Package bounded Linux runtime candidate with opt-in CI retention

Author: siriushex

.github/workflows/native-client.yml

@@ -6,6 +6,12 @@ on:
       - tools/session_store/**
       - .github/workflows/native-client.yml
   workflow_dispatch:
+    inputs:
+      retain_candidate:
+        description: Retain verified candidate without session state for seven days
+        type: boolean
+        required: false
+        default: false
 
 permissions:
   contents: read
@@ -82,6 +88,14 @@ jobs:
           python3 tools/session_store/native_build.py verify --source-root "$RUNNER_TEMP/native-source" --receipt "$RUNNER_TEMP/build-receipt.json"
           sha256sum "$RUNNER_TEMP/native-source/codex-rs/target/dev-small/codex"
           file "$RUNNER_TEMP/native-source/codex-rs/target/dev-small/codex"
+      - name: Package bounded runtime candidate
+        run: |
+          set -euo pipefail
+          cargo +1.95.0 metadata --locked --format-version 1 --filter-platform x86_64-unknown-linux-gnu --manifest-path "$RUNNER_TEMP/native-source/codex-rs/Cargo.toml" > "$RUNNER_TEMP/runtime-metadata.json"
+          python3 tools/session_store/runtime_bundle.py create \
+            --source-root "$RUNNER_TEMP/native-source" --build-receipt "$RUNNER_TEMP/build-receipt.json" \
+            --metadata "$RUNNER_TEMP/runtime-metadata.json" --cargo-home "${CARGO_HOME:-$HOME/.cargo}" \
+            --output "$RUNNER_TEMP/runtime-candidate" --receipt "$RUNNER_TEMP/runtime-receipt.json" --project-commit "$GITHUB_SHA"
       - name: Offline minimal-root version smoke
         run: |
           set -euo pipefail
@@ -91,13 +105,28 @@ jobs:
             --die-with-parent --new-session --cap-drop ALL --cap-add CAP_SETUID --cap-add CAP_SETGID --cap-add CAP_SETPCAP \
             --ro-bind /usr /usr --symlink usr/bin /bin --symlink usr/lib /lib \
             --symlink usr/lib64 /lib64 --proc /proc --dev /dev --perms 1777 --tmpfs /tmp \
-            --dir /work --ro-bind "$RUNNER_TEMP/native-source/codex-rs/target/dev-small/codex" /work/client \
+            --dir /work --ro-bind "$RUNNER_TEMP/runtime-candidate/bin/client" /work/client \
             --ro-bind "$GITHUB_WORKSPACE/tools/session_store/offline_smoke.py" /work/check.py \
             --chdir /work --clearenv --setenv PATH /usr/bin:/bin \
             -- /usr/bin/setpriv --reuid=65534 --regid=65534 --clear-groups \
             --bounding-set=-all --inh-caps=-all --ambient-caps=-all --no-new-privs \
             /usr/bin/python3 /work/check.py "$host_net"
       - name: Synthetic TLS device-code and cancellation
-        run: bash tools/session_store/protocol_smoke.sh "$RUNNER_TEMP/native-source/codex-rs/target/dev-small/codex"
+        run: bash tools/session_store/protocol_smoke.sh "$RUNNER_TEMP/runtime-candidate/bin/client"
       - name: Synthetic OAuth exchange and session readback
-        run: bash tools/session_store/protocol_smoke.sh "$RUNNER_TEMP/native-source/codex-rs/target/dev-small/codex" --exchange
+        run: bash tools/session_store/protocol_smoke.sh "$RUNNER_TEMP/runtime-candidate/bin/client" --exchange
+      - name: Reverify tested package and publish digest receipt
+        run: |
+          set -euo pipefail
+          digest="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["manifest_sha256"])' "$RUNNER_TEMP/runtime-receipt.json")"
+          python3 tools/session_store/runtime_bundle.py verify --root "$RUNNER_TEMP/runtime-candidate" --manifest-sha256 "$digest"
+          printf 'Candidate manifest SHA256: %s\n' "$digest" >> "$GITHUB_STEP_SUMMARY"
+          cat "$RUNNER_TEMP/runtime-receipt.json" >> "$GITHUB_STEP_SUMMARY"
+      - name: Retain verified runtime candidate on explicit dispatch only
+        if: github.event_name == 'workflow_dispatch' && inputs.retain_candidate
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: personal-ai-runtime-linux-x64-${{ github.sha }}
+          path: ${{ runner.temp }}/runtime-candidate/
+          if-no-files-found: error
+          retention-days: 7

AI_NOTES.md

@@ -1,3 +1,26 @@
+# Runtime Candidate Package - 2026-10-15
+
+- Owner explicitly approved retaining the checked Linux runtime in GitHub CI
+  for seven days. Retention is manual-dispatch opt-in only, not a release or
+  deployment. No auth, profiles, logs, caches, medical data or databases enter
+  the allowlisted candidate. Source/provenance/licenses only accompany the ELF.
+- Added a source-receipt-gated builder and bounded directory/ZIP verifier using
+  an external expected manifest digest, streamed hashes, no-follow file opens,
+  path/type/count/size guards and exact member coverage. Verifier never extracts,
+  installs or executes. Cargo notices are a public dependency inventory with
+  explicit declared-only gaps, not a legal/supply-chain/reproducibility claim.
+- Native CI now runs existing offline and ten synthetic protocol cases against
+  packaged bytes, then reverifies before optional upload. Unit and exact-source
+  native/Verify CI results remain publication/retention gates. Actual host ABI,
+  immutable installation/rollback, controller/launcher admission and private
+  owner challenge presentation remain separate. No runtime/provider/phone or
+  therapy action is connected by this stage.
+- Local resolved public metadata:1222packages/1814notice files,85declared-only
+  entries. One upstream git dependency's shared LICENSE is a source symlink;
+  resolve only within admitted public roots and copy regular content. Escaping
+  source links and all candidate links remain refused. No licensing completeness
+  is claimed. New tests also refuse unknown build-receipt payload fields.
+
 # Inactive Session Profile Guard - 2026-10-15
 
 - First Linux CI run failed two child-process fixtures (534other tests passed):

docs/DEVOPS.md

@@ -20,7 +20,7 @@ transaction safety. Actual runtime/credential presentation/adoption is not impli
 
 ## Pinned Native Build Validation
 
-Native Client Candidate is a source-only CI workflow, separate from Verify.
+Native Client Candidate is a disposable build workflow, separate from Verify.
 See tools/session_store/README.md. It fetches the fixed annotated tag and checks
 the peeled commit, all clean checkout state, exact native lock/toolchain and the
 three-path patch receipt before/after compilation. The upstream dev-small
@@ -35,8 +35,11 @@ production hosts and existing login roots are not build workers.
 
 Isolation preflight executes no client. Native login library tests and the actual CLI build precede the no-network,
 minimal-root, nonroot version smoke. A success is build/provenance evidence only,
-not authenticated model access or production containment. No binary artifact,
-release, deployment, keyring/profile mount or real login is part of this workflow.
+not authenticated model access or production containment. Push builds upload no
+binary. Owner-approved manual dispatch with retain_candidate=true retains only
+the verified runtime candidate for seven days; see the tooling README for the
+exact archive/digest contract. No release, deployment, keyring/profile mount or
+real login is part of this workflow.
 The same workflow now includes a separate synthetic native protocol harness;
 see tools/session_store/README.md. It uses only a disposable private CA/loopback
 peer, the development build's supported issuer override, six bounded negative/
@@ -53,7 +56,12 @@ account completion/readback and a separate native login status process with no
 connection attempts. This is not authenticated app-server restart: pinned native
 startup automatically fetches model metadata when already authenticated. Both
 auth issuer and ChatGPT base URL stay local; no real provider/credential/signature
-validation or model availability is claimed. CI retains no session/binary artifact.
+validation or model availability is claimed. CI retains no session/test-state
+artifact; explicitly retained binaries contain only the bounded public build
+candidate, provenance and notices. Never install from an archive's own digest:
+independently pin the exact successful CI run/source and job-summary manifest
+digest, verify the downloaded ZIP without extraction, then obtain separate
+host/runtime-change admission. Production hosts are not build workers.
 
 ## Atomic Session Candidate
 

docs/PLAN.md

@@ -1,5 +1,18 @@
 # PLAN
 
+## Runtime Candidate Delivery (2026-10-15)
+
+- Owner approved seven-day CI retention of the verified Linux candidate, not
+  release/deployment/authorization. Add bounded source-bound package creation,
+  external-manifest directory/ZIP verification and resolved dependency notices.
+- Test the packaged bytes in existing offline and ten synthetic protocol cases;
+  retain only on explicit manual dispatch. Default push uploads no binary or
+  session/test-state. Exact-source native/Verify CI and downloaded-archive checks
+  remain gates; do not infer runtime adoption from successful unit tests.
+- Next: host ABI/library/licensing review, immutable installation/rollback,
+  launcher/profile-controller integration and private owner code presentation.
+  Existing server, phone, authorization and therapy paths remain unchanged.
+
 ## Inactive Session Profile Guard (2026-10-15)
 
 - Added the source-only local serialization/admission component after synthetic

tools/session_store/README.md

@@ -55,7 +55,8 @@ adds the lockfile as the fourth changed path in the full-build checkout.
 Native Rust1.95.0 builds the login library tests and actual CLI with `--locked`
 and the upstream `dev-small` profile, two compile jobs and a90-minute job limit.
 This is a development validation build, not a release or reproducibility claim.
-No binary is uploaded or deployed. CI records source/patch/toolchain/binary
+Push builds upload no binary; explicit retention is described below. Nothing is
+deployed. CI records source/patch/toolchain/binary
 digests; these bind the observed build, not an independently signed attestation.
 
 An isolation-only preflight precedes compilation, creates/verifies the private
@@ -109,7 +110,8 @@ An independent host-side kernel namespace-reference check follows Bubblewrap's
 PID-namespace teardown. Passing runs print only count/status receipts. Failure
 diagnostics bound synthetic-only stderr/syscall tails and selected process
 status; never reuse this reporter with real credentials/profiles. Generated peer
-keys are removed by the wrapper; no binary or test-state artifact is uploaded.
+keys are removed by the wrapper; no test-state artifact is uploaded. Binary
+retention is a separate explicit opt-in below.
 
 Actual native protocol results remain pending until the exact-source workflow
 finishes. Synthetic codes are not credentials, successful cancellation is not
@@ -180,9 +182,48 @@ pinned app-server starts a model-catalog refresh worker when auth already exists
 Do not broaden this test to real model/provider routes or disable TLS as fallback.
 Trace/private-state/process/namespace checks apply to both native processes;
 receipts print only counts and booleans, not session contents. The same disposable
-tmpfs is destroyed afterward. No persistent credential/binary artifact is uploaded.
+tmpfs is destroyed afterward. No credential/test-state artifact is uploaded.
 Actual exchange results require the exact-source native workflow to finish.
 
+## Retained Runtime Candidate
+
+`runtime_bundle.py create` first rechecks the locked native source receipt and
+packages the actual Linux ELF as `bin/client`, that receipt, the integration
+patch, upstream/patch licenses and a resolved Cargo dependency notice inventory.
+No profile, authorization, build cache, diagnostic log or database is included.
+The same packaged bytes run the offline version and all ten synthetic protocol/
+exchange cases. A final directory verification precedes any upload.
+
+Normal push builds retain nothing. An owner-approved manual workflow dispatch
+with `retain_candidate=true` uploads only the allowlisted candidate for seven
+days. It is not a GitHub Release, deployment or production-runtime admission.
+The public repository's artifact can be downloaded by signed-in GitHub users.
+The manifest SHA256 and separate count/hash receipt are in the CI job summary;
+retain the trusted exact-run receipt separately from any downloaded archive.
+
+`runtime_bundle.py verify --zip candidate.zip --manifest-sha256 <trusted-digest>`
+checks the archive without extraction or execution. `--root` checks a directory.
+Both require the external manifest digest, exact closed file set, streamed content
+hashes, canonical paths, fixed ELF architecture/interpreter and bounded JSON,
+member counts and bytes. Links, duplicates, extra files/directories, traversal,
+special/encrypted members and unbounded expansion are refused. Legacy single-disk
+ZIP only; ZIP64/multipart archives are outside this narrow verifier's contract.
+The directory verifier pins a root descriptor and traverses with no-follow opens;
+it does not isolate a hostile same-UID/root process that can modify regular bytes.
+Archive permissions are not installation permissions or executable admission.
+
+Dependency metadata comes from locked Cargo resolution, filtered for Linux, not
+from a user profile. Only regular public-source-root license targets are read;
+source notice links may resolve within those public roots, never outside them,
+and are copied as regular bytes, not retained as links. Candidate links are refused;
+local build paths are omitted from the index. Workspace crates inherit the pinned
+upstream license. Packages without a discoverable top-level/explicit notice are
+reported as `declared-only`, not certified complete. This inventory is not a legal
+compliance audit, a minimal linked-dependency set, a signed attestation or proof
+against malicious build inputs. Host ABI/library closure, licensing review,
+immutable installation/rollback, launcher containment and profile-controller
+integration remain separate gates before real authorization or model use.
+
 ## Limits
 
 - Tests execute the actual Rust helper on synthetic files, including controlled