Qualify the durable recipe coordinator with the signed worker

.github/workflows/quality.yml

@@ -86,6 +86,11 @@ jobs:
         timeout-minutes: 20
         run: python tools/execution_spikes/recipe_worker_e2e_qualification.py --json --strict
 
+      - name: Run durable recipe coordinator qualification
+        shell: pwsh
+        timeout-minutes: 35
+        run: python tools/execution_spikes/recipe_coordinator_e2e_qualification.py --json --strict
+
       - name: Prepare signed WebView2 bootstrapper
         shell: pwsh
         run: ./packaging/prepare_webview2.ps1

docs/adr/0001-capability-tiered-agentic-execution-harness.md

@@ -1007,12 +1007,15 @@ ready. Attachment staging stores only bounded, MIME-sniffed bytes behind an
 opaque artifact ID. `build_native_recipe_coordinator_factory` composes a fresh
 signed/native launcher, broker binder, protected pipe identity, and authenticated
 client for each recipe job; it requires an explicit reviewed process-factory
-injection and never falls back to a host process. The next core slice is an
-end-to-end durable-coordinator run through the packaged signed worker, including
-cancellation, retention, atomic publication, and native cleanup. The separate
-`recipe.release-review.v1` verifier is available as optional release hardening;
-it remains observation-only and no approval record or production trust material
-is committed.
+injection and never falls back to a host process. The durable-coordinator
+packaged-worker slice is now implemented as the strict Windows-only
+`recipe_coordinator_e2e_qualification.py` gate. It stages an attachment, runs
+the real signed/native coordinator, verifies owner isolation, retention expiry,
+cancellation, atomic publication, and complete native cleanup, and never falls
+back to a host process. Quality CI runs it after the existing worker release
+qualification. The separate `recipe.release-review.v1` verifier is available as
+optional release hardening; it remains observation-only and no approval record or
+production trust material is committed.
 
 ### Phase 3 — `scratch.auto.v1` arbitrary WebAssembly code
 

docs/adr/0001-phase2-evidence.md

@@ -1,7 +1,7 @@
 # ADR-0001 Phase 2 evidence log
 
 - **Phase:** 2 — signed image recipes and calculator/check primitives
-- **Status:** Open-source qualification track complete through the fixed-function worker boundary; optional official-release hardening is separate
+- **Status:** Open-source qualification track complete through the durable packaged-worker coordinator boundary; optional official-release hardening is separate
 - **Scope:** Provider-independent contracts plus a qualification-only fixed-function core
 - **Source decision:** [Capability-tiered agentic execution harness](0001-capability-tiered-agentic-execution-harness.md)
 - **Contract ADR:** [Phase 2 typed recipe and primitive contract](0001-phase2-recipe-contract.md)
@@ -35,9 +35,10 @@
 | Fixed-function image provider core | **Complete (qualification-only)** | `RecipeImageProvider` validates allowlisted PNG/JPEG/WebP bytes, verifies/loads one frame with Pillow bomb/resource limits, applies only parsed steps, strips metadata, revalidates encoded output, and checks cancellation. The provider remains separate from the API; the typed coordinator route is qualification-only and default-off. |
 | Windows recipe sandbox qualification harness | **Complete (signed launch/broker/hostile/cancellation/resource/watchdog)** | `recipe_worker_e2e_qualification.py` signs a disposable package with an in-memory key, installs/verifies one immutable generation, binds the live AppContainer identity to the broker, and exercises the fixed PNG transform, truncated-PNG decoder rejection, active-SVG decoder rejection, and in-flight cancellation corpus. `resource_watchdog_qualification.py` separately proves immutable budgets, actual Job Object accounting, and kill-on-close tree reaping. The native broker uses bounded availability polling before reads so the cancellation reader remains live while the packaged provider transforms. |
 | Suspended native launcher/resource policy | **Complete (factory + binder + ACL cleanup + qualification evidence)** | `NativeWin32ProcessFactory` grants only inherited read/execute access to the fresh AppContainer SID on the verified package root, applies and verifies Job Object policy before resume, and removes the per-launch ACE during cleanup. `NativeBrokerIdentityBinder` pins the live server to the worker PID/AppContainer SID and launcher cleanup closes it on failure. |
-| OS sandbox provider and provider-produced image outputs | **Complete (qualification; default-off in the app)** | Signed installation, provenance, AppContainer/job identity, broker handshake, `prepare`, `input_chunk`, `input_complete`, `collect_output`, hostile decoder rejection, in-flight cancellation acknowledgement, artifact security review, resource accounting, and watchdog tree reaping are qualified. The explicit lifecycle composition, durable recipe coordinator/publication path, typed qualification-only API, trusted attachment staging, and per-job signed/native attempt factory are wired behind injection; the next gate is a durable-coordinator run through the packaged worker. Official-release review/signing remains optional hardening. |
+| OS sandbox provider and provider-produced image outputs | **Complete (qualification; default-off in the app)** | Signed installation, provenance, AppContainer/job identity, broker handshake, `prepare`, `input_chunk`, `input_complete`, `collect_output`, hostile decoder rejection, in-flight cancellation acknowledgement, artifact security review, resource accounting, watchdog tree reaping, and the durable packaged-worker coordinator run are qualified. Official-release review/signing remains optional hardening. |
 | Explicit qualification-profile lifecycle wiring | **Complete (local/CI composition; default-off in the app)** | `build_execution_lifecycle()` accepts only exact `disabled`/`qualification` selection, requires a qualification release gate, coordinator factory, and provider-health probe, and composes them in a fail-closed order. `Cortex_Preview.build_preview_app` exposes this only as an explicit injection; the normal app supplies no profile or controls. |
 | Durable recipe coordinator/request, attachment staging, and artifact publication | **Complete (qualification-only API; default-off in the app)** | `RecipeExecutionCoordinator` persists only opaque artifact IDs and canonical plan digests, enforces owner-scoped input reads and idempotency conflicts, leases/recoveries/cancels attempts, validates worker envelopes/chunks, and publishes exactly one output through `ArtifactBoundary.collect_outputs`. `POST /api/v1/execution/attachments` creates an idempotent owner-scoped `attachment.stage.v1` record through `ArtifactBoundary.stage_bytes`; `POST /api/v1/execution/recipe/image` consumes its opaque artifact ID after a ready `qualification` lifecycle. `build_native_recipe_coordinator_factory` binds a fresh signed/native launcher/broker/client attempt per job without host fallback. `tests/test_phase2_recipe_coordinator.py`, `tests/test_phase2_recipe_api.py`, `tests/test_phase2_attachment_staging.py`, `tests/test_phase2_native_recipe_attempt.py`, and `tests/test_phase2_qualification_lifecycle.py` cover the hostile, cancellation, API, native-composition, and lifecycle paths. |
+| Durable packaged-worker coordinator qualification | **Complete (local + hosted CI; default-off)** | `recipe_coordinator_e2e_qualification.py --json --strict --timeout-seconds 300` passed on Windows using an in-memory ephemeral signing key and a disposable immutable installer generation. The single coordinator corpus staged a PNG attachment, completed a real signed/native transform, verified digest/MIME/size and atomic publication, rejected a foreign owner, expired and purged a one-second artifact, cancelled an in-flight transform with no result artifact, and verified native worker/process and temporary-root cleanup. Final Quality run [30466976650](https://github.com/dovvnloading/Cortex/actions/runs/30466976650), job [90627154917](https://github.com/dovvnloading/Cortex/actions/runs/30466976650/job/90627154917), passed on commit `0c7b350` in 4m15s after the packaged worker release qualification. |
 
 ## Security invariants
 
@@ -144,6 +145,7 @@ python -m pytest tests/test_recipe_sandbox_qualification.py -q
 python tools/execution_spikes/native_launcher_qualification.py
 python tools/execution_spikes/recipe_sandbox_qualification.py --json --strict
 python tools/execution_spikes/recipe_worker_e2e_qualification.py --json --strict
+python tools/execution_spikes/recipe_coordinator_e2e_qualification.py --json --strict --timeout-seconds 300
 python tools/execution_spikes/recipe_parser_fuzz.py --json --strict
 python tools/execution_spikes/artifact_security_review.py --json --strict
 python tools/execution_spikes/resource_watchdog_qualification.py --json --strict
@@ -302,8 +304,9 @@ provider-health probe. The normal application remains default-off. The durable
 recipe-specific coordinator/request and artifact-publication path is now
 implemented as an explicit qualification-only API surface with a typed
 TypeScript client method; no outside reviewer or production key was required for
-it. The next core slice is trusted attachment staging and binding the real
-signed/native broker worker into the injected attempt factory.
+it. Trusted attachment staging and binding the real signed/native broker worker
+into the injected attempt factory are now complete; the durable packaged-worker
+coordinator qualification is the hosted CI gate for this stage.
 
 **Qualification API stage verification (2026-07-29):** The explicit
 `POST /api/v1/execution/recipe/image` surface is available only from a ready
@@ -330,6 +333,19 @@ the explicit coordinator helper requires a reviewed process-factory injection
 and creates no process during configuration. Focused verification passed 52
 tests across artifact boundary, attachment staging, native composition, API,
 and launcher suites; the qualification route remains unavailable in the normal
-default-off app. The next gate is an end-to-end durable-coordinator run through
-the packaged signed worker, including cancellation, retention, publication, and
-native cleanup.
+default-off app. Hosted Quality CI verification of the durable packaged-worker
+coordinator gate is complete.
+
+**Durable packaged-worker coordinator qualification result (2026-07-29):** The
+strict Windows probe
+`recipe_coordinator_e2e_qualification.py --json --strict --timeout-seconds 300`
+passed locally using only an in-memory ephemeral Ed25519 key and a disposable
+installer store. In one coordinator instance it staged a fixed PNG attachment,
+completed a signed/native transform with digest/MIME/size checks and atomic
+publication, rejected a foreign-owner request before worker launch, expired and
+purged a one-second attachment, cancelled an in-flight resize transform with no
+published result, and verified native process plus temporary workspace cleanup.
+The probe remains qualification-only and does not enable the normal application;
+hosted Quality CI run [30466976650](https://github.com/dovvnloading/Cortex/actions/runs/30466976650)
+and job [90627154917](https://github.com/dovvnloading/Cortex/actions/runs/30466976650/job/90627154917)
+passed the same gate on commit `0c7b350` in 4m15s.

docs/adr/0001-phase2-native-launcher.md

@@ -82,19 +82,18 @@ The fixed probe and watchdog corpus do not yet prove enforcement against a real
 signed recipe worker, resource-exhaustion behavior across supported Windows
 versions, or external launcher review.
 
-## Remaining blockers
-
-- The fixed signed `recipe_worker.exe` package is not shipped at the immutable
-  installer generation used by the launcher.
-- The fixed signed `recipe_worker.exe` bundle is not installed in the immutable
-  generation used by the launcher, so no real worker has completed the broker
-  handshake yet.
-- The packaged worker loop is now broker-only and fail-closed; the disposable
-  signed-worker qualification covers authenticated input/output, hostile decoder,
-  and cancellation cases, but the immutable production generation is not shipped
-  at the launcher path.
-- Real signed-worker resource enforcement, external security review, and lifecycle
-  health-gated wiring remain separate release gates.
+## Remaining release-hardening boundaries
+
+- The open-source qualification path uses a disposable ephemeral signing key and
+  temporary immutable installer generation; a production signed package and
+  pinned trust root are still optional official-release material.
+- External security review and release-specific resource/enforcement review remain
+  separate official-release gates.
+
+The disposable signed-worker qualification and the strict durable-coordinator
+qualification now prove a real broker handshake and native process lifecycle on
+Windows. Missing or unverifiable worker material still blocks the profile; there
+is no host-process or weaker-sandbox fallback.
 
 If any control is missing or cannot be verified, the provider remains unavailable;
 there is no host-process or weaker-sandbox fallback.

docs/adr/0001-phase2-qualification-lifecycle.md

@@ -68,10 +68,11 @@ The recipe-specific coordinator/request, trusted attachment staging, native
 attempt composition, and artifact-publication path plus their typed
 qualification-only API surfaces are now implemented behind this lifecycle
 boundary. It preserves the same release gate, native launcher, broker identity,
-resource/watchdog, and trusted artifact controls. The next slice is an
-end-to-end durable-coordinator run against the packaged signed worker, including
-cancellation, retention, publication, and native cleanup; it must remain
-default-off in the application.
+resource/watchdog, and trusted artifact controls. The durable-coordinator run
+against the packaged signed worker is now implemented as a separate strict
+qualification probe; it exercises cancellation, retention, publication,
+owner-isolation, and native cleanup while remaining default-off in the
+application.
 
 ## Verification
 
@@ -82,3 +83,16 @@ diagnostics, clean stop, and repository-bound worker-attempt factory wiring.
 `tests/test_phase2_recipe_api.py` covers both routes' ready-lifecycle gates and
 owner/idempotency/error behavior. `tests/test_phase2_native_recipe_attempt.py`
 covers explicit native composition without launch during configuration.
+The packaged-worker coordinator gate is
+`tools/execution_spikes/recipe_coordinator_e2e_qualification.py`; its local
+Windows run passed the transform, owner-isolation, retention, cancellation,
+atomic-publication, and native-cleanup cases. Quality CI runs it after the
+packaged worker release qualification.
+
+## Next stage
+
+Hosted Quality CI run [30466976650](https://github.com/dovvnloading/Cortex/actions/runs/30466976650)
+and job [90627154917](https://github.com/dovvnloading/Cortex/actions/runs/30466976650/job/90627154917)
+passed the coordinator gate on commit `0c7b350`. The immediate remaining action
+is review/merge of PR #64; the application remains disabled unless an explicit
+caller injects a ready qualification profile.

docs/adr/0001-phase2-recipe-contract.md

@@ -69,15 +69,16 @@ profile is now deliberately composable through an explicit injected lifecycle
 builder. Outside review and production trust are optional official-release
 hardening, not open-source prerequisites.
 
-## Required next gates
-
-1. Add trusted attachment staging and bind the real signed/native broker worker
-   into the injected attempt factory behind the passing lifecycle health check.
-   The qualification-only request surface and implemented coordinator are
-   documented in [the coordinator ADR](0001-phase2-recipe-coordinator.md); the
-   lifecycle builder intentionally does not create processes or discover
-   artifacts. Official prebuilt releases may add external review and production
-   trust as optional hardening.
+## Required next gate
+
+The trusted attachment boundary, signed/native attempt factory, and durable
+packaged-worker coordinator qualification are implemented behind the passing
+lifecycle health check. Hosted Quality run [30466976650](https://github.com/dovvnloading/Cortex/actions/runs/30466976650)
+passed `recipe_coordinator_e2e_qualification.py` on commit `0c7b350`; the
+immediate remaining action is review and merge. The lifecycle builder still
+intentionally does not create processes or discover artifacts. Official
+prebuilt releases may add external review and production trust as optional
+hardening.
 
 ## Verification
 

docs/adr/0001-phase2-recipe-coordinator.md

@@ -2,7 +2,8 @@
 
 - **Status:** Implemented and verified behind an explicit qualification-only
   API boundary, including trusted attachment staging and signed/native attempt
-  composition; the normal application remains default-off
+  composition and a durable packaged-worker qualification corpus; the normal
+  application remains default-off
 - **Phase:** 2 - fixed-function image recipe
 - **Parent:** [Capability-tiered agentic execution harness](0001-capability-tiered-agentic-execution-harness.md)
 - **Depends on:** [typed recipe contract](0001-phase2-recipe-contract.md),
@@ -136,13 +137,22 @@ composition, and bounded cleanup. The generated OpenAPI and TypeScript
 contracts include both typed envelopes, and `frontend/src/api/client.ts`
 exposes the qualification routes without enabling them in the UI by default.
 
+The qualification-only packaged-worker gate is
+`tools/execution_spikes/recipe_coordinator_e2e_qualification.py`. It signs the
+already-built one-folder worker with an in-memory ephemeral key, installs one
+disposable immutable generation, stages a PNG through `AttachmentStagingService`,
+and drives the real `RecipeExecutionCoordinator` through the native
+AppContainer/broker/client attempt. Its strict corpus verifies successful
+publication and digest/MIME/size binding, foreign-owner rejection, retention
+expiry and purge, in-flight cancellation with no result artifact, absence of
+temporary publication directories, and complete native process cleanup. The
+probe is Windows-only, bounded, redacted, and has no host-process fallback.
+
 ## Next stage
 
-The next implementation decision is an end-to-end qualification run through the
-durable coordinator using the packaged signed worker: stage an attachment,
-launch/bind the native attempt, exercise transform and cancellation, and verify
-retention, owner isolation, atomic publication, and complete native cleanup.
-That run must preserve this API/coordinator contract and keep the normal
-application default-off. No external reviewer or production key is required to
-continue the open-source qualification path; production trust remains optional
-release hardening.
+The coordinator implementation and hosted Quality CI gates are complete. The
+immediate remaining action is review/merge of PR #64. Any follow-on Phase 3
+arbitrary-code profile requires its own ADR and qualification gates; this
+API/coordinator contract must remain default-off. No external reviewer or
+production key is required for the open-source qualification path; production
+trust remains optional release hardening.

docs/adr/0001-phase2-recipe-provider.md

@@ -120,9 +120,14 @@ health-gated builder. The durable recipe coordinator binds that worker contract
 to owner-scoped staged artifacts and atomic publication, and the typed API route
 is available only after the lifecycle is ready. Trusted attachment staging and
 signed/native attempt composition are now present behind that same lifecycle.
-The next gate is an end-to-end durable coordinator run through the packaged
-worker: the provider must launch out of process, complete a staged transform,
-cancel in flight, and prove retention, publication, and native cleanup. It must
-never fall back to a host process or in-process execution.
+The packaged-worker coordinator gate is now implemented by
+`tools/execution_spikes/recipe_coordinator_e2e_qualification.py`. Its strict
+Windows corpus launches the provider out of process, completes a staged
+transform, rejects a foreign owner, expires and purges a short-retention
+attachment, cancels in flight, verifies atomic publication, and proves native
+cleanup. It never falls back to a host process or in-process execution. Hosted
+Quality run [30466976650](https://github.com/dovvnloading/Cortex/actions/runs/30466976650)
+passed this gate on commit `0c7b350`; the immediate remaining action is review
+and merge.
 External review and production signing remain optional official-release
 hardening.