fix(console): batch Windows catalog ACL verification

[mohanagy]

Summary

Closes #284.

Windows Console catalog discovery previously launched the trusted PowerShell ACL helper once for the canonical configuration directory and again for every candidate. Selected-profile mutations invoke fresh catalog discovery before each write, so the affected dashboard contracts could launch multiple helpers and intermittently cross their existing five-second boundary under Windows CI load.

This keeps the same trusted boundary but verifies the canonical directory and each candidate together in the existing bounded batch helper. Empty or wholly rejected catalogs still verify the directory alone before they can report ready. No timeout, test skip, worker setting, coverage threshold, profile revalidation, or ACL fail-closed behavior changed.

Evidence

• New focused regression test failed before the change because catalog discovery ignored the batch verifier, then passed after it.
• Windows first-run contracts now assert the exact combined directory-plus-file helper boundary.
• Independent source review approved the exact diff, including the deferred directory-only check for empty/rejected catalogs.
• Focused dashboard catalog test: pass.
• tests/console-dashboard-application-service.test.ts: 28 passed, 2 skipped.
• tests/console-windows-first-run.test.ts: 11 passed.
• npm run test:oauth-console, npm test, npm run test:coverage, lint, typecheck, build, smoke CLI, and pack check: pass locally.
• One aggregate-only packaged-fixture observation is tracked under test: eliminate aggregate-suite upstream startup instability #255; the exact focused package-contract test passed without a source change.

Security properties preserved

• The Windows helper remains the sole ACL authority and fails closed on false or error.
• Candidate lstat/realpath/stat identity checks and guarded open/revalidation remain unchanged.
• No configuration name, metadata, content, or path is returned until the batch ACL boundary succeeds.
• Existing test-only legacy ACL seam behavior is retained; production defaults to the batch verifier.

Summary by CodeRabbit

• New Features

  • Added support for batched Windows ACL verification when discovering console configuration.
  • Configuration discovery now verifies relevant directories and files together for improved consistency.

• Bug Fixes

  • Preserved trusted-configuration safeguards while reducing redundant Windows permission checks.
  • Improved handling when ACL verification cannot confirm a trusted configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 98aa41d9-3fb0-4ca0-8866-3fbede877b92

📥 Commits

Reviewing files that changed from the base of the PR and between daed340 and 1229f17.

📒 Files selected for processing (3)

• src/console/console-config-catalog.ts
• tests/console-dashboard-application-service.test.ts
• tests/console-windows-first-run.test.ts

---

📝 Walkthrough

Walkthrough

discoverConsoleConfigCatalog now supports batched Windows ACL verification for trusted directories and candidate files, tracks ACL boundary verification, and falls back to directory-only validation when necessary. Tests cover batched calls and updated Windows lifecycle verification counts.

Changes

Windows ACL verification batching

Layer / File(s)	Summary
ACL verifier contract and dispatch src/console/console-config-catalog.ts	Adds the batched verifier type and discovery option, and routes Windows checks through batched or per-path verification.
Candidate and boundary verification src/console/console-config-catalog.ts	Verifies directory and candidate paths together, tracks the verified ACL boundary, and performs a final directory check when required.
Batched ACL verification tests tests/console-dashboard-application-service.test.ts, tests/console-windows-first-run.test.ts	Adds coverage for batched directory/file verification and updates Windows first-run and lifecycle expectations.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant discoverConsoleConfigCatalog
  participant readTrustedConfiguration
  participant windowsAclPathsVerifier
  discoverConsoleConfigCatalog->>readTrustedConfiguration: pass candidate paths and ACL options
  readTrustedConfiguration->>windowsAclPathsVerifier: verify directory and candidate file
  windowsAclPathsVerifier-->>readTrustedConfiguration: return ACL result
  readTrustedConfiguration-->>discoverConsoleConfigCatalog: return catalog status

Loading

Possibly related PRs

• mohanagy/miftah#206: Earlier trusted configuration discovery and Windows ACL verification changes.
• mohanagy/miftah#223: Related Windows ACL checks in discoverConsoleConfigCatalog and readTrustedConfiguration.
• mohanagy/miftah#272: Introduces related batched Windows ACL verification mechanisms and test patterns.

Poem

A rabbit checks paths in a neat little queue,
One batch for the folder, one file in view.
Old calls hop aside as the new helpers run,
Boundary flags sparkle beneath the Windows sun.
“Verified!” cries the rabbit—“the catalog’s begun!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: batching Windows catalog ACL verification.
Description check	✅ Passed	The description covers the summary, security properties, and validation evidence, even if it is not formatted exactly like the template.
Linked Issues check	✅ Passed	The PR addresses the linked Windows timeout boundary with a focused regression and preserves ACL, timeout, and failure behavior requirements.
Out of Scope Changes check	✅ Passed	The changes stay focused on Windows ACL batching and related tests, with no clear unrelated code or behavior changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/284-windows-console-timeout

---

_{Comment @coderabbitai help to get the list of available commands.}