[rmcdaniel]

The CLI's standalone native development runtime cannot compile on Windows because the library imports Unix filesystem traits/flags and calls geteuid even when storage admission is disabled. This isolates the existing trusted descriptor reader behind cfg(unix) and leaves disabled admission available on every target. Configured observations on unsupported platforms return unavailable/fenced through the existing admission path; no replacement ownership policy or weaker file reader is introduced.

The Unix descriptor/UID/mode/no-follow/nonblocking/bounded-read implementation is unchanged. Tests retain its trust checks, add a portable disabled-admission assertion and cover configured fail-closed behavior on non-Unix targets. The storage-admission guide states the supported boundary.

Validation: all five targeted Unix admission tests pass, including ownership, symlink/FIFO/mode/depth/freshness checks and disabled admission. The descriptor-reader function body is byte-identical to the base. Exact-head Server checks are terminal (63 successful, one declared skip), and independent Security source review passes. The consuming Windows build and native-runtime acceptance job succeeds at CLI de4f097c3d930b1d61c4e4a9129ab76d59e896f2, compiling this exact Server revision and matching Avro/SQL patches. It exercises empty-PATH startup/readiness, workflow admission, persisted identity after restart, and configured-file refusal with HTTP 503 / storage_admission_unavailable. That individual Windows job succeeds; the wider CLI run has unrelated failures and is not claimed green. This source dependency is a development rebuild; it does not qualify a published Server image or broaden native-image platforms.

Refs #1222. Fixes the Server library blocker for durable-workflow/cli#161 / durable-workflow/cli#160. No admission collector, Windows UID trust, immutable tag, #980/#1204 or release/promotion path changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source review for exact 63cea4854ec6ebe56ab1603b014e246b907aedc0: PASS, scoped to the two-file portable storage-admission boundary.

The Unix reader body and its trust model are unchanged: final-component no-follow/nonblocking open, descriptor metadata checks, root/effective-UID ownership, regular-file/mode/size bounds, bounded read, object/depth validation, exact source/schema/state, and freshness all remain intact. Unix-only imports, constants, reader helpers, and filesystem tests are now consistently cfg(unix).

On non-Unix targets, the only new behavior is deliberately fail-closed. No file reader or UID substitute is introduced: default settings remain disabled/normal, while any configured observation returns the existing enabled/fenced storage_admission_unavailable snapshot. The absolute-path precondition cannot accidentally turn a Windows path into healthy evidence. Route classification, refusal shape, readiness semantics, permissions, and runtime APIs are unchanged.

Current exact-head checks, Rust CodeQL, native build, and existing backend/corpus lanes are terminal success. This source verdict does not qualify CLI 161 itself, a Windows configured-file collector, a published Server binary/image, or any release/promotion path; CLI still owns the exact Windows compile/lifecycle/configured-file proof.