feat: expose fail-closed Windows cleanup proof

[Eli Pinkerton (wallstop)]

Summary

• expose resourceSafe only after the activation-owning Windows container returns Unity successfully
• transfer nonce-bound proof through an isolated runner-temp mount and preserve build exit semantics
• bound cleanup to 120 seconds and fail closed on every proof infrastructure error
• add executable PowerShell, TypeScript, generated-dist, and lifecycle contract validation
• add conservative upstream sync automation: only documentation-only changes auto-merge; all executable/config/dependency changes open a singleton remediation issue

Verification

• 362 tests passed, 2 pre-existing skips
• TypeScript typecheck passed
• lint: 0 errors (18 upstream warnings)
• Windows PowerShell AST contract passed
• RC001-RC013 lifecycle verifier passed
• actionlint passed (shellcheck integration deferred to Linux CI because the local ARM shellcheck binary hangs)

---

Note

High Risk
Changes Unity license lifecycle signaling, Windows Docker/env wiring, and org-wide build-lock release semantics; mistakes could block paid builds or report unsafe cleanup as safe.

Overview
Adds a resourceSafe action output that stays false by default and becomes true only on Windows when the activation-owning container writes a nonce-bound proof after a successful Unity license return; build exit codes stay authoritative and uncertain cleanup stays fail-closed.

Runtime wiring creates a per-attempt proof under RUNNER_TEMP, mounts it into the Windows Docker image, passes nonce/path env vars, and sets the output after ResourceCleanupProof.consume in the local Windows build path.

CI and fork policy run verify-resource-cleanup-contract.mjs (RC001–RC014) in Integrity, enforce a fresh dist diff, add a Windows push job for the PowerShell proof contract, and gate the paid-license Windows matrix behind org build locks plus classify/release/verify steps (manual dispatch only). Mac/Ubuntu paid matrices drop automatic push triggers, use max-parallel: 1, and macOS builds run only on game-ci/unity-builder.

Fork maintenance adds UPSTREAM_COMMIT, FORK_MAINTENANCE.md, scheduled Upstream Sync (docs-only auto-merge; executable upstream changes open a singleton tracking issue), and removes the cats PR workflow.

^{Reviewed by Cursor Bugbot for commit 6574b30. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review

Please review exact head 0eb9b4f, focusing on fail-closed owning-container proof, non-masking time bounds, generated dist, and upstream-sync privilege separation.

[Eli Pinkerton (wallstop)]

Copilot review

Please review exact head 0eb9b4f, focusing on fail-closed owning-container proof, non-masking time bounds, generated dist, and upstream-sync privilege separation.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review

Please review exact head 57a403b; the only delta removes the inherited broken cat-comment workflow after its 403 CI failure.

[Eli Pinkerton (wallstop)]

Copilot review

Please review exact head 57a403b; the only delta removes the inherited broken cat-comment workflow after its 403 CI failure.

[Copilot]

Copilot review

Please review exact head 0eb9b4f, focusing on fail-closed owning-container proof, non-masking time bounds, generated dist, and upstream-sync privilege separation.

Reviewed exact head 0eb9b4f with the requested focus areas.

No concrete defects found in:

• fail-closed owning-container proof gating (resourceSafe stays false unless nonce proof is written after successful Windows return),
• non-masking bounded return behavior (120s bound with warnings/fail-closed semantics while preserving build exit authority),
• generated dist contract consistency (yarn build + contract checks are consistent), and
• upstream-sync privilege separation (classification guardrails, trusted-policy revalidation, and metadata checks before merge).

I also checked current CI: the only failure is the Cats 😺 workflow (403 token permission to post comment), which is unrelated to these lifecycle/security changes.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review

Please review exact head 8c097cc: finalizer fetches verified upstream, checked diff materialization prevents swallowed failures, and --no-renames classifies both sides of renames.

[Eli Pinkerton (wallstop)]

Copilot review

Please review exact head 8c097cc: finalizer fetches verified upstream, checked diff materialization prevents swallowed failures, and --no-renames classifies both sides of renames.

[Copilot]

Copilot review

Please review exact head 57a403b; the only delta removes the inherited broken cat-comment workflow after its 403 CI failure.

Reviewed exact head 57a403b. The only delta is deletion of .github/workflows/cats.yml, and Actions logs for the failing Cats 😺 run confirm the prior 403 (Resource not accessible by integration) came from issue-comment posting with insufficient token permissions. No defects found in this change.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review

Please review exact head efeb5ad; new delta makes the Windows matrix fail if any successful build lacks activation-owning resourceSafe=true proof.

[Eli Pinkerton (wallstop)]

Copilot review

Please review exact head efeb5ad; new delta makes the Windows matrix fail if any successful build lacks activation-owning resourceSafe=true proof.

[Copilot]

Copilot review

Please review exact head 8c097cc: finalizer fetches verified upstream, checked diff materialization prevents swallowed failures, and --no-renames classifies both sides of renames.

Reviewed exact head 8c097cc in the requested areas. No defects found: finalize re-checks live upstream SHA and aborts on drift before merge, checked diff materialization (git diff ... >/tmp/upstream-changed-files + mapfile) keeps classification failures non-silent under set -Eeuo pipefail, and --no-renames forces rename add/delete paths to be classified on both sides.

[Copilot]

Copilot review

Please review exact head efeb5ad; new delta makes the Windows matrix fail if any successful build lacks activation-owning resourceSafe=true proof.

Reviewed exact head efeb5ad focusing on the new Windows matrix proof gate. The added Verify activation-owning cleanup proof step enforces the intended fail-closed behavior: every successful build attempt must report resourceSafe == true, and the job fails if no attempt succeeds. No defects found in this delta.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review

Please review exact head 0ec7ce7; new delta makes Linux integrity rebuild dist and fail on any generated-source drift.

[Eli Pinkerton (wallstop)]

Copilot review

Please review exact head 0ec7ce7; new delta makes Linux integrity rebuild dist and fail on any generated-source drift.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review exact commit d5405bc. Please report every issue, including minor findings, or explicitly state zero issues.

[Eli Pinkerton (wallstop)]

copilot-pull-request-reviewer review exact commit d5405bc. Please report every issue, including minor findings, or explicitly state zero issues.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

5 issues from previous reviews remain unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d5405bc. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 22 out of 26 changed files in this pull request and generated no new comments.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review exact commit 13ec42d. Please report every issue, including minor findings, or explicitly state zero issues.

[Eli Pinkerton (wallstop)]

copilot-pull-request-reviewer review exact commit 13ec42d. Please report every issue, including minor findings, or explicitly state zero issues.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 26 changed files in this pull request and generated no new comments.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review exact commit 6574b30. Please report every issue, including minor findings, or explicitly state zero issues.

[Eli Pinkerton (wallstop)]

copilot-pull-request-reviewer review exact commit 6574b30. Please report every issue, including minor findings, or explicitly state zero issues.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6574b30. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 22 out of 26 changed files in this pull request and generated no new comments.