[Broccolito]

Durable job storage now enforces owner-private permissions in the backend while preserving the six job tools, normal submission/wait/cancellation and completed local output. Existing safe owned stores are repaired without deleting results. New output is private before bytes are written. Storage failures retain actionable codes/guidance while synchronous startup and all six job-tool registrations remain available.

Fixes #5. The original async-job contract and original-head native-app evidence below retain their original scope.

On Windows, retained no-reparse handles verify ownership and link counts. Protected DACLs grant only TokenUser. The process default-owner exception applies only to the exact current token owner when it is SYSTEM or Builtin Administrators; arbitrary ordinary group owners are refused because their members may have implicit permission-change rights.

Before changing any existing Windows ACL, every managed directory is inspected. A mutation allow ACE for an ordinary foreign account, an unknown ACE form or an unsafe mask refuses automatic migration with private_storage_requires_quiescent_repair. The user is advised to stop writers and have the owner/administrator remove foreign write/delete/change-permission rights throughout the tree, or select a fresh private root while retaining the old data. This prevents inheritable ACL repair from touching an entry a foreign writer could insert after enumeration. Known private stores and elevated SQLite journals keep working; no routine approval dialog is added. macOS/Linux inherited ACL cleanup and descriptor-relative checks are preserved.

Latest local validation on source 3afb2d24b364201b8fd4f279063a03886e01532f; shipping head f9a6e40f0e9c92a47fec4b56214474b847c214fe:

• macOS full credential-free suite: 79 tests, 13 explicit skips, no failures. Skips comprise ten Windows controls, two Linux-only controls and the existing Neo4j-only case. Both connector suites ran serially. No real credentials, PHI or live database queries were used.
• Wheel built twice identically: SHA-256 e83066ee4381d3f471005b65d676cf646a3fb84bf43c72b7bd8f7984778a148f. BRXT built twice identically: 138578 bytes, SHA-256 0eab7151e1005693205dcd76bded202a52dbeca33787e4c3ba99d3c790ad22cf. A separate build from committed source matches the BRXT; git diff --check passes.
• New Windows controls cover an unprotected outside hardlink canary at the first directory-repair boundary, rejection before any repair callback for a nested foreign-writable directory, unknown-ACE helper rejection, and a non-administrator default-owner helper negative. Positive legacy tests use read/list inheritance; existing real junction/hardlink/foreign-owner/first-write and SQLite controls remain.
• Final head f9a6e40f0e9c92a47fec4b56214474b847c214fe passed ten hosted Windows controls, zero skips, including the migration/default-owner regressions, in Windows private storage. All six Linux/macOS/Windows jobs across push and PR workflows are SUCCESS on this head. The two injected-helper controls test owner/unknown-ACE refusal; the remaining controls use actual Windows filesystem/ACL operations. This is not a second-account execution claim.

Scope limits: administrators/root, arbitrary same-user processes and foreign handles opened before permission tightening are outside the confidentiality claim. SQLite open and final result rename retain pathname seams after checks; use owner-controlled local storage. Windows chunked result reading retains its existing explicit unsupported-platform response; completed local worker files remain available. Native BioRouter and live database acceptance have not been rerun on these storage heads.

---

Query jobs currently require immediate status polling and return a local result path that a jailed host cannot read. A successful status lookup also hides a failed operation from the host's failure tracking. This adds native waiting, capacity discovery and bounded result reading by job ID, with an explicit operation outcome independent of lookup success.

The six job tools preserve atomic two-job admission and explicit resubmission. Failed jobs retain sanitized error codes, original phase and retryability, including FreeTDS timeout code 20003. Waits keep the MCP event loop responsive during SQLite contention and cancellation. A wait deadline returns an explicitly stale last observed active state when available; an unreadable initial state returns a transient lookup error without inventing an operation outcome. The POSIX result reader uses managed descriptor-relative opens, rejects links/nonregular files and unexpected result sizes, and fails closed on unsupported platforms. Updated instructions and a credential-free stdio fixture exercise real FastMCP tools without a database connection.

Fixes #3. Related host consumer: BaranziniLab/biorouter#438.

Follow-up 747f5ed2db0a0fd2fb0bf8a1d4b561f75b5a238e preserves the existing six-tool interface, 30-second contention-aware native wait, managed result reader and namespaced operation IDs. Capacity snapshots now explicitly include advisory: true. CLI watch uses native waiting. A failed worker launch or broken stdin pipe returns its allocated durable ID with failed operation metadata and releases its capacity slot; cleanup failures cannot hide that outcome. Failure guidance follows the structured cause rather than blindly rewriting SQL.

Earlier async-contract follow-up validation (before owner-private storage changes): 57 credential-free tests run, one existing Neo4j-only skip, no failures; wheel build passed; canonical BRXT rebuilt twice identically (129693 bytes, SHA-256 e89f2dfff8db05f60dfa00a7757591a9ea992df6ebfa28a0802c4e76886ca53d); committed-source BRXT comparison and git diff --check passed. Seven new regressions cover advisory snapshots, native CLI waiting, worker-start/pipe/reaper failures and actual MCP metadata. No live database queries or production credentials were used. Native BioRouter acceptance has not been repeated on this follow-up head; the original-head app evidence below retains its original scope.

Refs BaranziniLab/biorouter#436; leave that host issue open until both connectors and host verification are complete.

Original-head validation recorded for ddc3d70:

• Full Python suite: 50 tests run, one unrelated Neo4j test skipped; no failures.
• Real SQLite exclusive-lock regressions cover immediate zero waits, honest deadline snapshots, cancellation, responsive MCP requests and bounded lookup threads.
• FastMCP/worker fixtures cover operation metadata, atomic admission, safe errors and multilingual chunked results. These are synthetic checks; live OMOP connectivity and database execution have not been verified.
• uv build --wheel produced ucsfomopagent-0.3.2-py3-none-any.whl.
• Canonical BRXT regenerated twice with identical output: 129252 bytes, SHA-256 c5170231bd985f64ab39b77c19908e028685c7374b7291f21e28f3b467abd1a9.
• git diff --check passed.

The original PR author reported the following native validation on ddc3d70 through the actual development Electron app and Rust daemon, using this repository's credential-free stdio fixture and real JobStore, worker and FastMCP tools with a deterministic synthetic provider:

• Repeated lookups of a deliberately failed job remained successful (isError: false) while the host showed failed-operation badges and counted one distinct failed operation; observed badges survived session reload.
• Direct and nested Code Execution workflows completed. Inspecting a failed job did not throw (caught: false), while a third submission at full two-job capacity returned capacity_exceeded with isError: true.
• Direct and nested chunk readers reassembled the exact 69-byte CSV, including accented text, Han characters, emoji, quoted commas and an embedded newline. SHA-256: 5ef7a0f5e2475c79a84cca0500abb12a4e25fc9bba48a763600a5d5628fed649; reconstructed bytes matched the managed artifact.
• Zero-time waits reported an active job; cancellation reached cancelled and released both capacity slots. Nested cancellation also completed without an exception.

These app checks exercise synthetic jobs, not live database connectivity, production database execution or model reasoning. GitHub CI passed on the original ddc3d70 head: all four Linux/macOS check runs across push and pull-request workflows completed successfully, including Python tests, wheel build and deterministic BRXT checks.