test(azure): bind Claude runtime bundle to exact provider artifact bytes

[ruby-dlee]

Intent

Validate the exact current head of branch codex/azure-final-claude-acceptance. Relative to current main, the authored change strengthens the executable Claude runtime-bundle contract: every fixture artifact has distinct bytes, bin/claude must equal the exact supplied provider binary, its manifest digest must match those bytes, and Codex-only artifacts must remain absent. Production behavior is unchanged. R1, R2, R3, R5, R6, R7, and R8 are DONE; R4 and R9 remain PARTIAL until this fresh protected validation cell reaches close with its worktree disk released. R10 remains DROPPED, and C1 through C3 must not be promoted.

Run the full no-mistakes pipeline on this exact pushed head, including behavior tests through the Azure shard bridge, adversarial review, documentation checks, lint, push verification, PR creation, PR hygiene, and CI. No pull request exists for this branch; create it only in the pipeline's PR step and do not merge it during the run. Owner decisions at any gate must use the sealed signed owner-decision protocol for this exact run and gate. If review proves the contract inaccurate or incomplete, fix only tests/fm-azure-runtime-bundle.test.sh, push the corrected head to the same branch, and wait for green CI. Otherwise leave the head unchanged.

What Changed

• tests/fm-azure-runtime-bundle.test.sh now writes a distinct payload per fixture ELF binary (the artifact's filename is embedded after the header) so bundled binaries are no longer byte-identical to each other.
• The Claude runtime bundle contract check extracts bin/no-mistakes, bin/claude, bin/gh, and bin/node from the tarball and asserts bin/claude equals the exact supplied provider artifact bytes and that all four extracted binaries hash to distinct SHA-256 digests.
• The same check asserts the runtime.json manifest's declared digest for bin/claude matches sha256: of the provider artifact bytes, alongside the existing assertions that bin/codex and bin/codex-code-mode-host stay absent.

Risk Assessment

✅ Low: The change is a 13-line, test-only strengthening of an existing Claude runtime-bundle contract whose assertions I verified against the real producer's manifest and archive output; it touches no production code, and the modified fixture helper is used nowhere else in the repository.

Testing

Ran the single relevant test file (tests/fm-azure-runtime-bundle.test.sh, all six cases green) on top of the already-green baseline test command, then drove the real bundle producer manually to capture the operator-visible artifact: bin/claude's shipped bytes equal the supplied provider binary, its manifest digest matches those bytes, all four binary payloads are distinct, and both Codex-only artifacts are absent. To show the strengthened contract is not vacuous I built a self-consistent misbound bundle (bin/node's bytes shipped as bin/claude with the digest updated to match) and ran each commit's assertion block against it verbatim: the parent commit accepts it, this change rejects it, and under the parent's identical-byte fixtures the misbinding is invisible at the payload level entirely - confirming the fixture-byte and assertion changes are one indivisible strengthening. The diff touches no non-test file, so production behavior is unchanged as claimed. No screenshot applies: this is a CLI/archive-contract change with no rendered surface, so the reviewer-visible evidence is the producer transcript, the generated runtime.json manifest, and the digest/discrimination tables.

Evidence: Shipped Claude bundle: payload bytes vs supplied artifacts vs manifest digests

== operator view: shipped Claude runtime bundle == provider : claude provider_path : bin/claude == bin/* payload bytes vs supplied provider artifacts == member sha256(bundle bytes)manifest digest == supplied file bin/claude c223671b507cafb9 match YES bin/gh b379d12ff5ec8c39 match YES bin/gh-axi 425ba2cbe2b8b6e9 match n/a bin/no-mistakes 19291eff935e56aa match YES bin/node 8625501564b3823c match YES distinct payload digests among ['bin/no-mistakes', 'bin/claude', 'bin/gh', 'bin/node'] -> 4 of 4 bin/claude bytes == artifacts/claude bytes -> True manifest digest for bin/claude == sha256(artifacts/claude) -> True Codex-only artifacts absent -> bin/codex: True bin/codex-code-mode-host: True

== operator view: shipped Claude runtime bundle ==
provider        : claude
provider_path   : bin/claude
members         : bin/claude bin/gh bin/gh-axi bin/no-mistakes bin/node gh-axi/dist/bin/gh-axi.js gh-axi/dist/src/author.json gh-axi/dist/src/cli.js gh-axi/dist/src/passwordless.json gh-axi/dist/src/secret.js gh-axi/dist/src/secretary.json gh-axi/dist/src/tokenizer.json gh-axi/node_modules/fixture-dependency/dist/index.js gh-axi/node_modules/fixture-dependency/package.json gh-axi/package.json runtime.json

== bin/* payload bytes vs supplied provider artifacts ==
member                          sha256(bundle bytes)manifest digest     == supplied file  
bin/claude                      c223671b507cafb9    match               YES               
bin/gh                          b379d12ff5ec8c39    match               YES               
bin/gh-axi                      425ba2cbe2b8b6e9    match               n/a               
bin/no-mistakes                 19291eff935e56aa    match               YES               
bin/node                        8625501564b3823c    match               YES               

distinct payload digests among ['bin/no-mistakes', 'bin/claude', 'bin/gh', 'bin/node'] -> 4 of 4
bin/claude bytes == artifacts/claude bytes -> True
manifest digest for bin/claude == sha256(artifacts/claude) -> True
Codex-only artifacts absent -> bin/codex: True  bin/codex-code-mode-host: True

Evidence: Misbinding discrimination: old contract accepts the wrong provider bytes, new contract rejects them

Misbound bundle = bin/node's bytes shipped at bin/claude, with the manifest digest updated to match, i.e. a self-consistent bundle whose own digest recheck still passes. --- fixture regime: PARENT COMMIT 7b6b15f (all six artifacts written with identical bytes) --- supplied artifact digests: no-mistakes/claude/gh/node all c8b9669bd01ccecf misbound bundle payload vs correct bundle payload: NO - member bytes identical, defect invisible parent-commit assertions vs misbound bundle: PASS (accepted) this-change assertions vs misbound bundle: FAIL (rejected) this-change assertions vs correct bundle: FAIL (rejected) --- fixture regime: THIS CHANGE bb96be9 (each artifact's bytes carry its own name) --- supplied artifact digests: 19291eff935e56aa / c223671b507cafb9 / b379d12ff5ec8c39 / 8625501564b3823c misbound bundle payload vs correct bundle payload: YES - member bytes differ parent-commit assertions vs misbound bundle: PASS (accepted) this-change assertions vs misbound bundle: FAIL (rejected) this-change assertions vs correct bundle: PASS (accepted)

== Does the Claude runtime-bundle contract catch a producer that binds the WRONG bytes as bin/claude? ==

Misbound bundle = bin/node's bytes shipped at bin/claude, with the manifest digest
updated to match, i.e. a self-consistent bundle whose own digest recheck still passes.
Only a contract that compares bin/claude against the SUPPLIED provider binary can see it.
Assertion blocks below are lifted verbatim from each commit's claude_provider_bundle_contract.

--- fixture regime: PARENT COMMIT 7b6b15f (all six artifacts written with identical bytes) ---
    sha256 (first 16) of the supplied artifacts handed to the producer:
      no-mistakes    c8b9669bd01ccecf
      claude         c8b9669bd01ccecf
      gh             c8b9669bd01ccecf
      node           c8b9669bd01ccecf
    misbound bundle payload vs correct bundle payload: NO - member bytes identical, defect invisible
    parent-commit assertions vs misbound bundle: PASS (accepted)
    this-change  assertions vs misbound bundle: FAIL (rejected)
    this-change  assertions vs correct  bundle: FAIL (rejected)

--- fixture regime: THIS CHANGE bb96be9 (each artifact's bytes carry its own name) ---
    sha256 (first 16) of the supplied artifacts handed to the producer:
      no-mistakes    19291eff935e56aa
      claude         c223671b507cafb9
      gh             b379d12ff5ec8c39
      node           8625501564b3823c
    misbound bundle payload vs correct bundle payload: YES - member bytes differ
    parent-commit assertions vs misbound bundle: PASS (accepted)
    this-change  assertions vs misbound bundle: FAIL (rejected)
    this-change  assertions vs correct  bundle: PASS (accepted)

Reading:
  * Under the parent commit's identical-byte fixtures, misbinding the wrong artifact is
    literally undetectable - the bundle payload is unchanged.
  * The parent-commit assertions accept the misbound bundle in BOTH regimes; they never
    looked at bin/claude's bytes at all.
  * The strengthened assertions reject the misbound bundle and accept the correct one,
    but only once fixtures carry distinct bytes - so the fixture-byte change and the
    assertion change are one indivisible change.

Evidence: Generated runtime.json manifest from the real producer

{
 "files": [
  {
   "digest": "sha256:c223671b507cafb9b6d069e5d98e333fbf72026eb42872fcad2de507dc58e3ec",
   "path": "bin/claude"
  },
  {
   "digest": "sha256:b379d12ff5ec8c39aff9308a1214dac0b9ff61de689abff5fe0b20ece10cba5b",
   "path": "bin/gh"
  },
  {
   "digest": "sha256:425ba2cbe2b8b6e9b672ef68298dd44f347c5788e2c26e59c0cc92e404da3d3c",
   "path": "bin/gh-axi"
  },
  {
   "digest": "sha256:19291eff935e56aa7a6c51f8bf41a9c6634ec6101e5e8201502ba78270b487b4",
   "path": "bin/no-mistakes"
  },
  {
   "digest": "sha256:8625501564b3823cc239e43c9a6e0db3b907aececfd450827464a6d76a3ecd1f",
   "path": "bin/node"
  },
  {
   "digest": "sha256:85fed1543b56eed9bc015dd2e8c26b345cb59c8eac0d6c243c909274bedd33bd",
   "path": "gh-axi/dist/bin/gh-axi.js"
  },
  {
   "digest": "sha256:46678d3998b701588a4128e1364f3d3d05406cf2e63828496cd2dffc7223ae88",
   "path": "gh-axi/dist/src/author.json"
  },
  {
   "digest": "sha256:e520fad8e88e55e2db66a5278ca3106357ba9ab798990a62d3a21b1827b19aa4",
   "path": "gh-axi/dist/src/cli.js"
  },
  {
   "digest": "sha256:87b4d113fa1cf139a93b1e7045dc54cde5817069ddb08e67d72bfa447613b9b0",
   "path": "gh-axi/dist/src/passwordless.json"
  },
  {
   "digest": "sha256:795a85554e2377c8924e33f06d9dbab6db12afd3921fb6f2427921bc83e9dd13",
   "path": "gh-axi/dist/src/secret.js"
  },
  {
   "digest": "sha256:1d24d2a255d5b86685f468e4995f19cad65fb5effc1ff636c7d51f47a36900c2",
   "path": "gh-axi/dist/src/secretary.json"
  },
  {
   "digest": "sha256:f3fe54746a4dc6a8107d933e7f2e0ca6f1eee357aff7ddc837a4e29003e29e99",
   "path": "gh-axi/dist/src/tokenizer.json"
  },
  {
   "digest": "sha256:bca2afe0661de28d020ca896f92022c94e064f8056bbe0ab2ce83da74515fa7c",
   "path": "gh-axi/node_modules/fixture-dependency/dist/index.js"
  },
  {
   "digest": "sha256:a8680b32e67f1b6d45ad45ab720ad0ed103d5e69254d018aa35508bdb5a42e33",
   "path": "gh-axi/node_modules/fixture-dependency/package.json"
  },
  {
   "digest": "sha256:ae9d12a806c0ab358cf35c559fba4ef4b065e0a9beb3a1bb4c2e79433bdc0df5",
   "path": "gh-axi/package.json"
  }
 ],
 "gh_axi_closure": [
  "gh-axi/dist/bin/gh-axi.js",
  "gh-axi/dist/src/cli.js",
  "gh-axi/node_modules/fixture-dependency/dist/index.js",
  "gh-axi/node_modules/fixture-dependency/package.json",
  "gh-axi/package.json"
 ],
 "gh_axi_entrypoint": "gh-axi/dist/bin/gh-axi.js",
 "gh_axi_path": "bin/gh-axi",
 "gh_path": "bin/gh",
 "no_mistakes_path": "bin/no-mistakes",
 "no_mistakes_source_commit": "1111111111111111111111111111111111111111",
 "no_mistakes_version": "1.48.0",
 "node_path": "bin/node",
 "owner_decision_protocol": "fm.azure-validation-owner-decision/v1",
 "provider": "claude",
 "provider_path": "bin/claude",
 "schema": "fm.azure-validation-runtime/v1"
}

Evidence: Producer build transcript

AZURE VALIDATION RUNTIME BUILT output=.../claude-runtime.tar.gz digest=sha256:bb4f7112948bf204d6e072276bc8e8c2e47a4053089caca6c8bd33d5b527c3e1

AZURE VALIDATION RUNTIME BUILT output=/srv/fm-validation/cell/tmp/claude-bundle-evidence.lNAbKM/claude-runtime.tar.gz digest=sha256:bb4f7112948bf204d6e072276bc8e8c2e47a4053089caca6c8bd33d5b527c3e1

Evidence: Targeted test run transcript

== tests/fm-azure-runtime-bundle.test.sh == ok - explicit local inputs produce a no-download byte-deterministic manifest-first bundle with normalized guest-safe tar and gzip metadata ok - Claude runtime production is byte deterministic and binds only the exact Claude provider artifact ok - real submit stages no-follow one-link bytes before validation, survives a hostile source swap, rehashes the payload copy, and rejects links plus credential-bearing members ok - incomplete runtime closures, missing Codex tools, existing outputs, unsafe inputs, wrong-architecture ELF files, and bad versions refuse without partial artifacts ok - two concurrent producers publish exactly one deterministic runtime without clobbering output or each other's staging files ok - the exact shipped guest recheck binds duplicate-free sealed schema, fixed Node and gh-axi closure, credential policy, and one-link inventory exit=0

FM_AMBIENT_SEAL dropped=FM_AZURE_VALIDATION_ATTEMPT,FM_AZURE_VALIDATION_BRANCH,FM_AZURE_VALIDATION_CELL,FM_AZURE_VALIDATION_CELL_ID,FM_AZURE_VALIDATION_IDENTITY_CLIENT_ID,FM_AZURE_VALIDATION_RUNTIME_PATH,FM_AZURE_VALIDATION_SHARD_BRIDGE,FM_AZURE_VALIDATION_SHARD_COUNT,FM_AZURE_VALIDATION_SHARD_EXCHANGE,FM_AZURE_VALIDATION_STORAGE_ACCOUNT,FM_AZURE_VALIDATION_STORAGE_CONTAINER
== tests/fm-azure-runtime-bundle.test.sh ==
ok - explicit local inputs produce a no-download byte-deterministic manifest-first bundle with normalized guest-safe tar and gzip metadata
ok - Claude runtime production is byte deterministic and binds only the exact Claude provider artifact
ok - real submit stages no-follow one-link bytes before validation, survives a hostile source swap, rehashes the payload copy, and rejects links plus credential-bearing members
ok - incomplete runtime closures, missing Codex tools, existing outputs, unsafe inputs, wrong-architecture ELF files, and bad versions refuse without partial artifacts
ok - two concurrent producers publish exactly one deterministic runtime without clobbering output or each other's staging files
ok - the exact shipped guest recheck binds duplicate-free sealed schema, fixed Node and gh-axi closure, credential policy, and one-link inventory

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 2 infos

• ℹ️ tests/fm-azure-runtime-bundle.test.sh:593 - tests/fm-azure-runtime-bundle.test.sh:593 proves distinctness of the four archived binaries but only bin/claude is bound to its source (line 592). A builder that cross-wired two non-provider members (e.g. bin/gh receiving node's bytes and bin/node receiving gh's bytes) would keep all four digests distinct and still pass. Asserting each member equals its supplied source file would subsume the distinctness check. Noting only as residual coverage; the intent scopes the byte-equality contract to bin/claude, so this is not a defect in the authored contract.
• ℹ️ tests/fm-azure-runtime-bundle.test.sh:593 - tests/fm-azure-runtime-bundle.test.sh:593 hashes each member to test pairwise distinctness; comparing the byte strings directly (len(set(contents.values())) == len(contents)) is equivalent and shorter, since sha256 is injective for this purpose. Purely cosmetic - not worth a new head given the intent to leave the commit unchanged absent a proven contract defect.

✅ **Test** - passed

✅ No issues found.

• if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• tests/run.sh tests/fm-azure-runtime-bundle.test.sh - all 6 cases pass, including claude_provider_bundle_contract
• Manual producer run: bin/fm-azure-validation.sh build-runtime-bundle --provider claude --provider-binary <claude> --no-mistakes <nm> --gh <gh> --node <node> --gh-axi-package <pkg> --output claude-runtime.tar.gz against distinct-byte ELF fixtures
• Manual bundle inspection: extracted runtime.json plus every bin/* member and compared sha256 of each payload against the supplied artifact and against the manifest's declared digest; asserted 4-of-4 distinct digests and absence of bin/codex and bin/codex-code-mode-host
• Misbinding discrimination experiment: built a self-consistent misbound bundle (bin/node bytes shipped at bin/claude, manifest digest updated in place) under both the parent-commit identical-byte fixture regime and this change's distinct-byte regime, then ran each commit's claude_provider_bundle_contract python assertion block verbatim against correct and misbound bundles
• git diff --name-only 7b6b15f..bb96be9 | grep -v '^tests/' - confirms no production source file changed

⚠️ **Document** - 1 info

• ℹ️ docs/azure-validation.md:185 - Pre-existing, not caused by this change: bin/fm-azure-validation.py:106 accepts PROVIDERS = ("codex", "claude"), but the runtime-bundle section of docs/azure-validation.md shows only the --provider codex invocation and a codex manifest example, and mentions Claude solely by implication in "Codex bundles must include a provider-extra named codex-code-mode-host" (line 171). Nothing in that section is contradicted by this change, and it is test-only, so I left the doc untouched under the scope rules. Follow-up worth considering: add one sentence to docs/azure-validation.md naming codex and claude as the accepted --provider values and noting that a Claude bundle carries no provider-extra, keeping that fact in its single owner document rather than duplicating the build example.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.