Build Windows release graph once and reuse exact candidate archives

[TheGreenCedar]

Context

Run 30512692629 restores Cargo registry and git inputs plus a bounded sccache object cache, then compiles three Windows graphs: a debug repository-identity test, a release native-staging test, and the release CLI/runtime/qualification-driver package. The cache restores quickly, but build scripts, native configuration, staging, and linking repeat. Protected hosts also download the same authenticated 160–180 MB candidate archives on every proof phase.

The exact-package invariant remains strict: archive reuse is valid only for the exact source commit, target, and archive SHA-256. A PR head and a later merge commit are different candidates even when their trees or bytes happen to match.

Acceptance

• Build the exact-head Windows release graph once, including the production CLI, runtime, optional qualification driver, and the Windows native-staging regression harness.
• Run Windows path-identity and the complete immutable-native-staging regressions from artifacts emitted by that build, with no later Cargo or direct rustc invocation. Move genuinely source-only checks to source proof where they do not belong in the package graph.
• Package the exact production binaries emitted by that graph and preserve all existing path, staging, native identity, package-integrity, signing, and checksum guarantees.
• Cache model material by the checked-in model SHA-256, validating size and digest on every hit.
• Cache protected-host candidate archives in an atomic content-addressed store keyed by exact source SHA, target, and inner archive SHA-256. Authenticate producer provenance, target, archive name, size, and SHA-256 on every hit. Reject cross-SHA, stale-run, symlink/reparse, hardlink, partial, and traversal entries.
• On a cache miss, download the exact Actions or Release asset into a temporary sibling, validate outer and inner identity, then atomically publish the complete record. Never use prefix restore keys.
• Reuse one authenticated exact-main-SHA archive through prepublish qualification, publication, and postpublish proof where host locality permits. A promotion that changes SHA, signed macOS bytes, or a cold host must miss. Keep the one publisher transfer needed to upload GitHub Release assets.
• Remove unconditional large downloads used only to recover archive identity when an authenticated small package-cell record suffices.
• Publish timing that separates dependency/compiler/model cache restoration, native setup, the Cargo graph, linker work, regression execution, packaging, and artifact transfer.
• Update workflow policy and its mutation suite for every workflow edit. Update release-claims.json and claim/closeout tests for any changed reuse or claim-graph contract.
• Independently execute mutations that restore duplicate compiler invocations, run Cargo after the unified build, mix debug/release outputs, select arbitrary test binaries, admit stale or cross-SHA archives, skip hit verification, make large transfers unconditional, or key model material by anything other than model SHA. Every mutation must fail.

Use focused tests while iterating and one exact-head source proof only after independent acceptance. Never rerun an unchanged hardware-proof head.

Refs #1179

[TheGreenCedar]

Implementation lane opened.

• Worktree: /Users/albert/Developer/CodeStory/.codex/worktrees/1611-windows-package-graph
• Branch: codex/1611-windows-package-graph
• Base and current head: f2b2457
• Role: implementation; the frozen 0.16.3 candidate branch remains untouched
• Active slices: one Windows release Cargo graph with exact emitted-artifact binding; atomic source-SHA/target/archive-digest store with private-driver companions
• Checks: focused helper tests are pending; no broad source or hardware proof has been dispatched
• Decision boundary: if qualification run 30512692629 passes, this remains immediate post-release work. If that run exposes a source/workflow repair, this issue must land before recalibration or another expensive proof.
• Next proof: focused helper and workflow-policy mutation suites, independent executable adversary, one Windows focused package execution, then one exact-head source proof only after acceptance.

[TheGreenCedar]

Reopened after exact-head qualification run 30552009354 proved the merged graph still violates the issue acceptance.

• Worktree: /Users/albert/Developer/CodeStory/.codex/worktrees/1611-package-feature-isolation-r2
• Branch: codex/1611-package-feature-isolation-r2
• Base: 5e7b14c (current origin/dev/codestory-next)
• Role: focused support repair; no broad proof or hardware gate will run on this PR head
• Direct evidence: Cargo emitted codestory-retrieval with test-support and codestory-runtime with benchmark-support plus test-support into the production package graph. The packaged CLI therefore reported observation_source=test_support and failed accelerator_proof despite 45 native Vulkan completions.
• Acceptance: isolate production features, reject contaminated Cargo messages before packaging, preserve native/path guarantees through source-only or cheap native probes, then execute hostile mutations before integration.
• Obsolete qualification run 30552009354 was cancelled. It will not be rerun unchanged.

Refs #1597