[amrmelsayed]

Summary

Native (non-WSL) Windows support at parity with macOS and Linux, built over 12 phases (1-11 plus 3b) in one PR. WSL 2 stays documented as a supported alternative.

Closes #1658

Changes

• Shellper transport over named pipes with a Windows-only per-session secret and reconnect identity (schema v19). The POSIX endpoint, handshake and no-secret path are unchanged, pinned by goldens.
• Process census (PowerShell CIM, with creation times), killSessionTree session teardown, and a per-session Job Object for re-parented descendants. Orphan and husk sweeps work on Windows.
• Tower lifecycle: tower stop over HTTP (POST /api/shutdown: keyed, local, not tunnel-borne). A Tower started inside a session launches through CIM so it survives that session.
• Git Bash is the only plumbing shell (layout-verified resolver; System32 bash is rejected). One PATHEXT shim resolver (codev-sdk/node/executable) and an MSYS path translator. Forge, spawn, postSpawn, afx dev and porch checks all route through them. PowerShell for human shells.
• Worktree links without Developer Mode (junction / hard link / copy). Handle-tolerant worktree removal.
• ConPTY render-gate capture recorder and replay harness.
• Codev IDE server (Tower-managed Codev IDE server from npm: embed sidebar vsix, discover codev-ide-server on PATH, pass --extensions-dir #1789) on Windows.
• POSIX residue sweep, including the codev entrypoint, which was a silent no-op on Windows, and a drive-root hang. A preinstall guard refuses a Node version that has no prebuilds. doctor gains Windows prerequisite checks.
• windows.yml (dispatch only, never required): probes, targeted tests, and the unit / cli-e2e / post-release-e2e suites on Node 22 and 24.
• Docs: DEPENDENCIES.md (both trees), README, the release protocol, arch.md Platform Layer, lessons-learned, and the runnable-worktrees skill.

Testing

• Code head fa7d227 (later commits change only docs and porch state): Windows run https://github.com/cluesmith/codev/actions/runs/39927653580 with suites and the install guard. Install guard, install verification on Node 22/24, CLI e2e 22/24, probes (x64 Node 20/22/24, ARM64 Node 22/24) and unit Node 22 (codev 7526 passed / 156 skipped) were green on attempt 1. Unit Node 24 hit one intermittent (spec-1280 T12) on attempt 1 and went green on attempt 2 (sdk 204/204, core 174/174, codev 7526 / 156). Three one-off Windows intermittents are recorded in the review; none was skipped.
• POSIX full suite at the code head: 7574 passed / 108 skipped.
• Windows: run 39921687151, all green. The unit suites on Node 22 and 24 passed: sdk 204/204, core 174/174, codev 7522 passed / 156 skipped. cli-e2e and post-release-e2e (installing this branch's packed tarballs) passed on both legs. The launchers.windows targeted run went 3/3. Commits after it change docs only, plus a .gitattributes rule for the gate fixtures.
• POSIX: full suite 7570 passed / 108 skipped. Build and type checks are green.
• Two Flaky: session-manager real-shellper tests use fixed wall-clock deadlines that fail under full-suite load (CI-skipped, so only local/porch runs see them) #1800 POSIX real-shellper tests are skipped as FLAKY (Flaky: session-manager real-shellper tests use fixed wall-clock deadlines that fail under full-suite load (CI-skipped, so only local/porch runs see them) #1800 is open).

Known gaps (recorded in the review)

• Windows release blocker: bare user-tool spawns (git, gh, npm and others, 36 sites) look up programs in the cwd before PATH. This is ruled a follow-up after this PR; Windows support is not announced until it lands.
• Render gate holds all mail to Codex agents: region-end pattern misses the 'GPT-6.1-Sol default' status line #1858: mail to codex agents holds on every platform; codex ConPTY validation is pending the owner's scope decision.

Open before the pr gate

• The claude ConPTY fixtures, recorded on a Windows machine, still need to be committed to fixtures/gate/conpty/. Codex fixtures are blocked on Render gate holds all mail to Codex agents: region-end pattern misses the 'GPT-6.1-Sol default' status line #1858.
• The owner's manual pass on Windows still needs to run. The checklist with expected results is in the review under "PR-gate manual pass".

Spec

codev/specs/1658-windows-native-non-wsl-support.md

Review

codev/reviews/1658-windows-native-non-wsl-support.md

[amrmelsayed]

Architect integration review (main), round 1, head 1b78fc0

Risk tier: High (350 files, +23327/-1165; shellper transport, Tower lifecycle, render gate, install path). Three-way read: Claude REQUEST_CHANGES, Codex REQUEST_CHANGES, Gemini skipped (agy signed out on the review host). Both verdicts block on the same items the PR body itself declares open, and neither found a product defect in the merged code.

Verified sound (not re-raised)

• POSIX preserved and pinned by real goldens: HELLO frame byte-compared against a hardcoded literal, WELCOME key set pinned, spawn argv shape asserted in order, legacy suite pins the seam to linux on every host. shell.ts deletion is dead code with zero callers.
• Repo conventions: CLAUDE.md/AGENTS.md byte-identical, all four shipped skill copies hash-identical, DEPENDENCIES.md identical in both trees.
• sdk isolation (Introduce packages/codev-sdk: client SDK for Tower (server/client dependency isolation) #1189): boundary tests unmodified, zero new runtime deps, nested node/ dirs still get the full rule set.
• Shellper secret by env not argv, stripped from the shellper's own env and every PTY child, timingSafeEqual, fresh UUID pipe name. POST /api/shutdown behind the single key choke point, absent from the public allowlist, refuses the tunnel-proxy marker, requires a local-machine peer. Migration v19 PRAGMA-gated, idempotent, nullable, fresh-path schema in lockstep.
• preinstall runs on every platform; native-deps-guard.mjs is in the publish files whitelist and post-release-e2e installs the packed tarballs.

Blocking before the pr gate (already the agreed conditions)

1. Claude ConPTY fixtures recorded on the owner's Windows machine and committed under fixtures/gate/conpty/. The replay test skips loudly today with a meta-test guarding against a vacuous pass, which is the right discipline, but Windows render-gate behaviour currently rests on synthetic captures only.
2. Owner's manual Windows pass per the review's "PR-gate manual pass" checklist, with results recorded in the review.
3. Codex validation: the spec requires real Claude and Codex validation; Codex agents classify no-region-end on every platform (Render gate holds all mail to Codex agents: region-end pattern misses the 'GPT-6.1-Sol default' status line #1858). Either Render gate holds all mail to Codex agents: region-end pattern misses the 'GPT-6.1-Sol default' status line #1858 is fixed and merged first and Codex fixtures recorded, or the owner grants an explicit scope amendment recorded in the spec. Owner decision pending.

Must-fix in this lane before the gate request

• readShellperInfo POSIX read path (session-manager.ts ~1333): resolving on data plus destroy() instead of awaiting end is a Windows-motivated change applied un-gated to POSIX. Ruling: gate it behind the seam so POSIX keeps the end path byte-identical, matching the project's POSIX rule, or state in a comment why POSIX takes it too and add a test that pins the POSIX behaviour.
• sdk /node charter: packages/sdk/src/node/executable.ts never talks to Tower while the package still describes itself as the single implementation of how anything talks to Tower. Restate the charter in the sdk package.json description and in arch.md to name the shared Node-side utility role, so the next utility lands there by decision rather than precedent.
• Render gate holds all mail to Codex agents: region-end pattern misses the 'GPT-6.1-Sol default' status line #1858 as a known gap in the review doc, not only in the PR body, so the limitation survives the merge.

Follow-ups to file separately (not blocking)

• A POSIX-CI-runnable static lint for platform assumptions (hardcoded / separators, :-joined PATH, POSIX-only spawn shapes) as the standing guard against Windows rot while windows.yml is dispatch-only by ruling.
• consult: the integration review's generated diff file was 0 bytes for this 350-file PR; the reviewer fell back to reading the worktree. Likely a size or file-count cap in diff extraction.