Context
Exact-head qualification run https://github.com/TheGreenCedar/CodeStory/actions/runs/30537929769 built the complete Windows release graph once and Cargo finished successfully in 20m17s. The post-build selector then rejected Cargo own release-root executable because Windows Cargo emits it as a hardlink:
Cargo artifact codestory-cli must be a regular, non-symlink, singly linked file
The single-build graph is the intended design. Reintroducing duplicate builds or copying binaries without preserving their build identity is not acceptable.
Required outcome
- Accept only Cargo-owned native aliases that remain wholly inside the exact source SHA, source tree, target, and release-profile graph.
- Account for every native hardlink using filesystem identity and link count; any alias outside that exact graph must fail closed.
- Preserve rejection of debug/release mixing, stale or cross-SHA artifacts, symlinks, changed bytes, duplicate compiler artifacts, and paths outside the release graph.
- Keep one Cargo build invocation and package those exact binaries.
- Add executable regressions for the real Cargo hardlink shape plus debug, external, stale, and post-selection alias mutations.
- Do not edit workflow YAML, policy, or claims unless the workflow or graph contract actually changes.
- Use focused tests, independent mutation review, and no rerun of unchanged head 04605eb.
Refs #1558.
Context
Exact-head qualification run https://github.com/TheGreenCedar/CodeStory/actions/runs/30537929769 built the complete Windows release graph once and Cargo finished successfully in 20m17s. The post-build selector then rejected Cargo own release-root executable because Windows Cargo emits it as a hardlink:
The single-build graph is the intended design. Reintroducing duplicate builds or copying binaries without preserving their build identity is not acceptable.
Required outcome
Refs #1558.