Integrate Copilot production candidate with current master

.github/workflows/docker-runner-check.yml

@@ -7,20 +7,24 @@ on:
         description: "Branch in this repository to build; resolved to one immutable commit before checkout"
         type: string
         required: false
+      build_eval_image:
+        description: "Build an immutable qualification image as an inspectable OCI artifact without publication"
+        type: boolean
+        default: false
       publish_eval_image:
-        description: "Publish an immutable Daytona qualification image on the EC2 fleet (no provider credentials)"
+        description: "Publish an immutable Daytona qualification image on hosted Linux (no provider credentials)"
         type: boolean
         default: false
       verify_source:
-        description: "Run broad source checks on EC2"
+        description: "Run broad source checks on hosted Linux"
         type: boolean
         default: false
       verify_public_install:
-        description: "Build and verify clean public npm installation on EC2 (no provider credentials)"
+        description: "Build and verify clean public npm installation on hosted Linux (no provider credentials)"
         type: boolean
         default: false
       build_eval_viewer:
-        description: "Build the canonical eval report viewer on EC2"
+        description: "Build the canonical eval report viewer on hosted Linux"
         type: boolean
         default: false
   pull_request:
@@ -98,9 +102,10 @@ jobs:
           echo "target_sha=$target_sha" >> "$GITHUB_OUTPUT"
 
   manual_image:
-    name: Build and verify on EC2
+    name: Build and verify on Linux
     needs: authorize_manual
-    runs-on: runs-on/fleet=paperclip-public-pr-x64/env=public-ci
+    # Keep maintainer authorization below; use a native hosted Linux builder.
+    runs-on: ubuntu-latest
     timeout-minutes: 90
     permissions:
       contents: read
@@ -136,7 +141,11 @@ jobs:
           package-manager-cache: false
       - name: Resolve source dependencies without lifecycle scripts
         run: |
-          pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
+          if [[ "${{ inputs.build_eval_image || inputs.publish_eval_image }}" == true ]]; then
+            pnpm install --frozen-lockfile --ignore-scripts
+          else
+            pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
+          fi
           mkdir -p remote-verification
           sha256sum pnpm-lock.yaml > remote-verification/lock.sha256
           git rev-parse HEAD > remote-verification/source.txt
@@ -147,31 +156,49 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build checksum-verified Grok provider image
-        if: inputs.publish_eval_image
+      - name: Prepare hosted image build capacity
+        if: inputs.build_eval_image || inputs.publish_eval_image
+        run: |
+          # These preinstalled SDKs are absent from the image build context.
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          df -h .
+          test "$(df --output=avail -BG . | tail -1 | tr -dc '0-9')" -ge 35
+      - name: Build checksum-verified qualification image
+        if: inputs.build_eval_image || inputs.publish_eval_image
         env:
           SOURCE_SHA: ${{ needs.authorize_manual.outputs.target_sha }}
         run: |
           set -euo pipefail
           image="ghcr.io/paperclipai/paperclip-daytona-runner:qualification-${SOURCE_SHA}-${GITHUB_RUN_ID}"
           lock_sha="$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)"
+          content_id="$(node cli/node_modules/tsx/dist/cli.mjs tests/runner-e2e/daytona-image-content.ts)"
+          [[ "$content_id" =~ ^[0-9a-f]{64}$ ]]
+          printf '%s\n' "$content_id" > remote-verification/content-id.txt
+          output_args=(--output type=oci,dest=remote-verification/image.oci.tar)
+          if [[ "${{ inputs.publish_eval_image }}" == true ]]; then
+            output_args=(--push)
+          fi
           docker buildx build --platform linux/amd64 \
             --file docker/daytona-runner/Dockerfile \
             --build-arg "PAPERCLIP_RUNNER_SOURCE_REVISION=$SOURCE_SHA" \
-            --build-arg "PAPERCLIP_RUNNER_CONTENT_ID=qualification-$SOURCE_SHA" \
+            --build-arg "PAPERCLIP_RUNNER_CONTENT_ID=$content_id" \
             --build-arg "PAPERCLIP_RUNNER_LOCK_SHA256=$lock_sha" \
             --cache-from type=registry,ref=ghcr.io/paperclipai/paperclip-daytona-runner:e2e-buildcache-amd64 \
-            --tag "$image" --metadata-file remote-verification/image.json --push .
+            --tag "$image" --metadata-file remote-verification/image.json "${output_args[@]}" .
           digest="$(jq -r '."containerimage.digest"' remote-verification/image.json)"
           [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
           immutable="${image%:*}@$digest"
-          docker logout ghcr.io
-          docker buildx imagetools inspect "$immutable" >/dev/null
+          if [[ "${{ inputs.publish_eval_image }}" == true ]]; then
+            docker logout ghcr.io
+            docker buildx imagetools inspect "$immutable" >/dev/null
+          else
+            sha256sum remote-verification/image.oci.tar > remote-verification/image-archive.sha256
+          fi
           echo "$immutable" > remote-verification/image.txt
-          echo "Image: $immutable" >> "$GITHUB_STEP_SUMMARY"
-      - name: Verify repository on EC2
+          echo "Image: $immutable; published: ${{ inputs.publish_eval_image }}" >> "$GITHUB_STEP_SUMMARY"
+      - name: Verify repository on hosted Linux
         if: inputs.verify_source
-        # Leave time for artifact retention before the fleet's one-hour lifetime.
+        # Leave time for artifact retention within the job deadline.
         timeout-minutes: 38
         run: |
           set -uo pipefail
@@ -193,9 +220,11 @@ jobs:
         run: |
           set -euo pipefail
           test -f scripts/verify-grok-npm-install.mjs || { echo "Selected source does not provide the public-install verifier"; exit 1; }
-          pnpm install --frozen-lockfile --ignore-scripts > remote-verification/npm-setup.log 2>&1
+          pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile > remote-verification/npm-setup.log 2>&1
+          pnpm install --frozen-lockfile --ignore-scripts >> remote-verification/npm-setup.log 2>&1
           pnpm build > remote-verification/npm-build.log 2>&1
-          node scripts/verify-grok-npm-install.mjs > remote-verification/public-npm-install.log 2>&1
+          PAPERCLIP_RUNNER_QUALIFICATION_PACKAGES_DIR="$PWD/remote-verification/qualification-packages" \
+            node scripts/verify-grok-npm-install.mjs > remote-verification/public-npm-install.log 2>&1
       - name: Build canonical eval report viewer
         if: always() && (inputs.verify_source || inputs.build_eval_viewer)
         run: |
@@ -210,4 +239,6 @@ jobs:
         with:
           name: grok-remote-verification-${{ github.run_id }}
           path: remote-verification/
+          compression-level: 0
+          retention-days: 1
           retention-days: 7

.github/workflows/pr-trusted.yml

@@ -384,7 +384,7 @@ jobs:
           echo "arch=$(node -p 'process.arch')" >> "$GITHUB_OUTPUT"
 
       - name: Restore pnpm store (read only)
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm_store.outputs.path }}
           key: node-cache-${{ runner.os }}-${{ steps.pnpm_store.outputs.arch }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -609,7 +609,7 @@ jobs:
           echo "arch=$(node -p 'process.arch')" >> "$GITHUB_OUTPUT"
 
       - name: Restore pnpm store (read only)
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm_store.outputs.path }}
           key: node-cache-${{ runner.os }}-${{ steps.pnpm_store.outputs.arch }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -767,7 +767,7 @@ jobs:
           echo "arch=$(node -p 'process.arch')" >> "$GITHUB_OUTPUT"
 
       - name: Restore pnpm store (read only)
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm_store.outputs.path }}
           key: node-cache-${{ runner.os }}-${{ steps.pnpm_store.outputs.arch }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -905,7 +905,7 @@ jobs:
           echo "arch=$(node -p 'process.arch')" >> "$GITHUB_OUTPUT"
 
       - name: Restore pnpm store (read only)
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm_store.outputs.path }}
           key: node-cache-${{ runner.os }}-${{ steps.pnpm_store.outputs.arch }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -1078,7 +1078,7 @@ jobs:
           echo "arch=$(node -p 'process.arch')" >> "$GITHUB_OUTPUT"
 
       - name: Restore pnpm store (read only)
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm_store.outputs.path }}
           key: node-cache-${{ runner.os }}-${{ steps.pnpm_store.outputs.arch }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -1137,7 +1137,7 @@ jobs:
           echo "arch=$(node -p 'process.arch')" >> "$GITHUB_OUTPUT"
 
       - name: Restore pnpm store (read only)
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm_store.outputs.path }}
           key: node-cache-${{ runner.os }}-${{ steps.pnpm_store.outputs.arch }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -1327,7 +1327,7 @@ jobs:
           echo "arch=$(node -p 'process.arch')" >> "$GITHUB_OUTPUT"
 
       - name: Restore pnpm store (read only)
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm_store.outputs.path }}
           key: node-cache-${{ runner.os }}-${{ steps.pnpm_store.outputs.arch }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}

.github/workflows/release-verify.yml

@@ -107,45 +107,46 @@ jobs:
       matrix:
         include:
           # Split the long chat file by collected test locations, and balance
-          # the remaining server files across ten runners. Normal PR/local
-          # invocations retain their complete general-server group.
-          - group: general-server-without-chat
+          # the remaining server files across ten runners. Rust-backed server
+          # suites run in the cached Runner lane below. Local invocations retain
+          # their complete general-server group.
+          - group: general-server-without-chat-or-native-runner
             group_label: server (1/10)
             shard_index: 0
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (2/10)
             shard_index: 1
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (3/10)
             shard_index: 2
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (4/10)
             shard_index: 3
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (5/10)
             shard_index: 4
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (6/10)
             shard_index: 5
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (7/10)
             shard_index: 6
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (8/10)
             shard_index: 7
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (9/10)
             shard_index: 8
             shard_count: 10
-          - group: general-server-without-chat
+          - group: general-server-without-chat-or-native-runner
             group_label: server (10/10)
             shard_index: 9
             shard_count: 10
@@ -297,6 +298,7 @@ jobs:
             checks: check:eval-kernel check:protocol
           - lane: rust
             checks: check:runner check:api-authority
+          - lane: server-integration
 
     steps:
       - name: Checkout repository
@@ -373,14 +375,28 @@ jobs:
           # dependencies; never restore installed executables from cargo/bin.
           cache-workspace-crates: false
           cache-bin: false
-          # Both lanes restore the existing dependency cache. Only the Rust
+          # All lanes restore the existing dependency cache. Only the Rust
           # lane saves it, after warming both release and debug dependencies.
           save-if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
 
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Build native server test binaries
+        if: ${{ matrix.lane == 'server-integration' }}
+        timeout-minutes: 10
+        working-directory: packages/paperclip-runner
+        run: |
+          set -euo pipefail
+          pnpm build:rust
+          cargo build --release --manifest-path runner/Cargo.toml --locked -p paperclip-runner-core --bin paperclip-runnerd --bin fake-codex-app-server
+
+      - name: Run native server integration suites
+        if: ${{ matrix.lane == 'server-integration' }}
+        run: pnpm test:run:general -- --group general-server-native-runner
+
       - name: Verify Paperclip Runner
+        if: ${{ matrix.lane != 'server-integration' }}
         env:
           RUNNER_CHECKS: ${{ matrix.checks }}
         run: |