feat(runner): qualify native Codex platforms and cache hosted builds

Extract the tested runtime and installed-package prerequisite without changing agent creation defaults or experimental gates.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/release.yml

@@ -340,9 +340,54 @@ jobs:
           SOURCE_SHA: ${{ github.sha }}
         run: node scripts/cloud-source-verification.mjs "$SOURCE_SHA"
 
+  release_runner_source:
+    # Old promotions retain their already-shipped packaging contract. New
+    # sources opt into source-declared native target assembly in their release.sh.
+    needs: [verify_canary, select_nightly, select_beta, preflight_stable]
+    if: >-
+      !cancelled() && (
+        (github.event_name == 'push' && needs.verify_canary.result == 'success') ||
+        (needs.select_nightly.result == 'success' && needs.select_nightly.outputs.proceed == 'true') ||
+        needs.select_beta.result == 'success' || needs.preflight_stable.result == 'success')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      sha: ${{ steps.source.outputs.sha }}
+      required: ${{ steps.source.outputs.required }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ needs.preflight_stable.outputs.sha || needs.select_beta.outputs.sha || needs.select_nightly.outputs.sha || github.sha }}
+          persist-credentials: false
+      - name: Read the exact source packaging contract
+        id: source
+        env:
+          SOURCE_SHA: ${{ needs.preflight_stable.outputs.sha || needs.select_beta.outputs.sha || needs.select_nightly.outputs.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          [[ "$SOURCE_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
+          [[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
+          echo "sha=$SOURCE_SHA" >> "$GITHUB_OUTPUT"
+          source_script="$(git show "$SOURCE_SHA:scripts/release.sh")" || exit 1
+          if printf '%s\n' "$source_script" | grep -F 'assemble-daemons "$PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR"' > /dev/null; then
+            echo "required=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "required=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  release_runner_binaries:
+    needs: release_runner_source
+    if: needs.release_runner_source.outputs.required == 'true'
+    uses: ./.github/workflows/release-verify.yml
+    with:
+      ref: ${{ needs.release_runner_source.outputs.sha }}
+      runner_binaries_only: true
+
   publish_canary:
-    if: github.event_name == 'push'
-    needs: verify_canary
+    if: ${{ !cancelled() && github.event_name == 'push' && needs.verify_canary.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
+    needs: [verify_canary, release_runner_source, release_runner_binaries]
     runs-on: ubuntu-latest
     timeout-minutes: 150
     environment: npm-canary
@@ -380,6 +425,17 @@ jobs:
           git checkout -B master "$SOURCE_SHA"
           test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
 
+      - name: Download exact-source release daemon receipts
+        if: needs.release_runner_source.outputs.required == 'true'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-runner-inputs
+          merge-multiple: true
+      - name: Bind daemon inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true'
+        run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -633,12 +689,14 @@ jobs:
       artifact_name: nightly-release-smoke
 
   publish_nightly:
-    needs: [select_nightly, smoke_nightly]
+    needs: [select_nightly, smoke_nightly, release_runner_source, release_runner_binaries]
     # Publish when smoke passed, or when smoke was deliberately skipped by a
     # dry-run dispatch (the publish itself is a dry-run in that case).
     if: >-
       !cancelled() &&
       needs.select_nightly.outputs.proceed == 'true' &&
+      needs.release_runner_source.result == 'success' &&
+      (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') &&
       (needs.smoke_nightly.result == 'success' ||
        (needs.smoke_nightly.result == 'skipped' && github.event_name == 'workflow_dispatch' && inputs.dry_run))
     runs-on: ubuntu-latest
@@ -664,6 +722,17 @@ jobs:
           ref: ${{ needs.select_nightly.outputs.sha }}
           fetch-depth: 0
 
+      - name: Download exact-source release daemon receipts
+        if: needs.release_runner_source.outputs.required == 'true'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-runner-inputs
+          merge-multiple: true
+      - name: Bind daemon inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true'
+        run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -901,10 +970,12 @@ jobs:
       ref: ${{ needs.select_beta.outputs.sha }}
 
   publish_beta:
-    needs: [select_beta, verify_beta_candidate]
+    needs: [select_beta, verify_beta_candidate, release_runner_source, release_runner_binaries]
     if: >-
       !cancelled() &&
       needs.select_beta.result == 'success' &&
+      needs.release_runner_source.result == 'success' &&
+      (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') &&
       (needs.verify_beta_candidate.result == 'success' ||
        (needs.verify_beta_candidate.result == 'skipped' && needs.select_beta.outputs.mode == 'promote'))
     runs-on: ubuntu-latest
@@ -930,6 +1001,17 @@ jobs:
           ref: ${{ needs.select_beta.outputs.sha }}
           fetch-depth: 0
 
+      - name: Download exact-source release daemon receipts
+        if: needs.release_runner_source.outputs.required == 'true'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-runner-inputs
+          merge-multiple: true
+      - name: Bind daemon inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true'
+        run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -1286,8 +1368,8 @@ jobs:
       ref: ${{ needs.preflight_stable.outputs.sha }}
 
   preview_stable:
-    if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && inputs.dry_run
-    needs: [preflight_stable, verify_stable]
+    if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && inputs.dry_run && needs.preflight_stable.result == 'success' && needs.verify_stable.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
+    needs: [preflight_stable, verify_stable, release_runner_source, release_runner_binaries]
     runs-on: ubuntu-latest
     timeout-minutes: 45
     permissions:
@@ -1300,6 +1382,17 @@ jobs:
           fetch-depth: 0
           ref: ${{ needs.preflight_stable.outputs.sha }}
 
+      - name: Download exact-source release daemon receipts
+        if: needs.release_runner_source.outputs.required == 'true'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-runner-inputs
+          merge-multiple: true
+      - name: Bind daemon inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true'
+        run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -1328,8 +1421,8 @@ jobs:
           ./scripts/release.sh "${args[@]}"
 
   publish_stable:
-    if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run
-    needs: [preflight_stable, verify_stable]
+    if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run && needs.preflight_stable.result == 'success' && needs.verify_stable.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
+    needs: [preflight_stable, verify_stable, release_runner_source, release_runner_binaries]
     runs-on: ubuntu-latest
     timeout-minutes: 150
     environment: npm-stable
@@ -1347,6 +1440,17 @@ jobs:
           fetch-depth: 0
           ref: ${{ needs.preflight_stable.outputs.sha }}
 
+      - name: Download exact-source release daemon receipts
+        if: needs.release_runner_source.outputs.required == 'true'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-runner-inputs
+          merge-multiple: true
+      - name: Bind daemon inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true'
+        run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with: