fix(release): stage the target contract in assembly fixtures

Copy the immutable target JSON into the existing isolated helper fixture without changing negative assertions. Synchronize environment qualification recipes and access limits under the updated map contract.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

maps/agent-access-map/execution-environments.md

@@ -10,6 +10,12 @@ Each capability needs operation-level review before its entire scope can be
 qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
 for format, permission checks, evidence and maintenance.
 
+Scoped immutable-platform source review: 2026-10-12 at
+`d16eccf109b524778ceb896f79ccb3881bc61a9b`, limited to saved sandbox probing,
+server-owned qualification metadata and read/invalidation behavior. The original
+baseline commit and review depth remain for unrelated operations; no live agent
+or provider qualification is claimed by this update.
+
 ## `configuration`
 
 Review: `baseline`.
@@ -34,6 +40,18 @@ own policy and access review.
 Gaps: API exists; an agent cannot use instance environment management as an ordinary
 company actor.
 
+Scoped source review: [environment routes](../../server/src/routes/environments.ts)
+require board organization access for reads and local-implicit board or instance
+administrator for management. Create/PATCH reject client-supplied platform-proof
+metadata; [service updates](../../server/src/services/environments.ts) discard
+supplied proof, preserve current server proof atomically for metadata-only edits,
+and invalidate it when the target configuration or driver changes. Public row
+responses hide the private record. This is source-only at the scoped commit.
+Verify forged metadata rejection, concurrent probe/update preservation, target
+invalidation and restricted-reader redaction; actual agent-denial proof remains
+not run. Company/team packages do not import or export environment rows, so those
+packages do not transfer platform qualification.
+
 ## `capabilities`
 
 Review: `baseline`.
@@ -73,6 +91,15 @@ Agent access: `restricted` — Board/admin probes / CLI environment.
 Policy: Environment management is instance administrator/board; permitted assignment
 uses agent/project policy.
 
+Both probe endpoints require a board actor that is local-implicit or an instance
+administrator; ordinary agent identity and company membership alone are denied.
+The saved sandbox probe also resolves company/environment and secret access
+before allocating a fresh lease. Its measurement is company-bound to an immutable
+image digest, effective provider configuration and active custom-image identity;
+only confirmed cleanup permits recording it. A draft probe does not record saved
+qualification. Reading stored qualification does not lease/provision a target and
+does not grant an agent permission to probe or manage that target.
+
 Evidence: `source-only` — [implementation](../../server/src/routes/environments.ts#L353)
 at the reviewed commit above.
 
@@ -82,6 +109,24 @@ own policy and access review.
 
 Gaps: Reachability probes are not granted by an agent's right to execute assigned work.
 
+Scoped Evidence: `source-only` — [probe authorization](../../server/src/routes/environments.ts),
+[immutable binding, measurement and read](../../server/src/services/environment-probe.ts),
+[private metadata writes](../../server/src/services/environments.ts) and
+[custom-image binding](../../server/src/services/environment-custom-image-runtime.ts)
+at the scoped commit. A connection-only success or a fixture cannot certify
+native compatibility, account authentication or agent access.
+
+Scoped Verification: `not-run` — on one authorized owned target, compare pinned
+image proof with mutable/snapshot and changed-config controls; require independent
+cleanup evidence before recording proof. Assert agent/non-admin board denial,
+secret-context denial where the actor lacks access and forged-proof rejection.
+Verify API reads hide the private record and metadata-only updates cannot overwrite it. Then use
+[runtime validation](./runs-adapters.md#validation) for account/model/native startup.
+
+There is no new delegated agent probe binding or client proof-write API. Any
+human-action request/result handoff requires its own admitted path and verification;
+an accepted interaction does not turn the caller into a board administrator.
+
 ## `assignment`
 
 Review: `baseline`.

maps/feature-map/execution-environments.md

@@ -38,6 +38,33 @@ Automated: [environment UI](../../ui/src/pages/CompanyEnvironments.test.tsx), [d
 
 Manual: Save a disposable target, reload it, and run its available probe. Verify both success and missing-credential/reachability errors identify the target. Confirm unavailable providers are not offered as working run targets.
 
+For an immutable sandbox image, pin the OCI image with `@sha256` and explicitly
+probe the saved environment in the intended company. The existing connection
+probe allocates a fresh lease and can measure its OS, architecture and libc.
+Qualification is recorded only when the selected image/configuration matches
+the live lease and cleanup is confirmed. Inspect `platformQualificationRecorded`
+and its diagnostic in the probe result: connection success alone does not mean
+the image has native runtime qualification.
+
+The measured record is server-owned, company-bound and tied to the effective
+configuration and active custom-image identity. Mutable tags, provider defaults
+and name-only snapshots do not qualify. Changing the target or image invalidates
+the record; normal metadata edits cannot forge or overwrite it, and API reads
+omit the private metadata. Reading this evidence for discovery or creation does
+not allocate a sandbox. The draft `probe-config` checks are not a saved-image
+qualification operation. See the [runtime contract](../../packages/paperclip-runner/README.md)
+and [adapter validation recipe](./runs-adapters.md#adapter-setup) for native
+binary/provider readiness after platform qualification.
+
+Verification recipe: probe a pinned owned image, record its company/config/image
+identity and cleanup result, then change the image or target and verify its old
+qualification is not reused. A mutable-image connection can succeed while
+qualification remains absent. Assert ordinary agent and non-admin board probe
+requests are denied, and environment create/PATCH payloads cannot supply
+qualification metadata.
+This recipe and its [probe controls](../../server/src/__tests__/environment-probe.test.ts)
+are not claims that a live provider or agent-access journey ran for this map update.
+
 The local row has no UI Test button. Its API/CLI probe reports host/cwd
 availability only; it does not validate an adapter binary, workspace, or task
 execution. Remote-driver probes and a real bounded run need their own evidence.
@@ -51,5 +78,7 @@ Manual: Run a bounded command in the intended target, inspect its output and wor
 ## Gotchas
 
 - A probe is narrower evidence than a complete task with tools, files, and resumption.
+- Platform qualification does not authenticate a model account or qualify every
+  harness; the selected native runtime still needs its own setup and useful-task proof.
 - The local option may appear only when editing an existing local environment; availability follows current UI/provider capabilities.
 - Workspace service reachability and environment reachability are separate checks.

packages/paperclip-runner/scripts/release-provider-pack.test.mjs

@@ -52,7 +52,7 @@ test("release assembly rejects rehashed stale or missing packs before staging an
   const source = dirname(dirname(fileURLToPath(import.meta.url)));
   try {
     // Run the actual assembler in an isolated layout so it cannot overwrite built artifacts.
-    for (const file of ["scripts/stage-release-runner-binaries.mjs", "scripts/release-provider-pack.mjs", "src/live/runner-binary.ts", "acpx-profiles.json", "cursor-distributions.json"]) {
+    for (const file of ["scripts/stage-release-runner-binaries.mjs", "scripts/release-provider-pack.mjs", "src/live/runner-binary.ts", "acpx-profiles.json", "cursor-distributions.json", "release-runner-targets.json"]) {
       mkdirSync(dirname(join(root, file)), { recursive: true }); cpSync(join(source, file), join(root, file));
     }
     const platforms = {};