Bind capture admission to coordinator-leased job identity

[coneilen]

Summary

Bind capture admission to a separately coordinator-written lease and its hashed job instead of stale B head/base, executable, equivalence and CI-text literals. This is the G2-R2 tooling-only follow-up to the accepted R1 core, not capture authority or product readiness.

Refs #822

Changes

• Keep the same supervisor/worker/process/release engine in exactly the four approved existing files. Both processes recompute shared typed identity checks: exact Git objects and clean source head, reviewed-reference product/provider/build-input equivalence, current-head CI run/attempt/context identities, fresh-build receipts, original receipts, archive/source bytes, logs, inputs and executable hashes.
• The lease separately binds head/base/lane, job/review/equivalence/build/CI digests and CI identities. The job's named delta paths must equal actual Git diffs; fixed product/build-input coverage cannot be replaced by supplied success booleans. Job hashes identify data, not human approval. Build and CI checks validate coordinator-admitted artifacts; the capture process neither compiles products nor independently observes compilation or live GitHub.
• Preserve owned fixture relocation, all five embedded paths, reserved-root refusal, explicit-offset UTC, the 15-minute ceiling/90-second cleanup reserve, real empty/nonempty/Unicode launch binding, held-generation/kernel/EOF guards, and failure-aware official release. The supported live scene adapter remains B's five scenes/two phases; C/D/E adapters explicitly refuse. Generic D identity passes only a labelled no-desktop harmless-target rehearsal.
• Extend the real offline child from 31 to 49 cases. The new actual-supervisor negatives cover red CI, binary mismatch, non-equivalent product changes, omitted product-diff paths, swapped phases, unrelated base, wrong/empty/duplicate CI, duplicate JSON, altered source bytes, mismatched lease base and null/stale build provenance. Each refuses before the worker with its actual official release file. Existing scene mocks remain labelled component-only.
• After independent source review, require base ancestry, hash and parse the same immutable JSON byte read, and disable optional Git index locks/fsmonitor when inspecting the read-only source repository.
• Read mutable worker journals with delete-sharing, retain a held old snapshot across actual atomic replacement, and re-open for the fresh completed snapshot. Existing worker JSON updates use File.Replace with a typed null backup path; first publication uses non-overwriting File.Move. A named physical-I/O case covers the actual reader and actual writer. Errors still fail closed; there are no retries or delete-before-move gaps.
• Separately execute Test-CapNativeBindings offline: 16/16 DLL exports resolved using load/export lookup only, zero HWND actions. This is not WinApp/native UI compatibility.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcs\ig2r2\admission-red-v1 -AdmissionContractOnly -> 9 executed, 0 passed, 9 failed; red CI, binary mismatch and product diff were accepted by the actual old supervisor instead of refused; retained admission-red-v1.log and report.json.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcs\ig2r2\journal-api-green -> 49 executed, 49 passed, 0 failed: all original31,17 admission/scene-contract cases and the new actual journal reader/writer I/O regression; official refusal receipts and old/fresh snapshot proof retained.
REGRESSION: gh pr checks 824 -R scgopi/GraphCode --watch --interval 30 -> head67c515924f4bad1ac5bc40fdb800dd9ef9c301cc has seven successful workflows and24 completed pre-edit contexts (20SUCCESS/4configuredSKIPPED); hosted jobs116206306515/116206306588/116206310165 each prove actual49/49/0 and unchangedG1166/166/0; port contract343s of900s passed.

Exact tested/reviewed source is 67c515924f4bad1ac5bc40fdb800dd9ef9c301cc on accepted tooling base 5635acbc15c12df7d609701c9f43a87118d9b0ad. All four R2 source files are byte-identical to the locally tested journal-repair commit before the operator-approved tooling-only rebase. No workflow or runner edit is in this PR.

Hosted full ValidationRunner	Run / job	Capture child	G1 child	Contract step
Windows 2022 hardening	38668636857 / 116206306515	49/49/0	166/166/0	314 s
Windows 2025 hardening	38668636857 / 116206306588	49/49/0	166/166/0	305 s
Windows port Swift	38668636845 / 116206310165	49/49/0	166/166/0	343 s of 900 s

The port Swift job also completed successfully in 25m45s of its unchanged 45-minute job limit. The source-head run/job inventory and all three nonempty logs are retained. The final body-edit TDD event is an additional same-head gate recorded separately in the frozen packet; its extra rollup context must not be confused with the seven latest-per-workflow inventories.

The initial test-only -AdmissionContractOnly selector was removed after the retained RED, when the operator narrowed local validation to the full direct child (or -LaunchContractOnly). That historical RED command is not replayable on the final head, and its exact test-source file was not retained; the original failure output, report, input jobs, official receipts and source digests are retained. The first full GREEN at C:\gcs\ig2r2\green (40/40/0) used intermediate sources, regression (45/45/0) used the first signed candidate, and final (48/48/0) preceded the distinct-phase-byte fixture improvement. These and final-confirm (48/48/0) are separate earlier histories, not the current journal-api-green (49/49/0). The extra typed-data/coverage hardening cases did not each have their own RED; the feature-level red-CI/binary/product admission RED is genuine. No compilation/setup failure was presented as behavioural RED.

Export-only command: pwsh -NoProfile -File C:\gcs\ig2r2\Test-NativeExports.ps1 -> 16/16 resolved, zero HWND actions. The module hash and individual resolved entry points are in the retained export report.

Real B data-only command: pwsh -NoProfile -File C:\gcs\ig2r2\Test-BAdmissionWitness.ps1 -> actual identity, scene-contract, complete fixture-mapping and supervisor preflight-report DATA validators pass with repaired control hashes and the copied passing49-case report. The owned witness has seven historically coordinator-admitted CI runs/24 contexts and 116 source files per phase. Zero copied product launches, HWND actions or images. This wrapper authors normalized data and NOT_GRANTED identity bindings; it does not demonstrate coordinator admission of a production job, a live lease path, fixed runtime launch layout or scene execution. Its a44/65194 builds and unchanged 00:40 CI observation are historical data, not current-main or future-grant freshness; after the tooling merges B needs a new current head/CI/fresh builds/data.

Preserved failed iterations: head e6c8bf8's port run 38663273264, job 116189300841, timed out in the then-current five-minute runner-contract step. It started at 01:02:58.292Z; G1's 166/166 summary arrived at 01:06:06.044Z (188 seconds), leaving approximately 114 seconds for the capture child; the deadline fired at 01:08:00.665Z without a capture summary. The passing hardening jobs did not satisfy this failed gate. A budget-only Git/archive fixture reuse attempt was preserved and surgically removed under the operator's separate runner-budget change; it is not in this PR. This PR edits neither that workflow nor its runner guard, and does not change the capture lease's 15-minute/90-second limits. The first optimisation run budget-green is retained at 35/48 because a singleton proof-path array became a scalar; the corrected budget-final is retained at 46/48 because the genuine-empty command's final journal replacement was denied (and its dependent report-gate case failed). That target was ready, exit 0, retained-kernel exited and both streams reached EOF; official release correctly stayed CLEANUP_UNPROVEN. No success or metadata/ownership fallback was substituted.

The journal reader policy has a deterministic actual-file RED at C:\gcs\ig2r2\red: 49 executed, 47 passed, two failures (held reader blocks the actual worker atomic writer, plus the dependent preflight-report guard). It used a behaviour-preserving staged reader seam with the old sharing policy, not a missing-API or compile failure. All four exact RED sources are retained under journal-red-source. The share-delete-only attempt journal-green also remains 47/49: overwrite-move still refused the open destination on this host. The first File.Replace attempt journal-final is retained at 39/49 because PowerShell coerced an untyped null backup path to an empty string; that is an interop mistake, not a replacement-semantics result. The corrected worker uses a typed null and File.Replace for existing JSON snapshots, non-overwriting File.Move for first publication, and no retry/delete-then-move gap. These observations do not attribute the original transient's exact handle owner; external readers were not excluded. No CIM or kernel-death guard is weakened.

Not verified / NotExecuted: local full ValidationRunner.Tests.ps1 and validate.ps1 -Task windows-shell (their existing hidden native fixtures are not authorised), product builds by this worker, full native/WinApp compatibility, desktop, GUI, GraphCode/graphcoded/zmx execution, UIA/keyboard/input/rendering/pixels/screenshots, a live capture lease, B's prospective slot, C/D/E scenes, backend turns, product parity and readiness. No GUI staging or lease clock was started. Existing unforced supervisor-deadline/unsafe-CIM/rollback faults remain unproven; a target timeout is not supervisor deadline coverage.

The held-reader case is direct physical file I/O, not full concurrent-process collision stress. An unforced ACL/I/O failure or a reader-open collision still fails closed and may abort a later slot; no retry or broader reliability claim is made. The original transient's exact blocking-handle owner was not measured.

The supplied R1 packet BF7DF3DBEDFB24B8BA6F269145AFE72177FE1C5AFC517797BA9FED3BD827259A, its accepted review and original 31-case report remain immutable. The external B artifacts were genuinely rebuilt at a44 AFTER / 65194 BEFORE at their recorded times, not relabelled older binaries; they remain historical data, not current-main grant evidence, and their raw receipts stay read-only. Synthetic CI/build/review data in the new command cases is not live GitHub or product-build evidence. CI inventory completeness, configured-skip classification, review acceptance and refreshing real GitHub immediately before grant remain coordinator responsibilities; the core cannot detect omitted unlisted runs/contexts or authenticate compilation. Worker-side divergence with production modes was not fault-injected. If any future harness failure occurs in the separately approved single GUI slot, all captures stop and return to the operator; no retry is authorised here.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

make test / make check are macOS commands and were not run on this Windows tooling-only scope. The permitted offline commands above are the local evidence; hosted exact-head CI supplies the full-runner gate. This PR stays draft and unmerged.