fix(diagnostics): preserve home guards in isolated child environments

[luvs01]

Summary

• Arm the Windows diagnostic child's test-home guard after clearing its environment, while explicitly retaining the original protected home before fixture HOME/USERPROFILE replacement.
• Split the diagnostic guard from security: harden filesystem, routing, and request resource boundaries #719. Reject an invalid relative protected-home value instead of starting a child with an ambiguous boundary.
• Reuse the same environment setup in the Rust-driven Bun contracts and test that synthetic protected OpenCodex/Codex paths are refused while the fixture remains usable.

Verification

Current-head verification after dev refresh

Head: 03ed3cc96b7360acdc7f9a21638d6034bfed3e4a. Preserves the previous PR commits and includes fork/upstream dev dc45bb2ca92e9a4f841a73d70177bfec04722d47 through a normal merge.

• Windows local verification with pinned Bun 1.4.0:
• bun run typecheck and bun run structure:check passed.
• The refresh changes no files under scripts/diagnostics; the previous 16 passing Rust async-contract tests, format check, and clippy results are retained. They were not rerun for unchanged Rust code.
• The merge delta passes git diff --check.
• Repeating the full repository suite and broad import-graph selection across 13 branches was disproportionate; the commands above cover the affected behavior. Broader and platform-specific coverage remains for CI.
• Local-only combined validation including fix(test): isolate diagnostic servers from live Codex restart #717–[WRONG BRANCH] fix(desktop): bound library reads and preflight write sizes #730 and fix(service): require stable numeric health sentinel endpoints #731 at aa2f74051ae79cdbfa67b6fd12fd7170218d5290: typecheck, privacy scan, structure check, and 53 layout/ratchet/core-boundary tests passed. This is integration evidence, not a full combined runtime suite.
• Cross-platform CI dispatch was rejected by GitHub with HTTP 422: Actions has been disabled for this repository. Queued CodeQL entries are not completed test CI.
• New pushes trigger automated review, but Devin Review has been skipping full analysis because trial/credits are exhausted. A green status carrying that skip description is not review approval. No Draft was cleared based on these statuses.

Earlier verification below remains historical evidence; the current-head results above govern readiness.

• Windows, Rust/Cargo 1.98.1 and the existing MSVC 2022 toolchain; pinned Bun 1.4.0 for module contracts. No toolchain installation was needed.
• cargo fmt --manifest-path scripts/diagnostics/windows-version-control/Cargo.toml --check passed.
• cargo clippy --locked --manifest-path scripts/diagnostics/windows-version-control/Cargo.toml --all-targets -- -D warnings passed.
• cargo test --locked --manifest-path scripts/diagnostics/windows-version-control/Cargo.toml --test async_contracts -- --test-threads=4 — 16 passed, 0 failed.
• Negative control: disabling only the guard while retaining the synthetic original home made both protected-path probes pass through and failed the new contract; the armed setup passed.
• bun run typecheck, bun run privacy:scan, bun scripts/file-size-ratchet.ts, and git diff --check passed.
• The Windows liveness controller itself was not executed. Its callsite was compile/Clippy reviewed; runtime behavior was exercised through the same shared setup in the isolated module contracts. No installed application was restarted or real user directory written. Linux/macOS execution and hosted CI remain outstanding; retain Draft.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f3173944-108d-498c-b2bd-60520f12e9cf

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

The unique change has been preserved in a separately verified integration candidate.

Verified source HEAD 973abbc9fc9fbf80ff9473849e9b607189e81331 against integration candidate ac9167c4443c9def8b49dc23a594e21f2f6f3db1, based on development revision 6da2774369aa32552e318e333902499683d053bc. All four code/test files are byte-identical. The README retains the same paragraph at a different location, with a clean three-way check against the pending upstream process-isolation note. Attribution is preserved.

The validation record separates the source revision's successful Linux/macOS/Windows Rust contracts from the local checks and unavailable local Rust toolchain. New-head CI and maintainer review remain pending; integration remains unmerged.

Closing this fork PR as duplicate tracking after verified transfer. The source branch is retained. The verified integration candidate remains available for further review.