sipeed/picoclaw · error

create low integrity sid: %w

Error message

create low integrity sid: %w

What it means

Raised in createRestrictedPrimaryToken → setTokenLowIntegrity while building a low-integrity token for the isolated child. windows.CreateWellKnownSid(WinLowLabelSid) constructs the well-known S-1-16-4096 SID that is later attached as the token's mandatory integrity label. This call failing means Windows refused to allocate or initialize that well-known SID, so the restricted token cannot be produced.

Source

Thrown at pkg/isolation/platform_windows.go:191

	if r1 == 0 {
		if e1 != nil && e1 != syscall.Errno(0) {
			return 0, e1
		}
		return 0, syscall.EINVAL
	}
	if err := setTokenLowIntegrity(restricted); err != nil {
		_ = restricted.Close()
		return 0, err
	}
	return restricted, nil
}

// setTokenLowIntegrity lowers the token integrity level so writes to higher
// integrity locations are blocked by the OS.
func setTokenLowIntegrity(token windows.Token) error {
	lowSID, err := windows.CreateWellKnownSid(windows.WinLowLabelSid)
	if err != nil {
		return fmt.Errorf("create low integrity sid: %w", err)
	}
	tml := windows.Tokenmandatorylabel{
		Label: windows.SIDAndAttributes{
			Sid:        lowSID,
			Attributes: windows.SE_GROUP_INTEGRITY,
		},
	}
	if err := windows.SetTokenInformation(
		token,
		windows.TokenIntegrityLevel,
		(*byte)(unsafe.Pointer(&tml)),
		tml.Size(),
	); err != nil {
		return fmt.Errorf("set token low integrity: %w", err)
	}
	return nil
}

View on GitHub (pinned to 49183d7e8d)

Solutions

1. Check the wrapped errno: ERROR_INVALID_PARAMETER indicates the platform does not support the WinLowLabelSid well-known SID
2. Run the process on a genuine, supported Windows build (Vista or later, realistically Windows 10/11)
3. If the host is a compatibility layer (Wine etc.), disable subprocess isolation there since integrity levels are not emulated

if err := isolation.Preflight(); err != nil {
    if strings.Contains(err.Error(), "create low integrity sid") {
        // platform cannot build integrity SIDs (emulated/stripped windows) — isolation is unusable here
        return fmt.Errorf("host windows build lacks integrity-level support; disable isolation: %w", err)
    }
    return err
}

When it happens

Trigger: AllocateAndInitializeSid returning an error for WinLowLabelSid: essentially only on Windows editions/implementations that do not implement the mandatory-integrity SID family (pre-Vista lineage, Wine/ReactOS-style emulations), or genuine out-of-memory (ERROR_NOT_ENOUGH_MEMORY). On any supported Vista+ Windows this call practically never fails.

Common situations: Running the Windows isolation backend under Wine or an incomplete Windows compatibility layer; extremely old or stripped-down Windows builds; test hosts that emulate Windows APIs. Almost never seen on real Windows 10/11.

Related errors

• set token low integrity: %w
• assign process to job object: %w
• windows isolation does not yet support expose_paths filesyst
• credential: enc:// passphrase required
• credential: enc:// decryption failed (wrong passphrase or SS

AI-assisted analysis of sipeed/picoclaw@49183d7e8d (2026-08-15). Data as JSON: /api/errors/2f1cbca6330961ba. Report an issue: GitHub.