[satchlj]

Claude Fable 5.2 on @satchlj's behalf

Fixes the source check, which fails on every linux PR since #1340 merged (reported by @DjDeveloperr in #1340 (comment)).

Cause. #1340's static test test_no_other_path_designates_outside_a_window was written on a branch without 519d09b ("support a trusted-key-only initrd attach"). That commit makes refkey_unseal_cached build its unlock as a closure and run it inside policy_window on the real root, but bare in the trusted-key-only initrd (keystore_only), with the comment "Do not consume the real root's one policy window in the initrd".

Change (test only, no runtime change). This is option 1 from DJ's question: the initrd path is treated as the documented exception. The test now accepts exactly one deferred call, in refkey_unseal_cached, and only when its closure is used twice: bare under keystore_only, and inside crate::xart_guard::policy_window otherwise. Every other caller must still open or close the window before the call.

Why option 1 is consistent with #1340. #1340 protects against an existing session record being rewritten outside the window. With the window shut, the guard does not let that rewrite through, so the initrd path cannot cause it; under a changed boot policy it fails instead. Whether the initrd should open a window is @RyanTheTide's call (519d09b is his design); if he wants option 2, this test is the place to tighten afterwards.

Checked

• python3 -m unittest tools/aurora-sep/tests/test_policy_window.py and with -O: 4/4 pass on integration/aurora 17efdf6 (1 failure before).
• Two deliberate regressions in a scratch copy of refkey.rs each still fail the test: running unlock() bare on the real-root branch, and removing policy_window from the other ref-key unlock.

Not run: the rest of the source workflow locally, any kernel build, any hardware (nothing compiled changes).

🤖 Generated with Claude Code

[satchlj]

Claude Fable 5.2 on @satchlj's behalf

The host-tests failure on 0363e18 is the runner bootstrap, not this change: "Pin the host toolchains" could not resolve azure.archive.ubuntu.com (apt exit 100), the same mirror failure @DjDeveloperr patched on #973 and #1490. No test ran. I have re-run the failed job once; source, kunit and rust-build are still queued. This PR only changes tools/aurora-sep/tests/test_policy_window.py, which source runs.

[DjDeveloperr]

Reviewed: test-only, with no runtime change, in a single file (tools/aurora-sep/tests/test_policy_window.py). The allowance is narrow. Only (refkey.rs, refkey_unseal_cached) may defer, only inside a let unlock = || { closure, and exactly once. The closure must be used exactly twice, as if self.keystore_only.load(Relaxed) { unlock() } else { crate::xart_guard::policy_window(unlock) }, which matches 519d09b's code on integration/aurora. Every other PREPARE caller still has to open or close the window before the call. re is already imported. I'll merge once all its checks are green on this head.