ci(runner): compare retained and streaming snapshots

Add a bounded native Intel ABBA diagnostic using the exact retained baseline and separately compiled unpublished streaming candidate. Keep full output integrity, process ownership, and diagnostic-only attribution.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/docker-runner-check.yml

@@ -31,6 +31,10 @@ on:
         description: "Verify frozen Pi 1.0 closed startup and SDK contracts on native Intel macOS (no provider prompts)"
         type: boolean
         default: false
+      diagnose_pi_snapshot_streaming:
+        description: "Compare retained B9 baseline and unpublished streaming snapshots in four ABBA children (diagnostic only)"
+        type: boolean
+        default: false
       diagnose_pi_snapshot_pool:
         description: "Measure exact retained B9 snapshots in four process-start pool4/16 ABBA children (diagnostic only)"
         type: boolean
@@ -74,7 +78,7 @@ permissions: {}
 concurrency:
   # Different immutable manual sources retain independent evidence; the same
   # source/mode still supersedes itself. Ordinary PR grouping is unchanged.
-  group: docker-runner-check-${{ github.event.pull_request.number || github.ref }}-${{ inputs.diagnose_pi_snapshot_pool && 'pi-snapshot-pool' || inputs.diagnose_pi_startup && 'pi-startup-diagnostic' || inputs.verify_pi_intel && 'pi-native-intel' || inputs.diagnose_ajv_pack && 'ajv-diagnostic' || inputs.verify_runner && 'runner-verification' || inputs.source_e2e_support_only && 'source-e2e-support' || inputs.source_root_tests_only && 'source-root-tests' || inputs.verify_source && 'verification' || inputs.verify_public_install && 'public-install' || inputs.build_eval_viewer && 'viewer' || 'image' }}${{ github.event_name == 'workflow_dispatch' && inputs.expected_source_sha && format('-{0}', inputs.expected_source_sha) || '' }}
+  group: docker-runner-check-${{ github.event.pull_request.number || github.ref }}-${{ inputs.diagnose_pi_snapshot_streaming && 'pi-snapshot-streaming' || inputs.diagnose_pi_snapshot_pool && 'pi-snapshot-pool' || inputs.diagnose_pi_startup && 'pi-startup-diagnostic' || inputs.verify_pi_intel && 'pi-native-intel' || inputs.diagnose_ajv_pack && 'ajv-diagnostic' || inputs.verify_runner && 'runner-verification' || inputs.source_e2e_support_only && 'source-e2e-support' || inputs.source_root_tests_only && 'source-root-tests' || inputs.verify_source && 'verification' || inputs.verify_public_install && 'public-install' || inputs.build_eval_viewer && 'viewer' || 'image' }}${{ github.event_name == 'workflow_dispatch' && inputs.expected_source_sha && format('-{0}', inputs.expected_source_sha) || '' }}
   cancel-in-progress: true
 
 jobs:
@@ -129,10 +133,11 @@ jobs:
           SOURCE_E2E_SUPPORT_ONLY: ${{ inputs.source_e2e_support_only }}
           IMAGE_MODE: ${{ inputs.publish_eval_image || inputs.verify_public_install || inputs.build_eval_viewer }}
           VERIFY_PI_INTEL: ${{ inputs.verify_pi_intel }}
+          DIAGNOSE_PI_SNAPSHOT_STREAMING: ${{ inputs.diagnose_pi_snapshot_streaming }}
           DIAGNOSE_PI_SNAPSHOT_POOL: ${{ inputs.diagnose_pi_snapshot_pool }}
           DIAGNOSE_PI_STARTUP: ${{ inputs.diagnose_pi_startup }}
           DIAGNOSE_AJV: ${{ inputs.diagnose_ajv_pack }}
-          OTHER_MODE: ${{ inputs.publish_eval_image || inputs.verify_source || inputs.verify_public_install || inputs.build_eval_viewer || inputs.verify_pi_intel || inputs.diagnose_pi_startup || inputs.diagnose_pi_snapshot_pool || inputs.source_e2e_support_only }}
+          OTHER_MODE: ${{ inputs.publish_eval_image || inputs.verify_source || inputs.verify_public_install || inputs.build_eval_viewer || inputs.verify_pi_intel || inputs.diagnose_pi_startup || inputs.diagnose_pi_snapshot_pool || inputs.diagnose_pi_snapshot_streaming || inputs.source_e2e_support_only }}
         run: |
           set -euo pipefail
           test "$REPOSITORY" = paperclipai/paperclip
@@ -176,6 +181,7 @@ jobs:
             test "$EXPECTED_LOCK_SHA256" = 5ae57d1ddd475691dac1f1cfbd4836e54f7da1956b47e6e705b218ae3070ae2e
           fi
           if [ "$VERIFY_PI_INTEL" = true ]; then
+            test "$DIAGNOSE_PI_SNAPSHOT_STREAMING" != true
             test "$DIAGNOSE_PI_SNAPSHOT_POOL" != true
             test "$DIAGNOSE_PI_STARTUP" != true
             test "$VERIFY_RUNNER" != true
@@ -190,6 +196,7 @@ jobs:
             test "$(gh api "repos/$REPOSITORY" --jq '.visibility')" = public
           fi
           if [ "$DIAGNOSE_PI_STARTUP" = true ]; then
+            test "$DIAGNOSE_PI_SNAPSHOT_STREAMING" != true
             test "$DIAGNOSE_PI_SNAPSHOT_POOL" != true
             test "$VERIFY_PI_INTEL" != true
             test "$VERIFY_RUNNER" != true
@@ -203,6 +210,21 @@ jobs:
             test "$(gh api "repos/$REPOSITORY" --jq '.visibility')" = public
           fi
           if [ "$DIAGNOSE_PI_SNAPSHOT_POOL" = true ]; then
+            test "$DIAGNOSE_PI_SNAPSHOT_STREAMING" != true
+            test "$DIAGNOSE_PI_STARTUP" != true
+            test "$VERIFY_PI_INTEL" != true
+            test "$VERIFY_RUNNER" != true
+            test "$VERIFY_SOURCE" != true
+            test "$SOURCE_ROOT_TESTS_ONLY" != true
+            test "$SOURCE_E2E_SUPPORT_ONLY" != true
+            test "$DIAGNOSE_AJV" != true
+            test "$IMAGE_MODE" != true
+            test "$EXPECTED_SOURCE_SHA" = b9e5d6ecdb05ab7244c90976e07c950f8d09b15b
+            test "$EXPECTED_LOCK_SHA256" = 38338a6867358440c5ab5993eaeb85fb501bc7df65d24acf52fbd63c880ee4ba
+            test "$(gh api "repos/$REPOSITORY" --jq '.visibility')" = public
+          fi
+          if [ "$DIAGNOSE_PI_SNAPSHOT_STREAMING" = true ]; then
+            test "$DIAGNOSE_PI_SNAPSHOT_POOL" != true
             test "$DIAGNOSE_PI_STARTUP" != true
             test "$VERIFY_PI_INTEL" != true
             test "$VERIFY_RUNNER" != true
@@ -378,6 +400,57 @@ jobs:
           retention-days: 7
           if-no-files-found: error
 
+  manual_pi_snapshot_streaming:
+    name: Retained B9 native Intel baseline/streaming ABBA (not qualification)
+    if: github.event_name == 'workflow_dispatch' && inputs.diagnose_pi_snapshot_streaming
+    needs: authorize_manual
+    runs-on: macos-15-intel
+    timeout-minutes: 25
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout trusted diagnostic helpers only
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.workflow_sha }}
+          path: trusted-ci
+          persist-credentials: false
+      - name: Download exact failed qualification artifacts
+        timeout-minutes: 5
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh api repos/paperclipai/paperclip/actions/artifacts/11208570718/zip \
+            > "$RUNNER_TEMP/pi-startup-36959948724.zip"
+          printf '%s  %s\n' b82cf6c843006781e2e6d5f0a06e0ff39497ffc457b94a511f8bdda66628aa43 \
+            "$RUNNER_TEMP/pi-startup-36959948724.zip" | shasum -a 256 --check
+      - name: Measure four baseline/candidate snapshots with identical process-start pool4
+        timeout-minutes: 18
+        run: |
+          set -euo pipefail
+          python3 -B trusted-ci/scripts/ci/pi-intel/snapshot_streaming.py \
+            --archive "$RUNNER_TEMP/pi-startup-36959948724.zip" \
+            --output "$GITHUB_WORKSPACE/pi-snapshot-streaming-evidence"
+      - name: Admit complete diagnostic evidence within the storage bound
+        if: always()
+        id: diagnostic_evidence
+        timeout-minutes: 2
+        run: |
+          python3 -B trusted-ci/scripts/ci/pi-intel/admit_diagnostic_evidence.py \
+            --evidence "$GITHUB_WORKSPACE/pi-snapshot-streaming-evidence" \
+            --github-output "$GITHUB_OUTPUT"
+      - name: Retain original identities, four snapshot measurements and cleanup
+        if: always() && steps.diagnostic_evidence.outputs.admitted == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: pi-snapshot-streaming-${{ github.run_id }}
+          include-hidden-files: true
+          path: pi-snapshot-streaming-evidence/
+          retention-days: 7
+          if-no-files-found: error
+
   manual_runner_verify:
     name: Full offline Runner verification on GitHub-hosted Ubuntu
     if: github.event_name == 'workflow_dispatch' && inputs.verify_runner
@@ -808,7 +881,7 @@ jobs:
 
   manual_image:
     name: Build and verify on EC2
-    if: github.event_name == 'workflow_dispatch' && !inputs.verify_runner && !inputs.verify_source && !inputs.diagnose_ajv_pack && !inputs.verify_pi_intel && !inputs.diagnose_pi_startup && !inputs.diagnose_pi_snapshot_pool && !inputs.source_e2e_support_only
+    if: github.event_name == 'workflow_dispatch' && !inputs.verify_runner && !inputs.verify_source && !inputs.diagnose_ajv_pack && !inputs.verify_pi_intel && !inputs.diagnose_pi_startup && !inputs.diagnose_pi_snapshot_pool && !inputs.diagnose_pi_snapshot_streaming && !inputs.source_e2e_support_only
     needs: authorize_manual
     runs-on: runs-on/fleet=paperclip-public-pr-x64/env=public-ci
     timeout-minutes: 90