[lidge-jun]

Summary

The dev lane=all run 40708434824 failed two new groups of tests. Both are test-fixture assumptions; no product behavior changes here.

Windows config-root seeds (windows 4/9, 9/9). Since #7903, src/client/lifecycle-lock.ts asks hardenSecretDir to verify an existing runtime directory first, and that verifier launches real PowerShell (src/lib/windows-owner-acl.ts). claude-config-root-late-admission and claude-config-root-writer-barrier mock icacls but left the verifier real, inside a 1s ACL budget. A cold PowerShell start exhausts the budget, hardening refuses before the mocked icacls runs, and the seed reports written: false. Both files now stub the owner verifier as unavailable, so hardening takes the mocked icacls path exactly as before #7903; the stub is reset in afterEach.

macOS history ownership (macos 3/3, macos control). tests/fixtures/stop-restore-history-runner.ts hashed the raw CODEX_HOME spelling into its history-lock probe path, while production locks the canonical spelling (src/codex/paths.ts uses realpathSync.native). On macOS the temp alias (/var vs /private/var) gives a different hash, so the probe opened another database and saw history: false. The probe now canonicalizes the path the same way. This test was never reached on macOS before #7900 fixed the install script.

Verification

• Cause, from a bisect on this Windows host (three runs per head): the two Windows files pass naturally at 6ed7d6e, 12c0ec6 and 7eab243, but with a deliberately slow owner-ACL probe the four failing cases pass 4/0 before fix(windows): avoid repeat ACL propagation for lifecycle roots #7903 and fail 0/4 at fix(windows): avoid repeat ACL propagation for lifecycle roots #7903 and dev, at the same seeded.written assertions CI reported.
• Windows x64, Bun 1.4.4, OCX_TEST_NO_QUEUE=1: claude-config-root-late-admission, claude-config-root-writer-barrier, stop-restore-history-ownership, stop-restoration-preflight: 96 pass / 0 fail. bun run typecheck passed.
• The macOS fix is source-derived; this PR's checks are Ubuntu-only, so the macOS result comes from the next lane=all dev batch.

NOT RUN: macOS locally, full suite.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (Tests only.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. (Test stubs only; production ACL code unchanged.)

Summary by CodeRabbit

• Tests
  • Updated integration tests to account for unsuccessful Windows permission checks.
  • Adjusted a history-path check to use the resolved home directory path.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: fix/ci-acl-verifier-and-history-probe
• File: .coderabbit.yaml
• Commit: 63861c1
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3e5ea3b7-084d-4a48-a551-0baa9973ea7b

Commits

Reviewing files that changed from the base of the PR and between 4df7e8e and 63861c1.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: fix/ci-acl-verifier-and-history-probe
• File: .coderabbit.yaml
• Commit: 4df7e8e
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7452d39f-747f-4c5b-8377-995c5f2b3355

Commits

Reviewing files that changed from the base of the PR and between 7eab243 and 4df7e8e.

Files selected for processing: 3

• tests/claude-integration/claude-config-root-late-admission.test.ts
• tests/claude-integration/claude-config-root-writer-barrier.test.ts
• tests/fixtures/stop-restore-history-runner.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

Two Claude integration tests now control the Windows owner ACL test runner. A history fixture now uses the canonical CODEX_HOME path when resolving the history serialization database.

Changes: Windows ACL Test Setup

Layer / File(s)	Summary
Control the Windows owner ACL test runner tests/claude-integration/claude-config-root-late-admission.test.ts, tests/claude-integration/claude-config-root-writer-barrier.test.ts	Both tests configure the runner to return a non-timeout failure and reset it during teardown. The comments describe the mocked icacls context.

History Fixture Path Resolution

Layer / File(s)	Summary
Resolve the history database from the real CODEX_HOME path tests/fixtures/stop-restore-history-runner.ts	The lock-path check passes the canonical real path of CODEX_HOME to resolveCodexHistorySerializationDatabasePath instead of the supplied path spelling.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related issues

• lidge-jun/opencodex issue 7815: The writer-barrier test setup changes, but the PR does not add the remaining writer coverage described in the issue.
• lidge-jun/opencodex issue 7854: The tests configure mocked ACL checks so the real PowerShell owner check does not determine hardening.

Suggested reviewers: ingwannu, luvs01

Merge Risk: Minimal · previous review 4df7e

The targeted test-fixture updates are safe to merge; no actionable current-head risk was established.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately identifies both fixture updates: the config-root test fix and the macOS history-probe fixture fix. It also references the related issues and remains concise.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 3 files.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T15:41:23.456733Z	4df7e8e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.