Make embedding calibration GPU-only and measure true idle correctly

.github/scripts/candidate-archive-store.mjs

@@ -874,6 +874,7 @@ function publishStoreEntry(storeRoot, inputRoot, record) {
       removeOwnedTemporary(temporary, paths.parent, path.basename(paths.entry));
       return { admitted: false, ...concurrent };
     }
+    const prepared = lstatSync(temporary, { bigint: true });
     try {
       renameSync(temporary, paths.entry);
     } catch (error) {
@@ -884,6 +885,15 @@ function publishStoreEntry(storeRoot, inputRoot, record) {
       removeOwnedTemporary(temporary, paths.parent, path.basename(paths.entry));
       return { admitted: false, ...concurrent };
     }
+    const published = lstatSync(paths.entry, { bigint: true });
+    if (
+      !published.isDirectory()
+      || published.isSymbolicLink()
+      || published.dev !== prepared.dev
+      || published.ino !== prepared.ino
+    ) {
+      fail("candidate archive store entry was not published by atomic directory rename");
+    }
     return { admitted: true, ...verifyStoreEntry(storeRoot, expected) };
   } catch (error) {
     if (existsSync(temporary)) {

.github/scripts/candidate-archive-store.test.mjs

@@ -17,7 +17,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import test from "node:test";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
   admitCandidateArchive,
@@ -291,6 +291,45 @@ test("admission and a later hit materialize the complete exact payload as fresh
   }
 });
 
+test("admission rejects sequential publication beneath the final store key", async () => {
+  const fixture = createFixture();
+  try {
+    const source = readFileSync(SCRIPT, "utf8");
+    const atomicPublication = "      renameSync(temporary, paths.entry);";
+    assert.equal(
+      source.split(atomicPublication).length - 1,
+      1,
+      "atomic store publication must have one mutation target",
+    );
+    const sequentialPublication = [
+      "      mkdirSync(paths.entry, { mode: 0o700 });",
+      "      renameSync(temporaryPayload, paths.payload);",
+      "      renameSync(path.join(temporary, RECORD_FILE), paths.recordFile);",
+      "      rmSync(temporary, { recursive: true });",
+    ].join("\n");
+    const mutantFile = path.join(fixture.root, "candidate-archive-store-mutant.mjs");
+    writeFileSync(
+      mutantFile,
+      source.replace(atomicPublication, sequentialPublication),
+      { flag: "wx" },
+    );
+    const mutant = await import(pathToFileURL(mutantFile).href);
+    assert.throws(
+      () => mutant.admitCandidateArchive({
+        inputRoot: fixture.inputRoot,
+        outputDir: outputDir(fixture),
+        outputRoot: fixture.outputRoot,
+        record: fixture.record,
+        storeRoot: fixture.storeRoot,
+      }),
+      /not published by atomic directory rename/u,
+    );
+    assert.equal(statExists(outputDir(fixture)), false);
+  } finally {
+    cleanup(fixture);
+  }
+});
+
 test("the public checksum companion pair is mandatory", () => {
   const fixture = createFixture();
   try {

.github/scripts/check-workflow-policy.mjs

@@ -896,6 +896,8 @@ export function qualificationDriverArtifactViolations(
     'binary: "codestory_embedding_qualification.exe"',
     'rustTarget: "x86_64-pc-windows-msvc"',
     "metadata.isSymbolicLink()\n    || !metadata.isFile()\n    || metadata.nlink !== 1",
+    "function regularBuildOutput(file, label)",
+    "!Number.isSafeInteger(metadata.nlink)\n    || metadata.nlink < 1",
     "metadata.isSymbolicLink() || !metadata.isDirectory()",
     'fail("qualification driver helper arguments changed")',
     "containedRelativePath(root, candidate, label)",
@@ -904,7 +906,10 @@ export function qualificationDriverArtifactViolations(
     'fail(`${label} must not traverse symbolic links`)',
     "`codestory-cli-v${version}-${assetTarget}.${contract.archiveExtension}`",
     'targetDir,\n    contract.rustTarget,\n    "release",\n    contract.binary',
+    'const sourceMetadata = regularBuildOutput(',
     'fail("qualification driver artifact directory must start empty")',
+    "copyFileSync(source, staged)",
+    'const stagedMetadata = regularFile(staged, "staged qualification driver")',
     "archiveBytes: archiveMetadata.size",
     "archiveDigest: sha256(archivePath)",
     "archiveFile: expectedArchiveFile",
@@ -965,7 +970,7 @@ const packagedPlatformWorkflowDigest =
 // made advisory, parked in dead code, or followed by a payload substitution
 // while leaving the expected tokens in place.
 const packagedPlatformCoordinatorWorkflowDigest =
-  "464906e3cd7ec0e2f7e9195d60de035fdba76172c25d8b0861d0982f9d7dcc3e";
+  "5017abab05e80355daf4618795d5ec7f09c07b4bc33cc1d52dca968a96b056bb";
 const frozenCandidateQualityWorkflowDigest =
   "92d0a7ab0e0df63dacd5cc3ef0b58500a6578036494c329aa35279048734f173";
 const macosMetalWorkflowDigest =
@@ -987,13 +992,14 @@ const packagedHostCompilerFinalizerDigest =
   "b77d8bb12c2748bfe016ab65ccb2f4581356f3ccf1d666e747306caffd6c0c46";
 // The companion qualification driver is intentionally retained only inside
 // the private Actions package artifact. This digest pins both sides of that
-// contract: the producer copies only the selected target binary and binds it
-// to the exact candidate archive, while the consumer rejects symlinks, extra
-// files, identity drift, and byte drift before restoring execute permission.
-// Any helper edit therefore requires a policy and mutation-test review in the
-// same PR as the workflow change.
+// contract: the producer may read Cargo's trusted hard-linked build output,
+// but retains only a new singly linked copy bound to the exact candidate
+// archive. The consumer rejects symlinks, retained hardlinks, extra files,
+// identity drift, and byte drift before restoring execute permission.
+// Any helper edit therefore requires policy and mutation-test review in the
+// same PR.
 const qualificationDriverArtifactDigest =
-  "f7946e03fa6e272ca17f12616b82579da041de4d7c30b19d24ddbc5f1c7f0063";
+  "efc5126e24162d52f9da8bac38c3414b3a7492fb17eed5ff19867fadad69623e";
 const draftProofCommands = [
   "cargo test --locked -p codestory-llama-sys --test native_staging",
   "cargo test --locked -p codestory-llama-sys --test model_staging",
@@ -5139,6 +5145,16 @@ function validatePackagedCoordinator(workflows, violations, graph) {
     INPUT_CALIBRATION_RUN_ID: "${{ inputs.calibration_bundle_run_id }}",
   });
   requireExactResolverContract(violations, file, route, platformResolverContractDigest);
+  const sourceProofRequirement = namedStep(
+    route,
+    "Require successful exact-head source proof",
+  );
+  add(
+    violations,
+    sourceProofRequirement?.if
+      === "steps.resolve.outputs.mode != 'integration' && steps.resolve.outputs.mode != 'calibration'",
+    `${file} calibration alone must skip pre-freeze source proof while every frozen-candidate mode requires it`,
+  );
   requireStepRun(violations, file, route, "Require successful exact-head source proof", [
     "actions/runs?head_sha=$HEAD_SHA",
     '.path == ".github/workflows/source-proof.yml"',

.github/scripts/check-workflow-policy.test.mjs

@@ -3,6 +3,8 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   chmodSync,
+  linkSync,
+  lstatSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
@@ -47,6 +49,10 @@ import {
   validateWorkflows,
   windowsManifestProofPolicyViolations,
 } from "./check-workflow-policy.mjs";
+import {
+  produceQualificationDriverArtifact,
+  verifyQualificationDriverArtifact,
+} from "./qualification-driver-artifact.mjs";
 
 const fullSha = "0123456789abcdef0123456789abcdef01234567";
 const proofTopology = "proof5-v1-64015a841a2f69f33f7c9ce284f671ad27b3923a58db865fd4806d86230df6c5";
@@ -1610,7 +1616,7 @@ test("qualification driver is built once, retained privately, authenticated, and
       source.replace("sha256(archivePath) !== identity.archive.sha256", "false")],
     ["helper follows linked path ancestors", source =>
       source.replace("lstatSync(cursor).isSymbolicLink()", "false")],
-    ["helper accepts hardlinked drivers", source =>
+    ["helper accepts hardlinked retained drivers", source =>
       source.replace("metadata.nlink !== 1", "false")],
     ["helper accepts extra identity fields", source =>
       source.replace('fail(`${label} keys changed`)', "return")],
@@ -1655,6 +1661,82 @@ test("qualification driver is built once, retained privately, authenticated, and
   }
 });
 
+test("qualification driver retention breaks a Cargo source hardlink and rejects retained hardlinks", () => {
+  const directory = mkdtempSync(
+    path.join(os.tmpdir(), "codestory-qualification-driver-"),
+  );
+  try {
+    const targetDirectory = path.join(directory, "target");
+    const releaseDirectory = path.join(
+      targetDirectory,
+      "x86_64-pc-windows-msvc",
+      "release",
+    );
+    const depsDirectory = path.join(releaseDirectory, "deps");
+    mkdirSync(depsDirectory, { recursive: true });
+    const originalDriver = path.join(
+      depsDirectory,
+      "codestory_embedding_qualification-hash.exe",
+    );
+    const cargoDriver = path.join(
+      releaseDirectory,
+      "codestory_embedding_qualification.exe",
+    );
+    writeFileSync(originalDriver, "qualification-driver-v1");
+    chmodSync(originalDriver, 0o755);
+    linkSync(originalDriver, cargoDriver);
+    assert.equal(lstatSync(cargoDriver).nlink, 2);
+
+    const archive = path.join(
+      directory,
+      "codestory-cli-v0.16.3-windows-x64.zip",
+    );
+    writeFileSync(archive, "candidate-archive");
+    const artifactDirectory = path.join(directory, "artifact");
+    const produced = produceQualificationDriverArtifact({
+      archive,
+      assetTarget: "windows-x64",
+      outDir: artifactDirectory,
+      sourceSha: "a".repeat(40),
+      sourceTree: "b".repeat(40),
+      targetDir: targetDirectory,
+      trustedRoot: directory,
+      version: "0.16.3",
+    });
+    assert.equal(lstatSync(produced.driver).nlink, 1);
+    assert.equal(readFileSync(produced.driver, "utf8"), "qualification-driver-v1");
+
+    writeFileSync(originalDriver, "qualification-driver-v2");
+    assert.equal(readFileSync(produced.driver, "utf8"), "qualification-driver-v1");
+    const verified = verifyQualificationDriverArtifact({
+      archive,
+      artifactDir: artifactDirectory,
+      assetTarget: "windows-x64",
+      sourceSha: "a".repeat(40),
+      sourceTree: "b".repeat(40),
+      trustedRoot: directory,
+      version: "0.16.3",
+    });
+    assert.equal(verified.identity.driver.sha256, produced.identity.driver.sha256);
+
+    linkSync(produced.driver, path.join(directory, "retained-driver-alias.exe"));
+    assert.throws(
+      () => verifyQualificationDriverArtifact({
+        archive,
+        artifactDir: artifactDirectory,
+        assetTarget: "windows-x64",
+        sourceSha: "a".repeat(40),
+        sourceTree: "b".repeat(40),
+        trustedRoot: directory,
+        version: "0.16.3",
+      }),
+      /qualification driver artifact must be a regular, non-symlink, singly linked file/u,
+    );
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
+
 test("Windows packages one release graph into exact public and private artifacts", async (t) => {
   assert.deepEqual(validateWorkflows(loadWorkflows()), []);
   const file = "packaged-platform-proof.yml";
@@ -2859,6 +2941,43 @@ test("source proof reuse accepts only whole successful workflow runs", async (t)
   }
 });
 
+test("calibration precedes the sole frozen-candidate source proof", async (t) => {
+  assert.deepEqual(validateWorkflows(loadWorkflows()), []);
+  const coordinatorFile = "packaged-platform-pr.yml";
+  const mutations = [
+    ["calibration regains a pre-freeze source proof", workflow => {
+      draftStep(
+        workflow.jobs.route,
+        "Require successful exact-head source proof",
+      ).if = "steps.resolve.outputs.mode != 'integration'";
+    }],
+    ["qualification loses the frozen-head source proof", workflow => {
+      draftStep(
+        workflow.jobs.route,
+        "Require successful exact-head source proof",
+      ).if
+        = "steps.resolve.outputs.mode != 'integration' && steps.resolve.outputs.mode != 'calibration' && steps.resolve.outputs.mode != 'qualification'";
+    }],
+    ["every mode loses the exact-head source proof", workflow => {
+      draftStep(
+        workflow.jobs.route,
+        "Require successful exact-head source proof",
+      ).if = "false";
+    }],
+  ];
+
+  for (const [name, mutate] of mutations) {
+    await t.test(name, () => {
+      const workflows = loadWorkflows();
+      mutate(workflows.get(coordinatorFile));
+      assert.match(
+        validateWorkflows(workflows).join("\n"),
+        /calibration alone must skip pre-freeze source proof while every frozen-candidate mode requires it/u,
+      );
+    });
+  }
+});
+
 test("Windows package proof retains the readable native sccache executable", () => {
   const directory = mkdtempSync(path.join(os.tmpdir(), "codestory-windows-sccache-"));
   try {

.github/scripts/packaged_agent_proof/measurement_protocol_validation.py

@@ -35,7 +35,7 @@
     "calibration_workload_state_overrides",
 )
 EXPECTED_QUALIFICATION_MEASUREMENT_SHAPE_SHA256 = (
-    "1c065562adc34d0d9978187857807e491c4e6d4aa233fdd94f5636931a7b730e"
+    "bc78e8c0277062f1274b0ed97e9bafbef2574b2d1934cb6ab89e7f514900fef8"
 )
 
 
@@ -117,6 +117,11 @@ def _verify_scenario_and_metric_contracts(protocol: dict) -> tuple[set[str], dic
             and all(isinstance(event, str) and event for event in boundaries),
             f"measurement metric {metric} must have exact start and end events",
         )
+    require(
+        phase_boundaries["true_idle_exit"]
+        == ["final_product_request_completed", "engine_and_server_absent"],
+        "true-idle qualification must start at final product completion",
+    )
     metric_contracts = protocol.get("metric_contracts")
     require(
         isinstance(metric_contracts, dict)
@@ -419,6 +424,11 @@ def _verify_measurement_sampling(
             workload.get("input_generator"),
             f"measurement workload {metric}.input_generator",
         )
+    require(
+        workloads["true_idle_exit"].get("workload_id")
+        == "true_idle_after_product_completion_60000_awake_ms_v2",
+        "true-idle qualification workload changed its product-completion boundary",
+    )
     sampling = protocol.get("metric_sampling")
     require(
         isinstance(sampling, dict) and set(sampling) == required_metrics,

.github/scripts/packaged_agent_proof/self_test_full_stack_calibration.py

@@ -33,6 +33,38 @@ def _qualification_matrix_tests(fixture: FullStackFixture) -> dict:
         self_measurement_protocol,
         require_frozen=False,
     )
+    for label, field, value in (
+        (
+            "server idle epoch",
+            "phase",
+            [
+                "last_queued_active_or_leased_work_ended",
+                "engine_and_server_absent",
+            ],
+        ),
+        (
+            "pre-completion workload",
+            "workload",
+            "true_idle_60000_awake_ms_v1",
+        ),
+    ):
+        regressed_true_idle = json.loads(
+            json.dumps(measurement_contract["measurement_protocol"])
+        )
+        if field == "phase":
+            regressed_true_idle["phase_boundaries"]["true_idle_exit"] = value
+        else:
+            regressed_true_idle["workloads"]["true_idle_exit"]["workload_id"] = value
+        regressed_true_idle_path = (
+            fixture.root / f"true-idle-{field}-regression.json"
+        )
+        write_json(regressed_true_idle_path, regressed_true_idle)
+        try:
+            load_measurement_protocol(regressed_true_idle_path)
+        except ProofFailure:
+            pass
+        else:
+            raise ProofFailure(f"true-idle qualification accepted {label}")
     for quality_metric in (
         "answer_quality",
         "packet_quality",