合入上下文恢复，收口 Windows 脚本与托盘单人自用

.github/workflows/client-coverage-resource-diagnostic.yml

@@ -0,0 +1,56 @@
+name: Client coverage resource diagnostic
+
+on:
+  push:
+    branches:
+      - acceptance/context-recovery/**
+    paths:
+      - .github/workflows/client-coverage-resource-diagnostic.yml
+      - scripts/diagnose-client-coverage-resources.js
+      - scripts/lib/client-coverage-resource-command.js
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  compare:
+    runs-on: windows-latest
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        order: ['1,4', '4,1']
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - name: Prepare unchanged client coverage prerequisites
+        run: |
+          $ErrorActionPreference = 'Stop'
+          npm ci
+          if ($LASTEXITCODE -ne 0) { throw 'Dependency preparation failed.' }
+          npm ci --prefix plugins/hpm-local-evidence --ignore-scripts
+          if ($LASTEXITCODE -ne 0) { throw 'Fixture preparation failed.' }
+          rustup default stable
+          if ($LASTEXITCODE -ne 0) { throw 'Toolchain preparation failed.' }
+          npm run pretest:client:coverage
+          if ($LASTEXITCODE -ne 0) { throw 'Client prerequisite preparation failed.' }
+      - name: Compare identical full workloads in counterbalanced order
+        env:
+          PROBE_ORDER: ${{ matrix.order }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $failed = $false
+          foreach ($concurrency in $env:PROBE_ORDER.Split(',')) {
+            node scripts/diagnose-client-coverage-resources.js $concurrency
+            if ($LASTEXITCODE -ne 0) { $failed = $true }
+          }
+          if ($failed) { throw 'Resource diagnostic observed a failure; original qualification gates remain unchanged.' }

.github/workflows/codex-stop-diagnostic.yml

@@ -0,0 +1,99 @@
+name: Independent staged Codex and Claude enhanced diagnostics
+
+on:
+  push:
+    branches:
+      - acceptance/context-recovery/**
+    paths:
+      - .github/workflows/codex-stop-diagnostic.yml
+      - scripts/diagnose-codex-stop.js
+      - scripts/diagnose-claude-context.js
+      - scripts/lib/claude-context-diagnostic*.js
+      - scripts/lib/staged-client-diagnostic-policy.js
+      - scripts/lib/staged-client-diagnostic*.js
+      - test/claude-context-diagnostic*.test.js
+      - scripts/lib/codex-stop-diagnostic*
+      - test/codex-stop-diagnostic*.test.js
+      - test/fixtures/codex-stop-diagnostic*.ps1
+      - scripts/lib/nsis-client-*.js
+      - scripts/lib/nsis-client-*.cjs
+      - scripts/lib/nsis-client-*.ps1
+      - scripts/lib/nsis-installed-client-case.js
+      - scripts/lib/nsis-installed-client-matrix-contract.js
+      - scripts/lib/nsis-installed-business-reply.js
+      - scripts/lib/nsis-installed-daemon-http*.psm1
+      - scripts/lib/nsis-runtime-boundary*
+      - scripts/lib/nsis-encrypted-contract.js
+      - scripts/lib/nsis-installation-parallel.js
+      - scripts/lib/nsis-baseline-transfer.js
+      - scripts/lib/native-loopback-rpc.js
+      - scripts/lib/context-recovery-daemon-*
+      - scripts/context-hosted/shared/**
+      - scripts/prepare-release-runtime.js
+      - scripts/release-proxy-sources.json
+      - scripts/prepare-context-recovery-native.js
+      - scripts/prepare-evidence-gateway.js
+      - lib/release/**
+      - lib/proxy/**
+      - native/context-recovery-key/**
+      - tools/nsis-clients/package.json
+      - tools/nsis-clients/package-lock.json
+      - plugins/hpm-local-evidence/package.json
+      - plugins/hpm-local-evidence/package-lock.json
+      - package.json
+      - package-lock.json
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  diagnostic:
+    name: Staged ${{ matrix.client }} enhanced diagnostic
+    strategy:
+      fail-fast: false
+      matrix:
+        client: [codex, claude]
+    runs-on: windows-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: pwsh
+        working-directory: current
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          path: current
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22.22.3
+      - run: rustup default stable
+      - name: Restore original locked dependencies and stage actual runtime
+        run: |
+          $ErrorActionPreference = 'Stop'
+          npm ci
+          if ($LASTEXITCODE -ne 0) { throw 'Diagnostic dependency restore failed.' }
+          npm ci --prefix plugins/hpm-local-evidence --ignore-scripts
+          if ($LASTEXITCODE -ne 0) { throw 'Diagnostic plugin restore failed.' }
+          npm ci --prefix tools/nsis-clients --ignore-scripts
+          if ($LASTEXITCODE -ne 0) { throw 'Diagnostic fixed client restore failed.' }
+          npm run release:prepare
+          if ($LASTEXITCODE -ne 0) { throw 'Diagnostic runtime staging failed.' }
+          node -e "require('./scripts/lib/codex-stop-diagnostic-staging').prepareDiagnosticStaging()"
+          if ($LASTEXITCODE -ne 0) { throw 'Diagnostic runtime identity failed.' }
+      - name: Execute original enhanced CLI behind original Jobs and WFP
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Import-Module ./scripts/lib/codex-stop-diagnostic-run.psm1 -Force
+          Invoke-HpmCodexStopDiagnostic -Client '${{ matrix.client }}'
+      - name: Record diagnostic scope only
+        if: always()
+        run: |
+          @(
+            'Staged ${{ matrix.client }} enhanced diagnostic status: ${{ job.status }}'
+            'No full verify, Tauri build, NSIS installation or installed qualification is granted.'
+            'The original installed lifecycle workflow and all of its gates remain unchanged.'
+            'No real provider request, daily-instance change, or 24-hour run is performed.'
+          ) >> $env:GITHUB_STEP_SUMMARY

.github/workflows/context-business-boundary-diagnostic.yml

@@ -0,0 +1,69 @@
+name: Context business boundary diagnostic
+
+on:
+  push:
+    branches:
+      - acceptance/context-recovery/**
+    paths:
+      - .github/workflows/context-business-boundary-diagnostic.yml
+      - scripts/context-hosted/**
+      - scripts/lib/nsis-runtime-boundary.psm1
+      - scripts/lib/nsis-runtime-boundary-job.cs
+      - scripts/qualify-context-hosted.ps1
+      - scripts/prepare-context-hosted-run.js
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  diagnose:
+    runs-on: windows-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        scenario: [n08, n09, n09-sending-ack, n09-finished-ack, n09-withdrawn-ack, n09-uncertain-ack, n09-sending-commit, n09-finished-commit, n09-withdrawn-commit, n09-uncertain-commit]
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - name: Prepare fixed diagnostic prerequisites
+        run: |
+          $ErrorActionPreference = 'Stop'
+          npm ci
+          if ($LASTEXITCODE -ne 0) { throw 'Source dependency preparation failed.' }
+          npm ci --prefix plugins/hpm-local-evidence --ignore-scripts
+          if ($LASTEXITCODE -ne 0) { throw 'Fixture dependency preparation failed.' }
+          rustup default stable
+          if ($LASTEXITCODE -ne 0) { throw 'Native toolchain preparation failed.' }
+      - name: Prepare original pinned payload and plan
+        env:
+          SCENARIO: ${{ matrix.scenario }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          node scripts/prepare-context-hosted-run.js $env:SCENARIO
+          if ($LASTEXITCODE -ne 0) { throw 'Diagnostic payload preparation failed.' }
+      - name: Diagnose original bounded business execution
+        env:
+          SCENARIO: ${{ matrix.scenario }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          ./scripts/qualify-context-hosted.ps1 -Case $env:SCENARIO
+      - name: Preserve diagnostic evidence boundary
+        if: always()
+        run: |
+          @(
+            'Diagnostic execution only; no qualification or publication is granted.'
+            'The original pinned payload, network boundary, owned Job and business assertions are reused.'
+            'Formal Verify and the complete source-gates plus business chain remain required.'
+            'No payload, credential, original content, native reply or database is uploaded.'
+          ) >> $env:GITHUB_STEP_SUMMARY

.github/workflows/verify.yml

@@ -43,6 +43,8 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
+      - run: npm ci --prefix plugins/hpm-local-evidence --ignore-scripts
+      - run: rustup default stable
       - run: npm run test:unit
 
   coverage:
@@ -54,9 +56,33 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
-      - run: npm run test:coverage
-      - run: npm run test:client:coverage
-      - run: npm run test:frontend:coverage
+      - run: npm ci --prefix plugins/hpm-local-evidence --ignore-scripts
+      - run: rustup default stable
+      - name: Execute complete original coverage commands with owned file recording windows
+        shell: pwsh
+        env:
+          HPM_COVERAGE_IO: ${{ github.sha }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $PSNativeCommandUseErrorActionPreference = $false
+          $env:HPM_COVERAGE_IO_STAGE = 'proxy'
+          $env:HPM_COVERAGE_IO_PROXY_WINDOW = 'publication-interruption'
+          npm run test:coverage
+          $coverageExit = $LASTEXITCODE
+          if ($coverageExit -ne 0) { [Console]::Error.WriteLine('coverage_original_stage_failed:stage=' + $env:HPM_COVERAGE_IO_STAGE) }
+          node scripts/check-coverage-io-receipt.cjs
+          if ($LASTEXITCODE -ne 0) { throw 'Coverage I/O observation was not completed safely.' }
+          if ($coverageExit -ne 0) { throw 'Original proxy coverage failed; I/O evidence does not override its failure.' }
+          Remove-Item Env:\HPM_COVERAGE_IO_PROXY_WINDOW
+          $env:HPM_COVERAGE_IO_STAGE = 'client'
+          npm run test:client:coverage
+          $coverageExit = $LASTEXITCODE
+          if ($coverageExit -ne 0) { [Console]::Error.WriteLine('coverage_original_stage_failed:stage=' + $env:HPM_COVERAGE_IO_STAGE) }
+          node scripts/check-coverage-io-receipt.cjs
+          if ($LASTEXITCODE -ne 0) { throw 'Client coverage I/O observation was not completed safely.' }
+          if ($coverageExit -ne 0) { throw 'Original client coverage failed; I/O evidence does not override its failure.' }
+          npm run test:frontend:coverage
+          if ($LASTEXITCODE -ne 0) { throw 'Original frontend coverage failed.' }
 
   integration-tests:
     runs-on: windows-latest
@@ -85,8 +111,10 @@ jobs:
           workspaces: src-tauri
       - run: npm ci
       - run: npm run release:prepare
+      - run: npm run test:recovery-native
       - run: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check
       - run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
       - run: npm run test:rust
       - run: cargo install cargo-audit --version 0.22.2 --locked
       - run: node scripts/check-windows-rust-audit.js
+      - run: cargo audit --file native/context-recovery-key/Cargo.lock

.github/workflows/windows-baseline-artifact-bridge-review.yml

@@ -0,0 +1,42 @@
+name: Review branch private old NSIS artifact bridge
+
+on:
+  push:
+    branches:
+      - acceptance/windows-baseline-bridge/**
+
+permissions: {}
+
+jobs:
+  resolve:
+    runs-on: windows-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      release_id: ${{ steps.route.outputs.release_id }}
+      installer_asset_id: ${{ steps.route.outputs.installer_asset_id }}
+      identity_asset_id: ${{ steps.route.outputs.identity_asset_id }}
+      target_sha: ${{ steps.route.outputs.target_sha }}
+      transfer_tag: ${{ steps.route.outputs.transfer_tag }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+      - id: route
+        run: node scripts/resolve-nsis-review-route.cjs bridge
+  bridge:
+    needs: resolve
+    permissions:
+      contents: write
+    uses: ./.github/workflows/windows-baseline-artifact-bridge.yml
+    with:
+      release_id: ${{ needs.resolve.outputs.release_id }}
+      installer_asset_id: ${{ needs.resolve.outputs.installer_asset_id }}
+      identity_asset_id: ${{ needs.resolve.outputs.identity_asset_id }}
+      target_sha: ${{ needs.resolve.outputs.target_sha }}
+      transfer_tag: ${{ needs.resolve.outputs.transfer_tag }}