codexgpt 1.0.0

package/scripts/windows-local-control.ps1

@@ -0,0 +1,35 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$scriptRoot = [System.IO.Path]::GetFullPath($PSScriptRoot)
+$sourcePath = [System.IO.Path]::Combine($scriptRoot, 'windows-local-control.cs')
+if (-not [System.IO.File]::Exists($sourcePath)) {
+    [Console]::Error.WriteLine('LOCAL_CONTROL_SOURCE_MISSING')
+    exit 2
+}
+
+$compileTempRoot = [System.IO.Path]::GetFullPath($env:TEMP)
+$compileTempBefore = @{}
+foreach ($entry in [System.IO.Directory]::EnumerateDirectories($compileTempRoot)) {
+    $compileTempBefore[[System.IO.Path]::GetFullPath($entry)] = $true
+}
+
+Add-Type -Path $sourcePath -ReferencedAssemblies @('System.Web.Extensions', 'System.Security') -ErrorAction Stop | Out-Null
+
+# Windows PowerShell's Add-Type may leave a per-compilation directory whose DACL
+# explicitly denies the owner DELETE.  The local-control launcher deliberately
+# points TEMP at its private state root, so leaving that directory behind would
+# make the Gate-A0 cleanup claim false.  Repair and remove only directories that
+# appeared during this exact fixed-source compilation.
+foreach ($entry in [System.IO.Directory]::EnumerateDirectories($compileTempRoot)) {
+    $fullEntry = [System.IO.Path]::GetFullPath($entry)
+    if ($compileTempBefore.ContainsKey($fullEntry)) {
+        continue
+    }
+    $security = New-Object System.Security.AccessControl.DirectorySecurity
+    $security.SetSecurityDescriptorSddlForm('O:LAD:P(A;OICI;FA;;;SY)(A;OICI;FA;;;LA)')
+    [System.IO.Directory]::SetAccessControl($fullEntry, $security)
+    [System.IO.Directory]::Delete($fullEntry, $true)
+}
+
+[CodexGPT.Phase4.LocalControlSpike]::Run()

package/scripts/windows-native-api-inventory-v1.json

@@ -0,0 +1,90 @@
+{
+  "schemaVersion": 1,
+  "reviewedFiles": [
+    "scripts/windows-conpty-worker.ps1",
+    "scripts/windows-credential-host.cs",
+    "scripts/windows-credential-host.ps1",
+    "scripts/windows-local-control-spike.cs",
+    "scripts/windows-local-control-spike.ps1",
+    "scripts/windows-local-control.cs",
+    "scripts/windows-local-control.ps1",
+    "scripts/windows-process-host.cs",
+    "scripts/windows-process-host.ps1",
+    "scripts/windows-sandbox-attack-probe.cs",
+    "scripts/windows-sandbox-cleanup.ps1",
+    "scripts/windows-sandbox-spike.cs",
+    "scripts/windows-sandbox-spike.ps1"
+  ],
+  "entryCount": 377,
+  "inventoryDigest": "8c7e667898bea708b5788aa8331157e169d0d9409558ff290a7715ef9e59a041",
+  "apiPurposes": {
+    "csharp:CloseHandle": "Release only exact native handles owned by the reviewed host or probe.",
+    "csharp:ClosePseudoConsole": "Close only the exact worker-owned HPCON through the bounded close path.",
+    "csharp:CloseServiceHandle": "Release only the service-control-manager handle opened by the denial oracle.",
+    "csharp:ConnectNamedPipe": "Accept one exact local-control client on the reviewed named-pipe instance.",
+    "csharp:ConvertSecurityDescriptorToStringSecurityDescriptorW": "Render owner, group, DACL, and mandatory-label evidence for the exact pipe object.",
+    "csharp:ConvertStringSecurityDescriptorToSecurityDescriptorW": "Compile the fixed local-control authority descriptor.",
+    "csharp:CreateAppContainerProfile": "Create one nonce-bound ephemeral Gate S profile and verify collision rejection.",
+    "csharp:CreateConPtyPipe": "Create only the anonymous pipe pairs required by the isolated ConPTY worker.",
+    "csharp:CreateConPtyProcessW": "Create the fixed ConPTY child with the reviewed pseudo-console attribute.",
+    "csharp:CreateFileW": "Open only exact reviewed executables, mailslots, volumes, or raw-device denial targets.",
+    "csharp:CreateJobObjectW": "Create one unnamed kill-on-close Job for each owned process execution.",
+    "csharp:CreateMailslotW": "Create one nonce-bound mailslot solely for denial and cleanup evidence.",
+    "csharp:CreateNamedPipeW": "Create the random-server local-control pipe with first-instance and remote-client rejection.",
+    "csharp:CreatePipe": "Create exact standard-stream pipes constrained by the inherited handle list.",
+    "csharp:CreateProcessW": "Create reviewed children through STARTUPINFOEX with creation-time Job ownership.",
+    "csharp:CreatePseudoConsoleSafe": "Create the worker-local HPCON from exact SafeFileHandle endpoints.",
+    "csharp:DeleteAppContainerProfile": "Delete only nonce-bound Gate S profiles, including exact stale probe profiles.",
+    "csharp:DeleteProcThreadAttributeList": "Release only attribute lists allocated by the current operation.",
+    "csharp:DisconnectNamedPipe": "Disconnect only the currently handled local-control client.",
+    "csharp:FlushFileBuffers": "Flush the bounded local-control response before disconnect.",
+    "csharp:GetCurrentProcess": "Obtain current-process identity only for Job and security evidence.",
+    "csharp:GetCurrentThread": "Obtain the current server thread only for bounded client impersonation checks.",
+    "csharp:GetExitCodeProcess": "Read the exact owned child exit code after a bounded wait.",
+    "csharp:GetFileInformationByHandle": "Bind an opened executable to stable file-identity evidence.",
+    "csharp:GetKernelObjectSecurity": "Read security evidence from the exact named-pipe object.",
+    "csharp:GetModuleHandleW": "Resolve already-loaded kernel32 only for reviewed export checks.",
+    "csharp:GetNamedPipeClientProcessId": "Bind a request to the operating-system-reported local client process.",
+    "csharp:GetProcAddress": "Check exact reviewed Win32 exports without PATH-based loading.",
+    "csharp:GetSidSubAuthority": "Read the final mandatory-integrity RID from a reviewed SID.",
+    "csharp:GetSidSubAuthorityCount": "Locate the final mandatory-integrity RID in a reviewed SID.",
+    "csharp:GetStdHandle": "Save isolated-worker standard handles before the ConPTY detachment window.",
+    "csharp:GetTokenInformation": "[REDACTED_SECRET]",
+    "csharp:ImpersonateNamedPipeClient": "Enter the exact connected client's security context only for authority validation.",
+    "csharp:InitializeProcThreadAttributeList": "Allocate exact STARTUPINFOEX attribute storage.",
+    "csharp:IsProcessInJob": "Prove exact worker or child Job membership.",
+    "csharp:LocalFree": "Release only native security buffers allocated by reviewed conversion APIs.",
+    "csharp:OpenFileMappingW": "Attempt query-only access to the nonce-bound section denial target.",
+    "csharp:OpenProcess": "Open only the exact reported or parent process with query-only rights.",
+    "csharp:OpenSCManagerW": "Attempt connect-only service-control-manager access for the denial oracle.",
+    "csharp:OpenThreadToken": "[REDACTED_SECRET]",
+    "csharp:PeekNamedPipe": "Detect protocol-pipe EOF without consuming protocol bytes.",
+    "csharp:Protect": "Protect only bounded credential bytes with fixed additional entropy under DPAPI CurrentUser.",
+    "csharp:QueryFullProcessImageNameW": "Verify the created image matches the authorized executable.",
+    "csharp:ReadFile": "Read bounded local-control frames from the exact connected pipe.",
+    "csharp:ResizePseudoConsole": "Exercise only the exact worker-owned HPCON resize operation.",
+    "csharp:ResumeThread": "Activate only an already-owned suspended process after all attributes are bound.",
+    "csharp:RevertToSelf": "End client impersonation on every local-control path.",
+    "csharp:SetHandleInformation": "Remove inheritance from parent-side pipe handles.",
+    "csharp:SetInformationJobObject": "Apply kill-on-close and active-process limits to an owned Job.",
+    "csharp:SetKernelObjectSecurity": "Apply the fixed medium-integrity label to the exact pipe object.",
+    "csharp:SetStdHandle": "Temporarily detach and restore only isolated-worker standard handles.",
+    "csharp:TerminateJobObject": "Terminate only the exact probe Job during timeout or rollback.",
+    "csharp:TerminateProcess": "Terminate only the exact held child after its bounded wait expires.",
+    "csharp:Unprotect": "Unprotect only bounded manifest-bound credential blobs with fixed additional entropy under DPAPI CurrentUser.",
+    "csharp:UpdateProcThreadAttribute": "Bind exact Job, handle-list, security-capability, or HPCON attributes.",
+    "csharp:WaitForSingleObject": "Provide bounded native waits for exact owned handles.",
+    "csharp:WriteFile": "Write bounded local-control frames to the exact connected pipe.",
+    "powershell:Add-Type": "Compile only fixed package-root reviewed C# sources.",
+    "powershell:ConvertFrom-Json": "Validate the fixed package-root protocol authority.",
+    "powershell:CredentialHost.Run": "Enter the fixed-source DPAPI CurrentUser credential helper.",
+    "powershell:LocalControlSpike.Run": "Enter the fixed-source local-control factory.",
+    "powershell:ProcessHost.Run": "Enter the fixed-source protocol-only process host.",
+    "powershell:ProcessHost.RunConPtyPersistentWorker": "Enter the manifest-bound persistent ConPTY worker.",
+    "powershell:ProcessHost.RunConPtyWorker": "Enter the isolated ConPTY worker already owned by the host Job.",
+    "powershell:SandboxSpike.Cleanup": "Remove only one exact nonce-bound Gate S profile, registry target, and private run tree after forced termination.",
+    "powershell:SandboxSpike.Run": "Enter the fixed-source Gate S host after source and fixture validation.",
+    "powershell:System.IO.File.Exists": "Fail closed when a fixed package-root source or protocol file is absent.",
+    "powershell:System.IO.File.ReadAllText": "Read only fixed package-root protocol authority files."
+  }
+}

package/scripts/windows-process-host-manifest.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": 1,
+  "protocolName": "CXP4",
+  "protocolVersion": 1,
+  "headerLength": 64,
+  "nativeFactoryClass": "CodexGPT.Phase4.ProcessHost",
+  "productionPowerShell": "scripts/windows-process-host.ps1",
+  "productionCSharp": "scripts/windows-process-host.cs",
+  "conPtyWorker": "scripts/windows-conpty-worker.ps1",
+  "conPtyProbeChild": "scripts/windows-conpty-probe-child.mjs",
+  "protocolAuthority": "scripts/windows-process-host-protocol-v1.json",
+  "productionPowerShellSha256": "73386160c9af621c05fe6d3599dc6313bcb403ff3e1ddea7dbf7eb7cbe2b350f",
+  "productionCSharpSha256": "426c4a4b6eca413e9f8ea59a3da8ac8a755f9b11850fc957f51c324e1f41cb47",
+  "conPtyWorkerSha256": "86add118977df507ae9b373b7b4b1aec8bdc42e8ea001212133f4babcbb11f66",
+  "conPtyProbeChildSha256": "9fca85b7114b93170a849feef730a9b2e133c051ba5089164c8c3d0d2383ef02",
+  "protocolSha256": "7776effb5c38e40fc079199801a5127957b4ee61db9df85929789cf96d1c86a8",
+  "bootstrapSecretTransport": "private_parent_stdin",
+  "hostStdout": "protocol_only",
+  "hostStderr": "bounded_safe_codes"
+}

package/scripts/windows-process-host-protocol-v1.json

@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 1,
+  "name": "CXP4",
+  "magicHex": "43585034",
+  "version": 1,
+  "headerLength": 64,
+  "tagLength": 16,
+  "hmac": "HMAC-SHA-256",
+  "byteOrder": "little-endian",
+  "maxFramePayloadBytes": 65536,
+  "maxHelloPayloadBytes": 4096,
+  "maxInflightPerProcess": 8,
+  "maxInflightPerHost": 64,
+  "maxHostToNodeQueuedBytesPerProcess": 1048576,
+  "maxHostToNodeQueuedBytesPerHost": 16777216,
+  "maxNodeToHostQueuedBytesPerProcess": 262144,
+  "maxNodeToHostQueuedBytesPerHost": 4194304,
+  "streaming": {
+    "version": 1,
+    "maxInputBytes": 131072,
+    "maxOutputBytesPerStream": 16777216,
+    "maxOneShotTimeoutMs": 120000,
+    "maxArgumentItems": 512,
+    "maxArgumentUtf8Bytes": 65536,
+    "creditUnit": "exact_frame_bytes",
+    "cancellationAck": "after_owned_job_revocation"
+  },
+  "kinds": {
+    "HELLO": 1,
+    "HELLO_ACK": 2,
+    "REQUEST_JSON": 16,
+    "RESPONSE_JSON": 17,
+    "EVENT_JSON": 18,
+    "OUTPUT": 32,
+    "INPUT": 33,
+    "CREDIT": 34,
+    "CANCEL": 35,
+    "FATAL": 127
+  },
+  "flags": {
+    "STDERR": 1,
+    "EOF": 2
+  },
+  "rules": {
+    "firstSequence": 1,
+    "strictIncrement": true,
+    "sequenceWrap": false,
+    "requestIdBytes": 16,
+    "processGenerationBytes": 8,
+    "reservedBytesMustBeZero": true,
+    "creditPayloadBytes": 8,
+    "cancelPayloadBytes": 0,
+    "jsonRoot": "object",
+    "jsonEncoding": "strict-utf8",
+    "duplicateJsonKeys": false,
+    "directionalKeys": true,
+    "tagCoverageHeaderBytes": 48
+  }
+}