feat(runner): add Grok Build native ACP transport and qualification coverage

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/docker-runner-check.yml

@@ -1,6 +1,16 @@
 name: Docker Runner check
 
 on:
+  workflow_dispatch:
+    inputs:
+      publish_eval_image:
+        description: "Publish an immutable Daytona qualification image on the EC2 fleet (no provider credentials)"
+        type: boolean
+        default: false
+      verify_source:
+        description: "Run broad source checks on EC2"
+        type: boolean
+        default: false
   pull_request:
     paths:
       - .github/workflows/docker-runner-check.yml
@@ -14,11 +24,12 @@ on:
 permissions: {}
 
 concurrency:
-  group: docker-runner-check-${{ github.event.pull_request.number }}
+  group: docker-runner-check-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
   runner:
+    if: github.event_name == 'pull_request'
     name: Compile isolated native Runner
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -39,3 +50,119 @@ jobs:
       # No registry credentials or image publication.
       - name: Verify native build and dependency cache reuse
         run: bash scripts/check-docker-runner-cache.sh
+
+
+  authorize_manual:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 5
+    steps:
+      - name: Authorize an explicit maintainer image build
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          REPOSITORY_ID: ${{ github.repository_id }}
+          ACTOR_ID: ${{ github.actor_id }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+          ALLOWED_IDS: ${{ vars.AWS_CI_TRUSTED_USER_IDS }}
+        run: |
+          set -euo pipefail
+          test "$REPOSITORY" = paperclipai/paperclip
+          test "$REPOSITORY_ID" = 1170821064
+          jq -e 'type == "array" and length > 0 and all(.[]; type == "number")' <<< "$ALLOWED_IDS" >/dev/null
+          triggering_id="$(gh api "users/$TRIGGERING_ACTOR" --jq .id)"
+          for id in "$ACTOR_ID" "$triggering_id"; do
+            jq -e --argjson id "$id" 'index($id) != null' <<< "$ALLOWED_IDS" >/dev/null
+          done
+
+  manual_image:
+    name: Build and verify on EC2
+    needs: authorize_manual
+    runs-on: runs-on/fleet=paperclip-public-pr-x64/env=public-ci
+    timeout-minutes: 90
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Authorize an explicit maintainer image build
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          REPOSITORY_ID: ${{ github.repository_id }}
+          ACTOR_ID: ${{ github.actor_id }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+          ALLOWED_IDS: ${{ vars.AWS_CI_TRUSTED_USER_IDS }}
+        run: |
+          set -euo pipefail
+          test "$REPOSITORY" = paperclipai/paperclip
+          test "$REPOSITORY_ID" = 1170821064
+          jq -e 'type == "array" and length > 0 and all(.[]; type == "number")' <<< "$ALLOWED_IDS" >/dev/null
+          triggering_id="$(gh api "users/$TRIGGERING_ACTOR" --jq .id)"
+          for id in "$ACTOR_ID" "$triggering_id"; do
+            jq -e --argjson id "$id" 'index($id) != null' <<< "$ALLOWED_IDS" >/dev/null
+          done
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        with:
+          version: 9.15.4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - name: Resolve source dependencies without lifecycle scripts
+        run: |
+          pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
+          mkdir -p remote-verification
+          sha256sum pnpm-lock.yaml > remote-verification/lock.sha256
+          git rev-parse HEAD > remote-verification/source.txt
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - if: inputs.publish_eval_image
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build checksum-verified Grok provider image
+        if: inputs.publish_eval_image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          image="ghcr.io/paperclipai/paperclip-daytona-runner:qualification-${SOURCE_SHA}-${GITHUB_RUN_ID}"
+          lock_sha="$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)"
+          docker buildx build --platform linux/amd64 \
+            --file docker/daytona-runner/Dockerfile \
+            --build-arg "PAPERCLIP_RUNNER_SOURCE_REVISION=$SOURCE_SHA" \
+            --build-arg "PAPERCLIP_RUNNER_CONTENT_ID=qualification-$SOURCE_SHA" \
+            --build-arg "PAPERCLIP_RUNNER_LOCK_SHA256=$lock_sha" \
+            --cache-from type=registry,ref=ghcr.io/paperclipai/paperclip-daytona-runner:e2e-buildcache-amd64 \
+            --tag "$image" --metadata-file remote-verification/image.json --push .
+          digest="$(jq -r '."containerimage.digest"' remote-verification/image.json)"
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          immutable="${image%:*}@$digest"
+          docker logout ghcr.io
+          docker buildx imagetools inspect "$immutable" >/dev/null
+          echo "$immutable" > remote-verification/image.txt
+          echo "Image: $immutable" >> "$GITHUB_STEP_SUMMARY"
+      - name: Verify repository on EC2
+        if: inputs.verify_source
+        run: |
+          set -uo pipefail
+          pnpm install --frozen-lockfile --ignore-scripts
+          status=0
+          for check in 'pnpm -r typecheck' 'pnpm test:run' 'pnpm check:token-gates' 'pnpm test:e2e:runner:typecheck' 'pnpm test:e2e:runner:unit' 'pnpm build'; do
+            label="$(echo "$check" | tr -cs 'a-zA-Z0-9' '-')"
+            bash -c "$check" > "remote-verification/$label.log" 2>&1 || status=1
+          done
+          exit "$status"
+      - name: Retain source, image and verification evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: grok-remote-verification-${{ github.run_id }}
+          path: remote-verification/
+          retention-days: 7

.github/workflows/runner-full-stack-e2e.yml

@@ -1037,6 +1037,7 @@ jobs:
           OPENAI_API_KEY: ${{ matrix.credentialName == 'OPENAI_API_KEY' && secrets.OPENAI_API_KEY || '' }}
           ANTHROPIC_API_KEY: ${{ matrix.credentialName == 'ANTHROPIC_API_KEY' && secrets.ANTHROPIC_API_KEY || '' }}
           OPENROUTER_API_KEY: ${{ matrix.credentialName == 'OPENROUTER_API_KEY' && secrets.OPENROUTER_API_KEY || '' }}
+          XAI_API_KEY: ${{ matrix.credentialName == 'XAI_API_KEY' && secrets.XAI_API_KEY || '' }}
           DAYTONA_API_KEY: ${{ matrix.environmentId == 'daytona' && secrets.DAYTONA_API_KEY || '' }}
           PAPERCLIP_E2E_DAYTONA_IMAGE: ${{ needs.daytona_image.outputs.image }}
           PAPERCLIP_RUNNER_REMOTE_PROVIDER_PACK_PATH: ${{ github.workspace }}/packages/paperclip-runner/provider-pack