ci(hermes): retain rejected Mac closure manifest for byte comparison

Preserve file-level provisioning evidence before cleanup without weakening reviewed closure admission. Record the original cloud failure and the passing current-source native fixtures on macOS 26.5.2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/runner-hermes-native.yml

@@ -117,8 +117,27 @@ jobs:
             trap 'rm -rf "$hermes_build_root"' EXIT
             python3 -m venv "$hermes_build_root"
             "$hermes_build_root/bin/pip" install --disable-pip-version-check --no-input uv==0.12.17
-            PATH="$hermes_build_root/bin:$PATH" node packages/paperclip-runner/scripts/provision-hermes.mjs \
-              "$GITHUB_WORKSPACE/packages/paperclip-runner/provider-assets/hermes/darwin-arm64"
+            PATH="$hermes_build_root/bin:$PATH" node --input-type=module <<'NODE'
+          import { mkdir, writeFile } from 'node:fs/promises';
+          import { join, resolve } from 'node:path';
+          import { materializePinnedHermesDistribution } from './packages/paperclip-runner/scripts/provision-hermes.mjs';
+          const root = resolve('packages/paperclip-runner');
+          const evidence = join(process.env.RUNNER_TEMP, 'hermes-native-evidence');
+          await mkdir(evidence, { recursive: true, mode: 0o700 });
+          const diagnosticMaterializer = join(process.env.RUNNER_TEMP, 'hermes-materializer-with-manifest.py');
+          // Retain only the file manifest before rejected setup removes its
+          // temporary distribution. The original materializer and pin admission
+          // still run unchanged; this does not publish an unverified runtime.
+          await writeFile(diagnosticMaterializer,
+            'import runpy, shutil, sys\nfrom pathlib import Path\n' +
+            'runpy.run_path(' + JSON.stringify(join(root, 'scripts/materialize-hermes.py')) + ", run_name='__main__')\n" +
+            "shutil.copyfile(Path(sys.argv[2]) / 'manifest.json', " + JSON.stringify(join(evidence, 'candidate-manifest.json')) + ')\n',
+            { flag: 'wx', mode: 0o600 });
+          console.log(JSON.stringify(await materializePinnedHermesDistribution({
+            destination: join(root, 'provider-assets/hermes/darwin-arm64'),
+            provider: join(root, 'src/providers/hermes'), materializer: diagnosticMaterializer,
+          })));
+          NODE
           fi
 
       - name: Run native fixtures against a deterministic loopback model

doc/plans/2026-10-06-hermes-native-runner.md

@@ -1151,3 +1151,24 @@ prerequisite for current-source local browser qualification, not a substitute
 for the live provider, published installation, or actual Daytona release gates.
 Local workflow lint and all 44 focused source/security tests pass. Cloud execution
 of the new Mac job remains required; this configuration is not a passing result.
+
+The first `f129601d4` cloud Mac job compiles and stages the release daemon, then
+fails cold Python provisioning before credentials or fixtures. Its candidate
+closure is `253eaee233bd6fa1f5c5209084213e25a2da81b6cff5163f09eedcb15b1a93e2`
+with 19,249 files and 445,500,822 bytes, differing from the reviewed Mac pin.
+The original failure remains retained. General CI has 54 successful checks and
+two skips; the sole failing check is this new Mac qualification job. Fresh review
+is 5/5 with no open threads.
+
+The downloaded daemon passes GitHub archive-digest, binary-checksum, architecture,
+source-tree and signature admission. Its hash is
+`fef7167af720db91537bbc066e3b8129a15d59bb6425dd95efa2b8a1a00b4980`.
+On macOS 26.5.2 it passes all six native fixtures in 131.116 seconds, including
+38 pinned Python checks against the fully verified existing Mac closure. This
+is current-source transport proof with the cloud-built daemon and no local Rust
+compilation. It does not make the failed cold installation or live matrix pass.
+
+Cloud diagnostics now retain the candidate file manifest before rejected setup
+removes its temporary distribution. The original materializer and closure pin
+checks remain unchanged. Exact differing files must be identified and explained
+before changing any reviewed runtime pin.

tests/runner-e2e/workflow-security.test.ts

@@ -70,6 +70,12 @@ describe("public repository paid workflow security", () => {
     expect(provision).toContain('test "$(uname -m)" = arm64');
     expect(provision).toContain("uv==0.12.17");
     expect(provision).toContain("provider-assets/hermes/darwin-arm64");
+    expect(provision).toContain("materializePinnedHermesDistribution");
+    expect(provision).toContain("runpy.run_path(");
+    expect(provision).toContain("scripts/materialize-hermes.py");
+    expect(provision).toContain("shutil.copyfile(Path(sys.argv[2]) / 'manifest.json'");
+    expect(provision).toContain("candidate-manifest.json");
+    expect(provision).not.toContain("HERMES_CLOSURES[");
     const fixtures = workflow.slice(workflow.indexOf("      - name: Run native fixtures"), workflow.indexOf("      - name: Record source"));
     expect(fixtures).toContain('PAPERCLIP_RUNNER_BINARY="$PWD/dist/bin/paperclip-runnerd"');
     expect(fixtures).toContain('TMPDIR="$RUNNER_TEMP"');