Wide-deployment Windows path without WSL2. The agentic bridge already runs
on native Python + PowerShell; the only bash dependency is the H4/H2 gate
scripts, which run under Git Bash (Git for Windows) — much lighter than WSL2.
- h4_scan now returns a status (ok|blocked|timeout|unavailable). Timeout stays
FAIL-CLOSED (block/deny). "unavailable" (no bash / gate missing) DEGRADES the
turn to observed_only and does NOT block the developer — never silently
certifies without a working gate.
- bash interpreter is configurable via CASAN_AGENTIC_BASH; gates use it.
- doctor reports bash_available / gates_runnable + a remediation warning, and
stays green (degraded, not failed) when bash is absent.
- tests: +4 no-bash cases (degrade to observed_only, tool still allowed,
non-certified finalize, injection still blocked when bash present). 34/34.
- docs: Windows guide + security guide now point to Git Bash, not WSL2, and
document the timeout-vs-unavailable distinction.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
