fix(conformance): classify execution-root cleanup failures

[BunsDev]

Protected run 35125287541 failed on Windows at the generic execution-root cleanup stage, before isolation validation. This change identifies the actual cleanup operation using fourteen fixed categories, with private identity branding. It preserves original errors, cleanup order and grace periods, supervisor containment, root identity/stamp checks, symlink and missing-entry handling, and earlier infrastructure-failure precedence. Native paths, PIDs and messages are not published.

The categories propagate through the schema-v2 producer and outer diagnostic wrapper/extractor. Workflow byte pins, all governed blobs, explicit lock expectations, conformance documentation and roadmap are updated. This is diagnostic instrumentation; it does not claim to repair Windows or establish aggregate acceptance.

Dependency and landing: #308 landed by verified normal merge 4355c199170461b8de0023b0ccd963de318e53ac after all eleven exact-head CI jobs passed. This PR now targets main. Require full current-head CI and review, then a normal merge preserving signed source ancestry and complete reviewed tree. PR #307 has overlapping binding changes and needs sequential reconciliation.

Binding: signed source 7dda439daa59ee350ff12cd195ff169b52e1085c, tree 347c0b5300498d612f5411c1aee3372731ffc4f1; binding head 7e05e72f4ee1de2a2d49eed205a148f44a078908. Independent review verified all 25 governed files, 10 production deltas, 12 explicit expectations, 20 Unix and 16 Windows pins, and 41 documentation rows. Candidate/counterpart identities and publication restrictions remain unchanged.

Verification: normal suite 1,236 passed / 63 skipped; bound heavy suite 909 passed / 35 skipped; TypeScript, lint and diff checks passed. Focused coverage includes 65 diagnostic tests and 25 existing artifact-root regressions. Independent code and binding reviews found no blockers. After delivery: rebind SDK to the actual merge, rotate both scopes, and obtain fresh protected validation.

Refs #219; OpenCoven/sdk#38; OpenCoven/sdk#45. Preserve chat, running app and active worktrees.

Review follow-up: added the explicit owned-temp-directory.mjs golden row requested in review5226368815. Its exact pin test passed, the lock suite passed95 tests with1 skip, and the refreshed bound heavy suite passed909 tests with35 skips. Independent incremental binding review, TypeScript and lint passed. The source correction changes only that test expectation; governed executable bytes remain unchanged.

[Copilot]

🔵 Needs a closer look

A moderate governed-file lock expectation remains unresolved, and the stacked binding needs final human validation.

Pull request overview

Adds privacy-preserving, fixed-category diagnostics for process and execution-root cleanup failures.

Changes:

• Classifies cleanup failures by operation.
• Propagates diagnostics through conformance reporting.
• Updates tests, declarations, integrity pins, locks, and documentation.

File summaries

File	Summary
src/process-cleanup-diagnostics.test.ts	Tests process cleanup classifications.
src/phase1-conformance-lock.test.ts	Verifies authority and lock expectations.
src/owned-temp-cleanup-diagnostics.test.ts	Tests filesystem cleanup classifications.
scripts/process-owned-artifact-root.mjs	Classifies process and root cleanup failures.
scripts/process-owned-artifact-root.d.mts	Declares process cleanup diagnostic APIs.
scripts/phase1-schema-v2-producer.mjs	Publishes bounded cleanup diagnostics.
scripts/phase1-conformance.mjs	Propagates outer diagnostics.
scripts/owned-temp-directory.mjs	Brands filesystem cleanup failures.
scripts/owned-temp-directory.d.mts	Declares filesystem cleanup diagnostic APIs.
phase1-conformance.lock.json	Updates governed bindings and hashes.
docs/roadmap.md	Records diagnostic delivery status.
docs/phase1-conformance.md	Documents diagnostics and bindings.
.github/workflows/client-v1-conformance.yml	Updates workflow integrity pins.

Review details

Suppressed comments (1)

src/phase1-conformance-lock.test.ts:104

• The immutable expectedBehaviorAuthority.files golden list is meant to pin the governed behavior objects, but this PR changes scripts/owned-temp-directory.mjs and the lock/workflow digests for it without adding an expectation here. As a result, the exact reviewed blob/SHA for the cleanup implementation is not asserted by this test; add the fe9b011c8e6ac4f741f052dc15c7405bad390165 / 95f546ef9ed614f2a0f55d356ddfc54c943fc53b595b4eebebfcbd4db68e5c0b row.

      path: 'scripts/phase1-schema-v2-producer.mjs',
      blob: '76c8a0e31e55c8c1478dcb9657a1570d697b155c',
      sha256: '2e5fe8808230ad318aa86408bbad2004dbe4fd1c074f88de11fc581b227e0a51',

• Files reviewed: 13/13 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.