feat(windows): un-skip Docker driver tests and add basic NTFS ACL vault check

[stack72]

Summary

Stream A of the Windows-GA push (follows #1278's Stream 0 regression net). Two work items.

Work item 1 — Docker driver tests on Windows

Replaces the #!/bin/sh mock-script approach with a TypeScript-based mock launched through a tiny platform-specific shim — .cmd on Windows, chmod-able .sh on POSIX, both invoking deno run against the same mock TS source. Un-skips 10 tests that were previously gated on Deno.build.os === "windows". Production driver behavior is unchanged; only the stub binary form changed. Stream 0's POSIX-only SIGTERM and stream-interleaving tests stay gated because they exercise POSIX signal semantics.

Work item 2 — Vault NTFS ACL check (Windows-only behavior change)

⚠️ Behavior change for Windows users only. Before this PR, validateSshKeyPermissions returned early on Windows — SSH keys with broad ACLs would be silently accepted. After this PR, the vault rejects them with a clear remediation hint. POSIX behavior is byte-identical (verified: same Deno.stat, same (mode & 0o077) !== 0 check, same error string).

Adds src/infrastructure/security/file_security_check.ts with checkFileNotBroadlyReadable(path):

• POSIX: replicates the existing (stat.mode & 0o077) !== 0 rule with the identical error message format.
• Windows: shells out to PowerShell Get-Acl, walks each ACE, flags Allow entries that grant Read/ReadAndExecute/FullControl to broad principals (Everyone, Authenticated Users, Anonymous Logon, BUILTIN\Users — plus their SID forms for locale-variant Windows). Surfaces remediation as icacls /remove:g. Fails closed on PowerShell errors, parse failures, or paths containing NUL/CR/LF.

Scope is intentionally Option C — basic broad-principal check, not full ACL semantics. The helper does not walk inheritance, honour Deny ACEs, inspect alternate data streams, or resolve nested group membership. The intent is to match the bar the POSIX check already sets.

LocalEncryptionVaultProvider.validateSshKeyPermissions now delegates to the helper, prepending "SSH key " to preserve the historical error format that other code/tests parse. Adds parallel Windows-only test cases that grant Everyone:(R) via icacls and assert the vault rejects the key.

POSIX impact

None. The error string is byte-identical. The control flow is identical. The Stream 0 vault-directory-mode test and vault_cel_integration_test.ts are both green. macOS/Linux users see no behavior change.

Windows impact

Real, intentional, security-positive. The vault now actually checks ACLs on Windows, where it previously did not. Existing Windows vault users with SSH keys that have broad ACL grants (which can be the default on user-profile files in some configurations) may be locked out and see the new error message with icacls remediation guidance.

Out-of-scope follow-ups

• swamp doctor vault — TODO landed in src/domain/audit/doctor/check.ts. No doctor vault check exists today; deferring to keep this PR scoped. Worth landing soon to give Windows users proactive insight into their ACL state.
• Locale-variant Windows validation. SID fallbacks cover most cases; needs verification on a non-en-US runner.
• swamp doctor vault is the right surface for the disclosure about what the platform check does and doesn't cover.

Test Plan

• deno fmt --check clean (1286 files)
• deno lint clean (1165 files)
• deno check clean
• deno run test — 5154 passed, 0 failed, 27 ignored
• deno run compile produces a working binary
• Stream 0 regression tests green (vault directory 0o700, vault CEL integration, Docker SIGTERM and interleaving)
• All 10 previously-skipped Docker driver tests now run on Windows
• Verified POSIX error string is byte-identical to pre-PR

[github-actions]

Code Review

Well-structured PR. The security check extraction is clean, the icacls parser is well-tested with cross-platform unit tests, and the fail-closed approach throughout checkWindowsAcl is the right call for security-sensitive code. The createMockDriverCommand abstraction for cross-platform test mocking is a good pattern.

Blocking Issues

None.

Suggestions

1. Multi-line comment blocks — CLAUDE.md convention is "one short line max" for comments. The 11-line TODO in src/domain/audit/doctor/check.ts:32-42, the 8-line JSDoc on createMockDriverCommand in the test file, and the 24-line module docstring on file_security_check.ts all exceed that. The module docstring documents the security scope/threat model so it's arguably the right trade-off for a security file, but the TODO and test helper docblock could be trimmed to a single line each (e.g. // TODO(windows-ga): add swamp doctor vault surface — see PR #1281 for scope).

2. No timeout on icacls subprocess — checkWindowsAcl awaits cmd.output() with no AbortSignal. While icacls is a local system binary that should return instantly, a defensive timeout (e.g. 10s) would prevent a hung subprocess from blocking the vault indefinitely. CLAUDE.md mentions AbortSignal for network calls specifically, so this is just a hardening suggestion.

3. (R) substring match edge case — READ_GRANTING_TOKENS uses .includes("(R)") against the rights string. This is correct for icacls's current output format, but if icacls ever emits individual SDDL atoms like (RC) (Read Control), the (R) token wouldn't false-positive because the ) must follow R. Just noting the reasoning is sound — no change needed.

[github-actions]

Adversarial Review

Critical / High

None found.

Medium

1. Non-English Windows locale bypasses the ACL check (src/infrastructure/security/file_security_check.ts:56-61, 273-279).
   The BROAD_WINDOWS_PRINCIPALS list uses English names (Everyone, BUILTIN\Users, etc.). On localized Windows, icacls prints localized names — e.g., Jeder (German), Tout le monde (French). The localeCompare matches case variants but cannot bridge "Jeder" → "Everyone". The SID fallback (p.sid) only fires when Windows cannot resolve the SID to a name, which is rare on a functioning localized system — icacls will almost always print the localized name rather than the raw SID. The net effect is that the check silently passes on non-English Windows, accepting files with broad ACLs as secure. The PR description acknowledges this as out-of-scope, and the check is strictly additive (previously Windows returned early unconditionally), so this does not block. Worth noting that the PR body's claim that "SID fallbacks cover most cases" overstates coverage for localized Windows.

2. No timeout on icacls subprocess (src/infrastructure/security/file_security_check.ts:130-136).
   new Deno.Command("icacls", ...).output() runs without an AbortSignal. On a network-mounted path where the domain controller is unreachable, icacls can hang indefinitely, blocking the vault operation with no user-visible progress. A 10-second AbortSignal.timeout() would bound the wait and let the fail-closed branch surface a clear error.

Low

1. Remediation hints interpolate path into shell commands (src/infrastructure/security/file_security_check.ts:110-111, 177-178).
   The POSIX hint Run 'chmod 600 ${path}' to fix. and the Windows hint `icacls "${path}" /remove:g ...` embed the raw path. If the path contains shell metacharacters (spaces, semicolons, backticks), a user copy-pasting the hint could trigger unintended shell expansion. Not a code vulnerability (it's a human-readable message), but quoting the path in the POSIX hint (e.g., chmod 600 '${path}') would make the suggestion safe to paste.

2. TOCTOU between permission check and key read — inherent to the check-then-use design and identical to the prior POSIX behaviour. Not actionable here.

Verdict

PASS. This is well-constructed security-hardening code. The icacls parser is carefully designed (case-insensitive path stripping, :( split anchor, parens-based summary filter, fail-closed on empty ACEs or parse errors). The POSIX path is byte-identical to the prior inline check. The Docker test refactoring is mechanical and correct. The two medium findings are acknowledged limitations, not regressions — the Windows ACL check is strictly additive over the previous return on Windows.