FEATURE-ci-mingw-runtime: Recognize the exact MinGW SEH runtime

Allow libgcc_s_seh-1.dll in the native linkage audit while preserving provider rejection and the stronger installed package policy. Exercise the real make recipe and audit in both TLS modes and reject near-miss runtimes.

Verified test-first A1 PASS/A2 rejection for the observed Windows DLL; all 19 focused tests, Bash/Python syntax and diff checks pass. Native Windows execution remains CI/v3 PR owned.

Author: etr

scripts/audit-v3-native-linkage.sh

@@ -363,7 +363,7 @@ while IFS= read -r library; do
             fail "unexpected third-party load dependency: $library" ;;
         *)
             case "$name" in
-                linux-vdso.*|ld-linux*|ld-musl*|ld-elf*.so*|libc.so*|libm.so*|libstdc++.*|libstdc++-*|libgcc_s.*|libgcc_s-*|libwinpthread-*|libpthread.*|libthr.*|libexecinfo.*|libatomic.*|libdl.*|librt.*|libresolv.*|libc++.*|libc++abi.*|libsystem.*|kernel32.dll|ws2_32.dll|msvcrt.dll|ucrtbase.dll|api-ms-win-*.dll|advapi32.dll|bcrypt.dll|bcryptprimitives.dll|crypt32.dll|secur32.dll|user32.dll|kernelbase.dll|ntdll.dll) ;;
+                linux-vdso.*|ld-linux*|ld-musl*|ld-elf*.so*|libc.so*|libm.so*|libstdc++.*|libstdc++-*|libgcc_s.*|libgcc_s-*|libgcc_s_seh-1.dll|libwinpthread-*|libpthread.*|libthr.*|libexecinfo.*|libatomic.*|libdl.*|librt.*|libresolv.*|libc++.*|libc++abi.*|libsystem.*|kernel32.dll|ws2_32.dll|msvcrt.dll|ucrtbase.dll|api-ms-win-*.dll|advapi32.dll|bcrypt.dll|bcryptprimitives.dll|crypt32.dll|secur32.dll|user32.dll|kernelbase.dll|ntdll.dll) ;;
                 *) fail "unexpected third-party load dependency: $library" ;;
             esac ;;
     esac

scripts/test-v3-native-linkage.py

@@ -72,6 +72,15 @@ def test_configured_tls_mode_reaches_real_audit(self):
                     self.assertIn('A2 PASS' if mode == 'yes' else 'TLS-off load dependency',
                                   result.stdout)
 
+    def test_windows_seh_compiler_runtime_reaches_real_audit(self):
+        for mode in ['yes', 'no']:
+            with self.subTest(mode=mode):
+                result = self.gate(suffix='.exe', mode=mode,
+                                   dependency='KERNEL32.dll\nlibgcc_s_seh-1.dll')
+                self.assertEqual(0, result.returncode, result.stdout)
+                self.assertIn('A1 PASS', result.stdout)
+                self.assertIn('A2 PASS', result.stdout)
+
     def test_cxx_linker_gate_stops_before_audit(self):
         result = self.gate(linker='CC')
         self.assertNotEqual(0, result.returncode)
@@ -145,6 +154,17 @@ def test_missing_archive_fails_closed(self):
     def test_native_windows_executable_and_readiness_runtime(self):
         self.assertEqual(0, self.audit('KERNEL32.dll\nWS2_32.dll\nlibstdc++-6.dll', windows=True).returncode)
 
+    def test_windows_seh_runtime_lookalikes_are_rejected(self):
+        for dependency in ['libgcc_s_seh-1.dll.extra', 'libgcc_s_seh-2.dll',
+                           'libgcc_s_unknown-1.dll']:
+            for mode in ['yes', 'no']:
+                with self.subTest(dependency=dependency, mode=mode):
+                    result = self.audit(dependency, mode=mode, windows=True)
+                    self.assertNotEqual(0, result.returncode, result.stdout)
+                    self.assertIn('unexpected third-party load dependency: ' + dependency,
+                                  result.stdout)
+                    self.assertNotIn('A2 PASS', result.stdout)
+
     def test_windows_import_symbols_and_msys_are_rejected(self):
         self.assertNotEqual(0, self.audit('KERNEL32.dll', symbols=' U __imp_SSL_new', windows=True).returncode)
         self.assertNotEqual(0, self.audit('msys-2.0.dll', windows=True).returncode)

specs/tasks/FEATURE-ci-mingw-runtime.md

@@ -0,0 +1,64 @@
+# FEATURE-ci-mingw-runtime: recognize the MinGW SEH compiler runtime
+
+Status: Implemented; pending caller validation and finalization.
+Base: `v3` at `f91dddf4faf21f33cf27e9e4ece3870e3a593e56`.
+
+Windows package job `120444167361` in run `39962619327` and archive job
+`120444991245` in run `39962644789` reach the native audit, pass A1, then
+fail A2 on `libgcc_s_seh-1.dll`. The existing `libgcc_s.*|libgcc_s-*`
+patterns omit this underscore spelling. The native audit now recognizes
+that exact runtime basename, retaining the existing dependency policy.
+The [official MSYS2 runtime package](https://packages.msys2.org/packages/mingw-w64-x86_64-libgcc?repo=mingw64)
+lists `/mingw64/bin/libgcc_s_seh-1.dll`; the failed job installed that package.
+
+Action items:
+
+- [x] Create an isolated Groundwork worktree from the exact v3 base;
+  preserve the bauth worktree and previous closed diagnoses.
+- [x] Retain both Windows job logs and bind the failed/local audit, recipe,
+  fixture and package workflow sources to the recorded base revision.
+- [x] Add a test executing the production make recipe and real native audit
+  against the observed runtime import in TLS-off and TLS-on `.exe` lanes;
+  observe the original A1 PASS / A2 rejection before editing production.
+- [x] Add only the exact `libgcc_s_seh-1.dll` runtime classification.
+- [x] Reject near-miss extensions, versions and unknown underscore runtimes
+  in both TLS modes; preserve existing provider and MSYS rejection controls.
+- [x] Keep C++ linker, source scan, executable suffix, PE validation, missing
+  artifacts/inspectors and archive/static-symbol checks unchanged.
+- [x] Keep the stronger installed-package auditor, workflows, compiler
+  selection, dependencies and engine unchanged.
+- [x] Run the focused native-linkage module, Bash/Python syntax and diff checks.
+- [x] Retain raw RED/GREEN commands/results, source bindings, documentation
+  reference and journal under main `.debug/FEATURE-ci-mingw-runtime/`.
+- [ ] Caller: Groundwork validation and local finalization into v3.
+- [ ] CI / v3 PR: native Windows package and archive build/audit evidence.
+
+Local verification: the original 17-test focused baseline passed. The new
+make-gate regression failed in both TLS modes on the exact observed DLL,
+with A1 passing and A2 reporting the same rejection as CI. After the exact
+basename correction, all 19 tests pass. Three rejected runtime lookalikes
+are exercised in both TLS modes. Existing empty/`.exe` recipes, OpenSSL
+mode handling, C++ linker/build failure propagation, static provider,
+missing artifact, alternate provider and MSYS controls still pass.
+Bash syntax, Python AST syntax and `git diff --check` pass. The documented
+C++ linter does not apply to these script changes; no Python linter is
+documented in CLAUDE.md.
+
+The tests execute GNU make, the production recipe and the real source audit;
+build artifacts and native inspector outputs are controlled fixtures.
+They do not compile or inspect a native Windows binary. The installed-package
+auditor already recognizes selected-prefix `libgcc_s_*.dll` and remains
+byte-for-byte unchanged. Only one production dependency case is extended;
+all other audit guards remain unchanged.
+
+Native Windows CI remains incomplete and owned by CI / v3 PR under AGENTS;
+missing nonlocal evidence does not block local completion. No full native
+baseline, installation, unrelated repair, validation loop, merge or publication
+was performed. Linux parity and Darwin header-deadline causality remain
+CLOSED/UNCERTAIN; neither diagnosis was reopened.
+
+Project notes: focused script checks need Python 3, Bash and GNU make, with
+no installation. Full project builds use Autotools/C++20 (`bash bootstrap`,
+out-of-tree configure, make); they were outside this focused repair.
+Groundwork identity helper returned the task path/branch verbatim.
+Git metadata writes require sandbox escalation.