[Aurantium-47]

Summary

Keep recorded POSIX runtime roots case-sensitive when reconciliation runs on Windows. This fixes a source-discovered bug; no existing issue or PR covering this case was found.

Problem and expected behavior

Given a file mapping rooted at /runtime/App, a recorded script at /runtime/app/renderer.js must not acquire that mapping. On Windows, pathBelowRoot used the host-default path.relative even after identifying POSIX input, so those different roots produced a false location match. Automatic matching against the static application's POSIX input root had the same problem.

Change and scope

Use posix.relative for the POSIX branch of the shared root matcher. Its Windows branch still uses win32.relative. Add four service-level regressions using complete Evidence inputs: the two case mismatches, an exact POSIX match, and the existing case-insensitive Windows mapping behavior.

Contract and boundary impact

• Semantic owner: pathBelowRoot in javascriptRuntimeStaticCandidates.ts, used by runtime path matching and active static-layer scope.
• Contribution scope: routine correction to existing offline Evidence reconciliation; no separate maintainer scope decision is required.
• CLI and MCP/tool-catalog contract: no schema change; corrected match facts.
• Provider/platform impact: Windows-hosted reconciliation of recorded POSIX paths; no provider or bridge changes.
• Evidence/provenance: unmatched root spellings remain unknown instead of producing an unsupported location match. Input Evidence remains unchanged.
• Target selection, authority and cleanup: the operation consumes supplied Evidence without filesystem, browser, or target I/O; no new authority or cleanup behavior.
• Generated metadata, package and installation impact: none.

Expected effects:

• Read existing files or captured data (supplied Evidence).
• Launch or attach to a process.
• Inject instrumentation or run scripts/code.
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

On Windows x64, the final local-path tests against base c462a4ebd3a10e59253bcf38353a0914b176738b produced two failures: both POSIX case mismatches were reported matched. With this change all six local-path tests pass, including the existing relative-root and foreign-path controls.

Executed public CLI output, with no script source bytes supplied:

Runtime file, mapping rooted at /runtime/App	Status	Basis	Reason
/runtime/app/renderer.js	unknown	none	no-authorized-location-mapping
/runtime/App/renderer.js	matched	operator-file-mapping	unique-location-match

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity and source provenance remain preserved.
• Unsupported and uncertain outcomes remain visible.

Validation performed

Pinned Node 24.18.0 / npm 11.16.0 on Windows x64:

• node node_modules/vitest/vitest.mjs run tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts -t "JavaScript runtime reconciliation local paths" — 6 passed; 9 unrelated cases filtered out.
• node node_modules/vitest/vitest.mjs run tests/boundary/cli/electronCli.test.ts -t "Electron CLI runtime reconciliation" — 1 passed; 4 unrelated cases filtered out.
• Public reconcile-javascript-runtime <input.json> --json calls for the two examples above — both exited 0.
• npm run check — passed.
• npm run verify:test-discovery — all 1002 test files discovered exactly once.
• git diff --check — passed.

Compatibility, safety, and release

No migration, package, schema, or generated metadata change. Validation covers synthetic recorded Evidence through the production reconciliation service and compiled CLI. Live Electron/browser and native-provider verification were not run; those capture/provider paths are unchanged. The broader filesystem suite requires the Windows native artifact unavailable in this checkout. No containment or security-severity claim is made.

Before merge

• This PR addresses a concrete problem.
• Scope and authority questions are resolved for this existing offline operation.
• The PR has one focused outcome and a Conventional Commit title.
• The reason for not linking an existing issue is stated above.
• Tests cover changed behavior and positive controls.
• No owning docs, contracts, or generated metadata changes are needed.
• Representative CLI output is included.
• The diff was checked for secrets, unrelated cleanup, and unsupported claims.

AI-assisted implementation and review using OpenAI GPT-6; the validation above was executed locally.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[morluto]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

pathBelowRoot now uses posix.relative for recorded POSIX paths, even on Windows.

• POSIX runtime paths keep their case on Windows.

No actionable issues found. Tests were not run during this review.

_{Reviews (1) · Last reviewed commit: "fix(javascript): preserve POSIX runtime ..." · Reviewed by Greptile}