feat: add secure Windows peer messaging

[woai3c]

Goal and acceptance criteria

Enable secure local peer discovery and cross-session messaging on Windows while preserving the existing macOS/Linux Unix-socket behavior.

• Windows root sessions can register, discover, message, hold, accept, and refuse peers through named pipes.
• The transport fails closed on wrong user SID, integrity mismatch, insecure runtime paths, protocol mismatch, malformed frames, and broker loss.
• Broker lifetime is tied to the owning CLI session and stale registrations are removed after disconnect or crash.
• Signed release/package paths include validated x64 and arm64 broker artifacts with per-architecture provenance.
• Existing Unix-socket behavior and public peer APIs remain compatible.
• The full GitHub PR workflow passes on Windows, macOS, and Ubuntu.
• Three simultaneous Windows CLI agents can discover one another and complete a real broker-backed message ring.
• Complete a native Windows arm64 runtime smoke test on arm64 hardware.
• Capture controlled two-host remote-client rejection evidence.
• Record Human Local Acceptance and final Human Technical Review.

Scope and design

• Windows uses a local named-pipe client and a small Rust broker; macOS/Linux continue to use Unix domain sockets.
• Bootstrap and session traffic use bounded authentication tokens, SID and integrity-level verification, protected DACLs with an explicit owner SID, and remote-client rejection.
• Frames, deadlines, concurrent work, cancellation tombstones, and shutdown cleanup are bounded.
• Native artifacts are copied and validated through a versioned manifest containing architecture, size, SHA-256, protocol, source hash, and Rust toolchain provenance.
• This does not add TCP/network messaging, cross-user messaging, a fallback transport, or broader broker privileges.

Review disposition

PR_REVIEW_REPORT.md reviewed the original implementation revision c6fb0e5. Its four code findings were valid and are now addressed:

Finding	Assessment	Resolution
Elevated launch could fail owner validation	Valid, high severity	Set and verify the Windows object owner SID explicitly; request WRITE_OWNER only where needed; rebuild both bundled architectures.
Rapid connect/disconnect could terminate the broker	Valid, high severity	Treat Windows errors 232 and 233 as abandoned accept instances; a regression performs 4,000 raw disconnects before an authenticated request.
Successful requests consumed operation capacity	Valid, medium severity	Separate live operations from bounded completion tombstones; a 300-success regression confirms capacity remains available.
An unbuilt architecture could be relabeled with current provenance	Valid, medium severity	Manifest updates now name the artifacts actually rebuilt, preserve valid unbuilt provenance, and fail if an unbuilt binary changed; release regeneration explicitly validates all-current artifacts after both builds.

The fixes are in 9dff22a, a0ebd90, and 580258b. The report's remaining arm64-device, two-host, and human-acceptance items are evidence gaps rather than implementation defects and remain open below.

Verification evidence

GitHub CI

• PASSED — PR Check run 33192192153, 8/8 jobs:
  • Commit Message Check
  • Type Check
  • Lint & Format
  • Package Check
  • Windows Native Source, including freshly rebuilt x64 helper execution
  • Test on Windows, macOS, and Ubuntu
• PR merge state at this revision is CLEAN.

Local verification on Windows x64

• PASSED — pnpm build, pnpm typecheck, pnpm lint:check, tracked-file formatting, and git diff --check.
• PASSED — pnpm test: 199 files passed, 3 skipped; 1,978 tests passed, 37 skipped.
• PASSED — targeted fresh-native sequence: x64 broker self-test plus 6 Windows suites, 34/34 tests.
• PASSED — Windows transport suite: 10/10, including crash cleanup, cancellation, capacity recovery, malformed/oversized input, 4,000 abandoned clients, and 300 rapid successes.
• PASSED — Rust cargo fmt, cargo clippy with warnings denied, and cargo test: 19/19.
• PASSED — x64 and arm64 PE/manifest validation; the x64 bundled broker self-test executes successfully.
• PASSED — repeated Windows stress/file-lock run: 10 rounds, 130/130 assertions.
• PASSED — package budget: 2.93 MiB packed, 11.68 MiB unpacked, 41 files; packed-tarball install smoke 14/14.

Real multi-terminal acceptance smoke

• Started three independent ConPTY/PowerShell terminals running the built CLI as named agents alpha, beta, and gamma against one isolated Windows runtime.
• Verified registry discovery of both peers, then completed alpha -> beta -> gamma -> alpha delivery through the real named-pipe broker.
• Verified the exact payload entered each receiver's peer context, all three turns completed, no unexpected authority dialog appeared, and all CLIs exited cleanly.
• Repeated the complete topology four times: 12 CLI terminal processes total, 4/4 message rings passed.
• The deterministic fake model endpoint supplied tool choices only; CLI processes, registry, broker, named-pipe transport, authentication, and terminal lifecycle were real.

Remaining acceptance evidence

• Windows arm64 execution on target hardware: not executed. The arm64 PE, hash, manifest, and provenance checks pass, but this is not a substitute for a device smoke test.
• Controlled two-host remote pipe rejection: not executed. PIPE_REJECT_REMOTE_CLIENTS and local unit coverage are present, but release acceptance still requires a second controlled Windows host.
• Human Plan Review, Human Local Acceptance, and final Human Technical Review: pending.
• GitHub annotations report pnpm/action-setup@v4's Node 20 action runtime being forced to Node 24. This is a non-blocking upstream workflow warning; all jobs passed.

Readiness

• Review findings are dispositioned and all applicable code fixes are verified.
• Local regression, native, package, and real multi-terminal results pass.
• GitHub CI is green on all configured platforms.
• Remaining release evidence and human approvals are explicit.
• Maintainer approval is recorded against the final revision.