Fix protected conformance runtime isolation

[BunsDev]

Summary

• embed the no-reparse path guard inside the restricted Windows child bootstrap
• clone root-owned local authority sources with exact safe.directory, --local, and --no-hardlinks
• copy exact Node, pnpm, and rustup executables into the root-owned Unix trust boundary
• route both the restricted command and governed harness through the copied pnpm executable
• repin Phase 1 harness authority and verification metadata

Validation

• 542 normal unit tests passed, 61 skipped
• 243 heavy unit tests passed, 34 skipped
• lint and typecheck passed
• Unix shell syntax and native artifact-handoff tests passed
• privileged UID-containment tests remain covered by the Linux/macOS CI matrix

[Copilot]

🔵 Needs a closer look

It modifies security-sensitive isolation and toolchain trust-boundary behavior across scripts and CI workflow, which warrants final human validation of the threat model and runner/runtime assumptions.

Pull request overview

This PR tightens the Phase 1 conformance “protected runtime” isolation model by moving Windows path hardening into the restricted child bootstrap, eliminating shared-object Git clones for root-owned checkouts, and ensuring the Unix supervised boundary uses broker-resolved, root-copied toolchain executables (Node/pnpm/rustup) rather than relying on ambient paths or Corepack.

Changes:

• Route Phase 1 harness operations through a copied pnpm executable and remove explicit corepack invocation paths.
• Harden Unix authority cloning by using safe.directory=<sourceRoot> plus git clone --local --no-hardlinks (no alternates/shared objects).
• Update workflow/tests/docs/lock metadata to reflect the new isolation mechanics and repinned harness authority.

File summaries

File	Description
src/specification-guards.test.ts	Updates expectations for harness invoking pnpm directly rather than corepack pnpm@....
src/phase1-conformance.test.ts	Adds assertions around non-shared Git clone behavior and adjusts toolchain observation to use a PATH-resolved pnpm.
src/phase1-conformance-lock.test.ts	Repins expected harness authority revision/tree and associated file digests.
src/client-v1-conformance-workflow.test.ts	Updates workflow assertions for resolved tool executables and pnpm usage without Corepack.
scripts/unix-producer-supervisor.test.sh	Extends supervisor fixture to pass explicit Node/pnpm/rustup executables into the supervised boundary.
scripts/unix-producer-supervisor.sh	Requires and copies broker-resolved Node/pnpm/rustup into a root-owned trusted directory; PATH is rooted through that trust boundary.
scripts/unix-producer-command.sh	Switches frozen Unix install/build steps from corepack pnpm ... to pnpm ... under the supervised boundary.
scripts/phase1-conformance.mjs	Uses pnpm directly, hardens local clone semantics with safe.directory + --local --no-hardlinks, and updates packaging/observation commands accordingly.
phase1-conformance.lock.json	Updates the pinned harness revision and file digests to match the repinned authority state.
docs/phase1-conformance.md	Documents the revised isolation model (copied executables, local clone constraints) and updates byte/digest tables.
.github/workflows/client-v1-conformance.yml	Embeds the Windows no-reparse guard into the restricted child bootstrap and passes resolved Node/pnpm/rustup paths into the Unix supervisor.

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.