Hardening & robustness roadmap (post-freeze): daemon, store, Windows, CI

[maplesyzzurp]

Context

Building on the recent daemon-hardening work (issues #142, #143; draft PRs #144, #145, #146), here is a consolidated, grounded roadmap of the remaining solid hardening/robustness pathways. Opening as a single tracking issue since contributions are frozen until July per CONTRIBUTING — happy to split into per-item issues, re-sequence, or hold entirely per your preference.

Already in-flight (draft PRs, freeze-acknowledged)

• Harden daemon: fail closed on symlinked COVEN_HOME and non-socket socket path #144 — fail closed on a symlinked COVEN_HOME / non-socket socket path.
• Harden daemon TCP transport: require loopback Host + reject cross-origin (CSRF/DNS-rebinding) #145 — TCP transport loopback Host/Origin guard; includes a fix for a 127.evil.com-style prefix bypass in the loopback check.
• [prototype] Windows daemon support via named pipes #146 (draft/PoC) — Windows named-pipe daemon transport; also restricts conversation.id to a shell-safe charset and documents a Windows pipe access-control gap.

Proposed roadmap

Tier 1 — independent, high-value, low-risk

1. Index-backed get_session — crates/coven-cli/src/store.rs:544 loads every session (incl. archived) and .find()s in Rust: an O(n) scan + full deserialize on each per-session API op. Replace with SELECT … WHERE id = ?1.
2. SQLite WAL + busy_timeout — no journal_mode/busy_timeout is set, so concurrent API/session connections risk database is locked and reader/writer stalls. Set journal_mode=WAL + a busy_timeout at connection open.
3. Windows CI job — .github/workflows/ci.yml runs ubuntu-latest only, so the #[cfg(windows)] daemon ([prototype] Windows daemon support via named pipes #146) is never built or tested in CI. Add a windows-latest matrix leg.
4. euid / ownership fail-closed — the ownership leg of Daemon: fail closed on symlinked COVEN_HOME and non-socket socket path (AUTH.md hardening gap) #142 (deferred from Harden daemon: fail closed on symlinked COVEN_HOME and non-socket socket path #144): refuse a foreign-owned COVEN_HOME/socket (geteuid vs MetadataExt::uid).

Tier 2 — secure & complete the Windows transport (after CI)

5. .cmd argument-injection hardening — on Windows the harness resolves to a .cmd shim and portable-pty doesn't neutralize cmd.exe metacharacters, so a request prompt reaching argv is a latent injection. (conversation.id already hardened in [prototype] Windows daemon support via named pipes #146.)
6. Windows pipe owner-only security descriptor — the named pipe is bound with the OS default DACL, not the Unix 0600 owner-only gate. Set an owner-SID SD, or move to AF_UNIX (Win10 1803+).
7. Windows daemon lifecycle (start/stop/status) — deferred in [prototype] Windows daemon support via named pipes #146; Windows needs a non-kill(2) status/stop path.
8. Windows stream-mode kill via Job Object — PipedKiller is Unix-only (setsid + kill(-pid)); Windows needs a Job Object to reap the PTY child tree.

Tier 3 — hygiene & robustness

9. Supply-chain gate (cargo-deny) in CI — advisories/licenses/bans; the dependency tree grew with interprocess.
10. Body cap + I/O timeouts on the Unix socket & Windows pipe — only the TCP transport currently sets MAX_TCP_BODY_BYTES / TCP_IO_TIMEOUT.

Suggested sequence: 1 → 2 → 3 → (4 / 9 / 10 in parallel) → 5 → 7 → 8 → 6.