Merge master b189f586d into Codex runner default candidate

Preserve master transport, lifecycle, and release verification controls alongside macOS qualification.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/cloud-migrator-artifacts.yml

@@ -67,7 +67,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 24
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cloud-migrator-bundle
           path: migrator-artifacts

.github/workflows/docker.yml

@@ -183,6 +183,10 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
+        with:
+          buildkitd-config-inline: |
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io"]
 
       # Deployment tooling reads these labels from the registry to verify an
       # image's schema expectations against a migrator before deploying it,

.github/workflows/pr-trusted.yml

@@ -502,6 +502,15 @@ jobs:
           # across three dedicated runners (~143s each), and the remaining
           # ~2755s levels across twelve duration-balanced shards at ~230s
           # each, in line with the other ~200-290s lanes.
+          #
+          # The balance only holds while the manifest is fresh. By 2026-10-10
+          # the without-chat group had grown to 871 suites and ~5031s of serial
+          # vitest time (mean of runs 38076844891 and 38076972444), 230 of
+          # them unrecorded and weighted at the median, so the twelve shards
+          # ran 313-554s of tests (server 2/12 at 618s was the slowest check
+          # in the run). Re-recorded durations level them to ~415s each; the
+          # shard count stays at twelve because Build and workspaces-b sit
+          # above that already.
           - group: general-server-without-chat
             group_label: server (1/12)
             shard_index: 0
@@ -576,8 +585,16 @@ jobs:
             group_label: workspaces-a (2/2)
             shard_index: 1
             shard_count: 2
+          # workspaces-b became the slowest check (499-593s) once the server
+          # shards were rebalanced: the db project alone was 168-250s of its
+          # 436-513s of vitest time (PR runs 38084171761, 38083084276 and
+          # 38083020834, 2026-10-10). The db project now runs as its own
+          # workspaces-c lane; the rest of workspaces-b is ~265-275s of
+          # vitest time, so both jobs land near 300-350s with setup.
           - group: general-workspaces-b
             group_label: workspaces-b
+          - group: general-workspaces-c
+            group_label: workspaces-c
 
     steps:
       - name: Checkout repository
@@ -1002,6 +1019,20 @@ jobs:
       - name: Build
         run: pnpm build
 
+      # This verification only needs `pnpm build` output (the verifier stages
+      # the public packages' dist and reuses ui/dist itself), yet it ran at the
+      # end of Canary Dry Run, serially after the ~210-295s release.sh dry run.
+      # That made Canary Dry Run the slowest check in every green PR run:
+      # 484s, 572s and 483s in runs 37310951026, 37309272947 and 37308895471
+      # (2026-10-05), with this step alone at 210-223s of each. The Build lane
+      # finished its `pnpm build` in ~206s total in those same runs, so it
+      # absorbs the step at ~416s while Canary Dry Run drops to ~275-350s and
+      # neither remains the critical path (server 2/12 at ~437-467s is).
+      # docker-runner-check.yml runs the same verifier after `pnpm build`.
+      - name: Verify built-in Grok from a clean public npm install
+        if: ${{ hashFiles('scripts/verify-grok-npm-install.mjs') != '' }}
+        run: node scripts/verify-grok-npm-install.mjs
+
   verify_serialized_server:
     name: Verify serialized server suites (${{ matrix.shard_label }})
     needs: [gate]
@@ -1246,9 +1277,11 @@ jobs:
               commit --no-verify -m "ci(canary): stage regenerated lockfile"
           fi
           ./scripts/release.sh canary --skip-verify --dry-run
-      - name: Verify built-in Grok from a clean public npm install
-        if: ${{ hashFiles('scripts/verify-grok-npm-install.mjs') != '' }}
-        run: node scripts/verify-grok-npm-install.mjs
+
+      # The clean public npm install verification for the built-in Grok
+      # provider used to run here, after the dry run. It only needs `pnpm
+      # build` output, which the Build lane also produces, so it moved there:
+      # see "Verify built-in Grok from a clean public npm install" in `build`.
 
 
   e2e_shards:

.github/workflows/release-verify.yml

@@ -185,6 +185,9 @@ jobs:
             shard_count: 2
           - group: general-workspaces-b
             group_label: workspaces-b
+          # Keep parity with pr.yml: the db project runs as its own lane.
+          - group: general-workspaces-c
+            group_label: workspaces-c
 
     steps:
       - name: Checkout repository

.github/workflows/release.yml

@@ -186,7 +186,7 @@ jobs:
           node-version: 24
       - name: Install npm with trusted publishing support
         run: npm install --global npm@11.18.0 --ignore-scripts
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: preview-packages
           path: preview-packages
@@ -224,6 +224,10 @@ jobs:
           pnpm install --resolution-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile
           echo "TOOLS_EPOCH=$(date -u +%G-W%V)" >> "$GITHUB_ENV"
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+        with:
+          buildkitd-config-inline: |
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io"]
       - name: Build the immutable cloud image without registry credentials
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
@@ -269,7 +273,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 24
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: preview-image
           path: preview-image
@@ -399,8 +403,28 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ github.sha }}
           fetch-depth: 0
 
+      - name: Attach verified canary source to local master
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          if [ "$GITHUB_REPOSITORY" != "paperclipai/paperclip" ] ||
+             [ "$GITHUB_EVENT_NAME" != "push" ] ||
+             [ "$GITHUB_REF" != "refs/heads/master" ]; then
+            echo "Error: canary branch attachment requires a trusted master push." >&2
+            exit 1
+          fi
+          if ! [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]] ||
+             [ "$(git rev-parse HEAD)" != "$SOURCE_SHA" ]; then
+            echo "Error: canary checkout does not match the pinned source SHA." >&2
+            exit 1
+          fi
+          git checkout -B master "$SOURCE_SHA"
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+
       - name: Download exact-source release daemon receipts
         if: needs.release_runner_source.outputs.required == 'true'
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
@@ -429,6 +453,18 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      # Master can precede the separate lockfile-refresh PR. Preserve the
+      # resolution used for this build before release tooling restores the
+      # tracked lockfile or rewrites workspace versions.
+      - name: Save canary smoke lockfile
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: canary-smoke-lockfile-${{ github.sha }}
+          path: pnpm-lock.yaml
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
       - name: Restore tracked install-time changes
         run: git checkout -- pnpm-lock.yaml
 
@@ -503,6 +539,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
 
       - name: Setup pnpm
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
@@ -514,6 +553,13 @@ jobs:
         with:
           node-version: 24
 
+      # Default download scope is this workflow run, including job reruns.
+      # A missing artifact fails instead of resolving a different dependency set.
+      - name: Restore canary smoke lockfile
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: canary-smoke-lockfile-${{ github.sha }}
+
       - name: Install test dependencies
         run: pnpm install --frozen-lockfile