governance(v21): authorize Windows npm execution policy repair

[laiqian0239-glitch]

Work package

V21-DELEGATED-NPM-WINDOWS-EXEC-POLICY

Generic base-owned governance repair authorization only. No Learned Policy product/runtime implementation is included.

Proven root cause

While validating Learned Policy PR #379 on Windows, the repository's generic delegated npm-lock topology policy failed before npm could start:

• shared/release/implementationBranchPolicy.js selects npm.cmd on win32
• it passes that .cmd shim directly to child_process.execFileSync
• Windows probe result: EINVAL, errno -4071
• the exact trusted-main base c5b7d23dcd6a7aafef6f1b8749369ab008606c8b reproduces the same three positive dependency-policy fixture failures: 0 pass / 3 fail
• the policy and test blobs are unchanged between trusted main and feat(v21): Learned Policy decision outcome closed loop successor #379, so this is not a Learned Policy regression

No #379 scope expansion or product exception is permitted.

Exact authorization identity

• trusted main: c5b7d23dcd6a7aafef6f1b8749369ab008606c8b
• authorization branch: governance/v21-delegated-npm-windows-exec-policy-authorization
• exact proposal Head: 76c9aeb3a2606b68c3f30a42190232d729ff66b3
• topology: ahead 1 / behind 0
• changed files: exactly 1 authorization JSON

Future implementation seal

Future implementation branch, only after ordinary authorization merge:

fix/v21-delegated-npm-windows-exec-policy

Exactly two paths:

• shared/release/implementationBranchPolicy.js
• tests/wp0/v21-delegated-dependency-policy.test.js

Canonical path-set SHA-256:
da9c824293effd3aa16d3837ba461b488ef62f20e806e18e5115ae42573e268b

Mandatory first implementation commit is test-only on:

• tests/wp0/v21-delegated-dependency-policy.test.js

Single-test path digest:
f0bd84f25ba0b97479477fc6d88d483833e66af32f720fe8aa1df948201ff1e2

OSS-fit

Reuse existing Node.js child_process and the repository's existing trusted process/policy seam. No second process runner, package-manager wrapper, workflow or dependency is authorized. The direct Windows execFileSync('npm.cmd', ...) path must be retired and replaced by a platform-correct trusted invocation while preserving static npm args, offline mode, timeout, stdout/status semantics and fail-closed topology checks.

Boundaries

No temporary bypass, warning-only closure, continue-on-error, test weakening, shell interpolation of untrusted data, network fallback, Learned Policy-specific exception, workflow/dependency change, rebase/amend/force-push/squash, release, publish or promotion.

This authorization is effective only if ordinary two-parent merged while live main remains exactly the trusted base above. If main moves first, rebuild forward-only from fresh main.

Summary by CodeRabbit

• Documentation
  • Added governance authorization documentation for the delegated Windows npm execution repair.
  • Documented approved scope, validation requirements, repair behavior, restrictions, and release controls.
  • No changes were made to user-facing functionality or public APIs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c2a60040-a2af-41ed-b924-f0e2ab4acc23

📥 Commits

Reviewing files that changed from the base of the PR and between c5b7d23 and 76c9aeb.

📒 Files selected for processing (1)

• governance/layered-ci/v21-delegated-npm-windows-exec-policy-authorization.json

---

📝 Walkthrough

Walkthrough

The pull request adds a governance authorization document for repairing delegated npm execution on Windows. It defines scope, implementation constraints, validation requirements, merge rules, and restrictions on release and promotion actions.

Changes

npm Windows execution authorization

Layer / File(s)	Summary
Authorization scope and trusted execution seam governance/layered-ci/v21-delegated-npm-windows-exec-policy-authorization.json	Defines the trusted base, authorized branch scope, digest rules, selected Node.js process seam, and prohibited direct npm.cmd invocation or additional infrastructure.
Repair implementation and validation contract governance/layered-ci/v21-delegated-npm-windows-exec-policy-authorization.json	Specifies permitted files, red-test requirements, the reproduced Windows EINVAL failure, preserved execution parameters, fail-closed behavior, and the required implementation sequence.
Merge and release restrictions governance/layered-ci/v21-delegated-npm-windows-exec-policy-authorization.json	Prohibits scope expansion, workflow and dependency changes, release actions, publishing, promotion, and unauthorized governance use.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 76c9a

This PR only authorizes a narrowly scoped future Windows repair and does not change executable runtime behavior or production access. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the governance authorization for the Windows npm execution policy repair documented in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch governance/v21-delegated-npm-windows-exec-policy-authorization

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}