Merge latest Codex qualification and master fixes

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* codex/claude-runner-default: (25 commits)
  fix: pin ARM qualification helper to workflow source
  perf(ci): cache the Runner's release crate artifacts keyed by their inputs (#15932)
  perf(build): reuse a current Runner build in the server's prepare:runner-vendor step (#15926)
  fix(test): make the vitest home teardown remove read-only runtime-context bundles (#15931)
  fix(test): stop the Sentry timeout assertion matching a random event id (#15929)
  test: qualify Linux ARM with stock sandbox prerequisites
  docs(release): align 2026.1006.0-beta.0 stable notes header with v2026.1012.0 (#16000)
  fix: use Hermes adapter API URL env in prompt (#9425)
  fix(docker): skip the full-tree ownership walk on routine boots (#15992)
  refactor(chat): isolate Telegram, Slack, GitHub and Discord workflows (#15976)
  Preserve repository dependencies when importing GitHub skills (#15731)
  refactor(heartbeat): extract instruction working-copy lifecycle (#15984)
  test: retire redundant suites and consolidate owner coverage (#15978)
  refactor(heartbeat): extract runtime service coordination (#15980)
  refactor(heartbeat): extract execution configuration (#15973)
  refactor(heartbeat): extract run output recording (#15969)
  refactor(chat): extract failed-run retry coordination (#15845)
  refactor(chat): extract publication replacement decisions (#15844)
  refactor(chat): extract identity linking (#15836)
  refactor(heartbeat): extract session preparation (#15966)
  ...

# Conflicts:
#	packages/paperclip-runner/package.json

.github/workflows/pr-trusted.yml

@@ -475,6 +475,42 @@ jobs:
           # Restore only. Never let a pull request evict master's entry.
           save-if: false
 
+      # The Runner's own crate is the one thing the entry above leaves out:
+      # rust-cache drops workspace crates when it saves, and a fresh checkout
+      # would invalidate cargo's mtime fingerprints for them anyway. So this
+      # job compiled paperclip-runner-core in release mode on every run,
+      # 28-49s (runs 38169436532 to 38183149920, 2026-10-11), while 221 of
+      # the 239 master commits of the preceding week left its inputs alone.
+      # The master Rust lane in release-verify.yml saves that crate's release
+      # artifacts (about 70 MB) under a key made from the compiler, the
+      # checkout root and a hash of every input the build reads. A pull
+      # request whose merge tree carries byte-identical inputs restores them
+      # and marks them newer than the checkout, so cargo keeps them; any
+      # other pull request misses and compiles exactly as before. Exact key
+      # only: a prefix match would hand cargo another revision's output. The
+      # path list and the key live in scripts/runner-release-crate-cache.mjs
+      # and must match the writer's; a guard test holds them together.
+      - name: Compute the Runner release crate cache key
+        id: runner_release_crate_key
+        run: echo "scope=$(node scripts/runner-release-crate-cache.mjs scope)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore the Runner release crate (read only)
+        id: runner_release_crate
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            packages/paperclip-runner/runner/target/release/.fingerprint/paperclip-runner-core-*
+            packages/paperclip-runner/runner/target/release/deps/libpaperclip_runner_core-*
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runner_core-*.d
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runnerd-*
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd.d
+          key: runner-release-crate-v1-${{ steps.runner_release_crate_key.outputs.scope }}-${{ hashFiles('packages/paperclip-runner/rust-toolchain.toml', 'packages/paperclip-runner/runner/Cargo.toml', 'packages/paperclip-runner/runner/Cargo.lock', 'packages/paperclip-runner/runner/crates/**', 'packages/paperclip-runner/protocol/**', 'packages/paperclip-runner/test-fixtures/**', 'packages/paperclip-runner/test/fixtures/**', 'tests/runner-e2e/fixtures/**') }}
+
+      - name: Mark the restored Runner release crate current
+        if: ${{ steps.runner_release_crate.outputs.cache-hit == 'true' }}
+        run: node scripts/runner-release-crate-cache.mjs mark-current
+
       - name: Typecheck workspaces whose build scripts skip TypeScript
         run: pnpm run typecheck:build-gaps
 
@@ -749,10 +785,12 @@ jobs:
             command: check:static
           - lane_label: rust
             command: check:runner
+            release_crate: true
           - lane_label: vitest 1/2
             command: test:typescript:vitest --shard=1/2
           - lane_label: vitest 2/2
             command: test:typescript:vitest --shard=2/2
+            release_crate: true
 
     steps:
       - name: Checkout repository
@@ -878,6 +916,49 @@ jobs:
           # Restore only. Never let a pull request evict master's entry.
           save-if: false
 
+      # The Runner's own crate is the one thing the entry above leaves out:
+      # rust-cache drops workspace crates when it saves, and a fresh checkout
+      # would invalidate cargo's mtime fingerprints for them anyway. So this
+      # job compiled paperclip-runner-core in release mode on every run,
+      # 28-49s (runs 38169436532 to 38183149920, 2026-10-11), while 221 of
+      # the 239 master commits of the preceding week left its inputs alone.
+      # The master Rust lane in release-verify.yml saves that crate's release
+      # artifacts (about 70 MB) under a key made from the compiler, the
+      # checkout root and a hash of every input the build reads. A pull
+      # request whose merge tree carries byte-identical inputs restores them
+      # and marks them newer than the checkout, so cargo keeps them; any
+      # other pull request misses and compiles exactly as before. Exact key
+      # only: a prefix match would hand cargo another revision's output. The
+      # path list and the key live in scripts/runner-release-crate-cache.mjs
+      # and must match the writer's; a guard test holds them together.
+      #
+      # Only the lanes that build the release crate restore it: the Rust
+      # lane's release tests link the lib, and the final vitest shard hosts
+      # the server's native-runner suite, which builds the binary in its
+      # beforeAll. The static and first vitest lanes run no cargo at all.
+      - name: Compute the Runner release crate cache key
+        id: runner_release_crate_key
+        if: ${{ matrix.release_crate == true }}
+        run: echo "scope=$(node scripts/runner-release-crate-cache.mjs scope)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore the Runner release crate (read only)
+        id: runner_release_crate
+        if: ${{ matrix.release_crate == true }}
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            packages/paperclip-runner/runner/target/release/.fingerprint/paperclip-runner-core-*
+            packages/paperclip-runner/runner/target/release/deps/libpaperclip_runner_core-*
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runner_core-*.d
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runnerd-*
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd.d
+          key: runner-release-crate-v1-${{ steps.runner_release_crate_key.outputs.scope }}-${{ hashFiles('packages/paperclip-runner/rust-toolchain.toml', 'packages/paperclip-runner/runner/Cargo.toml', 'packages/paperclip-runner/runner/Cargo.lock', 'packages/paperclip-runner/runner/crates/**', 'packages/paperclip-runner/protocol/**', 'packages/paperclip-runner/test-fixtures/**', 'packages/paperclip-runner/test/fixtures/**', 'tests/runner-e2e/fixtures/**') }}
+
+      - name: Mark the restored Runner release crate current
+        if: ${{ steps.runner_release_crate.outputs.cache-hit == 'true' }}
+        run: node scripts/runner-release-crate-cache.mjs mark-current
+
       - name: Verify Paperclip Runner
         # pnpm appends trailing args to the end of the script's shell chain,
         # so the vitest lanes' --shard lands on `vitest run`. Do not add a
@@ -1013,6 +1094,42 @@ jobs:
           # Restore only. Never let a pull request evict master's entry.
           save-if: false
 
+      # The Runner's own crate is the one thing the entry above leaves out:
+      # rust-cache drops workspace crates when it saves, and a fresh checkout
+      # would invalidate cargo's mtime fingerprints for them anyway. So this
+      # job compiled paperclip-runner-core in release mode on every run,
+      # 28-49s (runs 38169436532 to 38183149920, 2026-10-11), while 221 of
+      # the 239 master commits of the preceding week left its inputs alone.
+      # The master Rust lane in release-verify.yml saves that crate's release
+      # artifacts (about 70 MB) under a key made from the compiler, the
+      # checkout root and a hash of every input the build reads. A pull
+      # request whose merge tree carries byte-identical inputs restores them
+      # and marks them newer than the checkout, so cargo keeps them; any
+      # other pull request misses and compiles exactly as before. Exact key
+      # only: a prefix match would hand cargo another revision's output. The
+      # path list and the key live in scripts/runner-release-crate-cache.mjs
+      # and must match the writer's; a guard test holds them together.
+      - name: Compute the Runner release crate cache key
+        id: runner_release_crate_key
+        run: echo "scope=$(node scripts/runner-release-crate-cache.mjs scope)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore the Runner release crate (read only)
+        id: runner_release_crate
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            packages/paperclip-runner/runner/target/release/.fingerprint/paperclip-runner-core-*
+            packages/paperclip-runner/runner/target/release/deps/libpaperclip_runner_core-*
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runner_core-*.d
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runnerd-*
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd.d
+          key: runner-release-crate-v1-${{ steps.runner_release_crate_key.outputs.scope }}-${{ hashFiles('packages/paperclip-runner/rust-toolchain.toml', 'packages/paperclip-runner/runner/Cargo.toml', 'packages/paperclip-runner/runner/Cargo.lock', 'packages/paperclip-runner/runner/crates/**', 'packages/paperclip-runner/protocol/**', 'packages/paperclip-runner/test-fixtures/**', 'packages/paperclip-runner/test/fixtures/**', 'tests/runner-e2e/fixtures/**') }}
+
+      - name: Mark the restored Runner release crate current
+        if: ${{ steps.runner_release_crate.outputs.cache-hit == 'true' }}
+        run: node scripts/runner-release-crate-cache.mjs mark-current
+
       - name: Build Runner Evalbook viewer
         run: pnpm --filter @paperclipai/paperclip-runner build:issue-thread
 
@@ -1259,6 +1376,42 @@ jobs:
           # Restore only. Never let a pull request evict master's entry.
           save-if: false
 
+      # The Runner's own crate is the one thing the entry above leaves out:
+      # rust-cache drops workspace crates when it saves, and a fresh checkout
+      # would invalidate cargo's mtime fingerprints for them anyway. So this
+      # job compiled paperclip-runner-core in release mode on every run,
+      # 28-49s (runs 38169436532 to 38183149920, 2026-10-11), while 221 of
+      # the 239 master commits of the preceding week left its inputs alone.
+      # The master Rust lane in release-verify.yml saves that crate's release
+      # artifacts (about 70 MB) under a key made from the compiler, the
+      # checkout root and a hash of every input the build reads. A pull
+      # request whose merge tree carries byte-identical inputs restores them
+      # and marks them newer than the checkout, so cargo keeps them; any
+      # other pull request misses and compiles exactly as before. Exact key
+      # only: a prefix match would hand cargo another revision's output. The
+      # path list and the key live in scripts/runner-release-crate-cache.mjs
+      # and must match the writer's; a guard test holds them together.
+      - name: Compute the Runner release crate cache key
+        id: runner_release_crate_key
+        run: echo "scope=$(node scripts/runner-release-crate-cache.mjs scope)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore the Runner release crate (read only)
+        id: runner_release_crate
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            packages/paperclip-runner/runner/target/release/.fingerprint/paperclip-runner-core-*
+            packages/paperclip-runner/runner/target/release/deps/libpaperclip_runner_core-*
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runner_core-*.d
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runnerd-*
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd.d
+          key: runner-release-crate-v1-${{ steps.runner_release_crate_key.outputs.scope }}-${{ hashFiles('packages/paperclip-runner/rust-toolchain.toml', 'packages/paperclip-runner/runner/Cargo.toml', 'packages/paperclip-runner/runner/Cargo.lock', 'packages/paperclip-runner/runner/crates/**', 'packages/paperclip-runner/protocol/**', 'packages/paperclip-runner/test-fixtures/**', 'packages/paperclip-runner/test/fixtures/**', 'tests/runner-e2e/fixtures/**') }}
+
+      - name: Mark the restored Runner release crate current
+        if: ${{ steps.runner_release_crate.outputs.cache-hit == 'true' }}
+        run: node scripts/runner-release-crate-cache.mjs mark-current
+
       # `release.sh` always executes its Step 2/7 workspace build, even when
       # `--skip-verify` bypasses the initial verification gate. release.sh
       # also requires a clean working tree, and the install step may have

.github/workflows/release-smoke.yml

@@ -320,6 +320,49 @@ jobs:
           path: ${{ runner.temp }}/public-runner-packs
       - name: Install only the existing verifier tooling
         run: pnpm install --ignore-scripts --no-frozen-lockfile
+      - name: Checkout immutable ARM qualification tooling
+        if: ${{ matrix.target == 'linux-arm64' }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # job.workflow_* identifies this reusable workflow, not its caller.
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
+          path: .qualification-tooling
+          sparse-checkout: scripts/prepare-linux-arm64-qualification.sh
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+      - name: Prepare Linux ARM sandbox prerequisites
+        if: ${{ matrix.target == 'linux-arm64' }}
+        timeout-minutes: 5
+        env:
+          SOURCE_SHA: ${{ inputs.qualification_source_sha }}
+          TOOLING_SHA: ${{ job.workflow_sha }}
+          TOOLING_REPOSITORY: ${{ job.workflow_repository }}
+          TOOLING_WORKFLOW_REF: ${{ job.workflow_ref }}
+          TOOLING_WORKFLOW_PATH: ${{ job.workflow_file_path }}
+        run: |
+          set -euo pipefail
+          [[ "$SOURCE_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
+          [[ "$TOOLING_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
+          [[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
+          [[ "$(git -C .qualification-tooling rev-parse HEAD)" == "$TOOLING_SHA" ]] || exit 1
+          node --input-type=module <<'NODE'
+          import { createHash } from 'node:crypto';
+          import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+          import { join } from 'node:path';
+          const directory = join(process.env.RUNNER_TEMP, 'paperclip-arm-bwrap-prerequisite');
+          mkdirSync(directory, { recursive: true });
+          const helper = '.qualification-tooling/scripts/prepare-linux-arm64-qualification.sh';
+          writeFileSync(join(directory, 'qualification-identity.json'), JSON.stringify({
+            productSourceSha: process.env.SOURCE_SHA,
+            toolingSourceSha: process.env.TOOLING_SHA,
+            toolingRepository: process.env.TOOLING_REPOSITORY,
+            toolingWorkflowRef: process.env.TOOLING_WORKFLOW_REF,
+            toolingWorkflowPath: process.env.TOOLING_WORKFLOW_PATH,
+            helperSha256: createHash('sha256').update(readFileSync(helper)).digest('hex'),
+          }, null, 2) + '\n');
+          NODE
+          bash .qualification-tooling/scripts/prepare-linux-arm64-qualification.sh
       - name: Verify host identity and actual clean npm consumer
         env:
           SOURCE_SHA: ${{ inputs.qualification_source_sha }}
@@ -336,6 +379,8 @@ jobs:
         if: always()
         with:
           name: ${{ inputs.artifact_name }}-${{ matrix.target }}
-          path: ${{ runner.temp }}/native-public-install.json
+          path: |
+            ${{ runner.temp }}/native-public-install.json
+            ${{ runner.temp }}/paperclip-arm-bwrap-prerequisite/
           if-no-files-found: warn
           retention-days: 14

.github/workflows/release-verify.yml

@@ -432,6 +432,61 @@ jobs:
         if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
         run: pnpm --filter @paperclipai/paperclip-runner build:rust
 
+      # The dependency cache above deliberately leaves the Runner's own crate
+      # out, so every pull request build compiled paperclip-runner-core in
+      # release mode (28-49s) although most pushes leave its inputs alone.
+      # This master push saves that crate's release artifacts for the readers
+      # in pr-trusted.yml ("Restore the Runner release crate") under a key
+      # made from the compiler, the checkout root and a hash of every input
+      # the build reads, so a reader only ever restores output of inputs
+      # byte-identical to its own. Same writer gate as the dependency cache:
+      # the Rust lane of an own-repository master push. The entry is looked
+      # up first; a push that left the inputs alone already has it. On a
+      # miss the crate is cleaned and built with the exact command the
+      # readers run, so the artifacts carry no test-profile variants. The
+      # path list and the key live in scripts/runner-release-crate-cache.mjs
+      # and must match the readers'; a guard test holds them together.
+      - name: Compute the Runner release crate cache key
+        id: runner_release_crate_key
+        if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
+        run: echo "scope=$(node scripts/runner-release-crate-cache.mjs scope)" >> "$GITHUB_OUTPUT"
+
+      - name: Check for this push's Runner release crate
+        id: runner_release_crate
+        if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          lookup-only: true
+          path: |
+            packages/paperclip-runner/runner/target/release/.fingerprint/paperclip-runner-core-*
+            packages/paperclip-runner/runner/target/release/deps/libpaperclip_runner_core-*
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runner_core-*.d
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runnerd-*
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd.d
+          key: runner-release-crate-v1-${{ steps.runner_release_crate_key.outputs.scope }}-${{ hashFiles('packages/paperclip-runner/rust-toolchain.toml', 'packages/paperclip-runner/runner/Cargo.toml', 'packages/paperclip-runner/runner/Cargo.lock', 'packages/paperclip-runner/runner/crates/**', 'packages/paperclip-runner/protocol/**', 'packages/paperclip-runner/test-fixtures/**', 'packages/paperclip-runner/test/fixtures/**', 'tests/runner-e2e/fixtures/**') }}
+
+      - name: Build the Runner release crate for its cache
+        if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha && steps.runner_release_crate.outputs.cache-hit != 'true' }}
+        working-directory: packages/paperclip-runner
+        run: |
+          set -euo pipefail
+          cargo clean --release --manifest-path runner/Cargo.toml -p paperclip-runner-core
+          pnpm build:binary
+
+      - name: Save the Runner release crate
+        if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha && steps.runner_release_crate.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            packages/paperclip-runner/runner/target/release/.fingerprint/paperclip-runner-core-*
+            packages/paperclip-runner/runner/target/release/deps/libpaperclip_runner_core-*
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runner_core-*.d
+            packages/paperclip-runner/runner/target/release/deps/paperclip_runnerd-*
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd
+            packages/paperclip-runner/runner/target/release/paperclip-runnerd.d
+          key: runner-release-crate-v1-${{ steps.runner_release_crate_key.outputs.scope }}-${{ hashFiles('packages/paperclip-runner/rust-toolchain.toml', 'packages/paperclip-runner/runner/Cargo.toml', 'packages/paperclip-runner/runner/Cargo.lock', 'packages/paperclip-runner/runner/crates/**', 'packages/paperclip-runner/protocol/**', 'packages/paperclip-runner/test-fixtures/**', 'packages/paperclip-runner/test/fixtures/**', 'tests/runner-e2e/fixtures/**') }}
+
   build:
     if: ${{ !inputs.runner_binaries_only }}
     name: Build