fix(control): provision native helper before launch

[LogicDuke]

Final bounded D062 lifecycle repair for PR #85.

Finding:

• CURRENT P2 availability/deployability defect.
• The mandatory Windows owner/DACL helper and generated provenance were not
  guaranteed by the supported clean source-checkout launch lifecycle.
• control and cockpit:live could build TypeScript and launch without the
  helper/provenance, causing the control channel to fail closed with
  HELPER_PROVENANCE_MISSING.
• No authorization bypass, token disclosure, HMAC bypass, or data-integrity
  impact.

Repair:

• supported launch ordering is now TypeScript build → helper provisioning gate
  → runtime launch;
• new bounded tools/control-owner/ensure-helper.mjs;
• non-Windows exits without native compilation;
• Windows with valid existing helper+provenance is idempotent;
• either artifact missing causes the existing trusted helper build to run;
• build failures stop launch;
• helper/provenance integrity and runtime hash-before-exec remain unchanged;
• CI Windows lane now exercises the same provisioning gate as supported operator
  launch.

Circuit-breaker evidence:

• PR55/PR74-style family-closure audit completed before commit;
• verdict: FAMILY_CLOSED_CURRENT_CANDIDATE_SOUND;
• fresh independent validation completed;
• no directly-related CURRENT lifecycle defect remains;
• stale source vs existing mutually-valid binary/provenance is an accepted
  design limitation under the adopted binary↔provenance invariant, not a
  CURRENT finding;
• no reconstruction is warranted.

Exact identity:

• base:
  aaa7ddc
• head:
  f12c0ae
• 1 commit
• 4 changed files
• patch SHA256:
  3C14132539AEB18DD5E86FA6A73C375436D9AF911185D550EF1EB8E6EB278280
• patch bytes:
  12950

Validation:

• helper lifecycle family-closure audit PASS;
• fresh independent validation PASS;
• clean-artifact Windows lifecycle PASS;
• exe-only partial state PASS;
• provenance-only partial state PASS;
• provenance SHA == exact helper bytes PASS;
• launch-lifecycle tests: 8 passed / 1 skipped;
• tests/control: 144 passed / 1 skipped;
• full suite: 2035 passed / 1 skipped;
• typecheck PASS;
• lint PASS;
• build PASS;
• git diff --check PASS.

Quarantine:

• F1 FIXED and untouched;
• F2 FIXED and untouched;
• F3 FIXED and untouched;
• atomicity residual DUPLICATE/resolved and untouched;
• effective-rights P3 remains CARRY_OBLIGATION and untouched.

This Draft PR grants no merge authority.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CepCzSGN8rDhJGx69N81NU

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e97dca33-b582-4c87-802e-7a370b0983b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T07:46:47.638469Z	f12c0ae	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f12c0ae096

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate artifacts before skipping the build

When both files exist but do not form a valid pair, this gate treats provisioning as complete. For example, if build.mjs is interrupted after replacing the executable but before rewriting its provenance, the next supported Windows launch skips rebuilding; runtime verification then reports HELPER_HASH_MISMATCH, leaving the control channel unavailable until someone manually deletes or rebuilds the artifacts. Validate the provenance and executable hash before taking the idempotent path, or rebuild when validation fails.

Useful? React with 👍 / 👎.

[LogicDuke]

Superseded (circuit-breaker quarantine), not merged and not repaired in place. Adjudication PR89_CURRENT_P2_CIRCUIT_BREAKER_SUPERSEDE: the lifecycle repair itself carries a CURRENT P2 in the same helper/provenance family (ensure-helper.mjs:57 skips on artifact existence without validating pair integrity; an interrupted build.mjs leaves exe-B + provenance-A, which the gate skips and the runtime rejects with HELPER_HASH_MISMATCH, leaving the control channel unavailable until manual recovery). Decision: SUPERSEDE_PR89_RECONSTRUCT_FROM_PARENT. A coherent replacement covering the full helper/provenance artifact-state matrix will be reconstructed directly from parent aaa7ddc under a separately authorized gate. Branch and Codex thread preserved as supersession evidence; not deleted, not resolved.