R23 R3: Windows runtime qualification harness

[bitmaster162]

Scope

R3 adds only a reproducible Windows runtime qualification harness and durable evidence for the already-merged Remote Commander / Secure MCP Tunnel path.

Exact lineage

• current base/master after R24 merge: 5e6887a3109590e190d5427a3205c3f99e9b5a3f
• current R3 head: 115896f191d78dc9bf13dbef5a4adc1955097d55
• branch: agent/r23-remote-commander-runtime-r3
• synchronization: normal merge commit, no rebase/force-push
• behind current master: 0
• functional diff vs current master: 3 R3 files

Windows runtime evidence

On an isolated clean Windows checkout at the exact R3 head:

• Git exact-head gate: PASS
• Git clean-worktree gate: PASS
• official openai/tunnel-client v0.0.14: verified
• release asset SHA-256: 784ab8da7b5a88f0109f1fd8aaf0a1c86067430b896dddf307ef7e3cc49fa1a5: exact match
• launcher Plan schema: PASS
• stdio transport: PASS
• profile: chatgpt-pro-readonly
• advertised tools exactly: capability_status, system_info, fs_list, fs_read
• benign fs_read: PASS
• direct hidden remember: DENIED
• public MCP listener: false
• health/UI listener scope: loopback
• direct shell: false
• local runtime status: LOCAL_READONLY_RUNTIME_GREEN
• post-R24 local Windows regression set: 44 passed
• exact-head runtime qualification on 115896f191d78dc9bf13dbef5a4adc1955097d55: PASS
• new P0 Unified Shadow Continuity #263: PASS
• review-gates #1153: Ubuntu PASS + Windows PASS
• CodeQL #351: PASS
• review threads: 0

Credential boundary

No OpenAI tunnel credentials were read, recovered, created, persisted, or logged.

With CONTROL_PLANE_API_KEY and CONTROL_PLANE_TUNNEL_ID absent:

• launcher Doctor fails closed;
• launcher Init fails closed;
• live_tunnel_qualified=false.

Live Init -> Doctor -> Run -> ChatGPT connector qualification remains a separate operator credential gate.

Parallel branch isolation

R24 / PR #199 merged independently into master as 5e6887a3109590e190d5427a3205c3f99e9b5a3f. Its file set had zero overlap with R3. R3 synchronized from that merged master with a normal merge commit and did not rewrite the historical R24 branch.

Merge boundary

All required gates are green on the exact current base/head shown above. No merge or deployment is authorized without a separate explicit approval.