diff --git a/packages/paperclip-runner/docs/durable-recovery.md b/packages/paperclip-runner/docs/durable-recovery.md
index 0fbef29f508..f04aab08a23 100644
--- a/packages/paperclip-runner/docs/durable-recovery.md
+++ b/packages/paperclip-runner/docs/durable-recovery.md
@@ -98,6 +98,35 @@ digest, and refuse the rest. A profile identity does not establish hosted
 harness qualification. [`rules/acpx-profile-identity.mdc`](../../../rules/acpx-profile-identity.mdc)
 summarizes these practices for contributors.
 
+Qualified ACPX native executables use Runner's persistent digest cache. The cache
+stores a computed SHA-256 digest under a key made from device, inode, size,
+nanosecond modification time, and nanosecond change time. Each check compares
+that digest with the independently selected build-owned pin. A changed file
+identity, missing entry, or unusable cache causes a full descriptor read and
+hash. A hit reuses the earlier digest; metadata identity is not a fresh content
+hash. Claude, Codex, and Grok use the same native executable admission path.
+
+Cache entries live in the operating-system temporary directory under
+`paperclip-runner-<uid>/executable-digests-v1`, outside task workspaces such as
+`/home/agent`. Neither `HOME` nor the task working directory selects this path.
+Node's `os.tmpdir()` selects the root and honors the platform's absolute
+`TMPDIR`, `TMP`, or `TEMP` override. Hosts must keep that root outside task
+workspaces; a relative or unusable root disables caching. Temporary-directory
+eviction removes the optimization until a later full hash fills it again. The
+directory and files are private to that user. Writes use a temporary file and
+atomic rename, so later Runner or sidecar processes can reuse complete entries.
+Cache errors fall back to hashing. The cache stores no credentials or file paths.
+
+Every admission still opens the executable without following its final symlink,
+checks its regular-file type, bounds, execute permission, and before/after file
+identity, and retains the descriptor for launch. Package qualification and the
+preparation-to-launch identity check remain. The cache deliberately trusts the
+operating-system user: a process with that user's access can plant a digest for
+a chosen fingerprint. It is not authenticated with a secret or signature.
+An administrator-owned read-only Runner can therefore use a user-writable cache,
+but this provides weaker protection against that same user than hashing every
+executable on each admission. Removing the cache restores full hashing.
+
 ## External controller checkpoints
 
 The optional controller persistence callback stores recovery control state, not
diff --git a/packages/paperclip-runner/src/drivers/acpx/executable-digest-cache.test.ts b/packages/paperclip-runner/src/drivers/acpx/executable-digest-cache.test.ts
new file mode 100644
index 00000000000..f33eb4fd39f
--- /dev/null
+++ b/packages/paperclip-runner/src/drivers/acpx/executable-digest-cache.test.ts
@@ -0,0 +1,160 @@
+import { createHash } from "node:crypto";
+import { chmod, lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createExecutableDigestCache, executableDigestCache, type ExecutableFileIdentity } from "../../executable-digest-cache.js";
+import { openVerifiedRuntimeExecutable } from "./installation-integrity.js";
+
+const temporary: string[] = [];
+const identity: ExecutableFileIdentity = { device: "1", inode: "2", size: "3", modifiedNanoseconds: "4", changedNanoseconds: "5" };
+const digest = `sha256:${"a".repeat(64)}`;
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await Promise.all(temporary.splice(0).map(path => rm(path, { recursive: true, force: true })));
+});
+
+async function fixture() {
+  const root = await mkdtemp(join(tmpdir(), "runner-executable-digest-cache-"));
+  temporary.push(root);
+  const directory = join(root, "cache");
+  const cache = createExecutableDigestCache(directory);
+  return { root, directory, cache };
+}
+
+describe("persistent executable digest cache", () => {
+  it("stores the actual digest in a private, versioned entry and survives a new cache instance", async () => {
+    const f = await fixture();
+    expect(await f.cache.read(identity)).toBeNull();
+    await f.cache.write(identity, digest);
+    expect(await createExecutableDigestCache(f.directory).read(identity)).toBe(digest);
+    const [name] = await readdir(f.directory);
+    expect(name).toMatch(/^v1-[a-f0-9]{64}\.json$/);
+    expect(JSON.parse(await readFile(join(f.directory, name), "utf8"))).toEqual({ version: 1, digest });
+    expect((await lstat(f.directory)).mode & 0o777).toBe(0o700);
+    expect((await lstat(join(f.directory, name))).mode & 0o777).toBe(0o600);
+  });
+
+  it.each(Object.keys(identity) as (keyof ExecutableFileIdentity)[])("invalidates a changed %s", async key => {
+    const f = await fixture();
+    await f.cache.write(identity, digest);
+    expect(await f.cache.read({ ...identity, [key]: "changed" })).toBeNull();
+  });
+
+  it.each(["malformed", "version", "digest", "oversized", "permissions", "symlink"] as const)(
+    "treats an unusable %s entry as a miss", async kind => {
+      const f = await fixture();
+      await f.cache.write(identity, digest);
+      const [name] = await readdir(f.directory), file = join(f.directory, name);
+      if (kind === "malformed") await writeFile(file, "{");
+      else if (kind === "version") await writeFile(file, JSON.stringify({ version: 2, digest }));
+      else if (kind === "digest") await writeFile(file, JSON.stringify({ version: 1, digest: "expected" }));
+      else if (kind === "oversized") await writeFile(file, "x".repeat(1025));
+      else if (kind === "permissions") await chmod(file, 0o644);
+      else { await rename(file, `${file}.target`); await symlink(`${file}.target`, file); }
+      expect(await f.cache.read(identity)).toBeNull();
+    },
+  );
+
+  it("falls back when the cache directory cannot be used and leaves existing permissions unchanged", async () => {
+    const f = await fixture();
+    await writeFile(f.directory, "not a directory");
+    await expect(f.cache.write(identity, digest)).resolves.toBeUndefined();
+    expect(await f.cache.read(identity)).toBeNull();
+    await rm(f.directory);
+    await mkdir(f.directory, { mode: 0o755 });
+    await f.cache.write(identity, digest);
+    expect(await f.cache.read(identity)).toBeNull();
+    expect((await lstat(f.directory)).mode & 0o777).toBe(0o755);
+  });
+
+  it("does not resolve a relative cache directory through the task working directory", async () => {
+    const cache = createExecutableDigestCache("relative-task-cache");
+    await cache.write(identity, digest);
+    expect(await cache.read(identity)).toBeNull();
+  });
+
+  it("publishes complete entries under concurrent writers without leftover temporary files", async () => {
+    const f = await fixture();
+    await Promise.all(Array.from({ length: 8 }, () => f.cache.write(identity, digest)));
+    expect(await f.cache.read(identity)).toBe(digest);
+    expect(await readdir(f.directory)).toHaveLength(1);
+  });
+});
+
+describe.skipIf(!["linux", "darwin"].includes(process.platform))("descriptor admission with cached digests", () => {
+  async function executable() {
+    const f = await fixture(), path = join(f.root, "native"), bytes = Buffer.from("qualified native fixture");
+    await writeFile(path, bytes, { mode: 0o700 });
+    vi.spyOn(executableDigestCache, "read").mockImplementation(f.cache.read);
+    vi.spyOn(executableDigestCache, "write").mockImplementation(f.cache.write);
+    return { ...f, path, digest: `sha256:${createHash("sha256").update(bytes).digest("hex")}` };
+  }
+
+  it("hashes a miss, reuses the actual digest, and still rejects a different independent pin", async () => {
+    const f = await executable();
+    await (await openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).handle.close();
+    expect(executableDigestCache.write).toHaveBeenCalledOnce();
+    await (await openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).handle.close();
+    expect(executableDigestCache.write).toHaveBeenCalledOnce();
+    await expect(openVerifiedRuntimeExecutable(f.path, digest, "fixture")).rejects.toThrow("digest mismatch");
+  });
+
+  it("rehashes changed contents and rejects corruption despite a previous valid entry", async () => {
+    const f = await executable();
+    await (await openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).handle.close();
+    await writeFile(f.path, "corrupted native fixture");
+    await expect(openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).rejects.toThrow("digest mismatch");
+  });
+
+  it.each(["permissions", "symlink", "replacement"] as const)("retains admission checks after cached %s changes", async kind => {
+    const f = await executable();
+    await (await openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).handle.close();
+    if (kind === "permissions") {
+      await chmod(f.path, 0o600);
+      await expect(openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).rejects.toThrow("bounded executable file");
+    } else if (kind === "symlink") {
+      await rename(f.path, `${f.path}.original`); await symlink(`${f.path}.original`, f.path);
+      await expect(openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).rejects.toThrow("real regular file");
+    } else {
+      await rename(f.path, `${f.path}.original`); await writeFile(f.path, "new invalid executable", { mode: 0o700 });
+      await expect(openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).rejects.toThrow("digest mismatch");
+    }
+  });
+
+  it("rejects mutation while a cache hit is being read", async () => {
+    const f = await executable();
+    await (await openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).handle.close();
+    vi.mocked(executableDigestCache.read).mockImplementationOnce(async () => {
+      await writeFile(f.path, "mutation during lookup");
+      return f.digest;
+    });
+    await expect(openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).rejects.toThrow("changed while it was verified");
+  });
+
+  it("checks executable identity after publishing a cold cache entry", async () => {
+    const f = await executable();
+    vi.mocked(executableDigestCache.write).mockImplementationOnce(async (identity, digest) => {
+      await f.cache.write(identity, digest);
+      await writeFile(f.path, "mutation during cache publication");
+    });
+    await expect(openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).rejects.toThrow("changed while it was verified");
+  });
+
+  it("falls back to hashing when the cache is unavailable", async () => {
+    const f = await executable();
+    await writeFile(f.directory, "unavailable cache");
+    await (await openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).handle.close();
+    await writeFile(f.path, "invalid native fixture");
+    await expect(openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).rejects.toThrow("digest mismatch");
+  });
+
+  it("trusts a digest planted by the same operating-system user for current metadata", async () => {
+    const f = await executable();
+    await writeFile(f.path, "content changed by the same user");
+    const metadata = await lstat(f.path, { bigint: true });
+    await f.cache.write({ device: metadata.dev.toString(), inode: metadata.ino.toString(), size: metadata.size.toString(),
+      modifiedNanoseconds: metadata.mtimeNs.toString(), changedNanoseconds: metadata.ctimeNs.toString() }, f.digest);
+    await (await openVerifiedRuntimeExecutable(f.path, f.digest, "fixture")).handle.close();
+  });
+});
diff --git a/packages/paperclip-runner/src/drivers/acpx/installation-integrity.ts b/packages/paperclip-runner/src/drivers/acpx/installation-integrity.ts
index fbf39064e18..1fab0150997 100644
--- a/packages/paperclip-runner/src/drivers/acpx/installation-integrity.ts
+++ b/packages/paperclip-runner/src/drivers/acpx/installation-integrity.ts
@@ -2,6 +2,7 @@ import { MAX_ACPX_RUNTIME_EXECUTABLE_BYTES, ACPX_PRIVATE_SNAPSHOT_ENV, createAcp
 import { createNativeAcpxDistributionSnapshot, NATIVE_ACPX_BOOTSTRAP_NAME, readNativeAcpxDistributionEntries, type NativeAcpxDistributionInput } from "./native-distribution-integrity.js";
 export type { NativeAcpxDistributionInput } from "./native-distribution-integrity.js";
 import { createHash } from "node:crypto";
+import { executableDigestCache, type ExecutableFileIdentity } from "../../executable-digest-cache.js";
 import {
   spawn as spawnChildProcess,
   type ChildProcess,
@@ -606,13 +607,7 @@ export async function awaitVerifiedAcpxProviderExit(
   await exitProof;
 }
 
-interface VerifiedAcpxCommandIdentity {
-  device: string;
-  inode: string;
-  size: string;
-  modifiedNanoseconds: string;
-  changedNanoseconds: string;
-}
+type VerifiedAcpxCommandIdentity = ExecutableFileIdentity;
 
 interface VerifiedAcpxRuntimeExecutable {
   path: string;
@@ -1204,7 +1199,7 @@ async function inspectCommand(
   }
 }
 
-async function openVerifiedRuntimeExecutable(
+export async function openVerifiedRuntimeExecutable(
   executablePath: string,
   expectedDigest: string,
   agent: string,
@@ -1246,23 +1241,31 @@ async function openVerifiedRuntimeExecutable(
         `ACPX ${agent} runtime executable must be a bounded executable file`,
       );
     }
-    const hash = createHash("sha256");
-    const buffer = Buffer.alloc(1024 * 1024);
+    const cachedDigest = await executableDigestCache.read(fileIdentity(before));
+    let digest = cachedDigest;
     let position = 0;
-    try {
-      while (position < Number(before.size)) {
-        const { bytesRead } = await handle.read(
-          buffer,
-          0,
-          Math.min(buffer.length, Number(before.size) - position),
-          position,
-        );
-        if (bytesRead === 0) break;
-        hash.update(buffer.subarray(0, bytesRead));
-        position += bytesRead;
+    if (digest === null) {
+      const hash = createHash("sha256");
+      const buffer = Buffer.alloc(1024 * 1024);
+      try {
+        while (position < Number(before.size)) {
+          const { bytesRead } = await handle.read(
+            buffer,
+            0,
+            Math.min(buffer.length, Number(before.size) - position),
+            position,
+          );
+          if (bytesRead === 0) break;
+          hash.update(buffer.subarray(0, bytesRead));
+          position += bytesRead;
+        }
+      } finally {
+        buffer.fill(0);
       }
-    } finally {
-      buffer.fill(0);
+      digest = `sha256:${hash.digest("hex")}`;
+    }
+    if (cachedDigest === null && position === Number(before.size) && digest === expectedDigest) {
+      await executableDigestCache.write(fileIdentity(before), digest);
     }
     const after = await handle.stat({ bigint: true });
     const lexicalAfter = await lstat(executablePath, { bigint: true }).catch(
@@ -1271,7 +1274,7 @@ async function openVerifiedRuntimeExecutable(
     const beforeIdentity = fileIdentity(before);
     const afterIdentity = fileIdentity(after);
     if (
-      position !== Number(before.size) ||
+      (cachedDigest === null && position !== Number(before.size)) ||
       lexicalAfter === null ||
       lexicalAfter.isSymbolicLink() ||
       !lexicalAfter.isFile() ||
@@ -1283,7 +1286,6 @@ async function openVerifiedRuntimeExecutable(
         `ACPX ${agent} runtime executable changed while it was verified`,
       );
     }
-    const digest = `sha256:${hash.digest("hex")}`;
     if (digest !== expectedDigest) {
       throw new Error(`ACPX ${agent} runtime executable digest mismatch`);
     }
diff --git a/packages/paperclip-runner/src/executable-digest-cache.ts b/packages/paperclip-runner/src/executable-digest-cache.ts
new file mode 100644
index 00000000000..b50b54d9059
--- /dev/null
+++ b/packages/paperclip-runner/src/executable-digest-cache.ts
@@ -0,0 +1,70 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { tmpdir, userInfo } from "node:os";
+import { isAbsolute, join } from "node:path";
+
+export interface ExecutableFileIdentity {
+  device: string;
+  inode: string;
+  size: string;
+  modifiedNanoseconds: string;
+  changedNanoseconds: string;
+}
+
+export function createExecutableDigestCache(directory?: string) {
+  async function location(identity: ExecutableFileIdentity, create: boolean): Promise<string> {
+    const user = userInfo();
+    const temporaryRoot = tmpdir();
+    if (!isAbsolute(directory ?? temporaryRoot)) throw new Error("Executable digest cache directory is unavailable");
+    const base = join(temporaryRoot, `paperclip-runner-${user.uid}`);
+    const directories = directory ? [directory] : [base, join(base, "executable-digests-v1")];
+    for (const [index, path] of directories.entries()) {
+      if (create) await mkdir(path, { mode: 0o700 }).catch(error => {
+        if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      });
+      const metadata = await lstat(path);
+      if (!metadata.isDirectory() || metadata.isSymbolicLink() || metadata.uid !== user.uid ||
+          (metadata.mode & (index === directories.length - 1 ? 0o077 : 0o022)) !== 0) {
+        throw new Error("Executable digest cache directory is unavailable");
+      }
+    }
+    const key = createHash("sha256").update(JSON.stringify([1, identity.device, identity.inode, identity.size,
+      identity.modifiedNanoseconds, identity.changedNanoseconds])).digest("hex");
+    return join(directories.at(-1)!, `v1-${key}.json`);
+  }
+
+  return {
+    async read(identity: ExecutableFileIdentity): Promise<string | null> {
+      try {
+        const path = await location(identity, false);
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+          const metadata = await handle.stat();
+          if (!metadata.isFile() || metadata.uid !== userInfo().uid || (metadata.mode & 0o077) !== 0 ||
+              metadata.size < 1 || metadata.size > 1024) return null;
+          const entry: unknown = JSON.parse(await handle.readFile("utf8"));
+          if (typeof entry !== "object" || entry === null || !("version" in entry) || entry.version !== 1 ||
+              !("digest" in entry) || typeof entry.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(entry.digest)) return null;
+          return entry.digest;
+        } finally { await handle.close(); }
+      } catch { return null; }
+    },
+    async write(identity: ExecutableFileIdentity, digest: string): Promise<void> {
+      let temporary: string | undefined;
+      try {
+        if (!/^sha256:[a-f0-9]{64}$/.test(digest)) return;
+        const path = await location(identity, true);
+        temporary = `${path}.${randomUUID()}.tmp`;
+        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try { await handle.writeFile(JSON.stringify({ version: 1, digest })); }
+        finally { await handle.close(); }
+        await rename(temporary, path);
+      } catch { } finally {
+        if (temporary) await unlink(temporary).catch(() => undefined);
+      }
+    },
+  };
+}
+
+export const executableDigestCache = createExecutableDigestCache();