Fail closed on unavailable Windows startup evidence

.github/workflows/cmux-tui-spec.yml

@@ -32,6 +32,12 @@ jobs:
       - name: Test inventory checker
         run: python3 cmux-tui/scripts/test_check_spec_inventory.py
 
+      - name: Test startup benchmark evidence contract
+        run: >-
+          python3 -m unittest -v
+          cmux-tui/scripts/test_startup_benchmark_contract.py
+          cmux-tui/scripts/test_startup_benchmark_claim.py
+
       - name: Check protocol and TUI action inventory
         run: python3 cmux-tui/scripts/check-spec-inventory.py
 

.github/workflows/cmux-tui-startup-benchmark.yml

@@ -1267,16 +1267,45 @@ jobs:
             fi
             "$preflight" "${args[@]}"
           }
+          claim_status="verified"
+          claim_reason=""
           if [[ "$RUNNER_OS" == "Windows" ]]; then
             appcontainer_evidence="$ARTIFACT_DIR/windows-appcontainer-feasibility.json"
-            "$preflight" \
-              --appcontainer-feasibility \
-              --fixture-parent "$PREFLIGHT_PARENT" \
-              --output "$appcontainer_evidence"
-            "$PYTHON_CMD" "$TRUSTED_SOURCE/cmux-tui/scripts/verify-startup-benchmark.py" \
-              --appcontainer-feasibility "$appcontainer_evidence"
-          fi
-          if [[ "$RUNNER_OS" == "Linux" ]]; then
+            if "$preflight" \
+                --appcontainer-feasibility \
+                --fixture-parent "$PREFLIGHT_PARENT" \
+                --output "$appcontainer_evidence"; then
+              "$PYTHON_CMD" "$TRUSTED_SOURCE/cmux-tui/scripts/verify-startup-benchmark.py" \
+                --appcontainer-feasibility "$appcontainer_evidence"
+            else
+              appcontainer_status=$?
+              if [[ "$appcontainer_status" -ne 78 ]]; then
+                echo "trusted Windows AppContainer feasibility failed with exit $appcontainer_status" >&2
+                exit "$appcontainer_status"
+              fi
+              "$PYTHON_CMD" "$TRUSTED_SOURCE/cmux-tui/scripts/verify-startup-benchmark.py" \
+                --appcontainer-feasibility "$appcontainer_evidence"
+              claim_status="unverified"
+              claim_reason="Windows AppContainer staging-readability capability was unavailable; no restricted-token broker run was started"
+              printf '%s\n' "$claim_reason" > "$ARTIFACT_DIR/windows-appcontainer-unavailable.txt"
+            fi
+            if run_preflight "$evidence"; then
+              :
+            else
+              preflight_status=$?
+              if [[ "$preflight_status" -ne 78 ]]; then
+                echo "trusted Windows preflight failed with exit $preflight_status" >&2
+                exit "$preflight_status"
+              fi
+              if [[ "$claim_status" != "unverified" ]]; then
+                claim_status="unverified"
+                claim_reason="trusted Windows preflight could not observe all required native security signals"
+              fi
+              {
+                printf '%s\n' "$claim_reason"
+              } >> "$ARTIFACT_DIR/windows-preflight-unverified.txt"
+            fi
+          elif [[ "$RUNNER_OS" == "Linux" ]]; then
             unprivileged_evidence="$ARTIFACT_DIR/sandbox-preflight-unprivileged.json"
             if run_preflight "$unprivileged_evidence"; then
               mv "$unprivileged_evidence" "$evidence"
@@ -1320,10 +1349,39 @@ jobs:
             bootstrap_sha256="$("$PYTHON_CMD" -c 'import hashlib,sys; print(hashlib.sha256(open(sys.argv[1], "rb").read()).hexdigest())' "$WINDOWS_BOOTSTRAP_BINARY")"
             test "$bootstrap_sha256" = "$WINDOWS_BOOTSTRAP_SHA256"
           fi
-          printf 'evidence=%s\n' "$evidence" >> "$GITHUB_OUTPUT"
-          printf 'evidence_sha256=%s\n' "$preflight_sha256" >> "$GITHUB_OUTPUT"
+          {
+            printf 'evidence=%s\n' "$evidence"
+            printf 'evidence_sha256=%s\n' "$preflight_sha256"
+            printf 'claim_status=%s\n' "$claim_status"
+            if [[ -n "$claim_reason" ]]; then
+              printf 'claim_reason=%s\n' "$claim_reason"
+            fi
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Write skipped Windows benchmark claim
+        if: runner.os == 'Windows' && steps.sandbox-preflight.outputs.claim_status == 'unverified'
+        shell: bash
+        env:
+          PYTHON_CMD: ${{ steps.trusted-python.outputs.command }}
+          CLAIM_REASON: ${{ steps.sandbox-preflight.outputs.claim_reason }}
+          PREFLIGHT_SHA256: ${{ steps.sandbox-preflight.outputs.evidence_sha256 }}
+          SUPERVISOR_SHA256: ${{ steps.trusted-build.outputs.supervisor_sha256 }}
+        run: |
+          set -euo pipefail
+          "$PYTHON_CMD" "$TRUSTED_SOURCE/cmux-tui/scripts/startup_benchmark_claim.py" \
+            --output-dir "$ARTIFACT_DIR" \
+            --fixture-parent-name "$(basename "$FIXTURE_PARENT")" \
+            --platform-label "$PLATFORM_LABEL" \
+            --backend "$SANDBOX_BACKEND" \
+            --trusted-sha "$TRUSTED_SHA" \
+            --baseline-sha "$BASELINE_SHA" \
+            --candidate-sha "$CANDIDATE_SHA" \
+            --supervisor-sha256 "$SUPERVISOR_SHA256" \
+            --preflight-sha256 "$PREFLIGHT_SHA256" \
+            --reason "$CLAIM_REASON"
 
       - name: Package profile attribution binaries
+        if: steps.sandbox-preflight.outputs.claim_status != 'unverified'
         shell: bash
         env:
           PYTHON_CMD: ${{ steps.trusted-python.outputs.command }}
@@ -1437,6 +1495,8 @@ jobs:
               "trusted_supervisor": release("TRUSTED_TARGET_ROOT") / "examples" / f"startup_benchmark_supervisor{suffix}",
               "trusted_preflight": release("TRUSTED_TARGET_ROOT") / "examples" / f"startup_benchmark_preflight{suffix}",
               "trusted_verifier": pathlib.Path(os.environ["TRUSTED_SOURCE"]) / "cmux-tui/scripts/verify-startup-benchmark.py",
+              "trusted_evidence_contract": pathlib.Path(os.environ["TRUSTED_SOURCE"]) / "cmux-tui/scripts/startup_benchmark_contract.py",
+              "trusted_claim_helper": pathlib.Path(os.environ["TRUSTED_SOURCE"]) / "cmux-tui/scripts/startup_benchmark_claim.py",
               "trusted_workflow": pathlib.Path(os.environ["TRUSTED_SOURCE"]) / ".github/workflows/cmux-tui-startup-benchmark.yml",
               "candidate_manifest": pathlib.Path(os.environ["ARTIFACT_DIR"]) / "candidate-product-manifest.json",
               "candidate_validation": pathlib.Path(os.environ["ARTIFACT_DIR"]) / "candidate-product-validation.json",
@@ -1560,6 +1620,7 @@ jobs:
           )
 
       - name: Run paired startup benchmark
+        if: steps.sandbox-preflight.outputs.claim_status != 'unverified'
         shell: bash
         env:
           BASELINE_BINARY_SHA256: ${{ steps.trusted-build.outputs.binary_sha256 }}
@@ -1898,7 +1959,7 @@ jobs:
           exit 0
 
       - name: Capture Windows startup profiles
-        if: ${{ always() && runner.os == 'Windows' }}
+        if: ${{ always() && runner.os == 'Windows' && steps.sandbox-preflight.outcome == 'success' && steps.sandbox-preflight.outputs.claim_status != 'unverified' }}
         continue-on-error: true
         shell: pwsh
         env:

.github/workflows/cmux-tui.yml

@@ -902,18 +902,55 @@ jobs:
           evidence="$RUNNER_TEMP/startup-containment/preflight.json"
           appcontainer_evidence="$RUNNER_TEMP/startup-containment/windows-appcontainer-feasibility.json"
           test -f "$CMUX_BENCH_TEST_WINDOWS_BOOTSTRAP"
-          "$preflight" \
-            --appcontainer-feasibility \
-            --fixture-parent "$CMUX_BENCH_TEST_FIXTURE_PARENT" \
-            --output "$appcontainer_evidence"
+          appcontainer_unavailable=0
+          if "$preflight" \
+              --appcontainer-feasibility \
+              --fixture-parent "$CMUX_BENCH_TEST_FIXTURE_PARENT" \
+              --output "$appcontainer_evidence"; then
+            python3 scripts/verify-startup-benchmark.py \
+              --appcontainer-feasibility "$appcontainer_evidence"
+          else
+            appcontainer_status=$?
+            if [[ "$appcontainer_status" -ne 78 ]]; then
+              echo "Windows AppContainer feasibility failed with exit $appcontainer_status" >&2
+              exit "$appcontainer_status"
+            fi
+            python3 scripts/verify-startup-benchmark.py \
+              --appcontainer-feasibility "$appcontainer_evidence"
+            appcontainer_unavailable=1
+          fi
           test -s "$appcontainer_evidence"
-          "$preflight" \
-            --supervisor "$supervisor" \
-            --windows-bootstrap-binary "$CMUX_BENCH_TEST_WINDOWS_BOOTSTRAP" \
-            --windows-bootstrap-sha256 "$CMUX_BENCH_TEST_WINDOWS_BOOTSTRAP_SHA256" \
-            --fixture-parent "$CMUX_BENCH_TEST_FIXTURE_PARENT" \
-            --output "$evidence" \
-            --backend windows-restricted-token-job
+          if "$preflight" \
+              --supervisor "$supervisor" \
+              --windows-bootstrap-binary "$CMUX_BENCH_TEST_WINDOWS_BOOTSTRAP" \
+              --windows-bootstrap-sha256 "$CMUX_BENCH_TEST_WINDOWS_BOOTSTRAP_SHA256" \
+              --fixture-parent "$CMUX_BENCH_TEST_FIXTURE_PARENT" \
+              --output "$evidence" \
+              --backend windows-restricted-token-job; then
+            if [[ "$appcontainer_unavailable" -eq 1 ]]; then
+              printf 'claim_status=unverified\n' >> "$GITHUB_OUTPUT"
+              printf '%s\n' 'Windows AppContainer staging-readability capability was unavailable; no restricted-token broker run was started' \
+                > "$RUNNER_TEMP/startup-containment/windows-preflight-unverified.txt"
+            else
+              printf 'claim_status=verified\n' >> "$GITHUB_OUTPUT"
+            fi
+          else
+            preflight_status=$?
+            if [[ "$preflight_status" -ne 78 ]]; then
+              echo "Windows startup containment preflight failed with exit $preflight_status" >&2
+              exit "$preflight_status"
+            fi
+            printf 'claim_status=unverified\n' >> "$GITHUB_OUTPUT"
+            if [[ "$appcontainer_unavailable" -eq 1 ]]; then
+              printf '%s\n' 'Windows AppContainer staging-readability capability was unavailable; no restricted-token broker run was started' \
+                > "$RUNNER_TEMP/startup-containment/windows-preflight-unverified.txt"
+            else
+              printf '%s\n' 'trusted Windows preflight could not observe all required native security signals' \
+                > "$RUNNER_TEMP/startup-containment/windows-preflight-unverified.txt"
+            fi
+            printf '%s\n' 'Windows startup containment claim skipped: required native security signals were unavailable.' \
+              >> "$GITHUB_STEP_SUMMARY"
+          fi
           test -s "$evidence"
           printf 'CMUX_BENCH_TEST_SUPERVISOR=%s\n' "$supervisor" >> "$GITHUB_ENV"
 
@@ -927,6 +964,7 @@ jobs:
             ${{ runner.temp }}/startup-containment/*-bootstrap-hang.json
             ${{ runner.temp }}/startup-containment/*-bootstrap-hang.dmp
             ${{ runner.temp }}/startup-containment/windows-appcontainer-feasibility-failure.json
+            ${{ runner.temp }}/startup-containment/windows-appcontainer-unavailable.txt
           if-no-files-found: warn
           retention-days: 7
 
@@ -938,10 +976,13 @@ jobs:
           path: |
             ${{ runner.temp }}/startup-containment/windows-appcontainer-feasibility.json
             ${{ runner.temp }}/startup-containment/windows-appcontainer-feasibility-failure.json
+            ${{ runner.temp }}/startup-containment/windows-appcontainer-unavailable.txt
+            ${{ runner.temp }}/startup-containment/windows-preflight-unverified.txt
           if-no-files-found: warn
           retention-days: 7
 
       - name: Run release startup harness gate
+        if: steps.windows-startup-containment-preflight.outputs.claim_status != 'unverified'
         working-directory: cmux-tui
         shell: bash
         env: