mcp-pacemaker 2.0.2 → 2.1.0

package/bin/windows-task-channel.mjs

@@ -0,0 +1,335 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFileSync, lstatSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const HELPER = fileURLToPath(new URL('./windows-task-channel/TaskChannelGuard.exe', import.meta.url));
+const METADATA = fileURLToPath(new URL('./windows-task-channel/TaskChannelGuard.build.json', import.meta.url));
+// A detached guard must not hold the caller's working directory open; that directory can be an
+// instance, config or staging path the caller is entitled to replace or remove. Its own packaged
+// directory is already locked while the running image is mapped, so it adds no new constraint.
+const HELPER_DIRECTORY = fileURLToPath(new URL('./windows-task-channel/', import.meta.url));
+
+function deferred() {
+  let resolve, reject;
+  const promise = new Promise((yes, no) => { resolve = yes; reject = no; });
+  promise.catch(() => {});
+  return { promise, resolve, reject };
+}
+
+class TaskChannel {
+  constructor() {
+    this.started = deferred();
+    this.worker = deferred();
+    this.completion = deferred();
+    this.pending = new Map();
+    this.frames = [];
+    this.waiters = [];
+    this.sequence = 0;
+    this.buffer = '';
+    this.failure = null;
+    this.intentionalClose = false;
+  }
+
+  verifyHelper() {
+    const metadataBytes = readFileSync(METADATA);
+    if (!lstatSync(METADATA).isFile() ||
+        lstatSync(METADATA).isSymbolicLink()) throw new Error('Invalid packaged task channel metadata path');
+    if (metadataBytes.length > 65536) throw new Error('Task channel metadata exceeds bounds');
+    const metadata = JSON.parse(metadataBytes);
+    const digest = metadata.binarySha256;
+    const valid = metadata.schemaVersion === 1 &&
+      metadata.binary === 'TaskChannelGuard.exe' &&
+      typeof digest === 'string' &&
+      digest.length === 64 &&
+      [...digest].every(character => '0123456789abcdef'.includes(character));
+    if (!valid) throw new Error('Invalid packaged task channel digest');
+    const stat = lstatSync(HELPER);
+    if (!stat.isFile() ||
+        stat.isSymbolicLink() ||
+        stat.size < 1 ||
+        stat.size > 4 * 1024 * 1024 ||
+        createHash('sha256').update(readFileSync(HELPER)).digest('hex') !== digest) {
+      throw new Error('Packaged task channel helper identity mismatch');
+    }
+  }
+
+  async start(request) {
+    if (process.platform !== 'win32') throw new Error('Task channel requires Windows');
+    this.verifyHelper();
+    const bytes = this.encode(request, 65536);
+    this.child = spawn(HELPER, [], {
+      cwd: HELPER_DIRECTORY, detached: true, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    this.child.stdout.setEncoding('utf8');
+    this.child.stderr.setEncoding('utf8');
+    this.child.on('error', error => this.fail(error));
+    this.child.stdin.on('error', error => this.fail(error));
+    this.child.stdout.on('error', error => this.fail(error));
+    this.child.stderr.on('error', error => this.fail(error));
+    let diagnosticBytes = 0;
+    this.child.stderr.on('data', text => {
+      diagnosticBytes += Buffer.byteLength(text);
+      if (diagnosticBytes > 2048) this.fail(new Error('Unexpected task guard diagnostics'));
+    });
+    this.child.stdout.on('data', text => this.consume(text));
+    this.child.on('close', (code, signal) => {
+      clearTimeout(this.timer);
+      const receipt = { code, signal,
+        reason: this.failure?.message ?? this.closeReason ?? (code === 0 ? 'completed' : `native-exit-${code}`) };
+      this.exited = true;
+      this.exitReceipt = receipt;
+      this.fail(this.failure ?? new Error(`Task channel closed (native exit ${code})`));
+      this.completion.resolve(receipt);
+    });
+    this.timer = setTimeout(() => this.fail(new Error('Task channel ready deadline exceeded')), 15000);
+    this.child.stdin.write(bytes);
+    try {
+      const ready = await this.started.promise;
+      clearTimeout(this.timer);
+      this.timer = setTimeout(() => this.fail(new Error('Task channel lifetime exceeded')),
+        (request.lifetimeMs ?? 60000) + 3000);
+      return ready;
+    } catch (error) {
+      error.guardIdentity ??= structuredClone(this.guardIdentity);
+      try {
+        error.helperExit = await this.close();
+        error.cleanupUnverified = false;
+      } catch (closeError) {
+        error.cleanupUnverified = true;
+        error.cleanupError = closeError.message;
+        error.message += `; ${closeError.message}`;
+      }
+      throw error;
+    }
+  }
+
+  encode(value, maximum = 16384) {
+    if (!value ||
+        typeof value !== 'object' ||
+        Array.isArray(value)) throw new Error('Task channel requires an object frame');
+    const bytes = Buffer.from(`${JSON.stringify(value)}\n`, 'utf8');
+    if (bytes.length > maximum) throw new Error('Task channel frame exceeds bounds');
+    return bytes;
+  }
+
+  consume(text) {
+    this.buffer += text;
+    if (Buffer.byteLength(this.buffer) > 131072) return this.fail(new Error('Task channel output exceeds bounds'));
+    let newline;
+    while ((newline = this.buffer.indexOf('\n')) >= 0) {
+      const line = this.buffer.slice(0, newline);
+      this.buffer = this.buffer.slice(newline + 1);
+      try { this.event(JSON.parse(line)); }
+      catch (error) { this.fail(error); return; }
+    }
+  }
+
+  event(message) {
+    if (!message ||
+        typeof message.type !== 'string') throw new Error('Invalid task channel event');
+    if (message.type === 'started') {
+      const identity = message.guardIdentity;
+      if (this.guardIdentity ||
+          identity?.pid !== this.child.pid ||
+          typeof identity.creationTime !== 'string') throw new Error('Invalid task guard startup identity');
+      this.guardIdentity = structuredClone(identity);
+    } else if (message.type === 'failed') {
+      const error = new Error(`Task channel refused: ${message.reason}`);
+      error.code = message.reason;
+      error.guardIdentity = message.guardIdentity;
+      error.detail = message;
+      this.fail(error);
+    } else if (message.type === 'ready' ||
+        message.type === 'result') {
+      if (this.ready) throw new Error('Duplicate task channel readiness');
+      if (message.guardIdentity?.pid !== this.child.pid) throw new Error('Task guard process binding mismatch');
+      this.ready = message;
+      this.started.resolve(structuredClone(message));
+    } else if (message.type === 'worker') {
+      if (!this.ready ||
+          this.peer) throw new Error('Unexpected task channel peer');
+      this.peer = structuredClone(message.peer);
+      this.workerSession = structuredClone(message.targetSession);
+      this.worker.resolve(structuredClone(this.peer));
+    } else if (message.type === 'frame') {
+      if (!this.peer ||
+          JSON.stringify(message.peer) !== JSON.stringify(this.peer)) throw new Error('Task channel peer changed');
+      const received = { peer: structuredClone(this.peer), frame: message.frame };
+      if (this.waiters.length) this.waiters.shift().resolve(received);
+      else {
+        if (this.frames.length >= 32) throw new Error('Task channel receive queue exceeds bounds');
+        this.frames.push(received);
+      }
+    } else if (message.type === 'sent' ||
+        message.type === 'authorized') {
+      const pending = this.pending.get(message.id);
+      if (!pending) throw new Error('Unexpected task channel acknowledgement');
+      this.pending.delete(message.id);
+      pending.resolve(structuredClone(message));
+    } else if (message.type === 'closed') {
+      this.closeReason = message.reason;
+    } else throw new Error('Unknown task channel event');
+  }
+
+  fail(error) {
+    this.failure ??= error;
+    this.failure.guardIdentity ??= structuredClone(this.guardIdentity);
+    this.started.reject(this.failure);
+    this.worker.reject(this.failure);
+    for (const pending of this.pending.values()) pending.reject(this.failure);
+    this.pending.clear();
+    for (const waiter of this.waiters) waiter.reject(this.failure);
+    this.waiters = [];
+    this.frames = [];
+    if (this.child?.stdin.writable) this.child.stdin.end();
+  }
+
+  request(action, frame) {
+    if (this.failure) return Promise.reject(this.failure);
+    if (!this.peer &&
+        action !== 'authorize') return Promise.reject(new Error('Task channel peer is not verified'));
+    if (this.pending.size >= 32) return Promise.reject(new Error('Task channel command queue exceeds bounds'));
+    if (frame !== undefined) this.encode(frame);
+    const id = ++this.sequence;
+    const pending = deferred();
+    this.pending.set(id, pending);
+    this.child.stdin.write(this.encode({ action, id, ...(frame === undefined ? {} : { frame }) }, 65536));
+    return pending.promise;
+  }
+
+  receive() {
+    if (this.failure) return Promise.reject(this.failure);
+    if (this.frames.length) return Promise.resolve(this.frames.shift());
+    if (this.waiters.length >= 32) return Promise.reject(new Error('Task channel waiter queue exceeds bounds'));
+    const pending = deferred();
+    this.waiters.push(pending);
+    return pending.promise;
+  }
+
+  async close() {
+    if (!this.child) return;
+    if (!this.exited &&
+        !this.intentionalClose) {
+      this.intentionalClose = true;
+      if (this.child.stdin.writable) this.child.stdin.write('{"action":"close"}\n');
+    }
+    let timer;
+    try {
+      return await Promise.race([this.completion.promise, new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          if (this.child.stdin.writable) this.child.stdin.end();
+          const error = new Error('Task guard exit unverified; retain owned cleanup evidence');
+          error.guardIdentity = structuredClone(this.guardIdentity);
+          error.cleanupUnverified = true;
+          reject(error);
+        }, 5000);
+      })]);
+    } finally { clearTimeout(timer); }
+  }
+}
+
+export async function createTaskChannel(options) {
+  const channel = new TaskChannel();
+  const { operationId, targetSid, sessionId, bootstrap, manifestParent, manifest,
+    expectedCreationTime, handshakeTimeoutMs = 30000, lifetimeMs = 900000 } = options;
+  const ready = await channel.start({
+    action: 'serve', operationId, targetSid, sessionId, bootstrap, manifestParent,
+    document: manifest, expectedCreationTime, handshakeTimeoutMs, lifetimeMs,
+  });
+  return {
+    ...ready,
+    pid: channel.child.pid,
+    awaitWorker: () => channel.worker.promise,
+    get workerSession() { return structuredClone(channel.workerSession); },
+    send: frame => channel.request('send', frame),
+    authorize: () => channel.request('authorize'),
+    receive: () => channel.receive(),
+    closed: channel.completion.promise,
+    close: () => channel.close(),
+  };
+}
+
+async function query(request) {
+  const channel = new TaskChannel();
+  const result = await channel.start(request);
+  const exit = await channel.completion.promise;
+  if (exit.code !== 0 ||
+      exit.signal !== null) throw new Error(`Task channel query failed: ${exit.reason}`);
+  return { ...result, helperExit: exit };
+}
+
+export function queryTaskChannelCaller() {
+  return query({ action: 'caller' });
+}
+
+export async function queryCliCallerContext() {
+  const result = await query({ action: 'cli-context' });
+  if (result.proofScope !== 'cli-effective-context-snapshot' ||
+      result.identity?.pid !== process.pid ||
+      typeof result.ordinaryEligible !== 'boolean') {
+    throw new Error('CLI context caller binding or proof scope is unverified');
+  }
+  return result;
+}
+
+export async function queryCurrentUserSession() {
+  const result = await query({ action: 'current-session' });
+  const session = result.session;
+  if (result.proofScope !== 'current-user-session-snapshot' ||
+      result.identity?.pid !== process.pid ||
+      typeof result.identity?.ownerSid !== 'string' ||
+      result.identity.ownerSid.length === 0 ||
+      !Number.isInteger(result.identity.sessionId) ||
+      result.identity.sessionId <= 0 ||
+      session?.ownerSid !== result.identity.ownerSid ||
+      session?.sessionId !== result.identity.sessionId ||
+      !['active', 'disconnected'].includes(session?.state) ||
+      typeof session?.logonTime !== 'string' ||
+      !/^[1-9][0-9]{0,18}$/.test(session.logonTime)) {
+    throw new Error('Current user session binding is unverified');
+  }
+  return result;
+}
+
+export async function requireOrdinaryUpgradeCaller() {
+  if (process.platform !== 'win32') return;
+  const caller = await queryCliCallerContext();
+  const facts = caller.actorFacts;
+  const observation = caller.observation;
+  const ordinary = caller.ordinaryEligible === true &&
+    facts?.ownerSid === caller.identity.ownerSid &&
+    facts?.sessionId === caller.identity.sessionId &&
+    facts?.elevated === false &&
+    facts?.enabledAdministrator === false &&
+    facts?.guardThreadImpersonating === false &&
+    facts?.parentThreadImpersonation === 'observed-none' &&
+    observation?.method === 'pss-threads-held-token-query' &&
+    observation?.processAccess === '0x101400' &&
+    observation?.captureFlags === '0x80' &&
+    observation?.threadContextFlags === 0 &&
+    observation?.completeStableThreadSet === true &&
+    observation?.primaryStable === true &&
+    observation?.atomicFutureProtection === false &&
+    Number.isInteger(observation?.threadCount) &&
+    observation.threadCount > 0 &&
+    observation.threadCount <= 128 &&
+    caller.helperExit?.code === 0 &&
+    caller.helperExit?.signal === null;
+  if (!ordinary) {
+    // Include the native reason: an ambiguous observation and a genuinely privileged caller are
+    // both refused, and without this they are indistinguishable after the fact.
+    const reason = typeof caller.reason === 'string' ? caller.reason : 'UNREPORTED';
+    throw new Error('Windows upgrade execution requires a verified ordinary caller; no elevation or runtime-authority fallback was attempted. ' +
+      `Observed: ${reason}.`);
+  }
+  return caller;
+}
+
+export function readProtectedManifest(path, { operationId, manifestParent }) {
+  return query({ action: 'read-manifest', path, operationId, manifestParent });
+}
+
+export function inspectTrustedCodeRoot(root) {
+  return query({ action: 'inspect-root', root });
+}

package/docs/account-upgrades.md

@@ -0,0 +1,205 @@
+# Explicit original-account upgrades on Windows
+
+The default scope is **the current user**, even from an elevated terminal.
+Scope does not authorize elevated runtime execution: without `--user`, Windows
+upgrade and recovery require a freshly verified ordinary caller before staging
+or mutation. Read-only planning remains available from an elevated terminal.
+The shared [user-runtime contract](execution-context.md) also applies to normal
+startup and to non-root Linux/macOS runtime operations.
+`--all-users` is not implemented. Selecting every host in `init` is not an
+all-users installation, and managing one other user's instance does not convert
+it into a machine service or LocalSystem service.
+
+An explicit account operation requires a canonical numeric SID and exactly one
+existing task or managed-instance selector:
+
+```text
+mcp-pacemaker --user <SID> --task <exact-task-path> upgrade --to <version> --plan
+mcp-pacemaker --user <SID> --task <exact-task-path> upgrade --to <version>
+mcp-pacemaker --user <SID> --instance <directory> upgrade --recover
+```
+
+### Supported option combinations
+
+These limits apply whenever `--user` selects the task-controller path, including
+an explicit selection of the current user's SID.
+
+| Form | Explicit account behavior |
+|---|---|
+| `--user SID --task PATH upgrade --to VERSION [--plan]` | One existing legacy task; preserve its account and port |
+| `--user SID --instance DIR upgrade --to VERSION [--plan]` | One registered managed instance |
+| `--user SID --instance DIR upgrade --recover` | Recover only its recorded operation; interactive authorization remains required |
+| `--sxs`, with or without `--port` | Unsupported; refuse before native/task discovery |
+| `--port` without SxS | Unsupported; normal replacement preserves the selected port |
+| Bare `upgrade` or `upgrade --self` | Unsupported in explicit account scope; select `--to` or `--recover` |
+| Recovery with `--task`, `--to`, `--plan` or `--registry` | Unsupported; refuse rather than ignore or override an option |
+| Both `--task` and `--instance`, `--config`, or `--all-users` | Refuse; no scope conversion or new registration is inferred |
+| Execution with `--yes` | Refuse; it cannot replace the two interactive confirmations. With read-only `--to ... --plan`, it authorizes no write |
+
+Selectors accept separate or equals syntax before or after `upgrade`.
+Without `--user`, current-user commands include bare repair,
+`--self` guidance, managed SxS with optional port, and selected-instance recovery.
+No machine-wide or cross-account SxS task-creation path is added.
+
+Another user requires an **already-elevated** administrator token, enabled
+Administrators membership, and complete native authorization checks. Restricted,
+AppContainer, impersonating or unverified cross-account contexts refuse.
+No account label, saved administrator flag or group membership alone grants
+authority. The product does not request UAC, enable privileges, impersonate,
+supply passwords, create accounts or change existing permissions.
+
+## Where code executes
+
+Invoke the management CLI from an independently trusted installation. The
+elevated controller never imports the target's CLI or recovery code and never
+runs its Node/npm, dependency hooks, authentication commands or workloads.
+Target records are bounded data. Elevated code roots with untrusted writers or
+redirectable ancestors refuse; a hash does not turn writable code into trusted code.
+
+Ordinary selected-CLI commands use a fresh native effective-context observation.
+Only a non-elevated, non-administrator primary token plus a complete stable set
+of held parent threads with no observed impersonation token can avoid the
+administrator-path recursive root checks. Primary-token elevation alone is not
+enough. Unknown, denied, changed or impersonating observations retain the strict
+checks with a reason; unverified helper exit is fatal. Target JSON cannot select
+this path. Package inventory verification still runs, and the observation does
+not promise that the process can never change context afterward.
+
+The existing task launches a bounded worker under its **unchanged original
+principal, InteractiveToken logon type and run level**. That worker performs
+staging, dependency acquisition, preflight, the existing same-user stop protocol,
+runtime startup and rollback. Task Scheduler success is only correlation:
+disabled tasks and `AllowDemandStart=false` do not prove a worker ran.
+An eligible existing interactive session and actual authenticated worker are required.
+Explicit account inspection also requires the selected user's profile facts from
+`Win32_UserProfile`. An unavailable provider or unreadable profile stops the operation;
+the adapter does not infer another user's profile from environment variables or repair WMI.
+Only non-elevated (`RunLevel=0`) InteractiveToken registrations are supported;
+other logon/run-level choices refuse rather than being converted.
+
+The guard queries only the selected session. Full account-name resolution must
+match the target SID; the session must be active or disconnected but still logged
+on. Stable WTS snapshots bind its logon generation before bootstrap, after worker
+connection and at each authorization. Missing, denied, changed or unmapped facts
+refuse. The approval prompt is followed by another check before staging.
+These are **point-in-time eligibility checks**, not held session ownership:
+Windows does not atomically reserve that desktop across `RunEx`. Detected drift
+aborts; no session is created, switched, disconnected or impersonated.
+
+The selected task's owner may be its runtime user or canonical
+`BUILTIN\Administrators` (`S-1-5-32-544`). Other accounts called “Administrator”
+are not assumed privileged. Owner, group, DACL, SACL and integrity are captured,
+bound and preserved independently from run-as identity. Missing, denied or
+changed full security refuses; it is never repaired or relaxed.
+
+## Controller capability and channel
+
+The controller can only inspect/hold/repoint/restore/release the exact approved
+registration. Paths, account, original XML/security and allowed variants are
+sealed before worker requests. Worker data cannot select a different task,
+executable, principal or privileged configuration write.
+
+A separate query-only native guard owns one local pipe connection and retains
+the actual worker PID/creation/token/session identity. It has no process-kill
+interface. A protected per-operation manifest carries an ephemeral public key;
+Node's built-in Ed25519 signatures bind a fresh challenge, operation digest,
+guard-observed peer and monotonic request/response transcript. Private keys stay
+in controller memory. There is no reconnect-by-PID or nonce-only fallback.
+Signed replies also bind the checked session SID, ID and logon generation.
+Peer identity is not loaded-code attestation; the fixed capability remains safe
+even if an authenticated target-user worker lies.
+
+Only new operation-directory/file/pipe security is established at creation.
+The target must already be able to read the trusted bootstrap and traverse/read
+the protected operation store. `--controller-root <existing-directory>` selects
+an already suitable store; it does not install into Program Files or repair ACLs.
+The default store parent is the controller's local application-data directory.
+If its existing ancestors do not support the required target access/protection,
+the operation refuses before stopping the backend.
+
+Automatic triggers/restarts are held while deliberate demand start remains
+possible. Manual/external task starts are not claimed suppressed. Conflicting
+generations or revisions refuse. Because `IgnoreNew` can block a second task run
+while the worker is active, verified legacy rollback launches the original
+supervisor locally **inside the original-user worker**, not as the administrator.
+Legacy captured roots and observed descendants are checked for the worker's
+session before stop; native held-generation revalidation remains stop authority.
+Excluded or unattributed historical processes are never session-query or kill targets.
+The compact session request accepts at most 512 unique captured identities and
+128 KiB of UTF-8. PID, FILETIME and current-account/session fields are checked
+before discovery. Session queries use at most 32 exact IDs per batch and four
+separate local CIM sessions, within the unchanged 15-second caller bound.
+Missing, duplicate, stale or unexpected results refuse the whole operation.
+
+## Failure and recovery
+
+Declining the runtime-upgrade prompt after worker bootstrap restores the exact
+pre-bootstrap task revision after fresh authorization. No staging or stop is
+authorized by that decline. Failed authorization or restoration remains an
+explicit uncertain outcome.
+
+### Controller-only failure before instance publication
+
+If bootstrap happened but automatic restoration failed before any managed
+instance was published, **there is no automatic CLI recovery command for that
+state**. `--instance <missing-directory>` cannot work, and explicit-account
+`--task ... upgrade --recover` is unsupported. Do not create an instance record,
+guess an operation, or edit target configuration to make either command run.
+
+The error and `Recovery evidence:` output name the exact protected operation
+directory. Keep both files:
+
+- `manifest.json`: `document.initialTask` is the pre-bootstrap task snapshot;
+  `document.binding.initialTaskRevision` binds it.
+- `controller-journal.json`: `initial`, the last verified `current` revision,
+  full task security, and the uncertain phase.
+
+The supported path is **manual verified restoration of that exact task** by an
+authorized operator using the existing Task Scheduler COM adapter/tooling:
+
+1. Verify the protected evidence, task path, SID and initial revision agree.
+   Missing or inconsistent evidence is a refusal, not permission to reconstruct it.
+2. Re-establish the controller's required actual authority and fresh target
+   SID/session/logon-generation eligibility. Saved token/session facts are not
+   authorization; denied or changed checks remain blocking.
+3. Read the actual task XML and complete security descriptor again. Reconcile
+   it with the captured revisions before any write; do not overwrite an unknown
+   intervening change.
+4. Restore the saved initial definition using update-only registration while
+   preserving the principal, logon type, run level and raw full descriptor.
+   Re-read and verify the result. Importing XML alone or repairing permissions
+   is not this procedure.
+
+This manual path restores task registration only. It does not authorize runtime
+stop/start, replay, account/session changes, or administrator writes to target
+state. If those checks cannot be completed, retain the evidence and leave the
+operation blocked.
+
+Controller and worker journals share an operation ID but have separate authority.
+Loss of the peer/channel ends privileged RPC; it does not authorize killing an
+orphan worker. Uncertain task, stop, launch or admission outcomes remain explicit.
+No unknown tool outcome is replayed.
+
+Recovery requires the exact managed instance and its protected prior controller
+record, fresh actor/task/account authorization and a new bootstrap/handshake.
+The initial published legacy instance already contains that operation reference;
+recovery does not depend on a later HOLD acknowledgement or administrator edits
+to target state. The reference, protected manifest, controller record and target
+config/port must agree. Settled committed, aborted and rolled-back transactions,
+including their legacy forms, return without another worker or task mutation.
+An old authorization flag is never reused. Existing stale-lock and uncertain-
+admission refusals still apply; the controller does not edit target configuration
+or force-remove its locks.
+
+## Qualification boundary
+
+Owned same-user pipe/process tests exercise the real query-only guard and worker.
+The production Task Scheduler adapters are separately exercised against injected
+COM objects. Neither establishes successful elevated **two-account** task/runtime
+behavior. Real task security visibility does not establish mutation preservation.
+
+`tools/account-upgrade/qualify-two-account.ps1` is a runnable qualification entry
+for a separately authorized Windows environment with pre-existing accounts,
+session, task, protected toolchain and operation store. It defaults to read-only
+planning; `-Execute` still requires the product's interactive confirmations.
+It must not be run on a live installation merely because the code is present.

package/docs/execution-context.md

@@ -0,0 +1,113 @@
+# User-runtime execution contracts
+
+The default runtime is an ordinary process belonging to its user. Starting the
+bridge or supervisor, registering autostart, upgrading and recovering do not
+silently elevate, demote, impersonate or select another account. An unavailable
+or privileged context refuses before runtime work. Read-only planning and
+installation with both `--no-start` and `--no-autostart` remain separate.
+
+`bin/runtime-context.mjs` is the shared observation boundary:
+
+| Platform | Required effective context |
+| --- | --- |
+| Windows | The existing native ordinary-caller proof: no elevation, enabled administrator membership or observed thread impersonation |
+| Linux | Stable non-root real/effective IDs, matching saved/filesystem IDs, and zero inherited/permitted/effective/ambient capabilities |
+| macOS | Stable non-root real/effective user IDs and matching real/effective group IDs |
+
+These are snapshots, not a promise that a process can never change context.
+The guard does not grant access to an arbitrary installation. Existing instance,
+file-security, service-registration and account-authorization checks still apply.
+Explicit original-account administration remains the separate Windows-only
+capability described in [account upgrades](account-upgrades.md).
+
+## Test contracts
+
+`tools/ci/test-contracts.mjs` declares the execution role, command and required
+capabilities. It verifies that the source contract includes every registered
+source test and preserves the declared test concurrency.
+
+| Contract | Required role and coverage |
+| --- | --- |
+| `source` | Ordinary runtime; complete registered source suite. Windows also needs the real caller's WTS logon because its account/session tests use that API. |
+| `source-ordinary` | Windows only. Ordinary runtime without a logon session; every registered file except the four in `SESSION_REQUIRED_TESTS`. The two Windows lanes must together cover every registered file exactly once. |
+| `compatibility` | Ordinary runtime; complete CLI/API compatibility command |
+| `browser` | Ordinary runtime; declared browser compatibility command |
+| `audit` | Verified privileged Windows fixture; the unchanged mandatory audit test, including its ordinary worker and complete result checks |
+| `service-context` | Read-only capability observation; **not** test coverage |
+
+Run the same entry point locally or in CI:
+
+```text
+npm run test:contract -- plan
+npm run test:contract -- source --check
+npm run test:contract -- source
+npm run test:contract -- compatibility
+npm run test:contract -- service-context --check
+```
+
+The service-context observation uses the current user's WTS session on Windows,
+owned `/run/user/<uid>` and user `systemd` manager on Linux, or the caller's `gui`
+launchd domain on macOS. A CLI-only or browser contract does not require a desktop
+merely for consistency with Windows.
+
+No adapter creates a user or session, changes UAC, edits privileges, rewrites a
+token, or falls back to another identity. Setup capability and ordinary runtime
+capability are not interchangeable. A missing required capability is a blocked
+qualification, not a successful skip.
+
+Windows integration fixtures also need a private checkout, home and temporary
+tree whose ancestors satisfy the existing path-security checks. A shared writable
+drive can correctly fail with `UNTRUSTED_PATH_WRITER` even when the process is
+ordinary. Use short, trusted profile-owned test roots: the nested upgrade packages
+must remain within the native .NET executable path limits, not just Node's file
+API limits. Do not change drive ACLs, enable long-path policy or relax the native
+checks to make an unsuitable test root pass.
+
+## CI and release boundaries
+
+The public workflow separates three roles rather than assuming an OS label implies a runtime.
+
+| Lane | Runner | What it proves |
+| --- | --- | --- |
+| `test (ubuntu-latest\|macos-latest, 20\|22\|24)` | Stock hosted | Ordinary user-runtime source and compatibility suites |
+| `windows-ordinary (20\|22\|24)` | Stock hosted Windows | Install, syntax, pinned native toolchain, three reproducible native builds, the actual refusal of an elevated built-in Administrator, then the `source-ordinary` and `compatibility` contracts run as a provisioned disposable standard account |
+| Windows session lane | Ordinary interactive Windows session | The four `SESSION_REQUIRED_TESTS` files, through the local publication gate |
+
+A stock hosted Windows runner signs in as the built-in Administrator with a full elevated token, and
+Task Scheduler ignores `RunLevel` for that account, so that account cannot host the ordinary
+user-runtime contract. The lane therefore does not try to demote it. It provisions a disposable
+standard account, which is never an administrator, and runs the suite as that account. It also
+proves the elevated refusal itself, and `tools/ci/windows-runner-role.mjs` fails loudly if a Windows
+runner ever does satisfy the ordinary contract, so real coverage is promoted rather than left
+unexecuted.
+
+A provisioned account signs in with a password logon and has no interactive logon session, so the
+four `SESSION_REQUIRED_TESTS` files that bind one stay in the session lane. They are still required,
+not skipped: `tools/npm-publication/local-gate.mjs` runs the complete source suite for the current
+release and requires `role: user-runtime` with `sessionVerified: true`. A Windows container without a
+real logged-on account cannot satisfy that, and neither can a hosted job. `testContract` asserts the
+two Windows lanes cover every registered file exactly once, so no file can fall out of both.
+
+The CI provider bounds job lifetime and owns job teardown; the contract entry
+point does not claim to provide VM or network isolation.
+
+The local command forwards cancellation to its owned test child and waits for
+exit/output closure, escalating termination after five seconds. Unverified
+closure after another five seconds is an error, not successful cleanup. Source
+tests retain a 60-minute command budget and compatibility tests a 45-minute budget;
+the audit keeps its existing 210-second budget and a 16 MiB output limit.
+Windows commands also use the existing native process-lifetime mechanism.
+None of these command bounds changes application startup or shutdown deadlines.
+
+No integration runner is provisioned by this change. An approved environment
+must already supply the required ordinary identity and session. Do not attach a
+personal workstation or unrestricted persistent runner to public pull requests.
+Runner admission, trusted-source selection, disposable-machine isolation and
+credential policy require independent infrastructure approval.
+
+The existing exact-source CI and local publication requirements remain enforced.
+The local source gate invokes the same read-only preflight and its verifier
+requires that original command receipt. A Windows container without WTS cannot
+stand in for an interactive user session. The privileged audit companion remains
+required and cannot replace the source suite. No missing integration result is
+relabelled as a pass.