[knqiufan]

Which issue or RFC does this PR close?

Related issue: #2112 — PR 09-C: Managed runtime and Installer/Ops resources.

This PR implements the candidate resource producer and required-platform CI for 09-C. The broader #2112 remains open: 09-A release-candidate assembly, 09-B qualified publication/download verification, and signed/notarized installed-platform evidence under #2108/#2109 remain outstanding. The Windows and Intel native candidate jobs must also pass before this PR's native build claims are accepted.

Local setup parent: #2114. Consumers: #2115 (installer; database admission in #2286) and #2116 (native bridge in #2289).

Rationale for this change

The managed installer and Desktop Ops bridge need complete versioned resources that run without a user's Python, uv, Git or compiler. This producer builds immutable candidate Server and independent Ops resources from exact source, interpreter and wheel identities on Windows x86_64 and macOS arm64/x86_64.

What changes are included in this PR?

• Pin CPython 3.12.16 / python-build-standalone 20261026 archives for all three native targets. Verify hashes, target layout and safe internal file aliases before producing link-free inventories.
• Prepare the exact Git source wheel and locked dependency closure; record source, package version, tool, license and artifact identities separately from executing-producer provenance. Install final resources offline with individual wheel hashes.
• Produce deterministic Server/Ops archives, real ResourceCatalog input, complete inventories and Desktop provisioning pins. Preserve the existing Ops bundle format and launcher contracts. Remove non-relocatable wrappers and mutable installer-cache records, repairing RECORD metadata.
• Keep the locked cryptography 50.0.0 on Intel macOS through a separate pinned Rust/OpenSSL/maturin/Xcode source-build path. A minimal locked build-host group avoids implicitly building it before that path; an allowlisted environment and backend binary verification prevent ambient toolchain overrides. Runtime dependency versions are unchanged.
• Add native CI for all three targets, repeated production after input relocation, consumer readback, launcher/Ops smoke, durable bounded failure diagnostics, and bilingual documentation.

Are there any user-facing changes?

Maintainers gain resource-production commands and CI. Every output is explicitly an unqualified candidate; there is no publication, inferred production URL, signing, notarization or qualification override. End users do not build dependencies or change global tooling. Windows production measures actual managed final/staging and independent Ops path budgets without enabling global long-path settings.

How was this change tested?

• Native CI fixes cover the three failed boundaries: the Windows version-mismatch fixture now copies inputs across volumes; the Intel post-build check distinguishes LC_ID_DYLIB from actual loaded libraries/search paths; the independent Bub lock mirrors the root resource-build group without changing any of its 122 package identities or versions.
• Final local producer/consumer regression: 55 passed, 2 Windows-native skips in 251.09s, including real repeated production, relocated consumer readback, bundled Server/Ops smoke and version-mismatch refusal. Six additional real Mach-O cases compile/inspect both arm64 and x86_64 extensions, permit the extension's own install-name and reject an external library or search path. The existing upstream cryptography extension also passes corrected inspection with only system dependencies. This is not an Intel cryptography execution or Windows rerun claim.
• uv lock --project e2e/bub --check --offline passed for all 122 packages; make check passed. Full harness dependency installation and a task-local uv 0.10.12 acquisition were attempted but stopped during slow downloads; no complete local harness installation or pinned-tool rerun is claimed.
• The focused remote Open Code Review failed during context compression. The plugin's delegate workflow independently reviewed all 3/3 final changed files, reran the six Mach-O regressions and lock checks, and found no blocking issues. Final file hashes were verified before commit. Windows/Intel native jobs and E2E harness validation must run on the new commit.
• Frozen requirements are written as UTF-8 LF on every host. A regression rejects digest-consistent CRLF inputs, and actual input preparation with simulated Windows default newlines produced 121 wheels accepted by the unchanged strict verifier.
• make check: passed lock validation, all pre-commit hooks, both type-check scopes and 61 integration-manifest tests.
• POWERCONTEXT_RESOURCE_TEST_INPUTS=... POWERCONTEXT_RESOURCE_TEST_INPUTS_SHA256=... POWERCONTEXT_RESOURCE_TEST_OUTPUT=... uv run --no-sync pytest -q tests/test_managed_resource_producer.py tests/test_ops_resources.py: 48 passed, 2 Windows-native skips in 237.63s using the actual minimal resource-build host environment. Its host does not contain cryptography, jieba or maturin.
• Real macOS arm64 production ran twice from frozen, relocated inputs with changed timestamps; complete archives/manifests matched. Real ResourceCatalog/ResourceStore readback used a seeded, hash-checked cache. The relocated installed Server reached readiness through its bundled launcher with disposable SQLite data; bundled AES-GCM and Ed25519 probes passed. Independent Ops ran with poisoned Python variables and a missing Server interpreter. No native service was registered or mutated.
• Exact packaged source for local evidence: aedf7beb1ecff2ea1fade6ccdd8e4bf6a298f799, version 1.4.2.dev36+gaedf7beb. Evidence records working-tree producer hashes separately and matches_committed_files=false; this is not a claim that the subsequently committed producer already ran in CI.
• Final Server archive SHA-256: ba3fefa0478dfa18aa0ece8ff928f9a02da46415d23bda9d676c909b3ac28167; Ops archive: d6171c2e40f84f2da2b44bcc69ff8852dc4a1be4fc207887e7d9cbd4160d3233; Ops manifest: cf707c6fa209dabf5576a0250569aaf7269e71b2b667adb815e66c72b69a2373.
• All three actual upstream interpreter archives were downloaded and hash/layout checked. Windows execution/path measurements and the full Intel cryptography build were not executed on this arm64 host; their native CI legs must pass. Signing, clean standard-user machines, login/reboot lifecycle and public release qualification remain separate acceptance work. Signing must precede final consumed hashes.
• Open Code Review remote review completed all 10 selected files. Its actionable environment, workflow and diagnostics findings were fixed. The plugin's delegate workflow then reviewed the final 19/19 changed files, including docs/tests/lock files excluded by default selection, with an independent Astra review of Intel/bootstrap behavior. Final file hashes were checked before commit; no blocking findings remain.

AI usage statement

Implemented with Codex using GPT-6.1 Sol, with earlier GPT-6 Luna investigation. The primary agent coordinated integration and final acceptance; GPT-6 Astra independently reviewed the Intel build/bootstrap boundary. Open Code Review remote and delegate modes were used before submission, and confirmed findings were repaired and revalidated.

[hireview001]

• CI failed: validate (failure).
• CI failed: Candidate macos-x86_64 (failure).
• CI failed: Candidate windows-x86_64 (failure).
• CI failed: Managed resource candidates (failure). Failed steps: Candidate windows-x86_64 / Produce twice, compare bytes, consume catalog, and run bundled launcher/Ops; Candidate macos-x86_64 / Acquire pinned interpreter and freeze native wheel closure.
• CI failed: E2E harness (failure). Failed steps: validate / Validate harness and Compose definitions.

[hidb4ai]

Reviewed commit 6d5113f. No remaining blocking code findings. The candidate-only production scope is consistent with the existing resource consumers; this adds no database tables or public HTTP/MCP/SDK operations.

Focused producer/resource tests, both lockfile checks (including the harness-pinned uv), lint, formatting and type checks passed locally. Native Windows/macOS checks are still pending and must pass before merge; local Linux checks do not establish native platform acceptance.