Proof: замкнуть Arb source → BUILD → RUN единым receipt

.github/workflows/arb.yml

@@ -48,11 +48,9 @@ jobs:
         run: |
           set -euo pipefail
           scope="/sys/fs/cgroup/labcolors-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          binary="$RUNNER_TEMP/arb-native-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
           {
             echo "LABCOLORS_CGROUP_SCOPE_V1=$scope"
             echo "LABCOLORS_EXECUTOR_CGROUP_V1=$scope/proof"
-            echo "LABCOLORS_ARB_NATIVE_BINARY=$binary"
           } >> "$GITHUB_ENV"
 
       - name: acquire and hash-check exact source archives
@@ -161,15 +159,11 @@ jobs:
           grep --fixed-strings --quiet 'pids' "$scope/proof/cgroup.subtree_control"
           test "$(cat "$scope/proof/pids.max")" = 2
 
-      - name: two fresh offline builds and evaluator runtime
+      - name: one source-bound BUILD to RUN receipt and evaluator runtime
         shell: bash
         run: |
           set -euo pipefail
-          echo "$$" | sudo tee \
-            "$LABCOLORS_CGROUP_SCOPE_V1/tasks/cgroup.procs" >/dev/null
-          python3 proof/region/v1/arb/tests/native_gate.py build
-          test -f "$LABCOLORS_ARB_NATIVE_BINARY"
-          test "$(stat --format=%a "$LABCOLORS_ARB_NATIVE_BINARY")" = 400
+          exec python3 proof/region/v1/arb/tests/native_gate.py receipt
 
       - name: native containment under an atomic two-task subtree
         shell: bash
@@ -197,9 +191,6 @@ jobs:
           if [[ -n "${LABCOLORS_ARB_SOURCE_DIR:-}" ]]; then
             rm -rf -- "$LABCOLORS_ARB_SOURCE_DIR" || record_failure
           fi
-          if [[ -n "${LABCOLORS_ARB_NATIVE_BINARY:-}" ]]; then
-            rm -f -- "$LABCOLORS_ARB_NATIVE_BINARY" || record_failure
-          fi
           if [[ -n "${LABCOLORS_CGROUP_SCOPE_V1:-}" && \
                 -d "$LABCOLORS_CGROUP_SCOPE_V1" ]]; then
             if [[ -f "$LABCOLORS_CGROUP_SCOPE_V1/cgroup.kill" ]]; then

proof/region/v1/arb/build.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Build the offline Arb evaluator from already admitted, read-only inputs.
+# Build the offline Arb evaluator from one admitted controller stream.
 # Acquisition and origin verification intentionally happen before this
 # network-free boundary; this recipe never resolves a tool or dependency online.
 
@@ -20,7 +20,7 @@ if [ "${LC_BUILD_ENV_V1-}" != 1 ]; then
         LANG=C \
         TZ=UTC \
         HOME=/nonexistent \
-        TMPDIR=/build/tmp \
+        TMPDIR=/build/work/tmp \
         SOURCE_DATE_EPOCH=0 \
         ZERO_AR_DATE=1 \
         ARFLAGS=crD \
@@ -30,10 +30,9 @@ unset LC_BUILD_ENV_V1
 
 umask 022
 
-readonly inputs=/inputs
-readonly workspace=/workspace
-readonly build=/build
-readonly output=/out
+readonly inputs=/build/snapshot/inputs
+readonly workspace=/build/snapshot/workspace
+readonly build=/build/work
 
 require_regular() {
     if [ ! -f "$1" ] || [ -L "$1" ]; then
@@ -76,7 +75,6 @@ for header in wire.h hash.h interval.h region.h; do
     require_regular "$workspace/proof/region/v1/arb/evaluator/$header"
 done
 require_empty_directory "$build"
-require_empty_directory "$output"
 
 /usr/bin/mkdir "$build/prefix" "$build/gmp" "$build/mpfr" "$build/flint" "$build/tmp"
 
@@ -175,5 +173,4 @@ else
     fi
 fi
 
-/usr/bin/install -m 0555 "$build/arb-evaluator-v1" "$output/arb-evaluator-v1"
-/usr/bin/sha256sum "$output/arb-evaluator-v1"
+/usr/bin/sha256sum "$build/arb-evaluator-v1"

proof/region/v1/arb/executor.py

@@ -29,6 +29,7 @@
 from typing import Callable, NoReturn, Protocol, TypeAlias
 
 
+EXECUTION_PLATFORM_V1 = "linux-x86_64"
 SANDBOX_POLICY_RELEASE_V1 = "labcolors.arb.executor.linux-x86_64.v1"
 
 # Linux UAPI values are fixed by fcntl.h.  Requiring F_SEAL_EXEC makes an older
@@ -154,8 +155,8 @@ class SupportedV1:
     sandbox_policy_release: str
 
     def __post_init__(self) -> None:
-        if type(self.platform) is not str or not self.platform:
-            raise TypeError("platform must be a nonempty str")
+        if self.platform != EXECUTION_PLATFORM_V1:
+            raise TypeError("unknown execution platform")
         if self.sandbox_policy_release != SANDBOX_POLICY_RELEASE_V1:
             raise TypeError("unknown sandbox policy release")
 
@@ -1690,7 +1691,7 @@ def _probe_capability_v1(self, guard: _ProbeGuardV1) -> CapabilityReportV1:
             if not failures:
                 return _invalidated_capability_report_v1()
             return UnsupportedV1(tuple(failures))
-        return SupportedV1("linux-x86_64", SANDBOX_POLICY_RELEASE_V1)
+        return SupportedV1(EXECUTION_PLATFORM_V1, SANDBOX_POLICY_RELEASE_V1)
 
     def _probe_sealed_memfd(
         self,