javi-forge 1.34.1 → 1.35.1

package/assets/claude-hooks/javi-forge-skillguard-pre-tool-use.mjs

@@ -87,13 +87,31 @@ function policyPathKeys(input, options = {}) {
 	return real === lexical ? [lexical] : [lexical, real];
 }
 function isAbsolutePolicyPath(value) { return POSIX_ABSOLUTE.test(value) || WINDOWS_DRIVE.test(value) || WINDOWS_UNC.test(value) || /^\\(?:\\\?|\?\?|\\\.)\\/i.test(value); }
+// Home-relative credential files, matched as a path SUFFIX (never an expanded
+// literal home) so one rule holds for every user, container and HOME. Literals
+// stay lowercase because lexicalNormalize folds keys on darwin/win32.
+const SENSITIVE_PATH_SUFFIXES = Object.freeze(["/.aws/credentials", "/.kube/config", "/.config/gcloud/application_default_credentials.json", "/.docker/config.json", "/.config/gh/hosts.yml"]);
+// Absolute system secrets: the shadow suite holds every local account's password
+// hash, and passwd/vipw leave the "-" backup beside it holding the same secret.
+const SENSITIVE_ABSOLUTE_KEYS = Object.freeze(["/etc/shadow", "/etc/shadow-", "/etc/gshadow", "/etc/gshadow-"]);
+// /proc/<pid>/environ is the FULL environment - every secret - of ANY process the
+// agent can see, so it is a first-class exfiltration sink. The corpus idiom is
+// literal matching; this is the one place a wildcard is unavoidable because the
+// pid component is unbounded. Kept narrow (environ leaves only) and fail-closed:
+// it covers the self/thread-self aliases and the per-thread task/<tid> form.
+const PROC_ENVIRON_KEY = /^\/proc\/(?:\d+|self|thread-self)\/(?:task\/\d+\/)?environ$/;
+// Secret Service / GNOME keyring store: every file under it is credential
+// material, so the directory itself and its whole subtree are sensitive.
+const SENSITIVE_DIRECTORY_SUFFIXES = Object.freeze(["/.local/share/keyrings"]);
 export function isSensitivePolicyKey(key, platform = process.platform) {
 	const parts = key.split("/").filter(Boolean);
 	const basename = parts.at(-1) ?? "";
 	if (/^\.env(?:\..+)?$/i.test(basename) && !/^\.env\.(?:example|sample|template)$/i.test(basename)) return true;
 	if ([".npmrc", ".pypirc", ".netrc", ".git-credentials"].includes(basename.toLowerCase())) return true;
 	if (parts.some((part) => part === ".ssh" || part === ".gnupg")) return true;
-	if (key.endsWith("/.aws/credentials") || key.endsWith("/.kube/config") || key.endsWith("/.config/gcloud/application_default_credentials.json")) return true;
+	if (SENSITIVE_ABSOLUTE_KEYS.includes(key) || PROC_ENVIRON_KEY.test(key)) return true;
+	if (SENSITIVE_PATH_SUFFIXES.some((suffix) => key.endsWith(suffix))) return true;
+	if (SENSITIVE_DIRECTORY_SUFFIXES.some((directory) => key.endsWith(directory) || key.includes(`${directory}/`))) return true;
 	return platform === "win32" || platform === "darwin" ? basename.toLowerCase() === "serviceaccountkey.json" : basename === "serviceAccountKey.json";
 }
 function isManaged(key) {
@@ -284,7 +302,12 @@ function classifyLongOption(token, longOptions) {
 }
 const ASSIGNMENT_TOKEN = /^[A-Za-z_][A-Za-z0-9_]*=/;
 const SHORT_BUNDLE = /^-[^-]/;
-const CRITICAL_TARGET_CORPUS = Object.freeze(["/", "/*", "~", "$HOME", "${HOME}", ".", "..", PROJECT_ROOT]);
+// FHS roots whose wholesale destruction bricks the host. CRITICAL_TARGET gates
+// ONLY destructive writes (rm -rf, recursive/777 chmod) and never reads, and
+// membership is exact-token, so `rm -rf /var/tmp/scratch` stays allowed: only the
+// root token itself is protected, in the same bare / trailing / glob forms as "/".
+const CRITICAL_SYSTEM_ROOTS = ["/etc", "/usr", "/var", "/boot"];
+const CRITICAL_TARGET_CORPUS = Object.freeze(["/", "/*", "~", "$HOME", "${HOME}", ".", "..", PROJECT_ROOT, ...CRITICAL_SYSTEM_ROOTS.flatMap((root) => [root, `${root}/`, `${root}/*`])]);
 const isCriticalTarget = (token) => CRITICAL_TARGET_CORPUS.includes(token);
 const OCTAL_MODE_SHAPE = /^0?[0-7]{3,4}$/;
 const SYMBOLIC_MODE_SHAPE = /^[ugoa]*[+=-][rwxXstugo]+(?:,[ugoa]*[+=-][rwxXstugo]+)*$/;

package/assets/claude-hooks/manifest.json

@@ -1 +1 @@
-{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc","historical":[]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"},"historical":[]},"installerHelpers":{"windowsSecureObject":{"name":"javi-forge-windows-secure-object.ps1","sha256":"2289ef6ac6b039ec74dc3ea0894413e243ff9bea963f04008a356b3838f9b8dd"}}}
+{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"5dc2a5c31131f4ac7d8657c78b950de52776aad6eaefe78ea0d764a9963c4425","historical":["78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc"]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"},"historical":[]},"installerHelpers":{"windowsSecureObject":{"name":"javi-forge-windows-secure-object.ps1","sha256":"2289ef6ac6b039ec74dc3ea0894413e243ff9bea963f04008a356b3838f9b8dd"}}}

package/dist/lib/__fixtures__/fake-secure-fs.d.ts

@@ -17,8 +17,16 @@ export interface FakeFaults {
     revalidateRefuse?: (target: string, callIndex: number) => boolean;
     /** Refuse proveOwnershipAndMode for a path on its Nth call. */
     ownershipRefuse?: (dirPath: string, callIndex: number) => boolean;
-    /** Refuse proveNoExtendedAcl for a path on its Nth call. */
+    /** Refuse proveNoExtendedAcl (STRICT) for a path on its Nth call. */
     aclRefuse?: (target: string, callIndex: number) => boolean;
+    /**
+     * Refuse proveNoEndangeringAcl (LENIENT ancestor predicate) for a path on its
+     * Nth call. When absent the fake falls back to `aclRefuse`, so an existing test
+     * that models an endangering ancestor ACL via `aclRefuse` still aborts the
+     * ancestor gate. Set this to drive the lenient and strict predicates
+     * independently on the same path.
+     */
+    endangeringAclRefuse?: (target: string, callIndex: number) => boolean;
     /** Refuse captureFile for a path (simulate open/read failure). */
     captureRefuse?: (target: string) => boolean;
     /** Override the sha of a captured file (simulate post-commit drift). */

package/dist/lib/__fixtures__/fake-secure-fs.js

@@ -31,6 +31,7 @@ export function makeFakeSecureFs() {
     const revalidateCounts = new Map();
     const ownershipCounts = new Map();
     const aclCounts = new Map();
+    const endangeringCounts = new Map();
     const writeCounts = new Map();
     const managedCounts = new Map();
     const inoFor = (p) => {
@@ -118,6 +119,20 @@ export function makeFakeSecureFs() {
             }
             return ok();
         },
+        // The lenient ancestor predicate. The engine calls THIS on ancestor
+        // controlling dirs (formerly `proveNoExtendedAcl`). It shares the `aclRefuse`
+        // toggle so a test that models "a controlling directory carries an
+        // endangering ACL" still drives the ancestor-gate abort; a dedicated
+        // `endangeringAclRefuse` toggle overrides it when a test needs to distinguish
+        // the lenient predicate from the strict one on the same path.
+        async proveNoEndangeringAcl(target) {
+            const idx = bump(endangeringCounts, target);
+            const refuseFn = fake.faults.endangeringAclRefuse ?? fake.faults.aclRefuse;
+            if (refuseFn?.(target, idx)) {
+                return { ok: false, refusal: "unsupported-posix-acl", detail: target };
+            }
+            return ok();
+        },
         async createDirExclusive(parent, name, mode) {
             const full = path.join(parent.path, name);
             if (dirs.has(full) || files.has(full))

package/dist/lib/secure-fs-posix.d.ts

@@ -19,10 +19,28 @@ export interface SpawnOutcome {
     stdout: string;
 }
 export type SpawnFn = (cmd: string, args: string[]) => Promise<SpawnOutcome>;
+/** Minimal `lstat` seam: yields the on-disk owner uid of the target. Injectable. */
+export type StatFn = (target: string) => Promise<{
+    uid: number;
+}>;
 /** The bounded ACL prover behind each platform adapter. */
 export interface PosixAclAdapter {
-    /** Run the bounded, LC_ALL=C ACL tool and decide clean|extended|inconclusive. */
+    /**
+     * STRICT any-extended-entry proof: refuse ANY named/mask/default/inherited ACL
+     * entry. Used on managed containers (`.claude`/`.claude/hooks`) and leaf source
+     * files, where the tool owns the node and tolerates no foreign ACL surface.
+     */
     proveClean(target: string): Promise<SecureResult<void>>;
+    /**
+     * LENIENT path-endangering proof for ANCESTOR (non-managed) controlling dirs:
+     * refuse only when a foreign principal can swap/delete/rename the on-path node
+     * — a named-user for a uid outside {owner, root, euid} with effective (raw ∩
+     * mask) `w`, OR any named-group with effective `w`. Everything else (base
+     * entries, a lone `mask::`, effective-non-write named entries, x-only, trusted
+     * named users, `default:*`) proceeds. Same fail-closed spawn edges as
+     * `proveClean`. On darwin this is the no-op alias of `proveClean` (deferred).
+     */
+    proveNoEndangeringAcl(target: string): Promise<SecureResult<void>>;
 }
 /**
  * The EXACT detail strings the POSIX adapters emit, exported so consumers (the
@@ -38,7 +56,7 @@ export declare const ACL_DETAIL: {
     readonly macosAclFlag: "ACL present (+ flag)";
     readonly macosAceListed: "ACE listed";
 };
-export declare function createLinuxAclAdapter(spawn?: SpawnFn): PosixAclAdapter;
+export declare function createLinuxAclAdapter(spawn?: SpawnFn, stat?: StatFn): PosixAclAdapter;
 export declare function createMacosAclAdapter(spawn?: SpawnFn): PosixAclAdapter;
 /**
  * Whether the host's ACL adapter is RESOLVABLE — an install-time capability

package/dist/lib/secure-fs-posix.js

@@ -64,23 +64,119 @@ export const ACL_DETAIL = {
 };
 // --- Linux getfacl adapter (Algorithm D) -------------------------------------
 const LINUX_BASE_ENTRY = /^(user|group|other)::/;
-export function createLinuxAclAdapter(spawn = defaultSpawn) {
+// Numeric getfacl entry shapes (LC_ALL=C, --numeric, --omit-header).
+const MASK_PERMS = /^mask::([r-][w-][x-])$/;
+const MASK_ANY = /^mask::/;
+const NAMED_USER = /^user:(\d+):([r-][w-][x-])$/;
+const NAMED_GROUP = /^group:(\d+):([r-][w-][x-])$/;
+const DEFAULT_ENTRY = /^default:/;
+/** Default owner-uid source: an lstat of the target (authoritative carve-out). */
+const defaultStat = async (target) => {
+    const stats = await lstat(target);
+    return { uid: stats.uid };
+};
+/** Run the shared, bounded, LC_ALL=C getfacl spawn and map its fail-closed edges. */
+async function runGetfacl(spawn, target) {
+    const res = await spawn("getfacl", [
+        "--absolute-names",
+        "--numeric",
+        "--omit-header",
+        "--",
+        target,
+    ]);
+    if (res.spawnError)
+        return refuse("unsupported-posix-acl", ACL_DETAIL.getfaclAbsent);
+    if (res.timedOut)
+        return refuse("unsupported-posix-acl", ACL_DETAIL.getfaclTimeout);
+    if (res.code !== 0)
+        return refuse("unsupported-posix-acl", `getfacl exit ${res.code}`);
+    return res;
+}
+function isSpawnOutcome(v) {
+    return "stdout" in v;
+}
+/** Strip an inline `#effective:...` suffix (tab-separated) and trim. */
+function stripEffective(raw) {
+    const hash = raw.indexOf("#");
+    return (hash === -1 ? raw : raw.slice(0, hash)).trim();
+}
+/** Non-empty, non-comment ACL lines with any inline `#effective` suffix removed. */
+function aclEntries(stdout) {
+    const entries = [];
+    for (const raw of stdout.split("\n")) {
+        if (raw.trim() === "" || raw.trimStart().startsWith("#"))
+            continue;
+        const line = stripEffective(raw);
+        if (line === "")
+            continue;
+        entries.push(line);
+    }
+    return entries;
+}
+const hasW = (perm) => perm.includes("w");
+/**
+ * Two-pass path-endangering classifier over numeric getfacl output. Returns
+ * `ok()` when no foreign principal can endanger the on-path node, or a
+ * fail-closed `unsupported-posix-acl` refusal. `trusted` is {ownerUid, 0, euid}.
+ */
+function classifyEndangering(entries, trusted) {
+    // PASS 1 — locate the mask (order-independent). A malformed mask fails closed.
+    let maskPerm = null; // null = no `mask::` entry present
+    for (const line of entries) {
+        const m = MASK_PERMS.exec(line);
+        if (m) {
+            maskPerm = m[1];
+            continue;
+        }
+        if (MASK_ANY.test(line)) {
+            return refuse("unsupported-posix-acl", ACL_DETAIL.extendedAclEntry);
+        }
+    }
+    const checkNamed = (id, raw, isUser) => {
+        if (!hasW(raw))
+            return true; // x-only traverse / r-only read ≠ endanger
+        // raw carries `w`: a named entry with raw `w` REQUIRES a mask to be
+        // effective; POSIX always emits one when a named entry exists. Its absence
+        // is anomalous → fail closed.
+        if (maskPerm === null)
+            return false;
+        if (!hasW(maskPerm))
+            return true; // masked out → effective lacks `w`
+        if (isUser && trusted.has(id))
+            return true; // owner/root/euid carve-out
+        return false; // foreign named-user OR any named-group with effective `w`
+    };
+    // PASS 2 — classify each entry.
+    for (const line of entries) {
+        if (LINUX_BASE_ENTRY.test(line))
+            continue; // base user::/group::/other::
+        if (MASK_ANY.test(line))
+            continue; // mask ceiling (validated in PASS 1)
+        if (DEFAULT_ENTRY.test(line))
+            continue; // inheritance-only; strict backstop
+        const nu = NAMED_USER.exec(line);
+        if (nu) {
+            if (checkNamed(Number(nu[1]), nu[2], true))
+                continue;
+            return refuse("unsupported-posix-acl", ACL_DETAIL.extendedAclEntry);
+        }
+        const ng = NAMED_GROUP.exec(line);
+        if (ng) {
+            if (checkNamed(Number(ng[1]), ng[2], false))
+                continue;
+            return refuse("unsupported-posix-acl", ACL_DETAIL.extendedAclEntry);
+        }
+        // Unrecognized/unparseable shape → fail closed.
+        return refuse("unsupported-posix-acl", ACL_DETAIL.extendedAclEntry);
+    }
+    return ok();
+}
+export function createLinuxAclAdapter(spawn = defaultSpawn, stat = defaultStat) {
     return {
         async proveClean(target) {
-            const res = await spawn("getfacl", [
-                "--absolute-names",
-                "--numeric",
-                "--omit-header",
-                "--",
-                target,
-            ]);
-            if (res.spawnError)
-                return refuse("unsupported-posix-acl", ACL_DETAIL.getfaclAbsent);
-            if (res.timedOut)
-                return refuse("unsupported-posix-acl", ACL_DETAIL.getfaclTimeout);
-            if (res.code !== 0) {
-                return refuse("unsupported-posix-acl", `getfacl exit ${res.code}`);
-            }
+            const res = await runGetfacl(spawn, target);
+            if (!isSpawnOutcome(res))
+                return res;
             for (const raw of res.stdout.split("\n")) {
                 const line = raw.trim();
                 if (line === "" || line.startsWith("#"))
@@ -91,12 +187,31 @@ export function createLinuxAclAdapter(spawn = defaultSpawn) {
             }
             return ok();
         },
+        async proveNoEndangeringAcl(target) {
+            const res = await runGetfacl(spawn, target);
+            if (!isSpawnOutcome(res))
+                return res;
+            // Owner uid is the authoritative carve-out source (proveOwnershipAndMode
+            // has already proven owner ∈ {euid, root}, so this narrows the trusted
+            // set to exactly those principals). An unresolvable lstat cannot prove
+            // the carve-out → fail closed.
+            let ownerUid;
+            try {
+                ownerUid = (await stat(target)).uid;
+            }
+            catch {
+                return refuse("unsupported-posix-acl", "acl owner-stat failed");
+            }
+            const euid = typeof process.geteuid === "function" ? process.geteuid() : -1;
+            const trusted = new Set([ownerUid, 0, euid]);
+            return classifyEndangering(aclEntries(res.stdout), trusted);
+        },
     };
 }
 // --- macOS /bin/ls -lde adapter (Algorithm E) --------------------------------
 const MACOS_ACE_LINE = /^\s*\d+:\s/;
 export function createMacosAclAdapter(spawn = defaultSpawn) {
-    return {
+    const adapter = {
         async proveClean(target) {
             const res = await spawn("/bin/ls", ["-lde", "--", target]);
             if (res.spawnError)
@@ -116,7 +231,15 @@ export function createMacosAclAdapter(spawn = defaultSpawn) {
             }
             return ok();
         },
+        // DEFERRED (user: Linux only): darwin ancestors stay STRICT = status-quo
+        // over-refusal, not the reported Linux bug. `/bin/ls -lde` ACE text carries
+        // no numeric mask to compute effective rights from, so the path-endangering
+        // narrowing is a documented follow-up. Alias to the strict proof.
+        proveNoEndangeringAcl(target) {
+            return adapter.proveClean(target);
+        },
     };
+    return adapter;
 }
 /**
  * Probe the ACL adapter READ-ONLY: it resolves and runs a version/list argv and
@@ -241,6 +364,14 @@ export function createPosixSecureFs(acl) {
         proveNoExtendedAcl(target) {
             return acl.proveClean(target);
         },
+        // Lenient ANCESTOR predicate: refuse only path-endangering foreign ACL
+        // entries. The transaction core calls THIS on ancestor (non-managed)
+        // controlling dirs and keeps `proveNoExtendedAcl`/`proveManagedContainer`
+        // (strict) on the dirs it owns — selection is by the managed-containers set,
+        // never by `process.platform`.
+        proveNoEndangeringAcl(target) {
+            return acl.proveNoEndangeringAcl(target);
+        },
         async createDirExclusive(parent, name, mode) {
             const full = path.join(parent.path, name);
             try {
@@ -353,14 +484,21 @@ export function createPosixSecureFs(acl) {
                 return refuse("unsafe-parent-chain", `rmdir ${handle.path}: ${errCode(error) ?? "error"}`);
             }
         },
-        // On POSIX, permission to ADD a child to a directory IS the directory's
-        // write bit; proveOwnershipAndMode already refuses any group/other write
-        // (stats.mode & 0o022). So the managed-container check is definitionally the
-        // same predicate gate() just ran on this path — idempotent, no new refusal
-        // surface. The seam has teeth only on win32, where Predicate A tolerates
-        // add-child on high ancestors (Round-4 / JDA-401).
-        proveManagedContainer(dirPath) {
-            return secureFs.proveOwnershipAndMode(dirPath);
+        // A MANAGED CONTAINER (`.claude`/`.claude/hooks`) the tool owns must refuse
+        // ANY extended ACL entry — strictly more than the lenient ancestor `gate()`,
+        // which now tolerates benign path-non-endangering entries. Two arms, both
+        // fail-closed: (1) ownership/mode — on POSIX, group/other write IS add-child
+        // on a directory (stats.mode & 0o022); (2) the STRICT any-extended-entry ACL
+        // proof, re-homed here from the ancestor gate so the net managed-container
+        // guarantee stays byte-identical to the pre-narrowing strict-everywhere
+        // behavior. The seam's add-child dimension has teeth only on win32; the
+        // strict ACL arm is what keeps `.claude` from accepting a benign entry an
+        // ancestor now would.
+        async proveManagedContainer(dirPath) {
+            const owned = await secureFs.proveOwnershipAndMode(dirPath);
+            if (!owned.ok)
+                return owned;
+            return acl.proveClean(dirPath);
         },
     };
     return secureFs;

package/dist/lib/secure-fs-transaction.d.ts

@@ -63,8 +63,22 @@ export interface PlatformSecureFs {
     revalidateIdentity(target: string, held: SecureIdentity): Promise<SecureResult<void>>;
     /** Prove owner == effective uid or root AND no group/other write bits. */
     proveOwnershipAndMode(dirPath: string): Promise<SecureResult<void>>;
-    /** Prove no extended/named/mask/default/inherited ACL on the path. */
+    /**
+     * STRICT proof: no extended/named/mask/default/inherited ACL on the path. Used
+     * on managed containers (via `proveManagedContainer`) and leaf source files.
+     */
     proveNoExtendedAcl(target: string): Promise<SecureResult<void>>;
+    /**
+     * LENIENT ancestor proof: refuse only a path-ENDANGERING ACL entry (a foreign
+     * principal that can swap/delete/rename the on-path node) and proceed on benign
+     * ones (a lone mask, an effective-non-write or x-only or trusted named entry, a
+     * `default:*`). Called by the engine on ANCESTOR (non-managed) controlling dirs
+     * only; managed containers keep the strict proof. Selection is by the
+     * managed-containers role, NEVER by `process.platform`. On win32 this mirrors
+     * the ratified Predicate A (already lenient on ancestors); on darwin it is the
+     * strict no-op alias (deferred).
+     */
+    proveNoEndangeringAcl(target: string): Promise<SecureResult<void>>;
     /** Create ONE child directory exclusively at mode, reopen+verify, return its handle. */
     createDirExclusive(parent: SecureDirHandle, name: string, mode: number): Promise<SecureResult<SecureDirHandle>>;
     /**

package/dist/lib/secure-fs-transaction.js

@@ -81,9 +81,16 @@ export async function runTransaction(input) {
     const backups = [];
     const needsWrite = (c) => c.desired !== null;
     const anyWrite = needsWrite(input.asset) || needsWrite(input.settings);
+    // The uniform per-held-dir gate. It runs the LENIENT ancestor ACL predicate on
+    // EVERY held dir — including managed containers, which are ALSO proved strict by
+    // `proveManagedContainer` right after they are gated (in ensureManagedContainer)
+    // and re-proved strict pre-commit/rollback. So `.claude`/`.claude/hooks` still
+    // refuse ANY extended entry (lenient-gated THEN strict-managed); only ancestor-
+    // only segments loosen. No `process.platform` here — role is expressed by which
+    // dirs get proveManagedContainer'd (the managedContainers set).
     async function gate(dirPath, handle) {
         must(`ownership ${dirPath}`, await secureFs.proveOwnershipAndMode(dirPath));
-        must(`acl ${dirPath}`, await secureFs.proveNoExtendedAcl(dirPath));
+        must(`acl ${dirPath}`, await secureFs.proveNoEndangeringAcl(dirPath));
         heldByPath.set(dirPath, handle);
         heldOrder.push(handle);
     }
@@ -134,7 +141,9 @@ export async function runTransaction(input) {
                 return false;
             if (!(await secureFs.proveOwnershipAndMode(handle.path)).ok)
                 return false;
-            if (!(await secureFs.proveNoExtendedAcl(handle.path)).ok)
+            // Lenient ancestor predicate — identical to preflight `gate()`, so an ACL
+            // that passed preflight is not spuriously refused at rollback re-prove.
+            if (!(await secureFs.proveNoEndangeringAcl(handle.path)).ok)
                 return false;
             // Re-check the container add/delete-child dimension on the rollback path
             // too, for full symmetry with the pre-commit re-prove (JDB5-002).
@@ -201,7 +210,11 @@ export async function runTransaction(input) {
         for (const handle of heldOrder) {
             must(`recheck-id ${handle.path}`, await secureFs.revalidateIdentity(handle.path, handle.identity));
             must(`recheck-own ${handle.path}`, await secureFs.proveOwnershipAndMode(handle.path));
-            must(`recheck-acl ${handle.path}`, await secureFs.proveNoExtendedAcl(handle.path));
+            // LENIENT ancestor predicate — MUST match preflight `gate()` so an ancestor
+            // ACL accepted at preflight is not refused at commit (spec: predicate is
+            // consistent across preflight and re-prove). Managed containers held here
+            // are ALSO re-proved strict just below via `recheck-container`.
+            must(`recheck-acl ${handle.path}`, await secureFs.proveNoEndangeringAcl(handle.path));
             // Re-prove the managed-container add/delete-child dimension for held
             // handles that ARE managed containers, closing the TOCTOU window between
             // ensure time and commit (JDB7-003; parity with 3a Decision 6 / JD-007).

package/dist/lib/secure-fs-windows.js

@@ -218,6 +218,13 @@ export function createWindowsSecureFs(transport) {
         async proveNoExtendedAcl(target) {
             return mapVoid(await call({ op: "proveDacl", args: { path: target } }), `acl ${target}`);
         },
+        // win32 already ships the ratified lenient Predicate A on ancestors via
+        // `proveDacl` (managed-container strictness lives in `proveManagedContainer`).
+        // So the lenient ancestor predicate is the SAME `proveDacl` op — ancestor and
+        // managed-container behavior stay byte-identical on Windows.
+        async proveNoEndangeringAcl(target) {
+            return mapVoid(await call({ op: "proveDacl", args: { path: target } }), `acl ${target}`);
+        },
         async proveManagedContainer(dirPath) {
             return mapVoid(await call({ op: "proveContainer", args: { path: dirPath } }), `container ${dirPath}`);
         },

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.34.1",
+	"version": "1.35.1",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {