feat(native): wire the E2E drive into the native window - #632

Refs #344. Step 4 after #620: this wires the E2E drive contract into the native window. Do not merge yet; it is for review.

What changes

Window (MainWindow.xaml.cs). With WOOTC_E2E_DRIVE=1, a 2-second timer makes the clicks a person makes, in this order:

1. Read the startup status. This needs one elevation, and the window never retries it.
2. Read the Linux configuration.
3. E2EDriveLoop takes over:
   • it fills the form through ConsumerConfiguration.ApplyDriveMapping, writes the values into the visible controls and reads them back;
   • it checks the plan with the engine and accepts the Install confirmation. The words of that confirmation are pinned by InstallDisclosureTests; the drive does not draw the dialog;
   • on Done, it uses the same path as Reboot now.

The screen, the button state, the hint, the progress step and the error come from what is on screen and from the install gate. A plan the engine refuses, or a failed install, is reported in error, so the harness fails at once and does not wait.

Core.

• E2EDriveLoop is the counterpart of startE2EDrive in e2e.js. It behaves as follows:
  • With no directive, it writes only the readiness marker.
  • With a directive, it performs one command per tick and then writes the bound report.
  • It never follows a malformed directive, a changed run or a second install directive.
  • A failed read is retried on the next tick.
  • A mapping refusal (from the explicit-target rule in feat(shell): E2E drive contract in Core with goldens shared by engine, harness and shell #620) is reported as the drive error.
• StartupController is the loop's channel. It never waits behind a connection or configuration read, and it answers only through an authenticated IDriveEngineSession.
• Behaviour change: a directive that names no encryption now maps to none, as the Wails loop does (directive.encryption || 'none'). Before, it took the catalogue default. The harness directive names no encryption, and the native install grant accepts only none or luks-passphrase.

Native transport. The assessment session implements E2EDriveDirective (no parameters, so a string comes back, at most 16 KiB), E2EDriveReport and E2EDriveReady (each takes one string and returns null). An install session refuses all three locally.

Engine (app/serve.go). The native configuration session now serves the three drive methods. Any other assessment session and the install session still refuse them. They stay inert unless the engine's own environment sets WOOTC_E2E_DRIVE=1, so the shell cannot turn them on. E2EDriveReady was served but missing from ProtocolMethods; it is now listed in both ProtocolMethods and docs/winui-shell.md.

Harness (the only harness change in this series).

• run-e2e.sh builds its install directive with tests/e2e/gui-drive-directive.py.
• Wails path: the directive bytes are identical to before (a test pins this against the old inline construction).
• Native path: the directive adds "storageId":"C:" and is byte-equal to the shared golden directive-install.json.
• WOOTC_E2E_GUI_FRONTEND selects the frontend; the default is wails. The value native is refused before any VM work, because the harness cannot launch the native shell yet. Driving the Wails app while recording a native run would give a green result from a proxy.

Local validation (head be52c6a)

Not proven, and open questions

• No drive has run in a real native window. The harness cannot yet stage or launch the native shell. That launch is the next WinUI phase C: screens, branding, E2E drive contract, UiTest gallery, one green shell-driven E2E #344 item ("one green run-e2e.sh --gui-install with the shell as the driven app").
• Engine environment: the engine starts through a runas elevation, and an elevated process may not inherit the shell's environment. A native harness launch will probably need WOOTC_E2E_DRIVE=1 set at machine level, so that both the shell and each elevated engine see it. This is not tested.
• Each plan check opens an install-purpose session, which means another elevation. Any native harness run needs UAC to be non-interactive in the guest.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN

Generated by Claude Code