fix(genesis): qualify macOS physical Git and original-operation recovery

.github/workflows/genesis-process-group-host-probe.yml

@@ -0,0 +1,198 @@
+name: Genesis process-group host probe (diagnostic only)
+
+# One pinned diagnostic tag, before any product repair or full qualification.
+# All normal owning delivery/authorization checks remain separately required.
+on:
+  push:
+    tags: ['l2-genesis-group-probe-*', 'l2-genesis-git-probe-*', 'l2-genesis-git-inventory-*', 'l2-genesis-git-cold-*', 'l2-genesis-product-probe-*']
+
+permissions:
+  contents: read
+
+jobs:
+  linux-controller-probe:
+    name: Targeted installed controller coverage on Linux
+    if: startsWith(github.ref, 'refs/tags/l2-genesis-product-probe-')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
+        with: {fetch-depth: 0}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with: {python-version: '3.14'}
+      - name: Install exact committed candidate outside checkout
+        run: |
+          set -euo pipefail
+          python -m pip install coverage jsonschema==4.25.1
+          python tools/qualification/build_platform_wheel.py --source-root . --version 2.3.124 --wheel-directory "$RUNNER_TEMP/ep-controller-wheel" --install-python "$(command -v python)"
+          python - <<'PY'
+          from pathlib import Path
+          import hashlib,json,os,zipfile,engineering_platform
+          wheel=Path(os.environ['RUNNER_TEMP'])/'ep-controller-wheel/engineering_platform-2.3.124-py3-none-any.whl'
+          package=Path(engineering_platform.__file__).resolve().parent
+          assert not package.is_relative_to(Path.cwd())
+          with zipfile.ZipFile(wheel) as z:
+              files=[n for n in z.namelist() if n.startswith('engineering_platform/') and not n.endswith('/')]
+              assert all((package.parent/n).read_bytes()==z.read(n) for n in files)
+          Path('controller-installed-binding.json').write_text(json.dumps({'source':os.environ['GITHUB_SHA'],'wheel_sha256':hashlib.sha256(wheel.read_bytes()).hexdigest(),'payload_files':len(files),'qualification':'TARGETED_COMPONENT_ONLY_NOT_FULL_DOD'},indent=2)+'\n')
+          PY
+      - name: Targeted actual installed controller and filesystem regressions
+        run: |
+          set -euo pipefail
+          coverage run --branch --source=engineering_platform.genesis_git_runtime,engineering_platform.genesis_service,engineering_platform.genesis_worker,engineering_platform.platform_version -m unittest \
+            tests.engineering.test_genesis_bootstrap tests.engineering.test_genesis_contract_and_cli \
+            tests.engineering.test_genesis_git_runtime tests.engineering.test_genesis_git_recovery tests.engineering.test_genesis_git_controller \
+            tests.engineering.test_platform_productization.PlatformProductizationTest.test_release_version_is_consistent_across_every_canonical_component \
+            tests.engineering.test_execution_host.LocalAgentRunnerTest.test_engineering_platform_accepts_newer_compatible_runner \
+            tests.engineering.test_execution_host.LocalAgentRunnerTest.test_default_runner_compatibility_accepts_the_repository_manifest \
+            tests.engineering.test_execution_host.LocalAgentRunnerTest.test_current_storage_schema_is_admitted_for_retry_children \
+            tests.engineering.test_execution_host.LocalAgentRunnerTest.test_engineering_platform_rejects_incompatible_platform_version \
+            tests.engineering.test_execution_host.LocalAgentRunnerTest.test_engineering_platform_rejects_bootstrap_checkpoint_memory_and_report_mismatches \
+            tests.engineering.test_execution_host.LocalAgentRunnerTest.test_engineering_platform_rejects_older_runner
+          coverage json -o controller-coverage.json
+          python - <<'PY'
+          import json
+          from pathlib import Path
+          report=json.loads(Path('controller-coverage.json').read_text())
+          assert len(report['files'])==4
+          for name,value in report['files'].items():
+              summary=value['summary']
+              line=100*summary['covered_lines']/summary['num_statements']
+              print(name, 'line', line, 'combined', summary['percent_covered'])
+              assert line>80.2, name
+          # This targeted report does not replace the ordinary full-suite
+          # per-module combined branch/line 80.20% gate or any other CI check.
+          PY
+      - name: Preserve targeted original evidence even on failure
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: genesis-linux-controller-facts-${{ github.sha }}
+          path: |
+            controller-installed-binding.json
+            controller-coverage.json
+            .coverage
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 30
+  macos-group-probe:
+    name: Original installed Genesis group facts on macOS-14
+    runs-on: macos-14
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
+        with: {fetch-depth: 0}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with: {python-version: '3.14'}
+      - name: Original qualified wheel and separate noneditable installation
+        if: "!startsWith(github.ref, 'refs/tags/l2-genesis-product-probe-')"
+        env:
+          BASE_SOURCE: 4d0c0461d7a5ec7fb7a50aa42f775cc4be09faa5
+        run: |
+          set -euo pipefail
+          test "$RUNNER_ENVIRONMENT" = github-hosted
+          test ! -e /private/tmp/gpc1
+          test ! -e /private/tmp/npc1
+          git worktree add --detach "$RUNNER_TEMP/ep-original-source" "$BASE_SOURCE"
+          python tools/qualification/build_platform_wheel.py --source-root "$RUNNER_TEMP/ep-original-source" --version 2.3.123 --wheel-directory "$RUNNER_TEMP/ep-original-wheel"
+          python -m venv /private/tmp/gpc1
+          /private/tmp/gpc1/bin/python -m pip install --no-deps "$RUNNER_TEMP/ep-original-wheel/engineering_platform-2.3.123-py3-none-any.whl"
+          /private/tmp/gpc1/bin/python -m pip install jsonschema==4.25.1
+          npm install --prefix /private/tmp/npc1 --ignore-scripts --no-audit --no-fund @openai/codex@0.160.1
+          python - <<'PY'
+          from pathlib import Path
+          import os
+          root=Path('/private/tmp/npc1')
+          found=[p for p in (root/'node_modules/@openai').rglob('codex') if '/vendor/' in str(p) and p.is_file() and os.access(p,os.X_OK)]
+          assert len(found)==1, 'one real pinned native executable required'
+          (root/'bin').mkdir()
+          (root/'bin/codex').symlink_to(found[0])
+          PY
+          python - <<'PY'
+          from pathlib import Path
+          import hashlib,json,os
+          bundle=json.loads(Path('tests/engineering/fixtures/genesis_local/authority-bundle.json').read_text())
+          matches=[value['utf8'].encode() for name,value in bundle['files'].items() if name.endswith('/validate.py')]
+          assert len(matches)==1
+          assert hashlib.sha256(matches[0]).hexdigest()=='3ce4eca67c659d65ea2df70439d7f61bc8e4eb16b3d4b64b397d7fc3bdc16ae2'
+          path=Path(os.environ['RUNNER_TEMP'])/'original-validator.py'
+          path.write_bytes(matches[0]);path.chmod(0o600)
+          PY
+      - name: Current exact committed candidate and separate noneditable installation
+        if: startsWith(github.ref, 'refs/tags/l2-genesis-product-probe-')
+        run: |
+          set -euo pipefail
+          test "$RUNNER_ENVIRONMENT" = github-hosted
+          test ! -e /private/tmp/gpc1
+          test ! -e /private/tmp/npc1
+          python tools/qualification/build_platform_wheel.py --source-root . --version 2.3.124 --wheel-directory "$RUNNER_TEMP/ep-candidate-wheel"
+          python -m venv /private/tmp/gpc1
+          /private/tmp/gpc1/bin/python -m pip install --no-deps "$RUNNER_TEMP/ep-candidate-wheel/engineering_platform-2.3.124-py3-none-any.whl"
+          /private/tmp/gpc1/bin/python -m pip install jsonschema==4.25.1
+          npm install --prefix /private/tmp/npc1 --ignore-scripts --no-audit --no-fund @openai/codex@0.160.1
+          python - <<'PY'
+          from pathlib import Path
+          import hashlib,json,os
+          root=Path('/private/tmp/npc1')
+          found=[p for p in (root/'node_modules/@openai').rglob('codex') if '/vendor/' in str(p) and p.is_file() and os.access(p,os.X_OK)]
+          assert len(found)==1
+          (root/'bin').mkdir(); (root/'bin/codex').symlink_to(found[0])
+          bundle=json.loads(Path('tests/engineering/fixtures/genesis_local/authority-bundle.json').read_text())
+          matches=[value['utf8'].encode() for name,value in bundle['files'].items() if name.endswith('/validate.py')]
+          assert len(matches)==1
+          assert hashlib.sha256(matches[0]).hexdigest()=='3ce4eca67c659d65ea2df70439d7f61bc8e4eb16b3d4b64b397d7fc3bdc16ae2'
+          path=Path(os.environ['RUNNER_TEMP'])/'original-validator.py'
+          path.write_bytes(matches[0]);path.chmod(0o600)
+          PY
+      - name: Small exact-candidate installed chain with unchanged group detector
+        if: startsWith(github.ref, 'refs/tags/l2-genesis-product-probe-')
+        run: |
+          set -euo pipefail
+          WHEEL="$RUNNER_TEMP/ep-candidate-wheel/engineering_platform-2.3.124-py3-none-any.whl"
+          SHA=$(shasum -a 256 "$WHEEL" | cut -d' ' -f1)
+          /private/tmp/gpc1/bin/python -I tools/qualification/genesis_process_group_host_probe.py \
+            --python /private/tmp/gpc1/bin/python --native /private/tmp/npc1 \
+            --bundle tests/engineering/fixtures/genesis_local/authority-bundle.json \
+            --validator "$RUNNER_TEMP/original-validator.py" \
+            --wheel "$WHEEL" --wheel-sha256 "$SHA" --source "$GITHUB_SHA" --root-prefix pgp \
+            --output "$RUNNER_TEMP/ep-group-probe" --case before-register \
+            --recipient tools/qualification/fixtures/genesis-process-group-evidence-recipient.pem
+      - name: Small original installed chain with unchanged group detector
+        if: startsWith(github.ref, 'refs/tags/l2-genesis-group-probe-')
+        run: |
+          set -euo pipefail
+          /private/tmp/gpc1/bin/python -I tools/qualification/genesis_process_group_host_probe.py \
+            --python /private/tmp/gpc1/bin/python --native /private/tmp/npc1 \
+            --bundle tests/engineering/fixtures/genesis_local/authority-bundle.json \
+            --validator "$RUNNER_TEMP/original-validator.py" \
+            --wheel "$RUNNER_TEMP/ep-original-wheel/engineering_platform-2.3.123-py3-none-any.whl" \
+            --wheel-sha256 bc49e7a3b15c9021b16546a5ca96e5fbf280072d900d8d3dc173dee4b79d5b9e \
+            --source 4d0c0461d7a5ec7fb7a50aa42f775cc4be09faa5 --root-prefix pgc \
+            --output "$RUNNER_TEMP/ep-group-probe" --case before-register \
+            --recipient tools/qualification/fixtures/genesis-process-group-evidence-recipient.pem
+      - name: Read-only causal native Git shim and selected-runtime comparison
+        if: startsWith(github.ref, 'refs/tags/l2-genesis-git-probe-') || startsWith(github.ref, 'refs/tags/l2-genesis-git-cold-')
+        run: |
+          set -euo pipefail
+          /private/tmp/gpc1/bin/python -I tools/qualification/genesis_git_runtime_probe.py \
+            --order ${{ startsWith(github.ref, 'refs/tags/l2-genesis-git-cold-') && 'direct-first' || 'shim-first' }} \
+            --python /private/tmp/gpc1/bin/python --native /private/tmp/npc1 \
+            --output "$RUNNER_TEMP/ep-group-probe" \
+            --recipient tools/qualification/fixtures/genesis-process-group-evidence-recipient.pem
+      - name: Read only selected Git ownership metadata without executing Git or native
+        if: startsWith(github.ref, 'refs/tags/l2-genesis-git-inventory-')
+        run: |
+          set -euo pipefail
+          /private/tmp/gpc1/bin/python -I tools/qualification/genesis_git_runtime_probe.py \
+            --selection-inventory-only \
+            --python /private/tmp/gpc1/bin/python --native /private/tmp/npc1 \
+            --output "$RUNNER_TEMP/ep-group-probe" \
+            --recipient tools/qualification/fixtures/genesis-process-group-evidence-recipient.pem
+      - name: Preserve whitelisted observations and encrypted original private evidence
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: genesis-macos-group-observations-${{ github.sha }}
+          path: ${{ runner.temp }}/ep-group-probe/public
+          if-no-files-found: error
+          retention-days: 30

docs/engineering/GENESIS_MACOS_GIT_RUNTIME_V1.md

@@ -0,0 +1,82 @@
+# Genesis macOS selected physical Git
+
+Assignment `L2-GENESIS-MACOS-PROCESS-GROUP-CLOSURE-V1-20261019`;
+JOIN `L2-L3-GENESIS-APPLY-HOST-QUALIFICATION-V1-20261019`.
+Product allocation EP2.3.124, CENTRAL77, storage45, bootstrap contract1.0.
+The earlier EP2.3.123 delivery and its evidence remain closed and unchanged.
+
+## Supported host mode
+
+`MACOS_OS_SELECTED_PHYSICAL_GIT_V1` uses the physical Git selected by the
+existing root-owned `/var/db/xcode_select_link`. It accepts an executable under
+`/Applications` or `/Library/Developer` only. Binary and ancestor ownership,
+permissions, no-follow regular-file identity and bounded SHA256 reads are
+checked. Root and the current trusted installation owner are supported;
+non-root ancestors must not be group/world writable. Root-owned group-write
+is accepted only for Darwin wheel/admin (GID0/80); other groups such as staff
+do not acquire host execution authority. World-write always refuses.
+No consumer supplies an
+executable path, and there is no PATH or shim fallback for this macOS mode.
+
+The trusted installation-owner/system-administrator boundary is explicit.
+Before/after hashes and inode metadata are drift checks; they are not an atomic
+exec binding against an administrator or the same trusted owner replacing and
+restoring executable bytes during execution. Unsupported or changed host
+selection is an explicit error, not permission to silently replace a pin.
+
+The controller records the exact operation/host-bound selection in the private
+signed attempt before native execution. PREFLIGHT actually runs fixed
+`--version` inside the original native sandbox before target creation. Every
+controller step checks the selection; every Git command checks its binary.
+The worker does not read the selector through a new sandbox grant. Original
+five-second Git and thirty-second step deadlines, sanitized environment,
+finite filesystem capabilities, permit handshake and whole-group detector
+remain in force. Linux retains its existing Git executable selection and rejects
+a macOS-mode pin rather than treating it as authority for a fallback command.
+The shared finite-log and original-empty-metadata recovery checks apply on both
+supported platforms.
+
+## Original-operation recovery
+
+Explicit resume can add a new PREFLIGHT attempt to a signed legacy operation
+which had completed native readiness before this mode existed. Earlier
+attempts and completed-step history are retained; the completed prefix is not
+duplicated. A failed current-mode pin remains binding and cannot be repinned.
+Read/status never performs this migration or native work. COMPLETE remains the
+original result. Current authority, source identity and original scopes are
+required at their existing effect boundaries, including before recovery.
+
+An interrupted Git initialization can reuse only the originally granted Git
+metadata inode, literally empty and still bound to the same target and exact
+documents. The held execution descriptor is checked after the last runtime
+hash and immediately before Git. Foreign or unproved nonempty metadata remains
+preserved and refused; no delete, adoption, reset or replacement target is
+authorized. Existing proved initialized Git follows its original guard.
+
+Private stdout/stderr and timeout bytes are retained within finite limits.
+Overflow is failure, including successful Git with truncated stderr. Log I/O
+failure cannot hide a primary nonzero exit, timeout or overflow; both errors
+remain available. No public receipt exposes the private executable path,
+credential or raw diagnostic details.
+
+## Evidence boundaries
+
+The original macOS14 shim chain reproduced a five-second GIT_INIT timeout with
+live bash/xcodebuild members in the recorded group. The unchanged detector
+correctly rejected that group. Later same-shim and reverse-order controls also
+succeeded: a unique cache/warming cause is not established. Physical Git is an
+explicit supported host mode, not a universal causal claim or a timeout waiver.
+
+New candidate installed evidence on local macOS27 and hosted macOS14 includes
+actual native steps, committed documents, B8R, lost response, a real Server
+crash/restart, nonmutating GET, separately authorized resume and replay. These
+candidate receipts retain their own source/wheel pins. The legacy installed
+migration uses a current controlled WRITE_FILES crash; it does not reconstruct
+the unavailable historical hosted target or demonstrate its old Git failure.
+Component fault injection and modeled PID-reuse controls remain labeled as
+such. Candidate evidence is not exact-final-main proof or Forge R57 acceptance.
+
+Full owning CI, independent final reviews, protected source and separate
+nonempty Finalization, NEW exact-final-main installed evidence, readback and
+safe own cleanup are delivery gates. R57's writer/PR/timer/budgets remain
+untouched until an actually qualified owning handoff; no automatic successor.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "engineering-platform-browser-validation",
   "private": true,
-  "version": "2.3.123",
+  "version": "2.3.124",
   "scripts": {
     "test:engineering-dashboard": "PYTHONPATH=src python3 -m engineering_platform.dashboard_browser_validation",
     "test:engineering-dashboard-logic": "node --test tests/engineering/dashboard_status_store.test.mjs tests/engineering/ui_localization_contract.test.mjs tests/engineering/dashboard_translation.test.mjs tests/engineering/dashboard_js_coverage.test.mjs tests/engineering/dashboard_worker_logs.test.mjs tests/engineering/dashboard_log_read.test.mjs",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-platform"
-version = "2.3.123"
+version = "2.3.124"
 description = "Local-first Engineering Platform execution operations runtime"
 readme = "README.md"
 requires-python = ">=3.14,<3.15"

src/engineering_platform/ENGINEERING_PLATFORM_CONFIG.json

@@ -3,7 +3,7 @@
   "platform": {
     "id": "engineering-platform",
     "name": "Engineering Platform",
-    "version": "2.3.123",
+    "version": "2.3.124",
     "generation": 2,
     "documentation_namespace": "engineering-platform",
     "capability_registry_version": 1

src/engineering_platform/ENGINEERING_PLATFORM_VERSION.json

@@ -1,15 +1,15 @@
 {
   "bootstrap_contract": "2026.12",
   "checkpoint_format": 1,
-  "dashboard_version": "2.3.123",
+  "dashboard_version": "2.3.124",
   "handoff_protocol": 1,
   "memory_format": 2,
   "minimum_codex_cli": "0.146.0",
   "inbox_protocol": 1,
-  "platform_version": "2.3.123",
+  "platform_version": "2.3.124",
   "report_format": 2,
-  "runner_version": "2.3.123",
+  "runner_version": "2.3.124",
   "status_model": 1,
   "storage_schema": 45,
-  "watcher_version": "2.3.123"
+  "watcher_version": "2.3.124"
 }