release: qualify Windows 10 diagnostics through RC for 0.5.0 #174

Activity

1. abruption

   added this to the v0.5.0 milestone on Oct 23, 2026
2. abruption commented on Oct 23, 2026

   

   abruption

   on Oct 23, 2026

   OwnerAuthor

   More actions

   Additional designated-host baseline qualification is complete using the exact published alpha executable, before the RC stage.

   • Scope decisions: Windows 10 x64/local NTFS; Windows 11 deferred. Homebrew feat: add opt-in Homebrew distribution through a third-party tap #42 moved to Long-Term, feat: add opt-in bounded discovery and listing across Codex homes #119/feat: add opt-in diagnostics for shadowed codex-unlock installations #121 to Post-0.5.0. The maintainer chose to retain Kaspersky Endpoint Security. Standard Defender activation/update did not enable protection (0x800106ba); it was not bypassed.
   • Kaspersky File Threat Protection returned enabled from the pinned signed vendor CLI before and after both runs; definitions were present. Local File Monitoring exports contained an explicit empty exclusion list. The maintainer separately reviewed the current global path/process exclusions and confirmed none applied to the test scope. This configuration evidence is not a claim that the vendor scans every I/O.
   • Exact alpha EXE: 0f13bbaca844c739026194391c906c8eacdfd8d62d5856336b9e9184c2d5b1f5, version 0.5.0-alpha.1, source 41aa81c1ff21d9695f1a5149cae2769e508d98c0.
   • Fixture: a7f1a1c8d8f3482fe22847e23c2ac672569bc7a05fc655e3f28b03038a518aac, from run 39721964946 / artifact 12401571775. The downloaded artifact ZIP digest was independently verified against 84098ce5f17ec16f4fee861fa04fe6dc4c879b1c6b5fa843dc0b98d4de33a993.
   • High: both capabilities and inspect refusal checks passed with the actual High token.
   • Medium: all 12 ordered cases passed (held/free, busy guard, missing guard/thread, hardlinks, junction, unavailable PID, unrelated same-user PID and Unicode paths). Both guard/thread identity and metadata pairs matched; all four fixture children exited normally via EOF and their roots were removed.
   • Pinned Codex 0.163.0 native observation: held/0; own server normal EOF exit 0; zero provider connections; afterwards thread file absent and unknown/open_existing_failed/2. This is not native-free or holder-attribution proof.
   • Root reparsed raw stdout against the versioned schema and independently checked case outcomes, identities, cleanup and file hashes. safeToUnlock=false throughout. The temporary task was removed.

   Preserved setup failure: the first High run refused the operator Node installation's symlink before measurement. The inventoried physical Node 24.22.1 path was used for the successful runs, without changing PATH or weakening product path checks.

   Private result SHA-256 values:

   • High launcher: db2b022d36e49bb247a099c4acc34efe6c454ea19bc9bd44ce88785cd2bb8077
   • High cases: 097bd6873d22a390472ff5af91f8b5bb5bc9d3bcd16cb651c74f97c4166af9f2
   • Medium launcher: 2fee96ad3155699ce2c6ffdb25fe7790476ac393617db66710b325d786dcac27
   • Medium cases: 2a10e51e96b8a3b6022992182aa8164724918c1e99cbf7cb8c81d0c8d72e1e32
   • Native observation: 31fa0cece315d51c1574a7a95c7193d9ef0de653d1a8cf0ba54beb690a0c5972

   Preparation #177 merged as 1bb8746d4ce80cd9c3915b7b617b6b8a289b8d45 after 41 successful checks and current-head Code/Security reviews with no findings. RC version PR #178 changes only the Release Please version files/changelog. The actual RC and stable build bytes must still pass their own host checks before publication; the baseline above is not substituted for those gates.
3. abruption commented on Oct 23, 2026

   

   abruption

   on Oct 23, 2026

   OwnerAuthor

   More actions

   windows-v0.5.0-rc.1 is public and its exact downloaded bytes passed designated-host qualification.

   • Release: https://github.com/abruption/codex-unlock/releases/tag/windows-v0.5.0-rc.1
   • Source/tag: 9ea3c78fe513ea5f473f9297ac6b3229159601ba (version PR chore(main): release windows 0.5.0-rc.1 #178, 41 checks and current-head Code/Security reviews passed).
   • Preparation/build/attachment run: https://github.com/abruption/codex-unlock/actions/runs/39934428426 — all jobs passed. Main CI run 39934406423 also passed.
   • RC EXE SHA-256: 3f31892816b243b27b7ce8d20889b5249c9f67f5b9152236a45b1b02dd61aa18
   • RC ZIP SHA-256: cc38df25ee4b91e759739edf6171370b21b02116ae537c3eb549be665ae8d232
   • Matching-source fixture: ccaef96e6b5077bdc84899b61bcd7ee3b5a0bd33731611588aa84deef2854557; artifact 12493595500 archive digest independently verified as 513fed3b90840e6b5a592f237a398b191e74b2d7d556fef8a41eb65e2a292f6f.

   On Windows 10 build19045/AMD64/NTFS, Kaspersky reported active before/after, the local FM exclusion list was explicitly empty, and the maintainer's reviewed global exclusion scope was hash-bound. Defender remained disabled and is not claimed as tested-on.

   • Actual High: capabilities unavailable and inspect refused, 2/2 cases.
   • Actual Medium: 12/12 ordered cases, both native identity/metadata pairs unchanged, 4/4 normal EOF fixture exits and removed roots.
   • Actual pinned Codex: held/0; own server exited normally/0 with no signal and zero provider connections; then absent/unknown/open_existing_failed/2. No native-free or holder-authority claim.
   • Root reparsed the raw payloads using the RC schema and independently checked outcomes, hashes and cleanup. The temporary task was removed; safeToUnlock=false throughout.

   Private evidence hashes:

   • High matrix: d7097b55ca7bba8bb478a92d4e26f71887995d409bc2de1563a713b683e514db
   • Medium matrix: 1644dddf96a932e71a6dd2a94163eb3dd5d88ef13a9e219285650060b2897d4e
   • Native run: 1fb27aff3b53647255e297fc55c791a8b521bb556a39dfa5feb7105048f6bc61

   Published at 2026-10-23T10:00:39Z with draft=false, prerelease=true, immutable=true, and make_latest=false. Anonymous release/ZIP retrieval succeeded and the downloaded ZIP hash still matched. No npm publication occurred.

   The stable promotion will use this RC evidence, but its own version embeds different bytes and must be built and measured again before stable publication.
4. abruption commented on Oct 23, 2026

   

   abruption

   on Oct 23, 2026

   OwnerAuthor

   More actions

   Windows 0.5.0 released

   The maintainer-approved Windows 10 diagnostic release path is complete: additional designated-host qualification → public RC → independently rebuilt and remeasured stable files → public stable release.

   • Stable: https://github.com/abruption/codex-unlock/releases/tag/windows-v0.5.0
   • Published 2026-10-23T10:39:09Z; release ID 421712266; draft=false, prerelease=false, immutable=true.
   • Public tag resolves to 73eacae7f5204d3825cf0284e51a80e0940866d4.
   • Final main CI: https://github.com/abruption/codex-unlock/actions/runs/39939358454 — success. CodeQL, Windows Rust, Rust experiment and fixture compilation also passed on that source.
   • Build/draft/attachment: https://github.com/abruption/codex-unlock/actions/runs/39939365707 — all jobs succeeded.

   Published bytes and actual host checks

   Item	SHA-256
   Stable ZIP	b61fdb66d0226541ec91f4d7d4afdcc9b6be9707e0e5348d93c7b92ac607c3fd
   Stable executable	1b9e7454780f9bb146dc43cce164bef5814434ce11ef04d4eb0421080bb5327c
   Outer manifest	c5c86a605fd636a95c2444dc60604d3aed49cf7467212899cec27004ddca2b08
   Matching-source fixture	39c08fe8b3a66b4c48582390d063267604a0833e14e27099860ababa3fc6fc53
   Fixture artifact 12495391227 archive	048829da04f7e6c3df3fc231d3ab6598040f2b8eaa46d394359e523ac2f14abb

   The ZIP contains exactly the executable, guide, inner manifest and checksums. Server asset digests, outer/inner manifests, source, version and payload checksums matched. Anonymous public release access and ZIP download succeeded and reproduced the tested ZIP hash.

   The final executable was separately tested on quintet-desktop, Windows 10 build19045/AMD64/NTFS:

   • Actual High: both refusal cases passed, with native diagnostics unavailable.
   • Actual Medium: all 12 cases passed; real synthetic held→free, busy coordinator, missing guard/thread, hardlinks, junction, PID observation boundaries and Unicode paths. Both native identity/metadata pairs matched; all four fixture processes exited normally through EOF and removed their own roots.
   • Pinned native Codex 0.163.0: held/0, then own-server normal EOF exit 0 with no signal and zero provider connections; after exit the thread file was absent, yielding unknown/open_existing_failed/2. This is not proof of native-free state or holder attribution.
   • Kaspersky File Threat Protection was enabled before/after. The local FM export explicitly had no exclusions, and the maintainer's current global UI review confirmed no applicable test path/process exclusions. Defender remained disabled; no Defender-on or Windows 11 coverage is claimed. This records configuration, not every individual antivirus scan.
   • The stable output was observed as schema=codex-unlock-windows, schemaVersion=1, releaseChannel=stable, preview=false, experimental=false, safeToUnlock=false, recoveryAvailable=false.
   • Root reparsed raw payloads and independently checked case outcomes, identities, cleanup and hashes. All three task names used for alpha/RC/stable Medium measurements were confirmed removed. Raw account/path/PID evidence stays private.

   Private stable result digests:

   • High matrix: 4f87eedc3d5902e880db360a2c407e98b69537599e45250fb7302dee930cdf82
   • Medium matrix: 7b1f85340159d2a31f4e2965c64dac7ac149d0afbc4842a7e2959722dfc13f2d
   • Native observation: 7012bfa2edf9f75c821f84758f6182dc7a95b0c2cf280db7b9a323daab2126e6

   Review and scope accounting

   Merged only the Windows preparation/promotion path:

   • feat(windows)!: prepare diagnostic RC and stable qualification #177: 1bb8746d4ce80cd9c3915b7b617b6b8a289b8d45
   • RC version chore(main): release windows 0.5.0-rc.1 #178: 9ea3c78fe513ea5f473f9297ac6b3229159601ba
   • Stable plan feat(windows): select stable release plan after qualified RC #179: 2893745bda171abc92b164127af87d4166d55acc
   • Stable version chore(main): release windows 0.5.0 #180: 73eacae7f5204d3825cf0284e51a80e0940866d4

   Every PR passed 41 checks and current-head Code/Security reviews before merge. The initial #177 Node 22.13 buffer-diff OOM was fixed with exact byte comparison and bounded diagnostics. #180 had one existing macOS lease-wait timeout; the failed job passed on rerun, with the original failure preserved in Actions. No check was bypassed.

   The implementation had independent non-interactive Claude Code 2.1.308 (claude-opus-5-5, response model verified) and Codex CLI 0.164.0 (isolated default, actual model not exposed) source review on input 0d89f59bc1bed17324b74434218ce09335ae4389a9ab6f08f2dd31b854786464. Both completed without tool/test execution; corrections and actual host evidence were separately verified. Unit/model review was not substituted for actual RC or stable measurement.

   Homebrew #42 is Long-Term; #119/#121 are Post-0.5.0. Four README locales and platform/preview/release guides define the Windows 10 diagnostic-only scope. Wider recovery/holder research remains separate. The Windows release used make_latest=false; GitHub Latest remains v0.4.7 and npm latest remains 0.4.7. The separate npm proposal #167 remains Draft and was not published.
5. abruption

   closed this as completedon Oct 23, 2026