feat(evals): connect hosted Runner costs and traces (#17889)

## Thinking Path > - Paperclip manages AI agents and measures their behavior with Runner evaluations. > - The cost controller, native tracing, private receipts and portable runtime are on master. > - The maintained live workflow still launches the provider CLI directly. > - Independent workers need one shared selection and disjoint budget allocations. > - Reports must keep unresolved allocations when a worker produces no evidence. > - This PR connects the maintained workflow to the existing controller and private archive. > - Operators can inspect known costs, conservative holds and trace evidence before qualifying paid recurrence. ## Linked Issues or Issue Description Refs #17452, #17469, #17493, #17506, #17523. **Current behavior** The live Runner workflow does not use the merged cost/tracing controller. Attempt-only aggregation cannot reconstruct a campaign when every worker archive is absent. Ordinary Actions artifacts in this public repository are readable by authenticated public GitHub users. **Proposed behavior** Controlled runs prepare one manifest, bind every selected request, enforce disjoint allocations and retain evidence in private storage. The report starts from the full retained manifest. Missing workers keep their allocations. The workflow rejects retries, unsupported providers, changed requests and absent or stale operating bounds before provider work. **Reason and benefit** The maintained workflow needs auditable costs and traces, including failures and missing receipts, before paid recurrence can be qualified. ## What Changed - Add controlled mode as the manual default and the only scheduled mode. Legacy mode remains explicit for other manual provider qualifications. - Prepare the full request selection and one shared manifest. Bind current run, first attempt, code, definitions, executable hashes and exact profile allocations. - Verify the copied controller and manifest before provider credentials. Require the controlled target to equal the trusted workflow revision before private archive access. - Reuse private archive retention for the controller policy, cell attempts and canonical report. AWS credentials remain transfer-step outputs. Controlled raw evidence is never uploaded as an Actions artifact. - Replay a retained manifest with partial or empty worker evidence. Count operating holds once and preserve known partial charges. - Pin the controller to an explicitly reviewed compatible lockfile digest. Reject resolver or byte drift before a frozen, script-free install into a job-local store. Record the lock digest in the runtime receipt and verify it again in private preparation. - Build the portable controller without secrets, private environment access or OIDC. Private preparation verifies that artifact and performs no dependency install. OIDC jobs use no mutable dependency resolution or shared cache. - Add synthetic source/copied-runtime tests, executable workflow admission tests, private archive tests and an operator runbook. ## Verification - Controller, campaign, portable runtime and workflow tests: 104 passed. This includes real aggregation from an isolated reporter without source dependencies, safe diagnostics, driver drift, distinct evidence binding and reviewed-lock drift. Real private Codex/Claude requests also pass through an independently verified copied runtime with fake transports. - Private transport and workflow contracts: 35 passed. Executable/static workflow guards: 13 passed. - Paired private report tests: 166 passed; Evalbook discovery: 7 passed. - `pnpm -r typecheck` and `pnpm build`: passed. - `pnpm test:e2e:runner:typecheck`, `actionlint .github/workflows/runner-protocol-live-evals.yml` and `git diff --check`: passed. - `pnpm test:run` hit repeated local embedded PostgreSQL initialization failures in unrelated DB-dependent server tests. Its owned process tree was stopped after preserving the log. This is a local verification limitation; current-head CI remains required. - An earlier head hit one unchanged Rust cleanup assertion. The exact test passed locally and the final head passed the full Rust lane; the initial failure log is retained. - On the final head, one unchanged chat idle-queue assertion failed once in CI. Its single scoped retry passed. All test jobs and the final aggregate gate passed on commit `2e328fa53dd296174d59d19f14f068aeeb0b82d8` (CI run 40535692048, attempt 2). - No paid model, Braintrust or cloud calls. No live variables, secrets, schedules or resources changed. ## Risks - Controlled mode fails closed until a reviewed `RUNNER_PROTOCOL_EVAL_CONTROLLER_POLICY_JSON` and a compatible private eval SHA exist. `all` does not silently become a supported subset. - The reviewed policy must cover setup, model requests, trace/gateway processing, archive transfer and retained storage. Hash binding does not establish vendor billing bounds. This PR does not enable recurrence or release historical holds. - The controlled policy must pin `controllerLockSha256`; it never accepts a resolver-generated digest automatically. No lockfile is committed. A changed compatible lock needs review. - Legacy browser verification now requires the committed frozen lockfile. A stale lockfile fails closed; controlled preparation has no dependency install. - Workflow cancellation can prevent the final report. The full manifest is retained before provider work and remains the starting point for reconciliation. - The workflow exceeds 1,000 lines because the shared shard anchor, dependencies, environment expressions and credential boundaries belong to one declarative job graph. Request preparation, accounting, archive safety and runtime verification stay in separately tested modules. ## Model Used OpenAI Codex, GPT-6-based coding agent with tool use and code execution. The host does not expose an exact deployment model ID or context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run the relevant tests locally and they pass; the broad local suite limitation is documented above - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green on the final head - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups; the secondary reviewer is also 5/5 - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-28 12:04:41 +01:00 · 2026-10-27 11:38:16 -05:00
1 parent 585b4e6af8
commit 8548173fc9
@@ -1,4 +1,4 @@
-name: Runner Direct Live Protocol Evals
+name: Runner Live Protocol Evals

 on:
  schedule:
@@ -30,10 +30,17 @@ on:
          - subscription
        default: api_key
        required: false
+      accounting_mode:
+        description: "Controlled Codex/Claude costs and traces, or explicit legacy provider qualification"
+        type: choice
+        options:
+          - controlled
+          - legacy
+        default: controlled
      max_infrastructure_retries:
        description: "Automatic retries only for explicitly retryable infrastructure failures (0-3)"
        type: number
-        default: 1
+        default: 0

 permissions:
  contents: read
@@ -51,6 +58,9 @@ jobs:
    permissions:
      contents: read
    outputs:
+      accounting_mode: ${{ steps.mode.outputs.mode }}
+      retry_count: ${{ steps.mode.outputs.retries }}
+      controller_lock_sha256: ${{ steps.mode.outputs.controller_lock_sha256 }}
      test_runner: ${{ steps.runner.outputs.runner }}
      max_parallel_default: ${{ steps.runner.outputs.max_parallel_default }}
      max_parallel_limit: ${{ steps.runner.outputs.max_parallel_limit }}
@@ -139,12 +149,35 @@ jobs:
          test "$resolved" = "$EVALS_SHA"
          echo "sha=$resolved" >> "$GITHUB_OUTPUT"

-      - name: Validate retry envelope
+      - name: Validate accounting mode and retry envelope
+        id: mode
        env:
-          RETRIES: ${{ github.event_name == 'schedule' && 1 || inputs.max_infrastructure_retries }}
+          EVENT_NAME: ${{ github.event_name }}
+          ACCOUNTING_MODE: ${{ inputs.accounting_mode || 'controlled' }}
+          RETRIES: ${{ inputs.max_infrastructure_retries || 0 }}
+          CONTROLLER_POLICY_JSON: ${{ vars.RUNNER_PROTOCOL_EVAL_CONTROLLER_POLICY_JSON }}
+          TARGET_SHA: ${{ steps.target.outputs.sha }}
        run: |
          set -euo pipefail
+          if [ "$EVENT_NAME" = schedule ]; then ACCOUNTING_MODE=controlled; RETRIES=0; fi
          [[ "$RETRIES" =~ ^[0-3]$ ]]
+          case "$ACCOUNTING_MODE" in
+            controlled)
+              test "$TARGET_SHA" = "$GITHUB_SHA"
+              test "$GITHUB_RUN_ATTEMPT" = 1
+              test "$RETRIES" = 0
+              if ! jq -e '.schema == "paperclip.runner-eval.hosted-policy/v1"' <<< "${CONTROLLER_POLICY_JSON:-}" >/dev/null; then
+                echo 'Controlled runs require a reviewed RUNNER_PROTOCOL_EVAL_CONTROLLER_POLICY_JSON; no provider work started.' >&2
+                exit 1
+              fi
+              lock_sha="$(jq -er '.controllerLockSha256 | select(type == "string" and test("^[a-f0-9]{64}$"))' <<< "$CONTROLLER_POLICY_JSON")"
+              echo "controller_lock_sha256=$lock_sha" >> "$GITHUB_OUTPUT"
+              ;;
+            legacy) test "$EVENT_NAME" = workflow_dispatch ;;
+            *) exit 1 ;;
+          esac
+          echo "mode=$ACCOUNTING_MODE" >> "$GITHUB_OUTPUT"
+          echo "retries=$RETRIES" >> "$GITHUB_OUTPUT"

      - name: Select paid test runner
        id: runner
@@ -265,6 +298,8 @@ jobs:
          REQUESTED_MAX_PARALLEL: ${{ inputs.max_parallel }}
          ROSTERS: ${{ inputs.rosters || 'all' }}
          GROK_AUTHENTICATION: ${{ inputs.grok_authentication || 'api_key' }}
+          ACCOUNTING_MODE: ${{ needs.authorize.outputs.accounting_mode }}
+          CONTROLLER_POLICY_JSON: ${{ vars.RUNNER_PROTOCOL_EVAL_CONTROLLER_POLICY_JSON }}
        run: |
          set -euo pipefail
          if ! [[ "$MAX_PARALLEL" =~ ^[1-9][0-9]*$ ]] || [ "$MAX_PARALLEL" -lt 2 ] || [ "$MAX_PARALLEL" -gt "$MAX_PARALLEL_LIMIT" ]; then
@@ -285,6 +320,13 @@ jobs:
            --campaign-id "gha-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" \
            --max-parallel "$MAX_PARALLEL" \
            --output runner-protocol-eval-catalog.json
+          if [ "$ACCOUNTING_MODE" = controlled ]; then
+            jq -e 'all(.cells[]; (.provider == "codex" and (.acpxAgent // "") == "" and .driver == "codex_app_server") or (.provider == "acpx" and .acpxAgent == "claude" and .driver == "acpx_runtime"))' runner-protocol-eval-catalog.json >/dev/null || {
+              echo 'Controlled selection supports native Codex and ACPX Claude only; select their rosters explicitly.' >&2; exit 1;
+            }
+            maximum="$(jq -er '.maxCells | select(type == "number" and floor == . and . > 0 and . <= 512)' <<< "$CONTROLLER_POLICY_JSON")"
+            jq -e --argjson maximum "$maximum" '.cells | length <= $maximum' runner-protocol-eval-catalog.json >/dev/null
+          fi

      - name: Require the chat-report renderer before paid execution
        run: |
@@ -408,16 +450,219 @@ jobs:
          retention-days: 30
          if-no-files-found: error

+  build_controller:
+    name: Build trusted controller without private archive access
+    needs: [authorize, target_lock]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    outputs:
+      artifact_id: ${{ steps.upload.outputs.artifact-id }}
+      runtime_receipt_sha256: ${{ steps.build.outputs.runtime_receipt_sha256 }}
+    steps:
+      - name: Select accounting mode
+        run: test '${{ needs.authorize.outputs.accounting_mode }}' = controlled || test '${{ needs.authorize.outputs.accounting_mode }}' = legacy
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        with:
+          node-version: 24
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        env:
+          NPM_CONFIG_AUDIT: "false"
+          NPM_CONFIG_FUND: "false"
+          NPM_CONFIG_UPDATE_NOTIFIER: "false"
+        with:
+          version: 9.15.4
+
+      - name: Download resolved lockfile for review binding
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          artifact-ids: ${{ needs.target_lock.outputs.artifact_id }}
+          path: ${{ runner.temp }}/runner-controller-lock
+
+      - name: Build portable controller in an unprivileged job
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: build
+        env:
+          EXPECTED_LOCK_SHA256: ${{ needs.authorize.outputs.controller_lock_sha256 }}
+          RESOLVED_LOCK_SHA256: ${{ needs.target_lock.outputs.lock_sha256 }}
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          test "$RESOLVED_LOCK_SHA256" = "$EXPECTED_LOCK_SHA256"
+          lock="$RUNNER_TEMP/runner-controller-lock/pnpm-lock.yaml"
+          test "$(sha256sum "$lock" | cut -d ' ' -f 1)" = "$EXPECTED_LOCK_SHA256"
+          cp "$lock" pnpm-lock.yaml
+          pnpm install --frozen-lockfile --ignore-scripts --store-dir "$RUNNER_TEMP/runner-controller-pnpm-store"
+          node packages/paperclip-runner/scripts/controlled-evals/build-runtime.mjs \
+            "$RUNNER_TEMP/runner-protocol-runtime" "$GITHUB_SHA" > "$RUNNER_TEMP/controller-runtime-receipt.json"
+          echo "runtime_receipt_sha256=$(jq -r .receiptSha256 "$RUNNER_TEMP/controller-runtime-receipt.json")" >> "$GITHUB_OUTPUT"
+
+      - name: Retain the trusted controller code for every worker
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: runner-protocol-runtime-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/runner-protocol-runtime/
+          retention-days: 30
+          if-no-files-found: error
+
+  prepare_controller:
+    name: Prepare one shared cost and trace manifest
+    needs: [authorize, catalog, build_runner, build_controller]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    environment: ${{ needs.authorize.outputs.accounting_mode == 'controlled' && 'runner-e2e-private-history' || '' }}
+    outputs:
+      artifact_id: ${{ needs.build_controller.outputs.artifact_id }}
+      manifest_sha256: ${{ steps.prepare.outputs.manifest_sha256 }}
+      runtime_receipt_sha256: ${{ needs.build_controller.outputs.runtime_receipt_sha256 }}
+    steps:
+      - name: Select accounting mode
+        run: test '${{ needs.authorize.outputs.accounting_mode }}' = controlled || test '${{ needs.authorize.outputs.accounting_mode }}' = legacy
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Generate private eval-repository token
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: evals_token
+        env:
+          COMMITPERCLIP_KEY: ${{ secrets.COMMITPERCLIP_KEY }}
+          GH_REPO: paperclipai/paperclip-evals
+        run: |
+          set -euo pipefail
+          token="$(node .github/scripts/get-bot-token.mjs)"
+          echo "::add-mask::$token"
+          echo "value=$token" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        with:
+          repository: paperclipai/paperclip-evals
+          ref: ${{ needs.authorize.outputs.evals_sha }}
+          path: .paperclip-evals
+          token: ${{ steps.evals_token.outputs.value }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        with:
+          node-version: 24
+
+      - name: Download the complete campaign catalog
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: runner-protocol-eval-catalog-${{ github.run_id }}-${{ github.run_attempt }}
+          path: runner-protocol-catalog
+
+      - name: Download the immutable provider runtime
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: runner-protocol-build-${{ needs.authorize.outputs.target_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: runner-protocol-build
+
+      - name: Download trusted controller built without archive permissions
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          artifact-ids: ${{ needs.build_controller.outputs.artifact_id }}
+          path: ${{ runner.temp }}/runner-protocol-runtime
+
+      - name: Verify copied controller before private preparation
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        env:
+          EXPECTED_LOCK_SHA256: ${{ needs.authorize.outputs.controller_lock_sha256 }}
+          RUNTIME_RECEIPT_SHA256: ${{ needs.build_controller.outputs.runtime_receipt_sha256 }}
+        run: |
+          set -euo pipefail
+          node packages/paperclip-runner/scripts/controlled-evals/verify-runtime.mjs "$RUNNER_TEMP/runner-protocol-runtime" "$GITHUB_SHA" "$RUNTIME_RECEIPT_SHA256"
+          test "$(jq -r '.inputs["pnpm-lock.yaml"]' "$RUNNER_TEMP/runner-protocol-runtime/runtime.json")" = "$EXPECTED_LOCK_SHA256"
+
+      - name: Compile requests and bind the reviewed operating policy
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: prepare
+        env:
+          PAPERCLIP_PROTOCOL_EVAL_SOURCE_SHA: ${{ needs.authorize.outputs.target_sha }}
+          PAPERCLIP_PROTOCOL_EVALS_SHA: ${{ needs.authorize.outputs.evals_sha }}
+          CONTROLLER_POLICY_JSON: ${{ vars.RUNNER_PROTOCOL_EVAL_CONTROLLER_POLICY_JSON }}
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          test "$(git -C .paperclip-evals rev-parse HEAD)" = "$PAPERCLIP_PROTOCOL_EVALS_SHA"
+          python3 .paperclip-evals/evals/paperclip-runner/tools/eval_program.py report --help | grep -q -- --controller-manifest
+          (cd runner-protocol-build && sha256sum --check runner-protocol-build.tar.gz.sha256)
+          mkdir runner-protocol-build/extracted
+          tar -xzf runner-protocol-build/runner-protocol-build.tar.gz -C runner-protocol-build/extracted
+          policy="$RUNNER_TEMP/runner-controller-policy.json"
+          POLICY_PATH="$policy" python3 - <<'PYTHON'
+          import os
+          with os.fdopen(os.open(os.environ["POLICY_PATH"], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as target:
+              target.write(os.environ["CONTROLLER_POLICY_JSON"])
+          PYTHON
+          worker="/tmp/paperclip-runner-controlled-${GITHUB_RUN_ID}"
+          python3 .paperclip-evals/evals/paperclip-runner/tools/prepare_controlled_campaign.py \
+            --catalog runner-protocol-catalog/runner-protocol-eval-catalog.json \
+            --runnerd runner-protocol-build/extracted/paperclip-runnerd \
+            --worker-runnerd "$worker/runner/paperclip-runnerd" \
+            --github-run-id "$GITHUB_RUN_ID" --definitions-revision "$PAPERCLIP_PROTOCOL_EVALS_SHA" \
+            --output "$RUNNER_TEMP/prepared-requests.json"
+          control="$RUNNER_TEMP/runner-protocol-control"
+          node "$RUNNER_TEMP/runner-protocol-runtime/controlled-evals/hosted.mjs" prepare \
+            runner-protocol-catalog/runner-protocol-eval-catalog.json "$RUNNER_TEMP/prepared-requests.json" \
+            "$policy" runner-protocol-build/extracted "$control" > "$RUNNER_TEMP/control-preparation.json"
+          cp "$policy" "$control/hosted-policy.json"
+          echo "manifest_sha256=$(jq -r .manifestSha256 "$RUNNER_TEMP/control-preparation.json")" >> "$GITHUB_OUTPUT"
+
+      - name: Obtain private archive credentials for transfer steps only
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: private_history_credentials
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
+        with:
+          role-to-assume: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_ROLE_ARN }}
+          aws-region: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          output-env-credentials: false
+          output-credentials: true
+          disable-retry: true
+          action-timeout-s: 60
+
+      - name: Retain the identical manifest and policy in private storage
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        env:
+          AWS_ACCESS_KEY_ID: ${{ steps.private_history_credentials.outputs.aws-access-key-id }}
+          AWS_SECRET_ACCESS_KEY: ${{ steps.private_history_credentials.outputs.aws-secret-access-key }}
+          AWS_SESSION_TOKEN: ${{ steps.private_history_credentials.outputs.aws-session-token }}
+          AWS_REGION: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET }}
+        run: node "$RUNNER_TEMP/runner-protocol-runtime/private-history.mjs" upload protocol-control "$GITHUB_RUN_ID" "$RUNNER_TEMP/runner-protocol-control"
+
  eval_shard_0:
    name: Direct eval ${{ matrix.rosterId }} / ${{ matrix.caseId }}
-    needs: [authorize, catalog, build_runner]
+    needs: [authorize, catalog, build_runner, prepare_controller]
    runs-on: ${{ needs.authorize.outputs.test_runner }}
    timeout-minutes: 18
    permissions:
      contents: read
      id-token: write
    environment:
-      name: runner-e2e-paid
+      name: ${{ needs.authorize.outputs.accounting_mode == 'controlled' && 'runner-e2e-private-paid' || 'runner-e2e-paid' }}
    strategy:
      fail-fast: false
      max-parallel: ${{ fromJSON(needs.catalog.outputs.max_parallel_per_shard) }}
@@ -435,6 +680,10 @@ jobs:
        run: |
          set -euo pipefail
          test "$REF" = "refs/heads/$DEFAULT_BRANCH"
+          if [ '${{ needs.authorize.outputs.accounting_mode }}' = controlled ]; then
+            test '${{ needs.authorize.outputs.target_sha }}' = "$GITHUB_SHA"
+            test "$GITHUB_RUN_ATTEMPT" = 1
+          fi
          triggering_actor_id="$(gh api "users/$TRIGGERING_ACTOR" --jq .id)"
          test "$triggering_actor_id" = "$ACTOR_ID" || test "$TRIGGERING_ACTOR" != "$ACTOR"
          for candidate in "$triggering_actor_id" "$ACTOR_ID"; do
@@ -484,10 +733,30 @@ jobs:
          tar --extract --gzip --file runner-protocol-build.tar.gz --directory extracted
          test -x extracted/paperclip-runnerd

+      - name: Download the trusted portable controller
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          artifact-ids: ${{ needs.prepare_controller.outputs.artifact_id }}
+          path: /tmp/paperclip-runner-controlled-${{ github.run_id }}/runtime
+
+      - name: Verify controller code before archive access
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: verify_controller
+        env:
+          RUNTIME_RECEIPT_SHA256: ${{ needs.prepare_controller.outputs.runtime_receipt_sha256 }}
+        run: |
+          set -euo pipefail
+          root="/tmp/paperclip-runner-controlled-${GITHUB_RUN_ID}"
+          node packages/paperclip-runner/scripts/controlled-evals/verify-runtime.mjs "$root/runtime" "$GITHUB_SHA" "$RUNTIME_RECEIPT_SHA256"
+          cp -a runner-protocol-build/extracted "$root/runner"
+
      # Keep the host policy aligned with runner-full-stack-e2e.yml. This is
      # deliberately before any provider credential or web-identity step.
      - name: Provision Codex sandbox on the disposable trusted runner
        if: matrix.provider == 'codex' || matrix.rosterId == 'protocol-live-acpx-codex-control'
+        env:
+          CONTROLLED_RUNNER_ROOT: ${{ needs.authorize.outputs.accounting_mode == 'controlled' && format('/tmp/paperclip-runner-controlled-{0}/runner', github.run_id) || '' }}
        run: |
          node --input-type=module <<'NODE'
          import { execFileSync } from "node:child_process";
@@ -499,7 +768,7 @@ jobs:
          let restricted = "0";
          try { restricted = readFileSync("/proc/sys/kernel/apparmor_restrict_unprivileged_userns", "utf8").trim(); } catch {}
          if (restricted !== "1") process.exit(0);
-          const root = realpathSync(path.join(process.env.GITHUB_WORKSPACE, "runner-protocol-build/extracted/portable"));
+          const root = realpathSync(process.env.CONTROLLED_RUNNER_ROOT ? path.join(process.env.CONTROLLED_RUNNER_ROOT, "portable") : path.join(process.env.GITHUB_WORKSPACE, "runner-protocol-build/extracted/portable"));
          const runnerRequire = createRequire(path.join(root, "package.json"));
          const acpRequire = createRequire(runnerRequire.resolve("@agentclientprotocol/codex-acp/package.json"));
          const codexRequire = createRequire(acpRequire.resolve("@openai/codex/package.json"));
@@ -518,6 +787,44 @@ jobs:
          execFileSync("sudo", ["-n", "apparmor_parser", "-r", profilePath], {timeout:15000, stdio:"pipe"});
          NODE

+      - name: Obtain private archive credentials for transfer steps only
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: private_history_credentials
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
+        with:
+          role-to-assume: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_ROLE_ARN }}
+          aws-region: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          output-env-credentials: false
+          output-credentials: true
+          disable-retry: true
+          action-timeout-s: 60
+
+      - name: Download the identical private campaign manifest
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        env:
+          CELL_ID: ${{ matrix.cellId }}
+          AWS_ACCESS_KEY_ID: ${{ steps.private_history_credentials.outputs.aws-access-key-id }}
+          AWS_SECRET_ACCESS_KEY: ${{ steps.private_history_credentials.outputs.aws-secret-access-key }}
+          AWS_SESSION_TOKEN: ${{ steps.private_history_credentials.outputs.aws-session-token }}
+          AWS_REGION: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET }}
+        run: node "/tmp/paperclip-runner-controlled-${GITHUB_RUN_ID}/runtime/private-history.mjs" download protocol-control "$GITHUB_RUN_ID" "/tmp/paperclip-runner-controlled-${GITHUB_RUN_ID}/control" "$CELL_ID"
+
+      - name: Verify current worker admission before provider credentials
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        env:
+          MANIFEST_SHA256: ${{ needs.prepare_controller.outputs.manifest_sha256 }}
+          PAPERCLIP_RUNNER_EVAL_EXECUTION_ID: ${{ matrix.cellId }}
+        run: |
+          set -euo pipefail
+          root="/tmp/paperclip-runner-controlled-${GITHUB_RUN_ID}"
+          node "$root/runtime/controlled-evals/hosted.mjs" verify "$root/control/controller-manifest.json" "$MANIFEST_SHA256" "$PAPERCLIP_RUNNER_EVAL_EXECUTION_ID"
+          {
+            echo "PAPERCLIP_RUNNER_EVAL_CONTROL_MANIFEST=$root/control/controller-manifest.json"
+            echo "PAPERCLIP_RUNNER_EVAL_ARCHIVE_CLI=$root/runtime/controlled-evals/archive.mjs"
+            echo "PAPERCLIP_RUNNER_EVAL_EXECUTION_ID=$PAPERCLIP_RUNNER_EVAL_EXECUTION_ID"
+          } >> "$GITHUB_ENV"
+
      - name: Prepare short-lived AgentCore web identity
        if: matrix.credentialName == 'AWS_AGENTCORE_OIDC'
        env:
@@ -547,7 +854,9 @@ jobs:
          CASE_ID: ${{ matrix.caseId }}
          CREDENTIAL_NAME: ${{ matrix.credentialName }}
          PROVIDER: ${{ matrix.provider }}
-          MAX_INFRASTRUCTURE_RETRIES: ${{ github.event_name == 'schedule' && 1 || inputs.max_infrastructure_retries }}
+          MAX_INFRASTRUCTURE_RETRIES: ${{ needs.authorize.outputs.retry_count }}
+          ACCOUNTING_MODE: ${{ needs.authorize.outputs.accounting_mode }}
+          BRAINTRUST_API_KEY: ${{ needs.authorize.outputs.accounting_mode == 'controlled' && secrets.BRAINTRUST_API_KEY || '' }}
          OPENAI_API_KEY: ${{ matrix.credentialName == 'OPENAI_API_KEY' && secrets.OPENAI_API_KEY || '' }}
          ANTHROPIC_API_KEY: ${{ matrix.credentialName == 'ANTHROPIC_API_KEY' && secrets.ANTHROPIC_API_KEY || '' }}
          OPENROUTER_API_KEY: ${{ matrix.credentialName == 'OPENROUTER_API_KEY' && secrets.OPENROUTER_API_KEY || '' }}
@@ -577,7 +886,7 @@ jobs:
        run: |
          set -euo pipefail
          mkdir -p cell-output/runs
-          if [ "$CREDENTIAL_NAME" != "AWS_AGENTCORE_OIDC" ]; then
+          if [ "$ACCOUNTING_MODE" != controlled ] && [ "$CREDENTIAL_NAME" != "AWS_AGENTCORE_OIDC" ]; then
            test -n "${!CREDENTIAL_NAME:-}"
          fi
          if [ "$PROVIDER" = "claude_managed" ]; then
@@ -586,13 +895,23 @@ jobs:
            test -n "$PAPERCLIP_CLAUDE_MANAGED_AGENT_VERSION"
            test -n "$PAPERCLIP_CLAUDE_MANAGED_ENVIRONMENT_ID"
          fi
+          runner_cli=runner-protocol-build/extracted/portable/dist/cli/eval-session.js
+          runner_package=runner-protocol-build/extracted/paperclip-runner.tgz
+          runnerd=runner-protocol-build/extracted/paperclip-runnerd
+          if [ "$ACCOUNTING_MODE" = controlled ]; then
+            test -n "$BRAINTRUST_API_KEY"
+            root="/tmp/paperclip-runner-controlled-${GITHUB_RUN_ID}"
+            runner_cli="$root/runtime/controlled-evals/run.mjs"
+            runner_package="$root/runner/paperclip-runner.tgz"
+            runnerd="$root/runner/paperclip-runnerd"
+          fi
          set +e
          python3 .paperclip-evals/evals/paperclip-runner/tools/run_live_roster.py run \
            --roster ".paperclip-evals/evals/paperclip-runner/rosters/$ROSTER_FILE" \
            --case "$CASE_ID" \
-            --runner-cli runner-protocol-build/extracted/portable/dist/cli/eval-session.js \
-            --runner-package runner-protocol-build/extracted/paperclip-runner.tgz \
-            --runnerd runner-protocol-build/extracted/paperclip-runnerd \
+            --runner-cli "$runner_cli" \
+            --runner-package "$runner_package" \
+            --runnerd "$runnerd" \
            --runs-root cell-output/runs \
            --summary-path cell-output/roster-summary.json \
            --max-infrastructure-retries "$MAX_INFRASTRUCTURE_RETRIES" \
@@ -621,14 +940,28 @@ jobs:
            caseId: process.env.CASE_ID,
            ...(authenticationMode ? { authenticationMode } : {}),
            ...(authenticationEvidenceFailure ? { authenticationEvidenceFailure } : {}),
+            accountingMode: process.env.ACCOUNTING_MODE,
            exitCode: Number(process.env.CELL_EXIT_CODE),
          }, null, 2)}\n`, { mode: 0o600 });
          if (authenticationEvidenceFailure) throw new Error(authenticationEvidenceFailure);
          NODE
          exit "$status"

-      - name: Upload access-controlled cell attempt
-        if: always()
+      - name: Retain controlled cell evidence in private storage
+        if: always() && needs.authorize.outputs.accounting_mode == 'controlled' && steps.private_history_credentials.outcome == 'success' && steps.verify_controller.outcome == 'success'
+        env:
+          AWS_ACCESS_KEY_ID: ${{ steps.private_history_credentials.outputs.aws-access-key-id }}
+          AWS_SECRET_ACCESS_KEY: ${{ steps.private_history_credentials.outputs.aws-secret-access-key }}
+          AWS_SESSION_TOKEN: ${{ steps.private_history_credentials.outputs.aws-session-token }}
+          AWS_REGION: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET }}
+          CELL_ID: ${{ matrix.cellId }}
+        run: |
+          test -d cell-output
+          node "/tmp/paperclip-runner-controlled-${GITHUB_RUN_ID}/runtime/private-history.mjs" upload "protocol-cell-$CELL_ID" "$GITHUB_RUN_ID" cell-output
+
+      - name: Upload legacy cell attempt
+        if: always() && needs.authorize.outputs.accounting_mode == 'legacy'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: runner-protocol-eval-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.cellId }}
@@ -639,14 +972,14 @@ jobs:
  eval_shard_1:
    name: Direct eval ${{ matrix.rosterId }} / ${{ matrix.caseId }}
    if: needs.catalog.outputs.matrix_1_present == 'true'
-    needs: [authorize, catalog, build_runner]
+    needs: [authorize, catalog, build_runner, prepare_controller]
    runs-on: ${{ needs.authorize.outputs.test_runner }}
    timeout-minutes: 18
    permissions:
      contents: read
      id-token: write
    environment:
-      name: runner-e2e-paid
+      name: ${{ needs.authorize.outputs.accounting_mode == 'controlled' && 'runner-e2e-private-paid' || 'runner-e2e-paid' }}
    strategy:
      fail-fast: false
      max-parallel: ${{ fromJSON(needs.catalog.outputs.max_parallel_per_shard) }}
@@ -655,13 +988,15 @@ jobs:

  report:
    name: Merge attempts and render canonical Evalbook
-    if: always() && !cancelled() && needs.catalog.result == 'success' && needs.build_runner.result == 'success'
-    needs: [authorize, catalog, build_runner, eval_shard_0, eval_shard_1]
+    if: always() && !cancelled() && needs.catalog.result == 'success' && needs.build_runner.result == 'success' && needs.prepare_controller.result == 'success'
+    needs: [authorize, catalog, build_runner, prepare_controller, eval_shard_0, eval_shard_1]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      actions: read
      contents: read
+      id-token: write
+    environment: ${{ needs.authorize.outputs.accounting_mode == 'controlled' && 'runner-e2e-private-history' || '' }}
    outputs:
      public_report_ready: ${{ steps.public_report.outputs.ready }}
    steps:
@@ -701,17 +1036,6 @@ jobs:
        with:
          version: 9.15.4

-      - name: Resolve trusted report lockfile without lifecycle scripts
-        run: |
-          set -euo pipefail
-          pnpm install --ignore-scripts --no-frozen-lockfile --lockfile-only
-          test -s pnpm-lock.yaml
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: 24
-          cache: pnpm
-
      - name: Download immutable campaign catalog
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
@@ -724,7 +1048,59 @@ jobs:
          name: runner-protocol-build-${{ needs.authorize.outputs.target_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: runner-protocol-build

-      - name: Download every access-controlled cell
+      - name: Download the retained controller code
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          artifact-ids: ${{ needs.prepare_controller.outputs.artifact_id }}
+          path: ${{ runner.temp }}/runner-protocol-runtime
+
+      - name: Verify retained controller bytes
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        env:
+          RUNTIME_RECEIPT_SHA256: ${{ needs.prepare_controller.outputs.runtime_receipt_sha256 }}
+        run: |
+          set -euo pipefail
+          node packages/paperclip-runner/scripts/controlled-evals/verify-runtime.mjs "$RUNNER_TEMP/runner-protocol-runtime" "$GITHUB_SHA" "$RUNTIME_RECEIPT_SHA256"
+
+      - name: Obtain private archive credentials for transfer steps only
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        id: private_history_credentials
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
+        with:
+          role-to-assume: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_ROLE_ARN }}
+          aws-region: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          output-env-credentials: false
+          output-credentials: true
+          disable-retry: true
+          action-timeout-s: 60
+
+      - name: Restore private manifest and every available controlled cell
+        if: needs.authorize.outputs.accounting_mode == 'controlled'
+        env:
+          AWS_ACCESS_KEY_ID: ${{ steps.private_history_credentials.outputs.aws-access-key-id }}
+          AWS_SECRET_ACCESS_KEY: ${{ steps.private_history_credentials.outputs.aws-secret-access-key }}
+          AWS_SESSION_TOKEN: ${{ steps.private_history_credentials.outputs.aws-session-token }}
+          AWS_REGION: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET }}
+          MANIFEST_SHA256: ${{ needs.prepare_controller.outputs.manifest_sha256 }}
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/runner-protocol-runtime/private-history.mjs"
+          control="$RUNNER_TEMP/runner-protocol-control"
+          node "$archive" download protocol-control "$GITHUB_RUN_ID" "$control" report
+          test "$(sha256sum "$control/controller-manifest.json" | cut -d ' ' -f 1)" = "$MANIFEST_SHA256"
+          mkdir -p downloaded-runner-protocol-evals
+          while IFS= read -r cell; do
+            node "$archive" download "protocol-cell-$cell" "$GITHUB_RUN_ID" "downloaded-runner-protocol-evals/runner-protocol-eval-$GITHUB_RUN_ID-1-$cell" || echo 'A private cell is unavailable; its allocation remains held.'
+          done < <(jq -r '.attempts[].executionId' "$control/controller-manifest.json")
+          {
+            echo "PAPERCLIP_RUNNER_EVAL_CONTROL_MANIFEST=$control/controller-manifest.json"
+            echo "PAPERCLIP_RUNNER_EVAL_ARCHIVE_CLI=$RUNNER_TEMP/runner-protocol-runtime/controlled-evals/archive.mjs"
+          } >> "$GITHUB_ENV"
+
+      - name: Download every legacy cell
+        if: needs.authorize.outputs.accounting_mode == 'legacy'
        id: download_cells
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -734,7 +1110,7 @@ jobs:
          merge-multiple: false

      - name: Retry cell download after artifact transport failure
-        if: steps.download_cells.outcome == 'failure'
+        if: needs.authorize.outputs.accounting_mode == 'legacy' && steps.download_cells.outcome == 'failure'
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
@@ -770,15 +1146,27 @@ jobs:

      - name: Render the access-controlled canonical Evalbook report
        run: |
-          python3 .paperclip-evals/evals/paperclip-runner/tools/eval_program.py report \
+          control_args=()
+          if [ -n "${PAPERCLIP_RUNNER_EVAL_CONTROL_MANIFEST:-}" ]; then
+            control_args=(--controller-manifest "$PAPERCLIP_RUNNER_EVAL_CONTROL_MANIFEST" --controller-archive-cli "$PAPERCLIP_RUNNER_EVAL_ARCHIVE_CLI")
+          fi
+          set +e
+          python3 .paperclip-evals/evals/paperclip-runner/tools/eval_program.py report "${control_args[@]}" \
            --runs-root runner-protocol-merged/runs \
            --output runner-protocol-merged/report \
            --viewer-root runner-protocol-build/extracted/dist-issue-thread \
            --inventory .paperclip-evals/evals/paperclip-runner/inventory.json \
-            --coverage-matrix .paperclip-evals/evals/paperclip-runner/coverage-matrix.json
+            --coverage-matrix .paperclip-evals/evals/paperclip-runner/coverage-matrix.json > runner-protocol-merged/accounting-report.json
+          status=$?
+          set -e
          cp runner-protocol-merged/campaign.json runner-protocol-merged/report/campaign.json
+          if [ -n "${PAPERCLIP_RUNNER_EVAL_CONTROL_MANIFEST:-}" ]; then
+            cp "$PAPERCLIP_RUNNER_EVAL_CONTROL_MANIFEST" runner-protocol-merged/controller-manifest.json
+          fi
+          exit "$status"

      - name: Render the same canonical grid from a public-safe evidence projection
+        if: needs.authorize.outputs.accounting_mode == 'legacy'
        run: |
          node packages/paperclip-runner/scripts/runner-protocol-eval-campaign.mjs sanitize \
            --runs-root runner-protocol-merged/runs \
@@ -793,24 +1181,28 @@ jobs:
          cp runner-protocol-merged/campaign.json runner-protocol-merged/public-report/campaign.json

      - name: Set up report browser verification
+        if: needs.authorize.outputs.accounting_mode == 'legacy'
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
        with:
          version: 9.15.4

      - name: Verify the actual chat viewer before publication
+        if: needs.authorize.outputs.accounting_mode == 'legacy'
        run: |
-          pnpm install --frozen-lockfile --ignore-scripts
+          pnpm install --frozen-lockfile --ignore-scripts --store-dir "$RUNNER_TEMP/runner-report-pnpm-store"
          pnpm --filter @paperclipai/paperclip-runner exec playwright install --with-deps chromium
          node packages/paperclip-runner/scripts/verify-runner-evalbook-viewer.mjs --report-root runner-protocol-merged/public-report --screenshots runner-protocol-merged/viewer-proof
          node packages/paperclip-runner/scripts/verify-runner-evalbook-viewer.mjs --report-root runner-protocol-merged/report

      - name: Enforce the static public allowlist
+        if: needs.authorize.outputs.accounting_mode == 'legacy'
        id: public_report
        run: |
          node --input-type=module -e 'import { validatePublicProtocolEvalReport } from "./packages/paperclip-runner/scripts/publish-runner-protocol-eval-history.mjs"; await validatePublicProtocolEvalReport("runner-protocol-merged/public-report", { viewerRoot: "runner-protocol-build/extracted/dist-issue-thread" });'
          echo "ready=true" >> "$GITHUB_OUTPUT"

      - name: Add campaign result to the workflow summary
+        if: always()
        run: |
          {
            echo '## Runner direct live protocol evals'
@@ -818,8 +1210,20 @@ jobs:
            jq -r '"- Cells: \(.totals.passed)/\(.totals.selected) passed\n- Behavior failures: \(.totals.behaviorFailures)\n- Infrastructure failures: \(.totals.infrastructureFailures)\n- Paperclip: `\(.source.paperclip.sha)`\n- Evals: `\(.source.evals.sha)`"' runner-protocol-merged/campaign.json
          } >> "$GITHUB_STEP_SUMMARY"

-      - name: Upload access-controlled canonical Evalbook and raw attempts
-        if: always()
+      - name: Retain controlled Evalbook and accounting in private storage
+        if: always() && needs.authorize.outputs.accounting_mode == 'controlled' && steps.private_history_credentials.outcome == 'success'
+        env:
+          AWS_ACCESS_KEY_ID: ${{ steps.private_history_credentials.outputs.aws-access-key-id }}
+          AWS_SECRET_ACCESS_KEY: ${{ steps.private_history_credentials.outputs.aws-secret-access-key }}
+          AWS_SESSION_TOKEN: ${{ steps.private_history_credentials.outputs.aws-session-token }}
+          AWS_REGION: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_AWS_REGION }}
+          RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET: ${{ vars.RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET }}
+        run: |
+          test -d runner-protocol-merged
+          node "$RUNNER_TEMP/runner-protocol-runtime/private-history.mjs" upload protocol-report "$GITHUB_RUN_ID" runner-protocol-merged
+
+      - name: Upload legacy canonical Evalbook and raw attempts
+        if: always() && needs.authorize.outputs.accounting_mode == 'legacy'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: runner-protocol-eval-report-${{ github.run_id }}-${{ github.run_attempt }}
@@ -828,7 +1232,7 @@ jobs:
          if-no-files-found: error

      - name: Upload publisher-only sanitized Evalbook
-        if: steps.public_report.outputs.ready == 'true'
+        if: needs.authorize.outputs.accounting_mode == 'legacy' && steps.public_report.outputs.ready == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: runner-protocol-eval-public-${{ github.run_id }}-${{ github.run_attempt }}
@@ -20,7 +20,9 @@ fail generation. Build with
 `pnpm --filter @paperclipai/paperclip-runner build:issue-thread` and provide
 `--viewer-root` or `PAPERCLIP_EVAL_VIEWER_ROOT` to the canonical Python renderer.

-The Actions artifact contains full evidence. S3 uses the same viewer with a
+Legacy manual runs place full evidence in Actions artifacts. These artifacts
+are readable by authenticated public GitHub users. Controlled runs keep full
+evidence in private S3 storage. The optional legacy public S3 report uses a
 closed public DTO: only isolated mock-run conversation text, scrubbed private
 references, named tool outcomes, and checks. Tool arguments/results, reasoning,
 provider identities, and company snapshots stay private. The public notice
@@ -231,12 +233,10 @@ not release historical holds or claim invoice
 settlement. Existing provider usage is retained separately; do not add the
 provider and controller cost observations as if they were separate charges.

-This local controller is not yet wired into the hosted matrix. Its durable
-attempt-directory guard applies to one shared filesystem, not independent
-GitHub workers. Hosted integration must bind unique cells to the prepared
-allocation, reject workflow/job reruns, and preserve the controller evidence
-before enabling paid work. Native OTLP routing, report integration, vendor
-metering bounds, and actual paid qualification remain separate gates.
+The hosted workflow now assembles one manifest and gives each independent
+worker a disjoint allocation. It checks the current GitHub run and first-attempt
+identity before provider access. Vendor metering bounds and actual paid route
+qualification remain separate gates. See the controlled workflow section below.
 ## Controller-assigned native observability

 The same CLI accepts `--observability-config /absolute/path/observability.json`
@@ -334,8 +334,8 @@ private `prepare_controlled_campaign.py` command prepares requests with the
 existing case compiler and rejects duplicate or missing matrix cells. Independent
 budgets, a second workflow run, or duplicate first-attempt jobs are not authorized
 by this guard. Pack and report commands remain usable offline after the run, so
-expired or failed attempts can still be retained and reconciled. The current
-live workflow has not yet been connected to this contract.
+expired or failed attempts can still be retained and reconciled. Controlled
+workflow mode now prepares and distributes this shared manifest.

 Use `requestBindingSha256` from `controlled-evals/manifest.mjs` to bind the
 complete compiled request. It excludes only the temporary working directory
@@ -428,12 +428,10 @@ not release historical holds or claim invoice
 settlement. Existing provider usage is retained separately; do not add the
 provider and controller cost observations as if they were separate charges.

-This local controller is not yet wired into the hosted matrix. Its durable
-attempt-directory guard applies to one shared filesystem, not independent
-GitHub workers. Hosted integration must bind unique cells to the prepared
-allocation, reject workflow/job reruns, and preserve the controller evidence
-before enabling paid work. Hosted tracing, destination readback, vendor
-metering bounds, and actual paid qualification remain separate gates.
+Controlled workflow mode now binds each independent worker to one allocation
+in the prepared shared manifest, rejects job reruns, and archives its evidence
+privately. Destination readback, vendor metering bounds and actual paid route
+qualification remain separate gates before paid recurrence.

 ### Portable controller runtime

@@ -477,8 +475,8 @@ Use the copied `controlled-evals/run.mjs` as `--runner-cli` and its sibling
 manifest is still required. Its executable paths and digests bind the actual
 Runner build, not this controller wrapper. The artifact does not authorize paid
 work, coordinate worker allocations, or prevent a workflow rerun by itself.
-The hosted matrix still needs the shared manifest and per-worker admission
-checks described above.
+Controlled workflow mode supplies the shared manifest and per-worker admission
+checks described above; the runtime artifact alone does not replace them.

 ## Controller tracing allocations and retained proof

@@ -534,7 +532,7 @@ Runner artifact.

 ## Hosted campaign

-Use the `Runner Direct Live Protocol Evals` workflow. Dispatch the workflow
+Use the `Runner Live Protocol Evals` workflow. Dispatch the workflow
 from the default branch and provide:

 - `target_branch`: the Paperclip branch to build and test;
@@ -545,8 +543,11 @@ from the default branch and provide:
  Disabled lanes remain available only through an explicit diagnostic
  selection; `all` never spends against a lane that the eval program has
  marked disabled;
- `max_infrastructure_retries`: zero through three, applied only when an
-  attempt explicitly reports a retryable infrastructure failure.
+- `accounting_mode`: `controlled` by default; `legacy` is an explicit manual
+  qualification path. Controlled mode supports native Codex and ACPX Claude.
+- `max_infrastructure_retries`: zero by default and required for controlled
+  mode. Legacy mode allows up to three retries only when an attempt explicitly
+  reports a retryable infrastructure failure.

 Native suspension failures are non-retryable infrastructure failures. The CLI
 retains only allowlisted close diagnostics: suspension and provider-drain
@@ -695,8 +696,9 @@ and the pinned `RUNNER_PROTOCOL_EVALS_SHA` repository variable.

 ## Reports and history

-Each cell uploads its immutable run directory to an access-controlled Actions
-artifact. The trusted report job merges all expected cells, represents missing
+Each legacy cell uploads its immutable run directory to an Actions artifact.
+These artifacts are public to authenticated GitHub readers in this repository.
+Controlled cells use the private transport below. The trusted report job merges all expected cells, represents missing
 cell artifacts as infrastructure failures, and invokes the report program from
 the pinned eval commit. The full artifact contains the canonical Evalbook grid,
 read-only Runner issue-thread attempt pages, and raw immutable run records.
@@ -809,3 +811,122 @@ full allocation.
 On cancellation, the controller keeps the scheduled process-group SIGKILL until
 any remaining owned descendants receive it, even if the CLI exits first. A
 forced stop still leaves cleanup unverified and retains the full allocation.
+
+## Controlled hosted workflow
+
+`accounting_mode=controlled` is the default for manual dispatch and the only
+scheduled mode. It supports explicitly selected native Codex and ACPX Claude
+rosters. `all` still means the entire maintained suite; unsupported cells fail
+admission rather than being omitted. Use `accounting_mode=legacy` explicitly
+for a manual qualification of other providers. Legacy runs retain their
+existing public artifact and publication behavior and do not claim complete
+controller cost coverage.
+
+Controlled runs require the evaluated target SHA to equal the trusted workflow
+revision on the default branch. This keeps target-branch code out of jobs with
+private archive access. Use explicit legacy mode for other branch diagnostics.
+Controlled runs require `max_infrastructure_retries=0` and GitHub run attempt 1.
+Re-running even one job is rejected at that worker before provider access.
+The existing nightly enable gate and exact eval SHA pin remain required.
+This change does not set either variable or enable paid recurrence.
+
+Set `RUNNER_PROTOCOL_EVAL_CONTROLLER_POLICY_JSON` only after its operating
+bounds have been reviewed. An absent, stale or invalid policy stops before
+provider work. The policy schema is `paperclip.runner-eval.hosted-policy/v1`:
+
+- `controllerLockSha256`, the SHA-256 of the explicitly reviewed compatible
+  workspace lockfile. The existing unprivileged target-lock job resolves it;
+  inspect that immutable artifact before setting the policy. The controller
+  build requires its digest to match, installs with `--frozen-lockfile` and a
+  job-local store, and records the digest in the runtime receipt. Private
+  preparation checks that receipt binding again. A changed lockfile requires a
+  policy review. No lockfile is committed by this workflow integration.
+- `maxUsd`, `maxCells` (1–512), `durationMs` (at most four hours), current
+  `pricingVerifiedAt` and `pricingExpiresAt`.
+- `route`, optional gateway `projectId`, exact `models`, and the same
+  four-component `overhead` contract used by the controller.
+- `observability` with `projectId`, `capture` and `nativeLimits`. Tracing is
+  required for this mode. `BRAINTRUST_API_KEY` is delivered only to the
+  trusted controller step, even when model requests use the direct route.
+- `allocations`, one entry per provider/agent/model profile, each with
+  `maxUsd`, `maxRequests`, `maxConcurrent` and `timeoutMs`.
+- `capacityBound`, a reviewed full-lifecycle proof. Its `configurationSha256`
+  hashes `canonical(hostedPolicyConfiguration(policy))`, which excludes only
+  the proof itself. The proof must cover every selected cell up to `maxCells`,
+  trace and gateway processing, retained data, private archive transfers,
+  workflow setup/build/reporting and the full retention window. A policy
+  digest is a binding to evidence, not independent proof of vendor charges.
+
+The preparer compiles every selected private request once. It validates exact
+catalog membership, source and definition revisions, executable digests and
+profile allocations. It adds campaign identities to the reviewed capacity
+bound, retains the policy digest, and emits one manifest with no provider calls.
+A changed prompt, fixture or compiled request fails the worker's binding check.
+The sum of all selected allocations and once-only overhead must fit `maxUsd`.
+This campaign cap does not replace the separate daily/weekly allowance gates.
+
+The portable runtime contains only trusted code and dependencies. Dependency
+resolution and runtime construction run in a separate job with no provider
+secrets, private-history environment or OIDC permission. Private preparation
+consumes only that verified artifact and uses no dependency install. Archive
+jobs use no shared dependency cache. Legacy browser report verification uses
+the committed frozen lockfile, disabled install scripts and a job-local store;
+a stale lockfile fails closed. A same-run
+GitHub artifact distributes it; workers verify its separate receipt digest and
+workflow revision. Manifest and policy bytes use private S3 instead. Workers
+check the manifest's separate preparer digest before model credentials are used.
+Controlled aggregation and Python reporting both use the archive module from
+that verified runtime through `PAPERCLIP_RUNNER_EVAL_ARCHIVE_CLI`. They need no
+source checkout dependencies or `tsx`. Model children receive proxy/relay
+credentials, never the provider, Braintrust or AWS archive credentials.
+The catalog and preparer require `codex_app_server` for native Codex and
+`acpx_runtime` for ACPX Claude before model work. Admission errors report
+known safe reasons; malformed inputs and private paths are not echoed.
+
+Private retention reuses the existing `runner-e2e-private-paid` and
+`runner-e2e-private-history` environments and `RUNNER_E2E_PRIVATE_HISTORY_*`
+role, region and bucket variables. The role and bucket policy are unchanged.
+The transfer helper verifies bucket privacy and 30-day bounded retention,
+rejects unsafe archives, uses conditional immutable writes and does not retry.
+Each archive is at most 264 MiB (256 MiB source). The reviewed operating bound
+must cover up to `maxCells` cell archives, one controller archive, one report
+archive, their download/receipt traffic and the GitHub code/build artifacts.
+Each shared manifest downloader supplies its worker cell ID or `report` as
+a receipt identity. Receipts use distinct immutable keys while all workers
+read the same manifest object. AWS credentials are action outputs used only
+by transfer steps.
+
+Private keys share the existing bounded prefix:
+
+```text
+runner-e2e-private/bounded-v1/campaigns/gha-RUN_ID-1/
+  protocol-control.zip
+  protocol-cell-CELL_ID.zip
+  protocol-report.zip
+```
+
+Each immutable attempt includes replayable controller evidence. The report uses
+the retained full manifest even when no cell archive is available. Missing,
+failed, cancelled or unreadable evidence retains its allocation; known partial
+charges remain visible. Overhead is held once per campaign. A workflow-wide
+cancellation may prevent report generation, but the manifest was already
+retained before model work and remains the reconciliation starting point.
+Full reports and trace/ledger evidence are never uploaded as GitHub artifacts
+in controlled mode. Public report projection and automatic publication are
+skipped. Selective publication requires a separate reviewed projection.
+
+To restore a report with an authorized private-history session, use the
+portable runtime's `private-history.mjs download protocol-report RUN_ID NEW_DIR`
+or `node cli/node_modules/tsx/dist/cli.mjs tests/runner-e2e/private-history.ts`
+with the same arguments. Supply the private bucket and AWS region through the
+existing environment variables. Read retained reports without rerunning models.
+The report command accepts `--controller-manifest` and
+`--controller-archive-cli` together; it rejects `--public-viewer` with those
+options. The pinned private eval revision must include these flags. The
+preparer checks that support before any paid cell.
+
+Synthetic tests prove request admission, proxy and OTLP receipt handling,
+portable runtime isolation, private archive replay, and complete/partial/empty
+campaign accounting. They do not establish current vendor prices, future
+retention charges, live Braintrust attribution or invoice settlement. Keep
+paid recurrence disabled until these independent gates are qualified.
@@ -164,12 +164,29 @@ export async function summarizeControlledEvidence(bundles, options) {
  for (const group of [...groups.values()].sort((a, b) => a.manifest.campaignId.localeCompare(b.manifest.campaignId))) {
    campaigns.push(await summarizeControlledCampaign(group.manifest, { filesByAttempt: group.filesByAttempt }));
  }
+  return history(campaigns);
+}
+
+function history(campaigns) {
  const sum = field => usd(campaigns.reduce((total, campaign) => total + units(campaign[field]), 0n));
  return { schema: 'paperclip.runner-eval.control-history/v1', costStatus: campaigns.some(c => c.costStatus === 'incomplete') ? 'incomplete' : 'provisional',
    knownUsd: sum('knownUsd'), heldUsd: sum('heldUsd'), committedUsd: sum('committedUsd'), operatingHeldUsd: sum('operatingHeldUsd'),
    incompleteAttempts: campaigns.reduce((total, c) => total + c.incompleteAttempts, 0), overBudget: campaigns.some(c => c.overBudget), campaigns };
 }

+export async function summarizeControlledManifest(value, bundles, options) {
+  const { manifest, manifestSha256 } = validateManifest(value, Date.now(), { admission: false });
+  const filesByAttempt = new Map(), digests = new Map();
+  for (const bundle of bundles) {
+    const decoded = decodeControlledEvidence(bundle, options), digest = sha256(canonical(bundle));
+    if (decoded.manifestSha256 !== manifestSha256 || digests.has(decoded.attemptId) && digests.get(decoded.attemptId) !== digest) {
+      throw new Error('Archive disagrees with the retained campaign manifest');
+    }
+    digests.set(decoded.attemptId, digest); filesByAttempt.set(decoded.attemptId, decoded.files);
+  }
+  return history([await summarizeControlledCampaign(manifest, { filesByAttempt })]);
+}
+
 if (await isEntrypoint(import.meta.url)) {
  const [command, ...args] = process.argv.slice(2);
  if (command === 'verify' && args.length === 2) {
@@ -179,10 +196,14 @@ if (await isEntrypoint(import.meta.url)) {
  } else if (command === 'pack' && args.length === 3) {
    const bundle = await packControlledAttempt({ manifest: await readJson(args[0]), attemptId: args[1] });
    await writeFile(args[2], JSON.stringify(bundle) + '\n', { flag: 'wx', mode: 0o600 });
+  } else if (command === 'report-campaign' && args.length) {
+    const result = await summarizeControlledManifest(await readJson(args[0]), await Promise.all(args.slice(1).map(path => readAttemptControlledEvidence(path))));
+    console.log(JSON.stringify(result, null, 2));
+    process.exitCode = result.costStatus === 'incomplete' ? 2 : 0;
  } else if (['report', 'report-attempts'].includes(command) && args.length) {
    const read = command === 'report' ? readControlledEvidence : readAttemptControlledEvidence;
    const result = await summarizeControlledEvidence(await Promise.all(args.map(path => read(path))));
    process.stdout.write(JSON.stringify(result, null, 2) + '\n');
    if (result.costStatus === 'incomplete') process.exitCode = 2;
-  } else throw new Error('Usage: archive.mjs verify <manifest.json> <request.json> | pack <manifest.json> <attempt-id> <output.json> | report <evidence.json>... | report-attempts <attempt-directory>...');
+  } else throw new Error('Usage: archive.mjs verify <manifest.json> <request.json> | pack <manifest.json> <attempt-id> <output.json> | report <evidence.json>... | report-attempts <attempt-directory>... | report-campaign <manifest.json> [attempt-directory...]');
 }
@@ -10,7 +10,7 @@ const source = dirname(fileURLToPath(import.meta.url));
 const repository = resolve(source, '../../../..');
 const require = createRequire(join(repository, 'server/package.json'));
 const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
-const scripts = ['entrypoint.mjs', 'evidence-files.mjs', 'archive.mjs', 'manifest.mjs', 'observability.mjs', 'report.mjs', 'run.mjs', 'verify-runtime.mjs'];
+const scripts = ['hosted.mjs', 'entrypoint.mjs', 'evidence-files.mjs', 'archive.mjs', 'manifest.mjs', 'observability.mjs', 'report.mjs', 'run.mjs', 'verify-runtime.mjs'];

 export async function buildControllerRuntime({ outputDirectory, sourceRevision }) {
  if (!/^[a-f0-9]{40}$/.test(sourceRevision)) throw new Error('Controller runtime requires an exact source revision');
@@ -25,9 +25,12 @@ export async function buildControllerRuntime({ outputDirectory, sourceRevision }
  const result = await build({ entryPoints: [join(source, 'shared-cost-runtime.ts')], outfile: runtime, bundle: true,
    platform: 'node', format: 'esm', target: 'node24', metafile: true, logLevel: 'silent',
    banner: { js: "import { createRequire as __paperclipCreateRequire } from 'node:module'; const require = __paperclipCreateRequire(import.meta.url);" } });
-  if (result.warnings.length) throw new Error('Controller runtime bundle emitted unresolved build warnings');
+  const history = await build({ entryPoints: [join(repository, 'tests/runner-e2e/private-history.ts')],
+    outfile: join(output, 'private-history.mjs'), bundle: true, platform: 'node', format: 'esm', target: 'node24', metafile: true, logLevel: 'silent' });
+  await cp(join(repository, 'tests/runner-e2e/private-history-archive.py'), join(output, 'private-history-archive.py'), { errorOnExist: true, force: false });
+  if (result.warnings.length || history.warnings.length) throw new Error('Controller runtime bundle emitted unresolved build warnings');
  const { isBuiltin } = await import('node:module');
-  if (Object.values(result.metafile.outputs).some(item => item.imports.some(item => !isBuiltin(item.path)))) throw new Error('Controller runtime has unbundled imports');
+  if (Object.values({ ...result.metafile.outputs, ...history.metafile.outputs }).some(item => item.imports.some(item => !isBuiltin(item.path)))) throw new Error('Controller runtime has unbundled imports');
  async function packageManifest(name, parentRequire) {
    try { return await realpath(parentRequire.resolve(`${name}/package.json`)); }
    catch (error) { if (error.code !== 'ERR_PACKAGE_PATH_NOT_EXPORTED') throw error; }
@@ -62,11 +65,12 @@ export async function buildControllerRuntime({ outputDirectory, sourceRevision }
  await writeFile(join(server, 'package.json'), '{"private":true}\n', { flag: 'wx', mode: 0o600 });
  await copyPackage('protobufjs', require, server);
  await writeFile(join(controller, 'runtime.mjs'), "export * as costRuntime from '../tests/runner-e2e/shared-runtime.mjs';\n", { flag: 'wx', mode: 0o600 });
-  const inputs = {};
-  for (const path of Object.keys(result.metafile.inputs)) {
+  const inputs = { 'pnpm-lock.yaml': sha256(await readFile(join(repository, 'pnpm-lock.yaml'))) };
+  for (const path of Object.keys({ ...result.metafile.inputs, ...history.metafile.inputs })) {
    const absolute = resolve(path);
    inputs[relative(repository, absolute).split('\\').join('/')] = sha256(await readFile(absolute));
  }
+  inputs['tests/runner-e2e/private-history-archive.py'] = sha256(await readFile(join(repository, 'tests/runner-e2e/private-history-archive.py')));
  for (const file of [...scripts, 'build-runtime.mjs', 'runtime.mjs']) inputs[relative(repository, join(source, file))] = sha256(await readFile(join(source, file)));
  const files = {}; let payloadBytes = 0;
  async function inventory(directory) {
@@ -0,0 +1,130 @@
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createRequire } from 'node:module';
+const runtime = process.env.PAPERCLIP_CONTROLLER_TEST_RUNTIME
+  ? pathToFileURL(resolve(process.env.PAPERCLIP_CONTROLLER_TEST_RUNTIME) + '/') : import.meta.url;
+const { canonical, costRuntime, observabilityBoundConfiguration, requestBindingSha256, sha256 } = await import(new URL('./manifest.mjs', runtime));
+const { runControlledEval } = await import(new URL('./run.mjs', runtime));
+const { build } = createRequire(new URL('../../../../package.json', import.meta.url))('esbuild');
+
+const childScript = options => `
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {spawn} from 'node:child_process';
+import {once} from 'node:events';
+import {readFile,writeFile,rm,readdir,symlink,truncate,mkdir} from 'node:fs/promises';
+import {dirname,join} from 'node:path';
+import {execFileSync} from 'node:child_process';
+const args=new Map();for(let i=2;i<process.argv.length;i+=2)args.set(process.argv[i],process.argv[i+1]);
+const request=JSON.parse(await readFile(args.get('--request'),'utf8'));
+if(${Boolean(options.failChild)})process.exit(3);
+if(${Boolean(options.resistantDescendant)}) {
+ const orphan=${Boolean(options.orphanExit)};
+ const descendant=spawn(process.execPath,['-e',"process.on('SIGTERM',()=>{});"+(orphan?"process.send('ready');":"process.stdout.write('ready');")+"setInterval(()=>{},1000)"],{stdio:orphan?['ignore','inherit','inherit','ipc']:['ignore','pipe','ignore']});
+ if(orphan)await once(descendant,'message');else await once(descendant.stdout,'data');
+ await writeFile(request.session.workingDirectory+'/descendant.pid',String(descendant.pid));
+}
+
+const descriptorRaw=await readFile(args.get('--gateway-config'),'utf8'),descriptor=JSON.parse(descriptorRaw);
+for(const key of ['OPENAI_API_KEY','ANTHROPIC_API_KEY','BRAINTRUST_API_KEY','GH_TOKEN','NODE_OPTIONS','PYTHONPATH'])assert.equal(process.env[key],undefined);
+const statuses=[];
+for(let i=0;i<${options.requests ?? 3};i++){
+ const response=await fetch(descriptor.baseUrl+(descriptor.provider==='openai'?'/v1/responses':'/v1/messages'),{method:'POST',headers:{authorization:'Bearer '+process.env.PAPERCLIP_RUNNER_EVAL_GATEWAY_TOKEN,'content-type':'application/json'},body:JSON.stringify({model:request.model,input:'synthetic fixture'})});
+ statuses.push(response.status);await response.text();
+}
+let nativeObservability;
+if(args.has('--observability-config')) {
+ const raw=await readFile(args.get('--observability-config'),'utf8'),config=JSON.parse(raw);
+ const parent=decodeURIComponent(config.launch.environment.OTEL_EXPORTER_OTLP_TRACES_HEADERS.slice('x-bt-parent='.length));
+ for(const signal of ['logs','traces'])for(let i=0;i<${options.otelRequests ?? 1};i++) {
+  const body=signal==='logs'?{resourceLogs:[{scopeLogs:[{logRecords:[{body:{stringValue:'synthetic-native-content'}}]}]}]}:{resourceSpans:[{scopeSpans:[{spans:[{traceId:'1'.repeat(32),spanId:'2'.repeat(16),name:'synthetic-native-span'}]}]}]};
+  const response=await fetch(config.baseUrl+'/v1/'+signal,{method:'POST',headers:{authorization:'Bearer '+process.env.PAPERCLIP_RUNNER_EVAL_OTLP_TOKEN,'x-bt-parent':parent,'content-type':'application/json'},body:JSON.stringify(body)});
+  await response.arrayBuffer();
+ }
+ nativeObservability={mode:'controller_otlp',configured:true,verification:'unverified',projectId:config.projectId,traceId:config.traceId,spanId:config.spanId,descriptorSha256:createHash('sha256').update(raw).digest('hex')};
+ if(${Boolean(options.realObservabilityValidator)}) {
+  const {prepareEvalObservabilityRuntime}=await import(${JSON.stringify(options.observabilityValidatorModule ?? '')});
+  await mkdir(process.env.HOME+'/codex',{recursive:true});
+  const prepared=await prepareEvalObservabilityRuntime(args.get('--observability-config'),request,
+   {evidence:{campaignId:descriptor.campaignId,executionId:descriptor.executionId},transportOptions:{environment:{CODEX_HOME:process.env.HOME+'/codex'}}},process.env);
+  assert.deepEqual(prepared.evidence,nativeObservability);
+  for(const signal of ['LOGS','TRACES'])assert(prepared.transportOptions.environment['OTEL_EXPORTER_OTLP_'+signal+'_HEADERS'].includes(encodeURIComponent('Bearer '+process.env.PAPERCLIP_RUNNER_EVAL_OTLP_TOKEN)));
+  nativeObservability=prepared.evidence;
+ }
+
+}
+if(${Boolean(options.waitForever)})await new Promise(()=>setInterval(()=>{},1000));
+if(!${Boolean(options.missingArtifact)})await writeFile(args.get('--output'),JSON.stringify({schema:'paperclip-runner/eval-session-artifact/v1',attemptId:request.attemptId,requestedModel:request.model,
+ requestRouting:${options.missingRoute ? 'null' : "{mode:'controller_gateway',provider:descriptor.provider,declaredUpstreamRoute:descriptor.upstreamRoute,campaignId:descriptor.campaignId,executionId:descriptor.executionId,attemptId:descriptor.attemptId,descriptorSha256:createHash('sha256').update(descriptorRaw).digest('hex')}"},
+ nativeObservability, snapshot:{status:'closed',process:{runnerExited:true,runnerPid:process.pid,providerPid:process.pid}},statuses,
+ leaked:${options.leakToken ? 'process.env.PAPERCLIP_RUNNER_EVAL_GATEWAY_TOKEN' : options.leakOtlpToken ? 'process.env.PAPERCLIP_RUNNER_EVAL_OTLP_TOKEN' : 'null'}}));
+if(${Boolean(options.invalidEvidence)}) {
+ const root=dirname(args.get('--output'));
+ const name=${JSON.stringify(options.invalidEvidence ?? '')};
+ const file=name==='receipt'?join(root,'receipts',(await readdir(join(root,'receipts')))[0]):join(root,name);
+ await rm(file);
+ const kind=${JSON.stringify(options.invalidFileType ?? '')};
+ if(kind==='fifo')execFileSync('mkfifo',[file]);
+ else if(kind==='symlink')await symlink('/dev/zero',file);
+ else {await writeFile(file,'');await truncate(file,16*1024*1024+1);}
+}
+
+if(${Boolean(options.orphanExit)})process.exit(0);
+`;
+
+async function fixture(t, { count = 1, allocation = '0.01', providerProfile = 'codex', route = 'direct', ...options } = {}) {
+  const root = await mkdtemp(join(tmpdir(), 'runner-controller-test-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const cli = join(root, 'fake-cli.mjs'), binary = join(root, 'runnerd'), archive = join(root, 'runner.tgz');
+  if (options.realObservabilityValidator) {
+    options.observabilityValidatorModule = join(root, 'eval-observability-runtime.mjs');
+    await build({ entryPoints: [fileURLToPath(new URL('../../src/cli/eval-observability-runtime.ts', import.meta.url))],
+      outfile: options.observabilityValidatorModule, bundle: true, platform: 'node', format: 'esm', target: 'node24', logLevel: 'silent' });
+  }
+  await writeFile(cli, childScript(options)); await writeFile(binary, 'synthetic daemon'); await writeFile(archive, 'synthetic package');
+  const provenance = async path => ({ path, sha256: sha256(await readFile(path)) });
+  const now = Date.now(), verifiedAt = new Date(now - 1000).toISOString(), expiresAt = new Date(now + 86_400_000).toISOString();
+  const overhead = { version: 1, reference: 'synthetic-allowance', runner: 'github-hosted', verifiedAt, expiresAt,
+    components: costRuntime.EVAL_OVERHEAD_COMPONENTS.map(component => ({ component, maxUsd: '0.001', reference: 'synthetic-proof' })) };
+  const bound = configuration => ({ version: 1, scope: 'full_lifecycle', evidenceSha256: 'a'.repeat(64), configurationSha256: sha256(canonical(configuration)) });
+  for (const component of overhead.components) component.provisionalBound = bound({ reference: overhead.reference, runner: overhead.runner, verifiedAt, expiresAt, component: { ...component } });
+  const biller = providerProfile === 'claude' ? 'anthropic' : 'openai';
+  const price = { provider: biller, model: 'fixture', version: 'synthetic-pricing', sourceUrl: 'https://provider.invalid/pricing', inputUsdPerMillion: '2', cachedReadUsdPerMillion: '1', outputUsdPerMillion: '10', ...(biller === 'openai' ? { cacheWrite30mUsdPerMillion: '2', cacheWrite12hUsdPerMillion: '2' } : { cacheWrite5mUsdPerMillion: '2', cacheWrite1hUsdPerMillion: '2' }) };
+  const model = { provider: biller, price, maximumInputTokens: 1000, maximumOutputTokens: 100, timeoutMs: 1000 };
+  model.provisionalBound = bound({ provider: model.provider, mode: route, price, maximumInputTokens: 1000, maximumOutputTokens: 100, reservation: '0.003000000' });
+  const manifest = { schema: 'paperclip.runner-eval.controller/v1', campaignId: 'synthetic-controller', maxUsd: '1',
+    deadlineAt: new Date(now + 60_000).toISOString(), pricingVerifiedAt: verifiedAt, pricingExpiresAt: expiresAt, overhead,
+    sourceRevision: 'a'.repeat(40), definitionsRevision: 'b'.repeat(40), runnerCli: await provenance(cli), runnerPackage: await provenance(archive), runnerd: await provenance(binary),
+    outputDirectory: join(root, 'controller'), route, ...(route === 'braintrust' ? { projectId: '11111111-1111-4111-8111-111111111111' } : {}), models: [model], attempts: [] };
+  const requests = [];
+  for (let index = 0; index < count; index++) {
+    const workspace = join(root, `workspace-${index}`); await mkdir(workspace);
+    const request = { schema: 'paperclip-runner/eval-session-request/v1', attemptId: `attempt-${index}`, prompt: 'synthetic', provider: providerProfile === 'claude' ? 'acpx' : 'codex', ...(providerProfile === 'claude' ? { acpxAgent: 'claude' } : {}), model: 'fixture',
+      runnerd: { path: binary, sha256: manifest.runnerd.sha256 }, limits: { turnTimeoutMs: 5000, maxAgentTurns: 1, maxEstimatedCostNanodollars: 1_000_000_000 }, session: { workingDirectory: workspace } };
+    const requestPath = join(root, `request-${index}.json`), outputPath = join(root, `output-${index}.json`);
+    await writeFile(requestPath, JSON.stringify(request)); requests.push({ request, requestPath, outputPath });
+    manifest.attempts.push({ executionId: `execution-${index}`, attemptId: request.attemptId, requestSha256: requestBindingSha256(request), provider: request.provider, ...(request.acpxAgent ? { acpxAgent: request.acpxAgent } : {}), model: 'fixture', maxUsd: allocation, maxRequests: 2, maxConcurrent: 1, timeoutMs: 5000 });
+  }
+  if (options.observability) {
+    manifest.observability = { projectId: '11111111-1111-4111-8111-111111111111',
+      capture: { userPrompts: false, assistantResponses: false, toolDetails: false, toolContent: false },
+      nativeLimits: { maxRequests: 4, maxRequestBytes: 16384, maxTotalBytes: 32768, maxConcurrent: 1, maxExpandedBytes: 65536, maxRecords: 16 } };
+    manifest.observability.provisionalBound = bound(observabilityBoundConfiguration(manifest));
+  }
+  const manifestPath = join(root, 'manifest.json');
+  const save = () => writeFile(manifestPath, JSON.stringify(manifest)); await save();
+  const environment = { PATH: process.env.PATH, OPENAI_API_KEY: 'synthetic-upstream-private', ANTHROPIC_API_KEY: 'other-private', BRAINTRUST_API_KEY: 'other-braintrust', GH_TOKEN: 'other-github', NODE_OPTIONS: '--require must-not-inherit', PYTHONPATH: '/must-not-inherit' };
+  return { root, manifest, manifestPath, requests, environment, save,
+    run: (index = 0, transport = () => success(biller), signal) => runControlledEval({ manifestPath, ...requests[index], environment, transport, signal, otlpTransport: options.otlpTransport ?? (async () => Response.json({})) }) };
+}
+let sequence = 0;
+function success(provider = 'openai') {
+  if (provider === 'anthropic') return Response.json({ type: 'message', id: `synthetic-${++sequence}`, model: 'fixture', usage: { input_tokens: 8, cache_read_input_tokens: 2, cache_creation_input_tokens: 0, output_tokens: 5, cache_creation: { ephemeral_5m_input_tokens: 0, ephemeral_1h_input_tokens: 0 } } }, { headers: { 'x-bt-used-endpoint': 'ANTHROPIC_API_KEY', 'x-bt-cached': 'MISS' } });
+  return Response.json({ object: 'response', id: `synthetic-${++sequence}`, status: 'completed', model: 'fixture', usage: {
+    input_tokens: 10, input_tokens_details: { cache_write_tokens: 0, cached_tokens: 2 }, output_tokens: 5, output_tokens_details: { reasoning_tokens: 3 } } });
+}
+
+
+export { childScript, fixture, success };
@@ -3,7 +3,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { test } from 'node:test';
 import { execFileSync } from 'node:child_process';
-import { mkdtemp, mkdir, open, readFile, readdir, rm, stat, symlink, truncate, writeFile } from 'node:fs/promises';
+import { cp, mkdtemp, mkdir, open, readFile, readdir, rm, stat, symlink, truncate, writeFile } from 'node:fs/promises';
 import { writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
@@ -19,124 +19,8 @@ const { readRegularFile, replaceEvidenceFile } = await import(new URL('./evidenc

 import { aggregateProtocolEvalCampaign, sanitizeProtocolEvalRuns } from '../runner-protocol-eval-campaign.mjs';

-const { build } = createRequire(new URL('../../../../package.json', import.meta.url))('esbuild');

-const childScript = options => `
-import assert from 'node:assert/strict';
-import {createHash} from 'node:crypto';
-import {spawn} from 'node:child_process';
-import {once} from 'node:events';
-import {readFile,writeFile,rm,readdir,symlink,truncate,mkdir} from 'node:fs/promises';
-import {dirname,join} from 'node:path';
-import {execFileSync} from 'node:child_process';
-const args=new Map();for(let i=2;i<process.argv.length;i+=2)args.set(process.argv[i],process.argv[i+1]);
-const request=JSON.parse(await readFile(args.get('--request'),'utf8'));
-if(${Boolean(options.failChild)})process.exit(3);
-if(${Boolean(options.resistantDescendant)}) {
- const orphan=${Boolean(options.orphanExit)};
- const descendant=spawn(process.execPath,['-e',"process.on('SIGTERM',()=>{});"+(orphan?"process.send('ready');":"process.stdout.write('ready');")+"setInterval(()=>{},1000)"],{stdio:orphan?['ignore','inherit','inherit','ipc']:['ignore','pipe','ignore']});
- if(orphan)await once(descendant,'message');else await once(descendant.stdout,'data');
- await writeFile(request.session.workingDirectory+'/descendant.pid',String(descendant.pid));
-}
-
-const descriptorRaw=await readFile(args.get('--gateway-config'),'utf8'),descriptor=JSON.parse(descriptorRaw);
-for(const key of ['OPENAI_API_KEY','ANTHROPIC_API_KEY','BRAINTRUST_API_KEY','GH_TOKEN','NODE_OPTIONS','PYTHONPATH'])assert.equal(process.env[key],undefined);
-const statuses=[];
-for(let i=0;i<${options.requests ?? 3};i++){
- const response=await fetch(descriptor.baseUrl+(descriptor.provider==='openai'?'/v1/responses':'/v1/messages'),{method:'POST',headers:{authorization:'Bearer '+process.env.PAPERCLIP_RUNNER_EVAL_GATEWAY_TOKEN,'content-type':'application/json'},body:JSON.stringify({model:request.model,input:'synthetic fixture'})});
- statuses.push(response.status);await response.text();
-}
-let nativeObservability;
-if(args.has('--observability-config')) {
- const raw=await readFile(args.get('--observability-config'),'utf8'),config=JSON.parse(raw);
- const parent=decodeURIComponent(config.launch.environment.OTEL_EXPORTER_OTLP_TRACES_HEADERS.slice('x-bt-parent='.length));
- for(const signal of ['logs','traces'])for(let i=0;i<${options.otelRequests ?? 1};i++) {
-  const body=signal==='logs'?{resourceLogs:[{scopeLogs:[{logRecords:[{body:{stringValue:'synthetic-native-content'}}]}]}]}:{resourceSpans:[{scopeSpans:[{spans:[{traceId:'1'.repeat(32),spanId:'2'.repeat(16),name:'synthetic-native-span'}]}]}]};
-  const response=await fetch(config.baseUrl+'/v1/'+signal,{method:'POST',headers:{authorization:'Bearer '+process.env.PAPERCLIP_RUNNER_EVAL_OTLP_TOKEN,'x-bt-parent':parent,'content-type':'application/json'},body:JSON.stringify(body)});
-  await response.arrayBuffer();
- }
- nativeObservability={mode:'controller_otlp',configured:true,verification:'unverified',projectId:config.projectId,traceId:config.traceId,spanId:config.spanId,descriptorSha256:createHash('sha256').update(raw).digest('hex')};
- if(${Boolean(options.realObservabilityValidator)}) {
-  const {prepareEvalObservabilityRuntime}=await import(${JSON.stringify(options.observabilityValidatorModule ?? '')});
-  await mkdir(process.env.HOME+'/codex',{recursive:true});
-  const prepared=await prepareEvalObservabilityRuntime(args.get('--observability-config'),request,
-   {evidence:{campaignId:descriptor.campaignId,executionId:descriptor.executionId},transportOptions:{environment:{CODEX_HOME:process.env.HOME+'/codex'}}},process.env);
-  assert.deepEqual(prepared.evidence,nativeObservability);
-  for(const signal of ['LOGS','TRACES'])assert(prepared.transportOptions.environment['OTEL_EXPORTER_OTLP_'+signal+'_HEADERS'].includes(encodeURIComponent('Bearer '+process.env.PAPERCLIP_RUNNER_EVAL_OTLP_TOKEN)));
-  nativeObservability=prepared.evidence;
- }
-
-}
-if(${Boolean(options.waitForever)})await new Promise(()=>setInterval(()=>{},1000));
-if(!${Boolean(options.missingArtifact)})await writeFile(args.get('--output'),JSON.stringify({schema:'paperclip-runner/eval-session-artifact/v1',attemptId:request.attemptId,requestedModel:request.model,
- requestRouting:${options.missingRoute ? 'null' : "{mode:'controller_gateway',provider:descriptor.provider,declaredUpstreamRoute:descriptor.upstreamRoute,campaignId:descriptor.campaignId,executionId:descriptor.executionId,attemptId:descriptor.attemptId,descriptorSha256:createHash('sha256').update(descriptorRaw).digest('hex')}"},
- nativeObservability, snapshot:{status:'closed',process:{runnerExited:true,runnerPid:process.pid,providerPid:process.pid}},statuses,
- leaked:${options.leakToken ? 'process.env.PAPERCLIP_RUNNER_EVAL_GATEWAY_TOKEN' : options.leakOtlpToken ? 'process.env.PAPERCLIP_RUNNER_EVAL_OTLP_TOKEN' : 'null'}}));
-if(${Boolean(options.invalidEvidence)}) {
- const root=dirname(args.get('--output'));
- const name=${JSON.stringify(options.invalidEvidence ?? '')};
- const file=name==='receipt'?join(root,'receipts',(await readdir(join(root,'receipts')))[0]):join(root,name);
- await rm(file);
- const kind=${JSON.stringify(options.invalidFileType ?? '')};
- if(kind==='fifo')execFileSync('mkfifo',[file]);
- else if(kind==='symlink')await symlink('/dev/zero',file);
- else {await writeFile(file,'');await truncate(file,16*1024*1024+1);}
-}
-
-if(${Boolean(options.orphanExit)})process.exit(0);
-`;
-
-async function fixture(t, { count = 1, allocation = '0.01', providerProfile = 'codex', route = 'direct', ...options } = {}) {
-  const root = await mkdtemp(join(tmpdir(), 'runner-controller-test-'));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const cli = join(root, 'fake-cli.mjs'), binary = join(root, 'runnerd'), archive = join(root, 'runner.tgz');
-  if (options.realObservabilityValidator) {
-    options.observabilityValidatorModule = join(root, 'eval-observability-runtime.mjs');
-    await build({ entryPoints: [fileURLToPath(new URL('../../src/cli/eval-observability-runtime.ts', import.meta.url))],
-      outfile: options.observabilityValidatorModule, bundle: true, platform: 'node', format: 'esm', target: 'node24', logLevel: 'silent' });
-  }
-  await writeFile(cli, childScript(options)); await writeFile(binary, 'synthetic daemon'); await writeFile(archive, 'synthetic package');
-  const provenance = async path => ({ path, sha256: sha256(await readFile(path)) });
-  const now = Date.now(), verifiedAt = new Date(now - 1000).toISOString(), expiresAt = new Date(now + 86_400_000).toISOString();
-  const overhead = { version: 1, reference: 'synthetic-allowance', runner: 'github-hosted', verifiedAt, expiresAt,
-    components: costRuntime.EVAL_OVERHEAD_COMPONENTS.map(component => ({ component, maxUsd: '0.001', reference: 'synthetic-proof' })) };
-  const bound = configuration => ({ version: 1, scope: 'full_lifecycle', evidenceSha256: 'a'.repeat(64), configurationSha256: sha256(canonical(configuration)) });
-  for (const component of overhead.components) component.provisionalBound = bound({ reference: overhead.reference, runner: overhead.runner, verifiedAt, expiresAt, component: { ...component } });
-  const biller = providerProfile === 'claude' ? 'anthropic' : 'openai';
-  const price = { provider: biller, model: 'fixture', version: 'synthetic-pricing', sourceUrl: 'https://provider.invalid/pricing', inputUsdPerMillion: '2', cachedReadUsdPerMillion: '1', outputUsdPerMillion: '10', ...(biller === 'openai' ? { cacheWrite30mUsdPerMillion: '2', cacheWrite12hUsdPerMillion: '2' } : { cacheWrite5mUsdPerMillion: '2', cacheWrite1hUsdPerMillion: '2' }) };
-  const model = { provider: biller, price, maximumInputTokens: 1000, maximumOutputTokens: 100, timeoutMs: 1000 };
-  model.provisionalBound = bound({ provider: model.provider, mode: route, price, maximumInputTokens: 1000, maximumOutputTokens: 100, reservation: '0.003000000' });
-  const manifest = { schema: 'paperclip.runner-eval.controller/v1', campaignId: 'synthetic-controller', maxUsd: '1',
-    deadlineAt: new Date(now + 60_000).toISOString(), pricingVerifiedAt: verifiedAt, pricingExpiresAt: expiresAt, overhead,
-    sourceRevision: 'a'.repeat(40), definitionsRevision: 'b'.repeat(40), runnerCli: await provenance(cli), runnerPackage: await provenance(archive), runnerd: await provenance(binary),
-    outputDirectory: join(root, 'controller'), route, ...(route === 'braintrust' ? { projectId: '11111111-1111-4111-8111-111111111111' } : {}), models: [model], attempts: [] };
-  const requests = [];
-  for (let index = 0; index < count; index++) {
-    const workspace = join(root, `workspace-${index}`); await mkdir(workspace);
-    const request = { schema: 'paperclip-runner/eval-session-request/v1', attemptId: `attempt-${index}`, prompt: 'synthetic', provider: providerProfile === 'claude' ? 'acpx' : 'codex', ...(providerProfile === 'claude' ? { acpxAgent: 'claude' } : {}), model: 'fixture',
-      runnerd: { path: binary, sha256: manifest.runnerd.sha256 }, limits: { turnTimeoutMs: 5000, maxAgentTurns: 1, maxEstimatedCostNanodollars: 1_000_000_000 }, session: { workingDirectory: workspace } };
-    const requestPath = join(root, `request-${index}.json`), outputPath = join(root, `output-${index}.json`);
-    await writeFile(requestPath, JSON.stringify(request)); requests.push({ request, requestPath, outputPath });
-    manifest.attempts.push({ executionId: `execution-${index}`, attemptId: request.attemptId, requestSha256: requestBindingSha256(request), provider: request.provider, ...(request.acpxAgent ? { acpxAgent: request.acpxAgent } : {}), model: 'fixture', maxUsd: allocation, maxRequests: 2, maxConcurrent: 1, timeoutMs: 5000 });
-  }
-  if (options.observability) {
-    manifest.observability = { projectId: '11111111-1111-4111-8111-111111111111',
-      capture: { userPrompts: false, assistantResponses: false, toolDetails: false, toolContent: false },
-      nativeLimits: { maxRequests: 4, maxRequestBytes: 16384, maxTotalBytes: 32768, maxConcurrent: 1, maxExpandedBytes: 65536, maxRecords: 16 } };
-    manifest.observability.provisionalBound = bound(observabilityBoundConfiguration(manifest));
-  }
-  const manifestPath = join(root, 'manifest.json');
-  const save = () => writeFile(manifestPath, JSON.stringify(manifest)); await save();
-  const environment = { PATH: process.env.PATH, OPENAI_API_KEY: 'synthetic-upstream-private', ANTHROPIC_API_KEY: 'other-private', BRAINTRUST_API_KEY: 'other-braintrust', GH_TOKEN: 'other-github', NODE_OPTIONS: '--require must-not-inherit', PYTHONPATH: '/must-not-inherit' };
-  return { root, manifest, manifestPath, requests, environment, save,
-    run: (index = 0, transport = () => success(biller), signal) => runControlledEval({ manifestPath, ...requests[index], environment, transport, signal, otlpTransport: options.otlpTransport ?? (async () => Response.json({})) }) };
-}
-let sequence = 0;
-function success(provider = 'openai') {
-  if (provider === 'anthropic') return Response.json({ type: 'message', id: `synthetic-${++sequence}`, model: 'fixture', usage: { input_tokens: 8, cache_read_input_tokens: 2, cache_creation_input_tokens: 0, output_tokens: 5, cache_creation: { ephemeral_5m_input_tokens: 0, ephemeral_1h_input_tokens: 0 } } }, { headers: { 'x-bt-used-endpoint': 'ANTHROPIC_API_KEY', 'x-bt-cached': 'MISS' } });
-  return Response.json({ object: 'response', id: `synthetic-${++sequence}`, status: 'completed', model: 'fixture', usage: {
-    input_tokens: 10, input_tokens_details: { cache_write_tokens: 0, cached_tokens: 2 }, output_tokens: 5, output_tokens_details: { reasoning_tokens: 3 } } });
-}
+import { childScript, fixture, success } from './controller-fixture.mjs';

 test('real child requests reserve before dispatch, stop at the cap and retain only controller credentials', async t => {
  const f = await fixture(t);
@@ -526,13 +410,30 @@ test('campaign collection retains and audits private archives, while public proj
  await rm(f.manifest.outputDirectory, { recursive: true });
  const input = { catalogPath, downloadsRoot: join(f.root, 'downloads'), evalsRoot: f.root,
    runsOut: join(f.root, 'collected'), campaignOut: join(f.root, 'campaign.json'),
-    source: { paperclip: { sha: f.manifest.sourceRevision }, evals: { sha: f.manifest.definitionsRevision } } };
+    source: { paperclip: { sha: f.manifest.sourceRevision }, evals: { sha: f.manifest.definitionsRevision } },
+    controllerArchiveCli: process.env.PAPERCLIP_CONTROLLER_TEST_RUNTIME ? join(process.env.PAPERCLIP_CONTROLLER_TEST_RUNTIME, 'archive.mjs') : undefined };
  const result = await aggregateProtocolEvalCampaign(input);
  assert.equal(result.controlledCosts.knownUsd, '0.000068000');
  assert.equal(result.controlledCosts.costStatus, 'incomplete');
  assert.equal(result.controlledCosts.committedUsd, '0.014068000');
  assert.equal(result.controlledCosts.incompleteAttempts, 1);
  assert.deepEqual(JSON.parse(await readFile(join(input.runsOut, 'attempt-0', 'controller-evidence.json'), 'utf8')), bundle);
+  const isolated = join(f.root, 'isolated-reporter'); await mkdir(join(isolated, 'controlled-evals'), { recursive: true });
+  for (const file of ['runner-protocol-eval-campaign.mjs', 'runner-protocol-eval-metrics.mjs', 'public-eval-chat.mjs']) {
+    await cp(new URL('../' + file, import.meta.url), join(isolated, file));
+  }
+  await writeFile(join(isolated, 'controlled-evals/archive.mjs'), "throw new Error('Source dependencies must not be loaded by the reporter');");
+  const isolatedInput = join(f.root, 'isolated-input.json');
+  await writeFile(isolatedInput, JSON.stringify({ ...input, controllerArchiveCli: undefined, runsOut: join(f.root, 'isolated-collected'), campaignOut: join(f.root, 'isolated-campaign.json') }));
+  const isolatedResult = await promisify(execFile)(process.execPath, ['--input-type=module', '-e', `
+    import {readFile} from 'node:fs/promises';
+    const {aggregateProtocolEvalCampaign}=await import(${JSON.stringify(pathToFileURL(join(isolated, 'runner-protocol-eval-campaign.mjs')).href)});
+    const result=await aggregateProtocolEvalCampaign(JSON.parse(await readFile(${JSON.stringify(isolatedInput)},'utf8')));
+    console.log(JSON.stringify(result.controlledCosts));
+  `], { cwd: isolated, env: { PATH: process.env.PATH,
+    PAPERCLIP_RUNNER_EVAL_ARCHIVE_CLI: input.controllerArchiveCli ?? fileURLToPath(new URL('./archive.mjs', import.meta.url)) }, timeout: 20000 });
+  assert.equal(JSON.parse(isolatedResult.stdout).knownUsd, result.controlledCosts.knownUsd);
+  assert.equal(JSON.parse(isolatedResult.stdout).heldUsd, result.controlledCosts.heldUsd);
  const publicRoot = join(f.root, 'public');
  await sanitizeProtocolEvalRuns({ runsRoot: input.runsOut, publicRunsRoot: publicRoot });
  assert.deepEqual((await readdir(join(publicRoot, 'attempt-0'))).sort(), ['artifact.json', 'case.json', 'config.json', 'score.json']);
@@ -0,0 +1,127 @@
+import { readFile, mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isEntrypoint } from './entrypoint.mjs';
+import { assertHostedAdmission, canonical, costRuntime, fields, observabilityBoundConfiguration, requestBindingSha256, sha256, validateManifest } from './manifest.mjs';
+import { readRegularFile } from './evidence-files.mjs';
+
+export function hostedPaths(runId) {
+  if (typeof runId !== 'string' || !/^[1-9][0-9]{0,19}$/.test(runId)) throw new Error('Invalid hosted run ID');
+  const root = `/tmp/paperclip-runner-controlled-${runId}`;
+  return { root, runner: join(root, 'runner'), controller: join(root, 'runtime'),
+    manifest: join(root, 'controller-manifest.json'), evidence: join(root, 'evidence') };
+}
+
+export function hostedPolicyConfiguration(policy) {
+  const { capacityBound, ...configuration } = policy;
+  return configuration;
+}
+
+export function prepareHostedManifest({ catalog, catalogSha256, prepared, policy, artifacts, environment, now = Date.now() }) {
+  fields(policy, ['schema', 'maxUsd', 'durationMs', 'pricingVerifiedAt', 'pricingExpiresAt', 'route', 'projectId', 'models', 'overhead', 'observability', 'allocations', 'maxCells', 'capacityBound', 'controllerLockSha256']);
+  if (policy.schema !== 'paperclip.runner-eval.hosted-policy/v1' || !policy.observability
+      || !Number.isSafeInteger(policy.durationMs) || policy.durationMs < 1 || policy.durationMs > 4 * 3_600_000
+      || !Number.isSafeInteger(policy.maxCells) || policy.maxCells < 1 || policy.maxCells > 512
+      || !Array.isArray(policy.allocations) || !policy.allocations.length) throw new Error('A bounded hosted policy with tracing is required');
+  if (!/^[a-f0-9]{64}$/.test(policy.controllerLockSha256 ?? '')) throw new Error('Invalid hosted controller lock binding');
+  costRuntime.reservationBound('operating_allowance', policy.capacityBound, hostedPolicyConfiguration(policy));
+  fields(policy.observability, ['projectId', 'capture', 'nativeLimits']);
+  const runId = environment.GITHUB_RUN_ID, paths = hostedPaths(runId);
+  if (prepared.schema !== 'paperclip.runner-eval.prepared-requests/v1' || prepared.githubRunId !== runId || prepared.githubRunAttempt !== 1
+      || prepared.campaignId !== `gha-${runId}-1` || prepared.catalogSha256 !== catalogSha256
+      || catalog.schema !== 'paperclip.runner-protocol-eval.catalog/v1' || catalog.campaignId !== prepared.campaignId
+      || prepared.sourceRevision !== environment.GITHUB_SHA || prepared.sourceRevision !== environment.PAPERCLIP_PROTOCOL_EVAL_SOURCE_SHA || prepared.sourceRevision !== catalog.source?.paperclipSha
+      || prepared.definitionsRevision !== environment.PAPERCLIP_PROTOCOL_EVALS_SHA || prepared.definitionsRevision !== catalog.source?.evalsSha
+      || !Array.isArray(prepared.cells) || !prepared.cells.length || prepared.cells.length > policy.maxCells
+      || !Array.isArray(catalog.cells) || catalog.cells.length !== prepared.cells.length
+      || !Array.isArray(catalog.matrices) || catalog.matrices.length !== 2) throw new Error('Prepared selection does not match the authorized catalog');
+  const indexed = new Map(catalog.cells.map(cell => [cell.cellId, cell]));
+  const scheduled = catalog.matrices.flatMap(matrix => Array.isArray(matrix.include) ? matrix.include : []);
+  if (indexed.size !== catalog.cells.length || scheduled.length !== catalog.cells.length
+      || new Set(scheduled.map(cell => cell.cellId)).size !== indexed.size
+      || scheduled.some(cell => canonical(cell) !== canonical(indexed.get(cell.cellId)))) throw new Error('Every selected cell must occur exactly once');
+  const key = item => canonical([item.provider, item.acpxAgent ?? null, item.model]);
+  const allocations = new Map();
+  for (const allocation of policy.allocations) {
+    fields(allocation, ['provider', 'acpxAgent', 'model', 'maxUsd', 'maxRequests', 'maxConcurrent', 'timeoutMs']);
+    if (allocations.has(key(allocation))) throw new Error('Duplicate hosted allocation policy');
+    allocations.set(key(allocation), allocation);
+  }
+  const seen = new Set();
+  const attempts = prepared.cells.map(cell => {
+    const request = cell.request, expected = indexed.get(cell.cellId), allocation = allocations.get(key(request));
+    if (!expected || seen.has(cell.cellId) || !allocation || cell.runId !== `gha-${runId}-1-${cell.cellId}`
+        || request.schema !== 'paperclip-runner/eval-session-request/v1'
+        || !(request.provider === 'codex' && !request.acpxAgent || request.provider === 'acpx' && request.acpxAgent === 'claude')
+        || request.driver !== (request.provider === 'codex' ? 'codex_app_server' : 'acpx_runtime') || request.driver !== expected.driver
+        || request.provider !== expected.provider || (request.acpxAgent ?? null) !== (expected.acpxAgent ?? null) || request.model !== expected.model
+        || request.runnerd?.path !== join(paths.runner, 'paperclip-runnerd') || request.runnerd.sha256?.replace(/^sha256:/, '') !== artifacts.runnerd.sha256
+        || prepared.runnerd?.path !== request.runnerd.path || prepared.runnerd.sha256 !== request.runnerd.sha256) throw new Error('Unsupported or mismatched controlled cell');
+    seen.add(cell.cellId);
+    return { ...allocation, executionId: cell.cellId, attemptId: request.attemptId, requestSha256: requestBindingSha256(request) };
+  });
+  const manifest = { schema: 'paperclip.runner-eval.controller/v1', campaignId: prepared.campaignId,
+    maxUsd: policy.maxUsd, deadlineAt: new Date(now + policy.durationMs).toISOString(), pricingVerifiedAt: policy.pricingVerifiedAt,
+    pricingExpiresAt: policy.pricingExpiresAt, route: policy.route, ...(policy.projectId ? { projectId: policy.projectId } : {}),
+    models: policy.models, overhead: policy.overhead, observability: { ...policy.observability },
+    sourceRevision: prepared.sourceRevision, definitionsRevision: prepared.definitionsRevision, ...artifacts,
+    outputDirectory: paths.evidence, hosted: { repository: environment.GITHUB_REPOSITORY, runId, runAttempt: 1, workflowRevision: environment.GITHUB_SHA, controllerLockSha256: policy.controllerLockSha256, policySha256: sha256(canonical(policy)) }, attempts };
+  manifest.observability.provisionalBound = { ...policy.capacityBound, configurationSha256: sha256(canonical(observabilityBoundConfiguration(manifest))) };
+  const validated = validateManifest(manifest, now);
+  assertHostedAdmission(manifest, attempts[0], { ...environment, PAPERCLIP_RUNNER_EVAL_EXECUTION_ID: attempts[0].executionId });
+  return validated;
+}
+
+export async function verifyHostedCell({ manifestPath, manifestSha256, cellId, environment }) {
+  const bytes = await readRegularFile(manifestPath, 16 * 1_048_576);
+  if (sha256(bytes) !== manifestSha256) throw new Error('Hosted manifest bytes changed');
+  const { manifest } = validateManifest(JSON.parse(bytes.toString('utf8')));
+  const attempt = manifest.attempts.find(item => item.executionId === cellId);
+  if (!attempt) throw new Error('Cell is outside the controlled selection');
+  assertHostedAdmission(manifest, attempt, environment);
+  return { manifest, attempt };
+}
+
+const safeAdmissionReasons = new Set([
+  'Invalid hosted run ID', 'Invalid hosted controller lock binding', 'Invalid controller fields', 'A bounded hosted policy with tracing is required',
+  'Invalid reviewed cost bound evidence', 'Reviewed cost bound configuration changed',
+  'Prepared selection does not match the authorized catalog', 'Every selected cell must occur exactly once',
+  'Duplicate hosted allocation policy', 'Unsupported or mismatched controlled cell',
+  'Invalid controller campaign identity or validity window', 'Controller requires current full-lifecycle operating bounds',
+  'Invalid controlled campaign selection', 'Invalid controller executable provenance', 'Invalid hosted controller identity',
+  'Invalid controller model pricing', 'Invalid controlled attempt allocation', 'Controlled allocations exceed the campaign budget',
+  'Incomplete operating overhead allowance', 'Operating overhead leaves no model allowance',
+  'Invalid operating overhead component', 'Invalid operating overhead fields', 'Invalid controller observability allocation',
+  'Observability capacity requires its operating bound evidence', 'Hosted manifest bytes changed',
+  'Cell is outside the controlled selection', 'Hosted controller admission does not match the current first-attempt worker',
+]);
+export function hostedAdmissionDiagnostic(error) {
+  if (error instanceof Error && safeAdmissionReasons.has(error.message)) return error.message;
+  if (error?.code === 'ENOENT') return 'A required hosted input file is missing';
+  if (error instanceof SyntaxError) return 'A hosted input is not valid JSON';
+  return 'Invalid or unreadable hosted input; check the catalog, policy and runtime bindings';
+}
+
+if (await isEntrypoint(import.meta.url)) {
+  try {
+    const [command, ...args] = process.argv.slice(2);
+    if (command === 'prepare' && args.length === 5) {
+      const [catalogPath, preparedPath, policyPath, runner, output] = args;
+      const json = async path => JSON.parse((await readRegularFile(path, 16 * 1_048_576)).toString('utf8'));
+      const catalogBytes = await readRegularFile(catalogPath, 16 * 1_048_576);
+      const prepared = await json(preparedPath), paths = hostedPaths(process.env.GITHUB_RUN_ID), artifacts = {};
+      for (const [name, relative] of [['runnerCli', 'portable/dist/cli/eval-session.js'], ['runnerPackage', 'paperclip-runner.tgz'], ['runnerd', 'paperclip-runnerd']]) {
+        artifacts[name] = { path: join(paths.runner, relative), sha256: sha256(await readFile(join(runner, relative))) };
+      }
+      const result = prepareHostedManifest({ catalog: JSON.parse(catalogBytes), catalogSha256: sha256(catalogBytes), prepared,
+        policy: await json(policyPath), artifacts, environment: process.env });
+      await mkdir(output, { mode: 0o700 });
+      await writeFile(join(output, 'controller-manifest.json'), canonical(result.manifest), { flag: 'wx', mode: 0o600 });
+      console.log(JSON.stringify({ manifestSha256: result.manifestSha256, cells: result.manifest.attempts.length,
+        allocatedUsd: result.allocatedUsd, providerCalls: 0 }));
+    } else if (command === 'verify' && args.length === 3) {
+      await verifyHostedCell({ manifestPath: args[0], manifestSha256: args[1], cellId: args[2], environment: process.env });
+    } else throw new Error('Usage: hosted.mjs <prepare catalog prepared policy runner output | verify manifest digest cell>');
+  } catch (error) {
+    console.error(`Hosted campaign admission failed: ${hostedAdmissionDiagnostic(error)}. No provider work was started by this command.`); process.exitCode = 2;
+  }
+}
@@ -0,0 +1,121 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { cp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { fixture, success } from './controller-fixture.mjs';
+import { canonical, sha256 } from './manifest.mjs';
+const runtime = process.env.PAPERCLIP_CONTROLLER_TEST_RUNTIME ? pathToFileURL(resolve(process.env.PAPERCLIP_CONTROLLER_TEST_RUNTIME) + '/') : import.meta.url;
+const { hostedPaths, hostedPolicyConfiguration, prepareHostedManifest, verifyHostedCell, hostedAdmissionDiagnostic } = await import(new URL('./hosted.mjs', runtime));
+const { packControlledAttempt, summarizeControlledManifest } = await import(new URL('./archive.mjs', runtime));
+
+async function campaign(t) {
+  const f = await fixture(t, { count: 2, observability: true });
+  const runId = String(Date.now() * 1000 + Math.floor(Math.random() * 1000)), paths = hostedPaths(runId);
+  t.after(() => rm(paths.root, { recursive: true, force: true }));
+  await mkdir(join(paths.runner, 'portable/dist/cli'), { recursive: true });
+  const artifacts = {};
+  for (const [name, relative] of [['runnerCli', 'portable/dist/cli/eval-session.js'], ['runnerPackage', 'paperclip-runner.tgz'], ['runnerd', 'paperclip-runnerd']]) {
+    artifacts[name] = { ...f.manifest[name], path: join(paths.runner, relative) };
+    await cp(f.manifest[name].path, artifacts[name].path);
+  }
+  const cells = f.requests.map(({ request }, index) => ({ cellId: `execution-${index}`, provider: request.provider, driver: 'codex_app_server', model: request.model }));
+  const catalog = { schema: 'paperclip.runner-protocol-eval.catalog/v1', campaignId: `gha-${runId}-1`,
+    source: { paperclipSha: f.manifest.sourceRevision, evalsSha: f.manifest.definitionsRevision },
+    cells, matrices: cells.map(cell => ({ include: [cell] })) };
+  const catalogSha256 = sha256(canonical(catalog));
+  for (const item of f.requests) { item.request.runnerd = { ...artifacts.runnerd, sha256: `sha256:${artifacts.runnerd.sha256}` }; item.request.acpxAgent = null; item.request.driver = 'codex_app_server'; await writeFile(item.requestPath, JSON.stringify(item.request)); }
+  const prepared = { schema: 'paperclip.runner-eval.prepared-requests/v1', campaignId: catalog.campaignId, githubRunId: runId, githubRunAttempt: 1,
+    sourceRevision: f.manifest.sourceRevision, definitionsRevision: f.manifest.definitionsRevision, catalogSha256, runnerd: f.requests[0].request.runnerd,
+    cells: cells.map((cell, index) => ({ cellId: cell.cellId, runId: `${catalog.campaignId}-${cell.cellId}`, request: f.requests[index].request })) };
+  for (const component of f.manifest.overhead.components) component.provisionalBound.evidenceSha256 = sha256(component.component);
+  const { provisionalBound, ...observability } = f.manifest.observability;
+  const { executionId, attemptId, requestSha256, ...allocation } = f.manifest.attempts[0];
+  const policy = { schema: 'paperclip.runner-eval.hosted-policy/v1', controllerLockSha256: 'e'.repeat(64), maxUsd: f.manifest.maxUsd, maxCells: 2, durationMs: 60000,
+    pricingVerifiedAt: f.manifest.pricingVerifiedAt, pricingExpiresAt: f.manifest.pricingExpiresAt,
+    route: 'direct', models: f.manifest.models, overhead: f.manifest.overhead, observability, allocations: [allocation] };
+  policy.capacityBound = { version: 1, scope: 'full_lifecycle', evidenceSha256: f.manifest.overhead.components.find(component => component.component === 'observability').provisionalBound.evidenceSha256, configurationSha256: sha256(canonical(hostedPolicyConfiguration(policy))) };
+  const environment = { ...f.environment, GITHUB_ACTIONS: 'true', GITHUB_REPOSITORY: 'paperclipai/paperclip', GITHUB_RUN_ID: runId,
+    GITHUB_RUN_ATTEMPT: '1', GITHUB_SHA: f.manifest.sourceRevision, PAPERCLIP_PROTOCOL_EVAL_SOURCE_SHA: prepared.sourceRevision, PAPERCLIP_PROTOCOL_EVALS_SHA: prepared.definitionsRevision };
+  const input = { catalog, catalogSha256, prepared, policy, artifacts, environment };
+  const build = () => prepareHostedManifest(input);
+  return { f, input, paths, environment, build };
+}
+
+test('one prepared manifest binds disjoint workers and retains partial or entirely missing campaigns', async t => {
+  const c = await campaign(t), result = c.build();
+  Object.assign(c.f.manifest, result.manifest); await c.f.save();
+  const empty = await summarizeControlledManifest(result.manifest, []);
+  assert.equal(empty.incompleteAttempts, 2); assert.equal(empty.heldUsd, '0.024000000');
+  assert.equal(empty.costStatus, 'incomplete');
+  Object.assign(c.f.environment, c.environment, { PAPERCLIP_RUNNER_EVAL_EXECUTION_ID: 'execution-0' });
+  assert.equal((await c.f.run(0, () => success())).code, 0);
+  const bundle = await packControlledAttempt({ manifest: result.manifest, attemptId: 'attempt-0', environment: c.f.environment });
+  const partial = await summarizeControlledManifest(result.manifest, [bundle, bundle]);
+  assert.equal(partial.incompleteAttempts, 1); assert.equal(partial.knownUsd, '0.000136000');
+  assert.equal(partial.heldUsd, '0.014000000'); assert.equal(partial.operatingHeldUsd, '0.004000000');
+  Object.assign(c.f.environment, { PAPERCLIP_RUNNER_EVAL_EXECUTION_ID: 'execution-1' });
+  assert.equal((await c.f.run(1, () => success())).code, 0);
+  const second = await packControlledAttempt({ manifest: result.manifest, attemptId: 'attempt-1', environment: c.f.environment });
+  const complete = await summarizeControlledManifest(result.manifest, [bundle, second]);
+  assert.equal(complete.incompleteAttempts, 0); assert.equal(complete.knownUsd, '0.000272000');
+  assert.equal(complete.heldUsd, '0.004000000'); assert.equal(complete.costStatus, 'provisional');
+  await assert.rejects(summarizeControlledManifest({ ...result.manifest, maxUsd: '2' }, [bundle]), /retained campaign manifest/);
+});
+
+test('hosted preparation rejects selection drift, unsupported cells and unreviewed or insufficient budgets', async t => {
+  const c = await campaign(t);
+  const changes = [
+    input => { input.prepared.definitionsRevision = 'd'.repeat(40); },
+    input => { input.prepared.catalogSha256 = '0'.repeat(64); },
+    input => { input.catalog.matrices[1].include = input.catalog.matrices[0].include; },
+    input => { input.prepared.cells[1] = input.prepared.cells[0]; },
+    input => { input.prepared.cells[0].request.provider = 'opencode'; },
+    input => { input.prepared.cells[0].request.driver = 'unsupported'; },
+    input => { input.catalog.cells[0].driver = 'unsupported'; input.catalog.matrices[0].include[0].driver = 'unsupported'; },
+    input => { input.prepared.cells[0].request.runnerd.sha256 = 'sha256:' + '0'.repeat(64); },
+    input => { input.policy.maxUsd = '0.01'; },
+    input => { input.environment.GITHUB_RUN_ATTEMPT = '2'; },
+    input => { input.environment.GITHUB_SHA = 'wrong'; },
+    input => { input.environment.GITHUB_SHA = 'c'.repeat(40); },
+    input => { delete input.policy.observability; },
+    input => { delete input.policy.controllerLockSha256; },
+    input => { input.policy.controllerLockSha256 = 'f'.repeat(64); },
+  ];
+  for (const change of changes) {
+    const input = structuredClone(c.input); change(input);
+    assert.throws(() => prepareHostedManifest(input));
+  }
+  const mixed = structuredClone(c.input);
+  mixed.policy.capacityBound.evidenceSha256 = mixed.policy.overhead.components.find(component => component.component !== 'observability').provisionalBound.evidenceSha256;
+  assert.throws(() => prepareHostedManifest(mixed), /Observability capacity requires its operating bound evidence/);
+  const input = structuredClone(c.input); input.policy.maxUsd = '0.01';
+  input.policy.capacityBound.configurationSha256 = sha256(canonical(hostedPolicyConfiguration(input.policy)));
+  assert.throws(() => prepareHostedManifest(input), /budget/);
+});
+
+test('worker preflight verifies identical manifest bytes and current cell/run before credentials', async t => {
+  const c = await campaign(t), { manifest, manifestSha256 } = c.build();
+  await writeFile(c.paths.manifest, canonical(manifest));
+  const input = { manifestPath: c.paths.manifest, manifestSha256, cellId: 'execution-0',
+    environment: { ...c.environment, PAPERCLIP_RUNNER_EVAL_EXECUTION_ID: 'execution-0' } };
+  assert.equal((await verifyHostedCell(input)).attempt.attemptId, 'attempt-0');
+  await assert.rejects(verifyHostedCell({ ...input, cellId: 'another-cell' }), /outside/);
+  await assert.rejects(verifyHostedCell({ ...input, environment: { ...input.environment, GITHUB_RUN_ATTEMPT: '2' } }), /first-attempt/);
+  await writeFile(c.paths.manifest, canonical(manifest) + '\n');
+  await assert.rejects(verifyHostedCell(input), /bytes changed/);
+});
+
+test('hosted CLI reports safe admission reasons without echoing private paths or malformed input', async () => {
+  assert.equal(hostedAdmissionDiagnostic(new Error('Reviewed cost bound configuration changed')), 'Reviewed cost bound configuration changed');
+  assert.equal(hostedAdmissionDiagnostic(new SyntaxError('SENSITIVE_SENTINEL')), 'A hosted input is not valid JSON');
+  assert.doesNotMatch(hostedAdmissionDiagnostic(new Error('private SENSITIVE_SENTINEL')), /SENSITIVE_SENTINEL/);
+  const result = await promisify(execFile)(process.execPath, [fileURLToPath(new URL('./hosted.mjs', runtime)), 'verify', '/nonexistent/SENSITIVE_SENTINEL', 'a'.repeat(64), 'cell'], {
+    env: { PATH: process.env.PATH, OPENAI_API_KEY: 'SENSITIVE_SENTINEL' }, timeout: 10000,
+  }).then(value => value, error => error);
+  assert.equal(result.code, 2);
+  assert.match(result.stderr, /A required hosted input file is missing/);
+  assert.doesNotMatch(result.stderr + result.stdout, /SENSITIVE_SENTINEL/);
+});
@@ -86,9 +86,11 @@ export function validateManifest(value, now = Date.now(), { admission = true } =
 function validateHostedIdentity(manifest) {
  const hosted = manifest.hosted;
  if (hosted === undefined) return;
-  fields(hosted, ['repository', 'runId', 'runAttempt', 'workflowRevision']);
+  fields(hosted, ['repository', 'runId', 'runAttempt', 'workflowRevision', 'policySha256', 'controllerLockSha256']);
  if (typeof hosted.repository !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}\/[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/.test(hosted.repository)
      || typeof hosted.runId !== 'string' || !/^[1-9][0-9]{0,19}$/.test(hosted.runId)
+      || hosted.policySha256 !== undefined && !hash(hosted.policySha256)
+      || hosted.controllerLockSha256 !== undefined && !hash(hosted.controllerLockSha256)
      || hosted.runAttempt !== 1 || typeof hosted.workflowRevision !== 'string' || !/^[a-f0-9]{40}$/.test(hosted.workflowRevision)
      || manifest.campaignId !== `gha-${hosted.runId}-1`) throw new Error('Invalid hosted controller identity');
 }
@@ -66,20 +66,33 @@ test('copied controller runs without source dependencies, retains native evidenc
  const probe = join(root, 'probe.mjs'); await writeFile(probe, isolatedProbe);
  const isolated = await exec(process.execPath, [probe, directory], { cwd: root, env: environment, timeout: 20_000 });
  assert.match(isolated.stdout, /preserves 64-bit values/);
+  const privateArchive = exec(process.execPath, ['--input-type=module', '-'], { cwd: root, env: environment, timeout: 10000 });
+  privateArchive.child.stdin.end(`
+    const { archivePrivateEvidence } = await import(${JSON.stringify(pathToFileURL(join(directory, 'private-history.mjs')).href)});
+    await archivePrivateEvidence('pack', ${JSON.stringify(join(directory, 'controlled-evals'))}, ${JSON.stringify(join(root, 'private.zip'))});
+    await archivePrivateEvidence('unpack', ${JSON.stringify(join(root, 'private.zip'))}, ${JSON.stringify(join(root, 'restored'))});
+    console.log('portable private archive round trip');
+  `);
+  assert.match((await privateArchive).stdout, /portable private archive round trip/);
+  assert.equal(await readFile(join(root, 'restored/hosted.mjs'), 'utf8'), await readFile(join(directory, 'controlled-evals/hosted.mjs'), 'utf8'));
  const stdin = exec(process.execPath, ['--input-type=module', '-'], { cwd: root, env: environment, timeout: 10_000 });
  stdin.child.stdin.end(`
-    for (const name of ['run.mjs', 'archive.mjs', 'report.mjs', 'verify-runtime.mjs']) await import(${JSON.stringify(pathToFileURL(join(directory, 'controlled-evals') + '/').href)} + name);
+    for (const name of ['run.mjs', 'archive.mjs', 'report.mjs', 'hosted.mjs', 'verify-runtime.mjs']) await import(${JSON.stringify(pathToFileURL(join(directory, 'controlled-evals') + '/').href)} + name);
    await import(${JSON.stringify(pathToFileURL(join(source, 'build-runtime.mjs')).href)});
    const { isEntrypoint } = await import(${JSON.stringify(pathToFileURL(join(directory, 'controlled-evals/entrypoint.mjs')).href)});
    if (await isEntrypoint(import.meta.url, '/missing/entrypoint.mjs')) throw new Error('Missing entrypoint was accepted');
    console.log('stdin imports are side-effect free');
  `);
  assert.match((await stdin).stdout, /stdin imports are side-effect free/);
-  const cases = 'real child requests|disjoint concurrent|controller owns native|cancellation during root export|native post-child otlp-native.jsonl rejects fifo|credential redaction replaces|missing provider artifacts|hosted workers reject reruns|hosted context requires a manifest|failed final OTLP receipt';
+  const cases = 'real child requests|disjoint concurrent|controller owns native|cancellation during root export|campaign collection retains and audits private archives|native post-child otlp-native.jsonl rejects fifo|credential redaction replaces|missing provider artifacts|hosted workers reject reruns|hosted context requires a manifest|failed final OTLP receipt';
  const behavioral = await exec(process.execPath, ['--test', '--test-reporter=tap', '--test-name-pattern', cases, join(source, 'controller.test.mjs')], {
    cwd: root, env: { ...environment, PAPERCLIP_CONTROLLER_TEST_RUNTIME: join(directory, 'controlled-evals') }, timeout: 80_000, maxBuffer: 1_048_576,
  });
-  assert.match(behavioral.stdout, /# pass 11\b/);
+  assert.match(behavioral.stdout, /# pass 12\b/);
+  const hosted = await exec(process.execPath, ['--test', '--test-reporter=tap', join(source, 'hosted.test.mjs')], {
+    cwd: root, env: { ...environment, PAPERCLIP_CONTROLLER_TEST_RUNTIME: join(directory, 'controlled-evals') }, timeout: 30000, maxBuffer: 1_048_576,
+  });
+  assert.match(hosted.stdout, /# pass 4\b/);


  const cli = await exec(process.execPath, [join(directory, 'controlled-evals/archive.mjs'), 'report-attempts', join(root, 'empty-attempts')], {
@@ -11,6 +11,7 @@ import {
  writeFile,
 } from "node:fs/promises";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
 import { sumAttemptCosts } from "./runner-protocol-eval-metrics.mjs";
 import {
  publicChatView,
@@ -397,7 +398,9 @@ export async function aggregateProtocolEvalCampaign({
  runsOut,
  campaignOut,
  source,
+  controllerArchiveCli = process.env.PAPERCLIP_RUNNER_EVAL_ARCHIVE_CLI,
 }) {
+  const controllerArchive = () => import(controllerArchiveCli ? pathToFileURL(resolve(controllerArchiveCli)).href : "./controlled-evals/archive.mjs");
  const catalog = await loadObject(catalogPath);
  if (catalog.schema !== "paperclip.runner-protocol-eval.catalog/v1") {
    throw new Error("Unsupported protocol eval catalog");
@@ -464,7 +467,7 @@ export async function aggregateProtocolEvalCampaign({
          throw error;
        });
        if (bundleStat) {
-          const { readAttemptControlledEvidence } = await import("./controlled-evals/archive.mjs");
+          const { readAttemptControlledEvidence } = await controllerArchive();
          const bundle = await readAttemptControlledEvidence(join(attemptRoot, entry.name));
          const allocation = bundle.manifest.attempts.find(item => item.attemptId === attemptId);
          const selectedExecutions = new Set(bundle.manifest.attempts.map(item => item.executionId));
@@ -550,7 +553,7 @@ export async function aggregateProtocolEvalCampaign({
  };
  let controlledCosts;
  if (controllerBundles.length) {
-    const { summarizeControlledEvidence } = await import("./controlled-evals/archive.mjs");
+    const { summarizeControlledEvidence } = await controllerArchive();
    controlledCosts = await summarizeControlledEvidence(controllerBundles);
    const allocatedAttempts = new Set(controlledCosts.campaigns.flatMap(campaign => campaign.attempts.map(attempt => attempt.attemptId)));
    if ([...copiedAttemptIds].some(id => !allocatedAttempts.has(id))) {
@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
 import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
@@ -41,7 +42,7 @@ test("direct live eval workflow keeps paid execution behind stable actor authori
  const copilotCredential = "COPILOT_GITHUB_TOKEN: ${{ matrix.credentialName == 'COPILOT_GITHUB_TOKEN' && secrets.COPILOT_GITHUB_TOKEN || '' }}";
  assert.equal(workflow.split(copilotCredential).length - 1, 1);
  const paid = workflow.slice(workflow.indexOf("  eval_shard_0:"), workflow.indexOf("  eval_shard_1:"));
-  assert.ok(paid.includes("name: runner-e2e-paid"));
+  assert.ok(paid.includes("'runner-e2e-private-paid' || 'runner-e2e-paid'"));
  assert.ok(paid.includes(copilotCredential));
  const reauthorizationIndex = paid.indexOf("Reauthorize paid execution before provider access");
  assert.ok(reauthorizationIndex >= 0);
@@ -121,13 +122,13 @@ test("resolves both repositories immutably and bounds total matrix concurrency",
      /repository: paperclipai\/paperclip-evals[\s\S]*?persist-credentials: false/gmu,
    ),
  ];
-  assert.equal(privateCheckouts.length, 3);
+  assert.equal(privateCheckouts.length, 4);
  const privateTokenSteps = [
    ...workflow.matchAll(
      /^      - name: Generate private eval-repository token\n(?<body>(?:^ {8,}.*\n?)*)/gmu,
    ),
  ];
-  assert.equal(privateTokenSteps.length, 4);
+  assert.equal(privateTokenSteps.length, 5);
  for (const tokenStep of privateTokenSteps) {
    assert.match(
      tokenStep.groups.body,
@@ -149,7 +150,7 @@ test("resolves both repositories immutably and bounds total matrix concurrency",
  );
  assert.match(
    workflow,
-    /--runner-cli runner-protocol-build\/extracted\/portable\/dist\/cli\/eval-session\.js/u,
+    /runner_cli=runner-protocol-build\/extracted\/portable\/dist\/cli\/eval-session\.js/u,
  );
  assert.doesNotMatch(workflow, /npm install --prefix/u);
 });
@@ -171,7 +172,7 @@ test("publishes only the separately sanitized Evalbook through trusted OIDC code
  assert.match(report, /runner-protocol-eval-campaign\.mjs sanitize/u);
  assert.match(
    report,
-    /Upload access-controlled canonical Evalbook and raw attempts/u,
+    /Upload legacy canonical Evalbook and raw attempts/u,
  );
  assert.match(report, /Upload publisher-only sanitized Evalbook/u);
  assert.match(
@@ -236,9 +237,8 @@ test("report preparation stays on the trusted lock and install mode", async () =
  assert.match(report, /ref: \$\{\{ github\.sha \}\}/u);
  assert.doesNotMatch(report, /Download resolved target lockfile/u);
  assert.doesNotMatch(report, /Restore resolved target lockfile/u);
-  assert.match(report, /Resolve trusted report lockfile without lifecycle scripts/u);
-  assert.match(report, /pnpm install --ignore-scripts --no-frozen-lockfile --lockfile-only/u);
-  assert.match(report, /pnpm install --frozen-lockfile --ignore-scripts\n/u);
+  assert.doesNotMatch(report, /--no-frozen-lockfile|cache: pnpm/u);
+  assert.match(report, /pnpm install --frozen-lockfile --ignore-scripts --store-dir "\$RUNNER_TEMP\/runner-report-pnpm-store"/u);
 });

 test("trusted catalog, direct eval, and report orchestration stay on workflow revision", async () => {
@@ -291,3 +291,110 @@ test("authentication failures retain cell metadata without leaking malformed sum
    await rm(root, { recursive: true, force: true });
  }
 });
+
+function workflowShell(workflow, name) {
+  const step = workflow.slice(workflow.indexOf(`      - name: ${name}\n`)).split(/\n      - /u)[0];
+  assert.ok(step.startsWith(`      - name: ${name}\n`));
+  const script = step.split('        run: |\n')[1];
+  assert.ok(script);
+  return script.split('\n').map(line => line.slice(10)).join('\n');
+}
+
+test('controlled admission rejects missing policy, automatic retries and job reruns before paid work', async () => {
+  const workflow = await readFile(workflowPath, 'utf8');
+  const script = workflowShell(workflow, 'Validate accounting mode and retry envelope');
+  const root = await mkdtemp(resolve(tmpdir(), 'runner-workflow-admission-'));
+  try {
+    for (const [mode, event, attempt, retries, policy, status] of [
+      ['controlled', 'workflow_dispatch', '1', '0', '', 1],
+      ['controlled', 'workflow_dispatch', '2', '0', JSON.stringify({schema:'paperclip.runner-eval.hosted-policy/v1',controllerLockSha256:'e'.repeat(64)}), 1],
+      ['controlled', 'workflow_dispatch', '1', '1', JSON.stringify({schema:'paperclip.runner-eval.hosted-policy/v1',controllerLockSha256:'e'.repeat(64)}), 1],
+      ['legacy', 'schedule', '1', '1', '', 1],
+      ['controlled', 'workflow_dispatch', '1', '0', JSON.stringify({schema:'paperclip.runner-eval.hosted-policy/v1',controllerLockSha256:'e'.repeat(64)}), 0],
+      ['legacy', 'workflow_dispatch', '1', '1', '', 0],
+    ]) {
+      const result = spawnSync('bash', ['-c', script], { encoding: 'utf8', env: { PATH: process.env.PATH,
+        ACCOUNTING_MODE: mode, EVENT_NAME: event, GITHUB_RUN_ATTEMPT: attempt, RETRIES: retries,
+        CONTROLLER_POLICY_JSON: policy, TARGET_SHA: 'a'.repeat(40), GITHUB_SHA: 'a'.repeat(40), GITHUB_OUTPUT: resolve(root, 'output') } });
+      assert.equal(result.status, status, `${mode}/${event}/${attempt}/${retries}: ${result.stderr}`);
+    }
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+test('controlled evidence uses private storage and cloud credentials stay out of provider execution', async () => {
+  const workflow = await readFile(workflowPath, 'utf8');
+  const paid = workflow.slice(workflow.indexOf('    steps: &direct_eval_steps'), workflow.indexOf('  eval_shard_1:'));
+  const model = paid.slice(paid.indexOf('      - name: Run one immutable direct protocol cell'), paid.indexOf('      - name: Retain controlled cell evidence'));
+  assert.ok(paid.indexOf('Verify current worker admission before provider credentials') < paid.indexOf('Run one immutable direct protocol cell'));
+  assert.ok(paid.indexOf('Provision Codex sandbox') < paid.indexOf('Obtain private archive credentials'));
+  assert.doesNotMatch(model, /AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN/u);
+  assert.match(model, /runner_cli="\$root\/runtime\/controlled-evals\/run.mjs"/u);
+  for (const step of workflow.split(/\n      - /u).filter(step => /uses: actions\/upload-artifact/u.test(step))) {
+    if (/path: (?:cell-output|runner-protocol-merged)\//u.test(step)) assert.match(step, /accounting_mode == 'legacy'/u);
+    assert.doesNotMatch(step, /path: .*runner-protocol-control\//u);
+  }
+  for (const step of workflow.split(/\n      - /u).filter(step => /uses: aws-actions\/configure-aws-credentials/u.test(step) && step.includes('id: private_history_credentials'))) {
+    assert.match(step, /output-env-credentials: false/u);
+    assert.match(step, /disable-retry: true/u);
+  }
+  assert.match(workflow, /upload protocol-control/u);
+  assert.match(workflow, /upload "protocol-cell-\$CELL_ID"/u);
+  assert.match(workflow, /upload protocol-report/u);
+  assert.match(workflow, /--controller-manifest "\$PAPERCLIP_RUNNER_EVAL_CONTROL_MANIFEST"/u);
+});
+
+test('Braintrust-controlled workers do not require an unused direct provider credential', async () => {
+  const workflow = await readFile(workflowPath, 'utf8');
+  const script = workflowShell(workflow, 'Run one immutable direct protocol cell');
+  const credentialCheck = script.slice(script.indexOf('if [ "$ACCOUNTING_MODE"'), script.indexOf('if [ "$PROVIDER"'));
+  assert.ok(credentialCheck.includes('test -n "${!CREDENTIAL_NAME:-}"'));
+  for (const [mode, credential, status] of [['controlled', '', 0], ['legacy', '', 1], ['legacy', 'synthetic-only', 0]]) {
+    const result = spawnSync('bash', ['-euc', credentialCheck], { encoding: 'utf8', env: {
+      ACCOUNTING_MODE: mode, CREDENTIAL_NAME: 'OPENAI_API_KEY', OPENAI_API_KEY: credential,
+    } });
+    assert.equal(result.status, status, result.stderr);
+  }
+});
+
+test('private archive jobs consume verified controller code without resolving dependencies', async () => {
+  const workflow = await readFile(workflowPath, 'utf8');
+  const builder = workflow.slice(workflow.indexOf('  build_controller:'), workflow.indexOf('  prepare_controller:'));
+  const preparer = workflow.slice(workflow.indexOf('  prepare_controller:'), workflow.indexOf('  eval_shard_0:'));
+  assert.doesNotMatch(builder, /id-token: write|environment:|secrets\./u);
+  assert.match(builder, /build-runtime.mjs/u);
+  assert.doesNotMatch(builder, /--no-frozen-lockfile/u);
+  assert.match(builder, /test "\$RESOLVED_LOCK_SHA256" = "\$EXPECTED_LOCK_SHA256"/u);
+  assert.match(builder, /pnpm install --frozen-lockfile --ignore-scripts --store-dir/u);
+  assert.doesNotMatch(preparer, /pnpm install|build-runtime.mjs|cache: pnpm/u);
+  assert.ok(preparer.indexOf('verify-runtime.mjs') < preparer.indexOf('hosted.mjs" prepare'));
+  assert.match(preparer, /needs\.build_controller\.outputs\.runtime_receipt_sha256/u);
+  for (const job of workflow.split(/\n(?=  [A-Za-z0-9_]+:)/u).filter(value => value.includes('id-token: write'))) {
+    assert.doesNotMatch(job, /--no-frozen-lockfile|cache: pnpm|actions\/cache/u);
+    for (const install of job.matchAll(/pnpm install[^\n]*/gu)) {
+      assert.match(install[0], /--frozen-lockfile/u);
+      assert.match(install[0], /--ignore-scripts/u);
+      assert.match(install[0], /--store-dir/u);
+    }
+  }
+});
+
+test('controller dependency lock rejects resolution or byte drift before installation', async () => {
+  const workflow = await readFile(workflowPath, 'utf8');
+  const script = workflowShell(workflow, 'Build portable controller in an unprivileged job');
+  const pin = script.slice(script.indexOf('test "$RESOLVED_LOCK_SHA256"'), script.indexOf('pnpm install'));
+  const root = await mkdtemp(resolve(tmpdir(), 'runner-reviewed-lock-'));
+  const digest = createHash('sha256').update('reviewed dependencies').digest('hex');
+  try {
+    await mkdir(resolve(root, 'runner-controller-lock'));
+    for (const [index, resolved, bytes, status] of [[0, digest, 'reviewed dependencies', 0], [1, 'f'.repeat(64), 'reviewed dependencies', 1], [2, digest, 'changed dependencies', 1]]) {
+      const cwd = resolve(root, `worker-${index}`); await mkdir(cwd);
+      await writeFile(resolve(root, 'runner-controller-lock/pnpm-lock.yaml'), bytes);
+      const result = spawnSync('bash', ['-euc', pin], { cwd, encoding: 'utf8', env: {
+        PATH: process.env.PATH, RUNNER_TEMP: root, EXPECTED_LOCK_SHA256: digest, RESOLVED_LOCK_SHA256: resolved,
+      } });
+      assert.equal(result.status, status, result.stderr);
+      if (status === 0) assert.equal(await readFile(resolve(cwd, 'pnpm-lock.yaml'), 'utf8'), bytes);
+      else await assert.rejects(readFile(resolve(cwd, 'pnpm-lock.yaml')), { code: 'ENOENT' });
+    }
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
@@ -651,7 +651,11 @@ test("Runner eval workflows pin actions and gate paid live execution", () => {
    );
    assert.ok(providerJobs.length > 0, `${name} needs a provider-secret job`);
    for (const block of providerJobs) {
-      assert.match(block, /\n    environment:\n      name: runner-e2e-paid\n/);
+      if (name === "runner-protocol-live-evals.yml") {
+        assert.ok(block.includes("name: ${{ needs.authorize.outputs.accounting_mode == 'controlled' && 'runner-e2e-private-paid' || 'runner-e2e-paid' }}"));
+        assert.ok(block.includes("test '${{ needs.authorize.outputs.target_sha }}' = \"$GITHUB_SHA\""));
+        assert.ok(block.includes('test "$GITHUB_RUN_ATTEMPT" = 1'));
+      } else assert.match(block, /\n    environment:\n      name: runner-e2e-paid\n/);
      assert.match(
        block,
        /\n    steps:(?: &[A-Za-z0-9_-]+)?\n(?:\s*\n)*      - name: Reauthorize[^\n]*\n/,
@@ -160,3 +160,52 @@ it.each([false, true])("retains an unknown transfer without retrying it when rec
  expect(JSON.parse(await readFile(`${receipt}.retention.json`, "utf8")).requests[0].status)
    .toBe(receiptFails ? "failed_or_unknown" : "accepted");
 });
+
+it("keeps protocol controller, report and cell archives disjoint inside the existing private prefix", () => {
+  const kinds = ["evidence", "report", "protocol-control", "protocol-report", "protocol-cell-native-codex--get-task-context"];
+  const keys = kinds.map(kind => privateArtifactKey(kind, "12345"));
+  expect(new Set(keys).size).toBe(kinds.length);
+  expect(keys.every(key => key.startsWith(`${PRIVATE_HISTORY_PREFIX}/campaigns/gha-12345-1/`))).toBe(true);
+  for (const kind of ["protocol-cell-", "protocol-cell-../report", "protocol-cell-a/b", `protocol-cell-${"a".repeat(201)}`]) {
+    expect(() => privateArtifactKey(kind, "12345")).toThrow();
+  }
+});
+
+it("gives independent shared-manifest downloaders separate immutable receipts", async () => {
+  const root = await temporary(), source = path.join(root, "source"), archive = path.join(root, "control.zip");
+  await mkdir(source); await writeFile(path.join(source, "controller-manifest.json"), '{"campaign":"synthetic"}');
+  await archivePrivateEvidence("pack", source, archive);
+  const config = configurationRunner(configurations()), receipts = new Map<string, unknown>(), downloads: string[] = [];
+  const runner = async (args: string[]) => {
+    if (args[1] === "get-object") {
+      downloads.push(args[args.indexOf("--key") + 1]!);
+      await copyFile(archive, args[args.indexOf("--cli-connect-timeout") - 1]!);
+      return { stdout: '{"VersionId":"manifest-version"}' };
+    }
+    if (args[1] === "put-object") {
+      expect(args).toEqual(expect.arrayContaining(["--if-none-match", "*", "--cache-control", "private, no-store"]));
+      const key = args[args.indexOf("--key") + 1]!;
+      if (receipts.has(key)) throw new Error("Immutable receipt already exists");
+      receipts.set(key, JSON.parse(await readFile(args[args.indexOf("--body") + 1]!, "utf8")));
+      return { stdout: '{"VersionId":"receipt-version"}' };
+    }
+    return config(args);
+  };
+  for (const receiptIdentity of ["protocol-live-mini--get-task-context", "protocol-live-acpx-claude--get-task-context", "report"]) {
+    const receipt = path.join(root, `${receiptIdentity}.json`);
+    await retainPrivateTransfer({ operation: "download", kind: "protocol-control", runId: "12345", receiptIdentity,
+      directory: path.join(root, receiptIdentity), bucket: "private-bucket", publisher: new BoundedHistoryPublisher(receipt, runner) },
+      receipt, () => new BoundedHistoryPublisher(`${receipt}.retention.json`, runner));
+    expect(await readFile(path.join(root, receiptIdentity, "controller-manifest.json"), "utf8")).toBe('{"campaign":"synthetic"}');
+  }
+  expect(new Set(downloads)).toEqual(new Set([privateArtifactKey("protocol-control", "12345")]));
+  expect(receipts.size).toBe(3);
+  expect([...receipts.values()]).toEqual(expect.arrayContaining([
+    expect.objectContaining({ receiptIdentity: "report", transfer: expect.objectContaining({ uri: expect.stringContaining("protocol-control.zip") }) }),
+  ]));
+  const receipt = path.join(root, "duplicate.json");
+  await expect(retainPrivateTransfer({ operation: "download", kind: "protocol-control", runId: "12345", receiptIdentity: "report",
+    directory: path.join(root, "duplicate"), bucket: "private-bucket", publisher: new BoundedHistoryPublisher(receipt, runner) },
+    receipt, () => new BoundedHistoryPublisher(`${receipt}.retention.json`, runner))).rejects.toThrow("receipt retention failed");
+  expect(receipts.size).toBe(3);
+});
@@ -13,8 +13,9 @@ export const PRIVATE_HISTORY_PREFIX = "runner-e2e-private/bounded-v1";
 export const PRIVATE_ARCHIVE_BYTES = 264 * 1024 * 1024;

 export function privateArtifactKey(kind: string, runId: string) {
-  if (!["evidence", "report"].includes(kind) || !/^[1-9][0-9]{0,19}$/.test(runId)) {
-    throw new Error("Private history needs an evidence/report kind and numeric workflow run ID");
+  if (!(["evidence", "report", "protocol-control", "protocol-report"].includes(kind)
+      || /^protocol-cell-[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(kind)) || !/^[1-9][0-9]{0,19}$/.test(runId)) {
+    throw new Error("Private history needs a supported artifact kind and numeric workflow run ID");
  }
  return `${PRIVATE_HISTORY_PREFIX}/campaigns/gha-${runId}-1/${kind}.zip`;
 }
@@ -46,13 +47,23 @@ export async function verifyPrivateHistory(publisher: BoundedHistoryPublisher, b

 type TransferOptions = {
  operation: "upload" | "download";
-  kind: "evidence" | "report";
+  kind: string;
  runId: string;
  directory: string;
  bucket: string;
  publisher: BoundedHistoryPublisher;
+  receiptIdentity?: string;
 };

+function privateTransferReceiptKey(options: TransferOptions) {
+  const key = privateArtifactKey(options.kind, options.runId);
+  if (options.receiptIdentity !== undefined && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(options.receiptIdentity)) {
+    throw new Error("Invalid private transfer receipt identity");
+  }
+  const identity = options.receiptIdentity === undefined ? "" : `.${createHash("sha256").update(options.receiptIdentity).digest("hex")}`;
+  return `${key}.${options.operation}${identity}-receipt.json`;
+}
+
 export async function transferPrivateArtifact(options: TransferOptions) {
  privateArtifactKey(options.kind, options.runId);
  await verifyPrivateHistory(options.publisher, options.bucket);
@@ -84,7 +95,7 @@ async function transferVerifiedArtifact(options: TransferOptions) {
 }

 export async function retainPrivateTransfer(options: TransferOptions, receipt: string, receiptPublisher?: () => BoundedHistoryPublisher) {
-  const key = privateArtifactKey(options.kind, options.runId);
+  const receiptKey = privateTransferReceiptKey(options);
  await verifyPrivateHistory(options.publisher, options.bucket);
  let result: Awaited<ReturnType<typeof transferVerifiedArtifact>> | undefined;
  let failure: unknown;
@@ -96,12 +107,13 @@ export async function retainPrivateTransfer(options: TransferOptions, receipt: s
  if (receiptPublisher) {
    await options.publisher.save();
    const snapshot = JSON.stringify({ ...JSON.parse(await readFile(receipt, "utf8")),
+      ...(options.receiptIdentity === undefined ? {} : { receiptIdentity: options.receiptIdentity }),
      transfer: result ? { status: "complete", ...result } : { status: "failed_or_unknown" },
      receiptUpload: { status: "pending_at_snapshot", maxBytes: 1024 * 1024 } });
    if (Buffer.byteLength(snapshot) > 1024 * 1024) throw new Error("Private transfer receipt exceeds allowance");
    await writeFile(`${receipt}.transfer.json`, snapshot, { mode: 0o600, flag: "wx" });
    try {
-      await receiptPublisher().upload(options.bucket, `${key}.${options.operation}-receipt.json`, `${receipt}.transfer.json`, "application/json", "private, no-store", true);
+      await receiptPublisher().upload(options.bucket, receiptKey, `${receipt}.transfer.json`, "application/json", "private, no-store", true);
    } catch (retentionError) {
      throw new AggregateError(failure ? [failure, retentionError] : [retentionError], "Private transfer receipt retention failed; local receipts remain authoritative");
    }
@@ -111,16 +123,21 @@ export async function retainPrivateTransfer(options: TransferOptions, receipt: s
 }

 async function main() {
-  const [operation, kind, runId, directory] = process.argv.slice(2);
+  const [operation, kind, runId, directory, receiptIdentity] = process.argv.slice(2);
  if (!["verify", "upload", "download"].includes(operation ?? "") || !kind || !runId || !directory) {
-    throw new Error("Usage: private-history.ts verify|upload|download evidence|report RUN_ID DIRECTORY");
+    throw new Error("Usage: private-history.ts verify|upload|download KIND RUN_ID DIRECTORY [RECEIPT_ID]");
  }
  privateArtifactKey(kind, runId);
+  if (receiptIdentity !== undefined && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(receiptIdentity)
+      || kind === "protocol-control" && operation === "download" && !receiptIdentity || process.argv.length > 7) {
+    throw new Error("Shared protocol downloads require a bounded unique receipt identity");
+  }
  if (process.env.GITHUB_ACTIONS === "true" && (process.env.GITHUB_RUN_ATTEMPT !== "1" || process.env.GITHUB_RUN_ID !== runId)) {
    throw new Error("Private bounded history accepts only the initial attempt of this workflow run");
  }
  const bucket = process.env.RUNNER_E2E_PRIVATE_HISTORY_S3_BUCKET ?? "";
-  const receipt = path.resolve(`private-history-${operation}-${kind}-${runId}.json`);
+  const label = kind.startsWith("protocol-") ? createHash("sha256").update(`${kind}:${receiptIdentity ?? ""}`).digest("hex") : kind;
+  const receipt = path.resolve(`private-history-${operation}-${label}-${runId}.json`);
  await (await open(receipt, "wx", 0o600)).close();
  const publisher = new BoundedHistoryPublisher(receipt);
  if (operation === "verify") {
@@ -130,7 +147,7 @@ async function main() {
  }
  const receiptPublisher = operation === "upload" || process.env.GITHUB_ACTIONS === "true"
    ? () => new BoundedHistoryPublisher(`${receipt}.retention.json`) : undefined;
-  const result = await retainPrivateTransfer({ operation: operation as "upload" | "download", kind: kind as "evidence" | "report", runId, directory, bucket, publisher }, receipt, receiptPublisher);
+  const result = await retainPrivateTransfer({ operation: operation as "upload" | "download", kind, runId, directory, bucket, publisher, receiptIdentity }, receipt, receiptPublisher);
  console.log(JSON.stringify(process.env.GITHUB_ACTIONS === "true" ? { version: 1, privateTransferCompleted: true } : result));
 }

@@ -31,7 +31,8 @@ describe("public repository paid workflow security", () => {
      expect(jobStart, filename).toBeGreaterThanOrEqual(0);
      expect(jobEnd, filename).toBeGreaterThan(jobStart);
      const paidJob = workflow.slice(jobStart, jobEnd);
-      expect(paidJob, filename).toContain("name: runner-e2e-paid");
+      expect(paidJob, filename).toContain(filename === "runner-protocol-live-evals.yml"
+        ? "'runner-e2e-private-paid' || 'runner-e2e-paid'" : "name: runner-e2e-paid");
      expect(paidJob, filename).toContain(credentialStep);
      const reauthorizationIndex = paidJob.indexOf("Reauthorize paid execution before provider access");
      expect(reauthorizationIndex, filename).toBeGreaterThanOrEqual(0);
@@ -212,7 +213,8 @@ describe("public repository paid workflow security", () => {
      expect(contents).toContain("github.triggering_actor");
      expect(contents).toContain("refs/heads/$DEFAULT_BRANCH");
      expect(contents).toContain("needs: authorize");
-      expect(contents).toContain("name: runner-e2e-paid");
+      expect(contents).toContain(name === "runner-protocol-live-evals.yml"
+        ? "'runner-e2e-private-paid' || 'runner-e2e-paid'" : "name: runner-e2e-paid");
      expect(contents).not.toMatch(
        /^\s*(?:pull_request|pull_request_target|push|workflow_call|workflow_run):/m,
      );
@@ -872,13 +874,17 @@ describe("public repository paid workflow security", () => {
    }
    expect(recurring).toContain("needs.authorize.outputs.target_sha == github.sha");
    for (const filename of await readdir(workflows)) {
-      if (!/\.ya?ml$/u.test(filename) || filename === "runner-full-stack-e2e.yml") continue;
+      if (!/\.ya?ml$/u.test(filename) || ["runner-full-stack-e2e.yml", "runner-protocol-live-evals.yml"].includes(filename)) continue;
      const other = await readFile(path.join(workflows, filename), "utf8");
      for (const environment of environments) expect(other, filename).not.toContain(environment);
    }
    const protocol = await readFile(path.join(workflows, "runner-protocol-live-evals.yml"), "utf8");
-    expect(protocol).toContain("name: runner-e2e-paid");
-    expect(protocol).toContain("needs.authorize.outputs.target_sha");
+    expect(protocol).toContain("'runner-e2e-private-paid' || 'runner-e2e-paid'");
+    const admission = protocol.split("      - name: Validate accounting mode and retry envelope")[1]!.split("      - name:")[0]!;
+    expect(admission).toContain('test "$TARGET_SHA" = "$GITHUB_SHA"');
+    const worker = protocol.split("    steps: &direct_eval_steps")[1]!.split("      - uses:")[0]!;
+    expect(worker).toContain("test '${{ needs.authorize.outputs.target_sha }}' = \"$GITHUB_SHA\"");
+    expect(worker).toContain('test "$GITHUB_RUN_ATTEMPT" = 1');
  });

  it("uses environment-scoped OIDC for a no-delete history publisher", async () => {
@@ -942,3 +948,23 @@ describe("public repository paid workflow security", () => {
    }
  });
 });
+
+it("keeps dependency resolution and shared caches out of Runner protocol archive jobs", async () => {
+  const workflow = await readFile(path.join(repositoryRoot, ".github/workflows/runner-protocol-live-evals.yml"), "utf8");
+  const jobs = workflow.split(/\n(?=  [A-Za-z0-9_]+:)/u);
+  const privileged = jobs.filter(job => job.includes("id-token: write"));
+  expect(privileged.length).toBeGreaterThanOrEqual(4);
+  for (const job of privileged) {
+    expect(job).not.toMatch(/--no-frozen-lockfile|cache:\s*(?:pnpm|npm|yarn)|actions\/cache/u);
+    for (const install of job.matchAll(/pnpm install[^\n]*/gu)) {
+      expect(install[0]).toContain("--frozen-lockfile");
+      expect(install[0]).toContain("--ignore-scripts");
+      expect(install[0]).toContain("--store-dir");
+    }
+  }
+  const builder = jobs.find(job => job.startsWith("  build_controller:"))!;
+  expect(builder).not.toMatch(/id-token: write|environment:|secrets\./u);
+  const preparer = jobs.find(job => job.startsWith("  prepare_controller:"))!;
+  expect(preparer).not.toMatch(/pnpm install/u);
+  expect(preparer.indexOf("verify-runtime.mjs")).toBeLessThan(preparer.indexOf('hosted.mjs" prepare'));
+});