nil, fmt.Errorf("brand catalog contains no known images")
 		}
 	}
-	if a.GetSupportPolicy().ExperimentalImages {
+	if policy.ExperimentalImages {
 		return catalog, nil
 	}
 	green := catalog[:0]