Merge verified release fixture and environment map updates

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* codex/runner-native-platform-prerequisites:
  fix(release): stage the target contract in assembly fixtures

maps/agent-access-map/execution-environments.md

@@ -10,6 +10,12 @@ Each capability needs operation-level review before its entire scope can be
 qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
 for format, permission checks, evidence and maintenance.
 
+Scoped immutable-platform source review: 2026-10-12 at
+`d16eccf109b524778ceb896f79ccb3881bc61a9b`, limited to saved sandbox probing,
+server-owned qualification metadata and read/invalidation behavior. The original
+baseline commit and review depth remain for unrelated operations; no live agent
+or provider qualification is claimed by this update.
+
 ## `configuration`
 
 Review: `baseline`.
@@ -34,6 +40,18 @@ own policy and access review.
 Gaps: API exists; an agent cannot use instance environment management as an ordinary
 company actor.
 
+Scoped source review: [environment routes](../../server/src/routes/environments.ts)
+require board organization access for reads and local-implicit board or instance
+administrator for management. Create/PATCH reject client-supplied platform-proof
+metadata; [service updates](../../server/src/services/environments.ts) discard
+supplied proof, preserve current server proof atomically for metadata-only edits,
+and invalidate it when the target configuration or driver changes. Public row
+responses hide the private record. This is source-only at the scoped commit.
+Verify forged metadata rejection, concurrent probe/update preservation, target
+invalidation and restricted-reader redaction; actual agent-denial proof remains
+not run. Company/team packages do not import or export environment rows, so those
+packages do not transfer platform qualification.
+
 ## `capabilities`
 
 Review: `baseline`.
@@ -73,6 +91,15 @@ Agent access: `restricted` — Board/admin probes / CLI environment.
 Policy: Environment management is instance administrator/board; permitted assignment
 uses agent/project policy.
 
+Both probe endpoints require a board actor that is local-implicit or an instance
+administrator; ordinary agent identity and company membership alone are denied.
+The saved sandbox probe also resolves company/environment and secret access
+before allocating a fresh lease. Its measurement is company-bound to an immutable
+image digest, effective provider configuration and active custom-image identity;
+only confirmed cleanup permits recording it. A draft probe does not record saved
+qualification. Reading stored qualification does not lease/provision a target and
+does not grant an agent permission to probe or manage that target.
+
 Evidence: `source-only` — [implementation](../../server/src/routes/environments.ts#L353)
 at the reviewed commit above.
 
@@ -82,6 +109,24 @@ own policy and access review.
 
 Gaps: Reachability probes are not granted by an agent's right to execute assigned work.
 
+Scoped Evidence: `source-only` — [probe authorization](../../server/src/routes/environments.ts),
+[immutable binding, measurement and read](../../server/src/services/environment-probe.ts),
+[private metadata writes](../../server/src/services/environments.ts) and
+[custom-image binding](../../server/src/services/environment-custom-image-runtime.ts)
+at the scoped commit. A connection-only success or a fixture cannot certify
+native compatibility, account authentication or agent access.
+
+Scoped Verification: `not-run` — on one authorized owned target, compare pinned
+image proof with mutable/snapshot and changed-config controls; require independent
+cleanup evidence before recording proof. Assert agent/non-admin board denial,
+secret-context denial where the actor lacks access and forged-proof rejection.
+Verify API reads hide the private record and metadata-only updates cannot overwrite it. Then use
+[runtime validation](./runs-adapters.md#validation) for account/model/native startup.
+
+There is no new delegated agent probe binding or client proof-write API. Any
+human-action request/result handoff requires its own admitted path and verification;
+an accepted interaction does not turn the caller into a board administrator.
+
 ## `assignment`
 
 Review: `baseline`.

maps/feature-map/execution-environments.md

@@ -38,6 +38,33 @@ Automated: [environment UI](../../ui/src/pages/CompanyEnvironments.test.tsx), [d
 
 Manual: Save a disposable target, reload it, and run its available probe. Verify both success and missing-credential/reachability errors identify the target. Confirm unavailable providers are not offered as working run targets.
 
+For an immutable sandbox image, pin the OCI image with `@sha256` and explicitly
+probe the saved environment in the intended company. The existing connection
+probe allocates a fresh lease and can measure its OS, architecture and libc.
+Qualification is recorded only when the selected image/configuration matches
+the live lease and cleanup is confirmed. Inspect `platformQualificationRecorded`
+and its diagnostic in the probe result: connection success alone does not mean
+the image has native runtime qualification.
+
+The measured record is server-owned, company-bound and tied to the effective
+configuration and active custom-image identity. Mutable tags, provider defaults
+and name-only snapshots do not qualify. Changing the target or image invalidates
+the record; normal metadata edits cannot forge or overwrite it, and API reads
+omit the private metadata. Reading this evidence for discovery or creation does
+not allocate a sandbox. The draft `probe-config` checks are not a saved-image
+qualification operation. See the [runtime contract](../../packages/paperclip-runner/README.md)
+and [adapter validation recipe](./runs-adapters.md#adapter-setup) for native
+binary/provider readiness after platform qualification.
+
+Verification recipe: probe a pinned owned image, record its company/config/image
+identity and cleanup result, then change the image or target and verify its old
+qualification is not reused. A mutable-image connection can succeed while
+qualification remains absent. Assert ordinary agent and non-admin board probe
+requests are denied, and environment create/PATCH payloads cannot supply
+qualification metadata.
+This recipe and its [probe controls](../../server/src/__tests__/environment-probe.test.ts)
+are not claims that a live provider or agent-access journey ran for this map update.
+
 The local row has no UI Test button. Its API/CLI probe reports host/cwd
 availability only; it does not validate an adapter binary, workspace, or task
 execution. Remote-driver probes and a real bounded run need their own evidence.
@@ -51,5 +78,7 @@ Manual: Run a bounded command in the intended target, inspect its output and wor
 ## Gotchas
 
 - A probe is narrower evidence than a complete task with tools, files, and resumption.
+- Platform qualification does not authenticate a model account or qualify every
+  harness; the selected native runtime still needs its own setup and useful-task proof.
 - The local option may appear only when editing an existing local environment; availability follows current UI/provider capabilities.
 - Workspace service reachability and environment reachability are separate checks.

packages/paperclip-runner/scripts/release-provider-pack.test.mjs

@@ -52,7 +52,7 @@ test("release assembly rejects rehashed stale or missing packs before staging an
   const source = dirname(dirname(fileURLToPath(import.meta.url)));
   try {
     // Run the actual assembler in an isolated layout so it cannot overwrite built artifacts.
-    for (const file of ["scripts/stage-release-runner-binaries.mjs", "scripts/release-provider-pack.mjs", "src/live/runner-binary.ts", "acpx-profiles.json", "cursor-distributions.json"]) {
+    for (const file of ["scripts/stage-release-runner-binaries.mjs", "scripts/release-provider-pack.mjs", "src/live/runner-binary.ts", "acpx-profiles.json", "cursor-distributions.json", "release-runner-targets.json"]) {
       mkdirSync(dirname(join(root, file)), { recursive: true }); cpSync(join(source, file), join(root, file));
     }
     const platforms = {};