[deku2026]

PipeOptions.CurrentUserOnly compares an elevated token's default owner (potentially BUILTIN\Administrators), refusing a service pipe owned by that same user's SID. Check the connected pipe's owner against WindowsIdentity.User before handing it to HTTP/2, dispose on any refusal/query failure, and deny foreign/group/missing owners. Parent-child listeners explicitly set the user-SID owner and protected user-only DACL so the client rule works in both modes; service ACL/peer policy and public API are unchanged. Align raw ACL probes and current documentation; register the newly authored tests in the existing provenance inventory.

Author native Windows via MCP: locked affected restore; Release build 0 warnings/errors; format check; ownership tests 4/4, existing parent/service ACL checks 2/2, generated-call/malformed-frame real pipe 1/1; routine LocalRpc 947 passed/57 documented skips. Both affected AOT probes compiled without warnings; native service probe passed real named-pipe/peer/deadline/stream-lane checks. Current token owner equals user SID, so these are same-user current-token checks, not proof of an elevated-client/non-elevated-node pair or second-account denial (AR-21/AR-02). No elevation or real credential-store operation. ArcForges package adoption remains MR-43.

Diagnosed failures retained: initial CA2000 author build fixed by isolating token lifetime inside the owner-query helper, with analyzer still enabled. Initial pushed head 16b33c0 failed both formal legs at the missing provenance classification; final follow-up adds exactly the new test path to firstParty, without changing policy/pins/immutable receipts. Neither earlier failed leg is a full pass.

Final head 66ffbc7, tree 46768fc94d3f45383f8d008d1e433aebd5b47cb2, base 49e2dbe: native Windows full 17 steps/532s and Linux full 24 steps/406s passed through MCP run-and-report. All summary results, live exact-head required success statuses and owner-skipped hosted checks read; freshly fetched main remains the base. Formal LocalRpc: Windows 947 passed/57 skips (1004 total), Linux 946 passed/53 skips (999 total; platform-dependent theory rows), zero failures. Candidate pack verified 21 packages at local-only 1.0.0-ci.1.1, not a NuGet publication claim.

Direct separate self-review comment 6400304577 read all nine files, no blocking finding; performed by OpenAI Codex alone per owner instruction, no independent reviewer claimed. Logs Windows dev/logs/mr12-author*, mr12-extra*, mr12-formal*, mr12-final*; Linux logs/mr12-formal* and mr12-final*. Complete final summaries: 20261025-163937-66ffbc7c6ec3-win and 20261026-003932-66ffbc7c6ec3-linux.

Generated by OpenAI Codex.

[deku2026]

Formal verification at initial head 16b33c0 correctly failed: the newly authored test file had not been classified in eng/provenance/files.json. Linux provenance-policy failed (21s; subsequent steps not run), and Windows native-stage reached the same inventory assertion (61s leg; restore/native passed, remaining steps not run). Both failure summaries/logs are retained and neither is a complete pass. The exact inventory delta was confirmed to be only LocalRpcPipeOwnershipTests.cs, then registered as first-party in 66ffbc7; no reused receipt, policy, pin or check changed. Old leg completion/drain was inspected before restarting this host's full leg. Both final-head full native legs are now running; prior statuses are not reused. Runtime source/author evidence is unchanged by the inventory-only follow-up.

[deku2026]

Direct separate self-review at final head 66ffbc7 (tree 46768fc94d3f45383f8d008d1e433aebd5b47cb2, base 49e2dbe). Read the complete nine-file diff against the current same-user endpoint contract and the ArcForges.Client precedent. The connected handle's owner is checked before a stream reaches HTTP/2; all query/refusal failures dispose it and are still wrapped as a pre-stream connect failure. Equality is to token User, with group/foreign/null inputs denied. Parent-child instances now carry the explicit user owner and protected user-only ACL; FirstPipeInstance remains, service security/peer policy is unchanged, and no TCP or remote transport is added. Raw ACL probes intentionally do not apply a second, incorrect default-owner rule; ownership has its own direct SID and real-pipe checks. No new public API, dependency, interop import or relaxed assertion. The one-line first-party inventory addition classifies only the newly authored tests, with all immutable/reused provenance records untouched. No blocking finding. Author results and limits in the PR are accurate: current-token same-user pipes and a native service call pass, while actual mixed integrity levels and second-account denial stay deferred. Both full final-head host legs remain required. Review is my own separate pass under the user's explicit no-other-model/no-agent instruction, not an independent review.