Keep disabled Windows action journals private at creation

[ekalb81]

Problem and behavior

The disabled action engine could create Windows journal directories, backups, and staged event files with default ACLs. A future action path could expose journal bytes to other local users before permission changes. This change creates those objects with a protected current-user-and-SYSTEM DACL at creation, verifies owner/DACL/type/reparse status through handles, and refuses unsafe existing objects without rewriting them. The root and journal handles stay pinned across event, backup, undo, recovery, and publication operations; path bindings are checked before and after publication.

An earlier revision parsed raw ACE pointers; CodeQL found two invalid-pointer alerts. The final runtime uses the native Windows security-descriptor-to-SDDL API and canonicalizes both observed and allowlisted expected descriptors through that API, while retaining raw owner and null-DACL checks. This accepts equivalent built-in SID aliases; a portable synthetic LOCAL SERVICE (LS) policy regression covers both files and directories.

Production apply and undo remain hard-disabled, with no new mutation IPC, provider adapter, shell execution, or real provider-file access. Provider-target ACL preservation and final CAS/lock, startup recovery, and journal retention remain review gates. Related #46.

Validation and provenance

• Current head 48d819b: test-only alias fixture change from c13910b; targeted Windows privacy tests 8/8 pass. All exact-head CI passed before squash merge, including Check + test, Coverage, MSRV, Visual, editors and the final CodeQL aggregate. Independent security review found no blocking issue on the runtime or portable fixture.
• Prior runtime head c13910b: full Windows Rust rerun 890 passed, 19 ignored; Clippy and exact-head CI (Check + test, Coverage, MSRV, Visual, editors, CodeQL aggregate) passed. An earlier full run failed once in unchanged quota_accounts.rs:615 with a synthetic settings-save error; that focused test passed alone and the bounded full rerun passed. Cause is unproven and tracked separately in Investigate intermittent Windows live-quota consent save failure #322. These are prior-head results, not claims about the final test-only head.
• Earlier 724f784: all six required Windows checks passed. An actual synthetic NTFS junction journal was refused with unchanged referent bytes. Symlink creation was unavailable on this Windows host (privilege 1314), so that fixture branch was not demonstrated here.
• Linux: 13 focused action executor regressions passed on archived source f3a4fd9 (SHA-256 9929e40a41f376ba686e0bb661f5c437cadab30cb67f2c96f757521dded80f56). Later runtime changes are Windows-only SDDL validation; the archive is not claimed as current-head source.
• No frontend/UI change. Current-head Visual CI passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T05:31:43.233473Z	724f784	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.