Merge frozen master into work-folders base

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/scripts/tests/release-runner-cache.test.mjs

@@ -1,6 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
+import { runInNewContext } from "node:vm";
 
 const workflow = readFileSync(new URL("../../workflows/release-verify.yml", import.meta.url), "utf8");
 const runner = workflow.split("  verify_paperclip_runner:")[1].split("  build:")[0];
@@ -22,16 +23,48 @@ test("the shared cache excludes workspace artifacts and only restores or saves t
   assert.match(runner, /cache-workspace-crates: false/);
   assert.match(runner, /cache-bin: false/);
   const saveIf = runner.match(/^\s*save-if: (.+)$/m)?.[1];
-  assert.equal(saveIf, "${{ github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}");
+  assert.equal(saveIf, "${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}");
   const cacheStep = runner.split("      - name: Cache Runner Rust dependencies")[1].split("      - name: Install dependencies")[0];
-  assert.equal(cacheStep.match(/^\s*if: (.+)$/m)?.[1], saveIf);
+  assert.equal(cacheStep.match(/^\s*if: (.+)$/m)?.[1], saveIf.replace("matrix.lane == 'rust' && ", ""));
   assert.doesNotMatch(runner, /cache-on-failure: true|cache-all-crates: true/);
 });
 
-test("cache hits cannot bypass Runner verification", () => {
-  const verify = runner.split("      - name: Verify Paperclip Runner")[1];
-  assert.match(verify, /run: pnpm --filter @paperclipai\/paperclip-runner check:all/);
-  assert.doesNotMatch(verify, /if:|continue-on-error:/);
-  assert.ok(runner.indexOf("Cache Runner Rust dependencies") < runner.indexOf("      - name: Verify Paperclip Runner\n"));
+test("parallel lanes cover check:all exactly once and never bypass verification", () => {
+  const scripts = JSON.parse(readFileSync(new URL("../../../packages/paperclip-runner/package.json", import.meta.url))).scripts;
+  const checks = [...runner.matchAll(/^            checks: (.+)$/gm)].flatMap(([, value]) => value.split(" "));
+  assert.deepEqual(checks, scripts["check:all"].split(" && ").map((command) => command.replace(/^pnpm run /, "")));
+  assert.deepEqual([...runner.matchAll(/^          - lane: (.+)$/gm)].map(([, value]) => value), ["protocol", "rust"]);
+  assert.match(runner, /fail-fast: false/);
+  assert.doesNotMatch(runner, /max-parallel: 1|^    needs:|continue-on-error:/m);
+  const verify = runner.split("      - name: Verify Paperclip Runner\n")[1].split("      - name: Warm debug")[0];
+  assert.match(verify, /RUNNER_CHECKS: \$\{\{ matrix.checks \}\}/);
+  assert.match(verify, /set -euo pipefail/);
+  assert.match(verify, /for check in \$RUNNER_CHECKS; do\s+pnpm --filter @paperclipai\/paperclip-runner "\$check"\s+done/);
+  assert.doesNotMatch(verify, /if:|cache-hit/);
   assert.doesNotMatch(runner, /id-token: write|packages: write|secrets: inherit/);
 });
+
+test("only the trusted Rust lane writes, and warms both build profiles before saving", () => {
+  const cache = runner.split("      - name: Cache Runner Rust dependencies")[1].split("      - name: Install dependencies")[0];
+  const warm = runner.split("      - name: Warm debug dependencies for the shared Runner cache")[1];
+  const expr = (body, field) => body.match(new RegExp(`^ +${field}: \\$\\{\\{ (.+) \\}\\}$`, "m"))[1];
+  assert.equal(expr(cache, "save-if"), expr(warm, "if"));
+  assert.match(warm, /run: pnpm --filter @paperclipai\/paperclip-runner build:rust/);
+  const sha = "a".repeat(40);
+  const base = { repository: "paperclipai/paperclip", event_name: "push", ref: "refs/heads/master", sha };
+  for (const lane of ["protocol", "rust"]) {
+    for (const [overrides, ref, trusted] of [
+      [{}, sha, true],
+      [{ event_name: "pull_request", ref: "refs/pull/1/merge" }, sha, false],
+      [{ event_name: "pull_request_target" }, sha, false],
+      [{ event_name: "workflow_dispatch" }, sha, false],
+      [{ repository: "someone/paperclip" }, sha, false],
+      [{ ref: "refs/heads/feature" }, sha, false],
+      [{}, "b".repeat(40), false],
+    ]) {
+      const context = { matrix: { lane }, github: { ...base, ...overrides }, inputs: { ref } };
+      assert.equal(runInNewContext(expr(cache, "if"), context), trusted);
+      assert.equal(runInNewContext(expr(cache, "save-if"), context), trusted && lane === "rust");
+    }
+  }
+});

.github/workflows/docker-runner-check.yml

@@ -6,6 +6,7 @@ on:
       - .github/workflows/docker-runner-check.yml
       - Dockerfile
       - .dockerignore
+      - scripts/check-docker-runner-cache.sh
       - packages/paperclip-runner/rust-toolchain.toml
       - packages/paperclip-runner/runner/**
       - packages/paperclip-runner/protocol/**
@@ -20,7 +21,7 @@ jobs:
   runner:
     name: Compile isolated native Runner
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     permissions:
       contents: read
     steps:
@@ -30,8 +31,8 @@ jobs:
           persist-credentials: false
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      # Compile the real target with the real .dockerignore. This catches new
-      # Cargo or embedded protocol inputs that the isolated COPY set omits.
-      # No registry credentials, cache imports/exports, or image publication.
-      - name: Compile the Runner from its isolated Docker context
-        run: docker buildx build --target runner-build --progress plain .
+      # Compile the real target, then change source in a disposable context.
+      # Require dependency-layer reuse and changed metadata from the real binary.
+      # No registry credentials, external cache, or image publication.
+      - name: Verify native build and dependency cache reuse
+        run: bash scripts/check-docker-runner-cache.sh

.github/workflows/release-verify.yml

@@ -262,12 +262,21 @@ jobs:
         run: pnpm test:runner-workflow-evals
 
   verify_paperclip_runner:
-    name: Verify Paperclip Runner
+    name: Verify Paperclip Runner (${{ matrix.lane }})
     runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.sha != '' && inputs.ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
     timeout-minutes: 20
     permissions:
       contents: read
 
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - lane: protocol
+            checks: check:eval-kernel check:protocol
+          - lane: rust
+            checks: check:runner check:api-authority
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -305,15 +314,27 @@ jobs:
           # dependencies; never restore installed executables from cargo/bin.
           cache-workspace-crates: false
           cache-bin: false
-          # The step guard also restricts restores. Save only after a successful
-          # master-push verification of that push's exact commit.
-          save-if: ${{ github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
+          # Both lanes restore the existing dependency cache. Only the Rust
+          # lane saves it, after warming both release and debug dependencies.
+          save-if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
 
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
       - name: Verify Paperclip Runner
-        run: pnpm --filter @paperclipai/paperclip-runner check:all
+        env:
+          RUNNER_CHECKS: ${{ matrix.checks }}
+        run: |
+          set -euo pipefail
+          for check in $RUNNER_CHECKS; do
+            pnpm --filter @paperclipai/paperclip-runner "$check"
+          done
+
+      - name: Warm debug dependencies for the shared Runner cache
+        # Protocol tests need debug binaries. Populate their dependencies in
+        # the sole cache writer, so a cold save also serves the protocol lane.
+        if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
+        run: pnpm --filter @paperclipai/paperclip-runner build:rust
 
   build:
     name: Build