Fix/windows integration harness - #69
Merged
Merged
Conversation
The harness built the sidecar with no .exe suffix and dialed a filesystem-path Unix socket, so it never ran on Windows: exec.Command can't launch an extensionless binary there, and the sidecar's own Windows named-pipe transport (pipe.go, already build-tagged) never got addressed correctly. Neither bug is visible to go build, go vet, or GOOS=windows cross-compilation — only running the suite surfaces them. Adds a build-tagged harnessSocketPath/dialSidecar pair mirroring how internal/transport already splits uds.go/pipe.go, and wires the integration suite into CI on both ubuntu-latest and windows-latest so this can't regress silently again. Detection numbers are unaffected — pipeline logic is pure text processing with no platform dependency. Verified: full suite passes identically to the pre-existing Linux run (33 baseline + 25 gap probes, same 4 probes closed).
aggregate.go multiplies risk score by ProvenanceWeight(rc.Provenance), a field set inside the agent process — the untrusted side of the trust boundary. Since a compromised PEP could claim any trust weight, this probe re-sends every corpus payload under each configured provenance value and asserts the verdict never loosens. Result: 0/58 downgraded. Detection is signal-driven in OPA (category presence, not score threshold), so the score multiplier a forged provenance controls doesn't change the outcome. Kept as a standing regression test — if a future policy escalates on score instead of signal count (e.g. the planned on_context multi-signal fix), this probe is what would catch a forged-provenance bypass reappearing.
kavishkafer
force-pushed
the
fix/windows-integration-harness
branch
from
July 31, 2026 14:02
d50db7a to
898e0da
Compare
VibhorGautam
reviewed
Aug 1, 2026
VibhorGautam
left a comment
VibhorGautam
left a comment
Contributor
There was a problem hiding this comment.
the %PATH% error not mentioning extensions is nasty, good find. pipe split matching the sidecar transport makes sense
one thing on the provenance probe, it only logs, never fails. if forged provenance ever starts downgrading verdicts ci stays green, so it doesn't actually guard anything. since it's staying in the suite id make it fail when downgrades > 0, passes today anyway since you measured zero
2 small ones, the job pins go 1.22 but go.mod wants 1.25 so every run downloads the toolchain, and go-winio is a direct import now but still marked indirect. neither blocks
I had this same ci job half written locally so good timing. will do opa test and -count=1 on the makefile separately
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix Windows integration harness and close CI gaps
Discovered while attempting to reproduce detection numbers locally on Windows: the integration harness has historically been broken on Windows due to two silent runtime bugs that escape compilation and linting checks (
go build/go vet).This PR resolves both issues, brings Windows into the integration CI matrix, and adds a test verifying risk score provenance boundaries.
1. Fix Sidecar Execution Failure (Bug 1)
.exeextension. Whilego buildsucceeds and writes the extensionless file to disk, Windows refuses to launch it.os/execfails with a misleadingexecutable file not found in %PATH%error because it strictly expects.exe,.com,.bat, or.cmdextensions on this platform..exesuffix when running on Windows.2. Fix Transport Communication Failure (Bug 2)
pipe.gobuild tags andgo-winio), the integration harness completely bypassed this abstraction, resulting in anIncorrect functionerror on Windows.unix/windowssplit found in the sidecar's transport package over to the harness, enabling proper Windows Named Pipe dialing.3. CI Matrix Expansion
windows-latestto the integration test matrix to ensure platform compatibility moving forward.4. Added Security Boundary Test (
aggregate.go)provenancetrust weight (which multiplies the overall risk score).