{
  "schema": "railiance-platform.operator-browser-native-windows.v1",
  "prepared_at": "2026-11-06T18:49:12.290563+00:00",
  "trigger_workplan": "railiance-apps/RAPPS-WP-0014-T03",
  "problem": "Founder reports WSL Chrome password/OTP delay, tab/close failures and random wrong controls. Same real-launcher X11/software probe remains unreliable; native Windows Edge disposable-profile probe is founder-confirmed responsive.",
  "user_native_windows_verdict": "Everything works normally",
  "windows_acl_setup": "Use numeric current-user SID with icacls and verify protected owner-only DACL before browser creation. Set-Acl attempted domain-name translation and failed with a domain trust error; no domain/account setting changed.",
  "native_profile": "unique private Windows temporary folder; normal browser profile never selected",
  "url_transport": "Authorization URL to PowerShell worker uses stdin, not worker argv/encoded script or a handoff file. Edge receives initial authorization URL as its browser startup argument, as Linux Chromium did. Credential-bearing query keys are refused.",
  "native_windows_process_environment": "Clear BAO_TOKEN, VAULT_TOKEN and OPENBAO_TOKEN in child process only",
  "callback_allowlist": [
    "http://localhost:8250/oidc/callback",
    "http://127.0.0.1:8250/oidc/callback"
  ],
  "issuer": "https://kc.coulomb.social",
  "wsl_selection": "microsoft in kernel release; fail closed without fallback to shared/default browser",
  "non_wsl": "existing pinned Linux Chromium path retained",
  "lifecycle": "Owned PID/start-time/executable guards, close after browser exit or 600s, bounded private-profile removal retry",
  "tests": {
    "operator_unit_cases": 15,
    "operator_unit_status": "passed",
    "native_fixture": {
      "production_guard_refuses_local_fixture": true,
      "private_acl_verified_before_launch": true,
      "ipv4_and_localhost_redirect_reached": true,
      "owned_process_closed": true,
      "private_profile_removed": true,
      "native_identity_request": false
    },
    "final_native_windows_credential_query_guard": "passed without browser creation or network request"
  },
  "sources_sha256": {
    "scripts/operator-browser/xdg-open": "a6794d50dbe4131ff2b3fd259365d5f30d467702daf8d8d4f63265bab47e2e51",
    "scripts/operator-browser/windows_browser.py": "fd952b6960cac3159e50708e492163fcab8540f7b9d6227e88ce75c5626b2824",
    "tests/test_operator_windows_browser.py": "b0e87ff253a978649015ddc80c27ff0478834144db3d0938d229b7edd5cdbcdf"
  },
  "actual_attended_owner_login_with_new_launcher": "pending",
  "scope_limits": [
    "No issuer/role/callback registrations, output allowlist, token-helper control, factor policy or credential grants changed",
    "No real browser page/profile contents, authorization URL, cookies, token helper, password or OTP read by the agent",
    "Underlying WSLg issue is bypassed, not claimed repaired"
  ]
}