[knqiufan]

Which issue or RFC does this PR close?

Related issue: #2112 — PR 09-C: Managed runtime and Installer/Ops resources.

This PR implements the candidate resource producer and required-platform CI for 09-C. The broader #2112 remains open: 09-A release-candidate assembly, 09-B qualified publication/download verification, and signed/notarized installed-platform evidence under #2108/#2109 remain outstanding. The Windows and Intel native candidate jobs must also pass before this PR's native build claims are accepted.

Local setup parent: #2114. Consumers: #2115 (installer; database admission in #2286) and #2116 (native bridge in #2289).

Rationale for this change

The managed installer and Desktop Ops bridge need complete versioned resources that run without a user's Python, uv, Git or compiler. This producer builds immutable candidate Server and independent Ops resources from exact source, interpreter and wheel identities on Windows x86_64 and macOS arm64/x86_64.

What changes are included in this PR?

• Pin CPython 3.12.16 / python-build-standalone 20261026 archives for all three native targets. Verify hashes, target layout and safe internal file aliases before producing link-free inventories.
• Prepare the exact Git source wheel and locked dependency closure; record source, package version, tool, license and artifact identities separately from executing-producer provenance. Install final resources offline with individual wheel hashes.
• Produce deterministic Server/Ops archives, real ResourceCatalog input, complete inventories and Desktop provisioning pins. Preserve the existing Ops bundle format and launcher contracts. Remove non-relocatable wrappers and mutable installer-cache records, repairing RECORD metadata.
• Keep the locked cryptography 50.0.0 on Intel macOS through a separate pinned Rust/OpenSSL/maturin/Xcode source-build path. A minimal locked build-host group avoids implicitly building it before that path; an allowlisted environment and backend binary verification prevent ambient toolchain overrides. Runtime dependency versions are unchanged.
• Add native CI for all three targets, repeated production after input relocation, consumer readback, launcher/Ops smoke, durable bounded failure diagnostics, and bilingual documentation.

Are there any user-facing changes?

Maintainers gain resource-production commands and CI. Every output is explicitly an unqualified candidate; there is no publication, inferred production URL, signing, notarization or qualification override. End users do not build dependencies or change global tooling. Windows production measures actual managed final/staging and independent Ops path budgets without enabling global long-path settings.

How was this change tested?

• Windows CI job Candidate windows-x86_64 completed native input acquisition, then exposed a CRLF/LF mismatch at strict frozen-requirements verification. Preparation now writes explicit UTF-8 LF bytes on every host; digest and wheel-closure checks remain strict. A regression rejects digest-consistent CRLF inputs. Actual arm64 input preparation with simulated Windows default text newlines produced 121 wheels accepted by the unchanged consumer verifier. Focused producer/consumer regressions passed (46 passed, 2 platform skips, 3 full native production tests deselected); make check passed. The focused fix passed Open Code Review with no findings, and its new regression was manually reviewed. The native Windows rerun remains pending; simulated newline handling is not Windows platform acceptance.

• make check: passed lock validation, all pre-commit hooks, both type-check scopes and 61 integration-manifest tests.

• POWERCONTEXT_RESOURCE_TEST_INPUTS=... POWERCONTEXT_RESOURCE_TEST_INPUTS_SHA256=... POWERCONTEXT_RESOURCE_TEST_OUTPUT=... uv run --no-sync pytest -q tests/test_managed_resource_producer.py tests/test_ops_resources.py: 48 passed, 2 Windows-native skips in 237.63s using the actual minimal resource-build host environment. Its host does not contain cryptography, jieba or maturin.

• Real macOS arm64 production ran twice from frozen, relocated inputs with changed timestamps; complete archives/manifests matched. Real ResourceCatalog/ResourceStore readback used a seeded, hash-checked cache. The relocated installed Server reached readiness through its bundled launcher with disposable SQLite data; bundled AES-GCM and Ed25519 probes passed. Independent Ops ran with poisoned Python variables and a missing Server interpreter. No native service was registered or mutated.

• Exact packaged source for local evidence: aedf7beb1ecff2ea1fade6ccdd8e4bf6a298f799, version 1.4.2.dev36+gaedf7beb. Evidence records working-tree producer hashes separately and matches_committed_files=false; this is not a claim that the subsequently committed producer already ran in CI.

• Final Server archive SHA-256: ba3fefa0478dfa18aa0ece8ff928f9a02da46415d23bda9d676c909b3ac28167; Ops archive: d6171c2e40f84f2da2b44bcc69ff8852dc4a1be4fc207887e7d9cbd4160d3233; Ops manifest: cf707c6fa209dabf5576a0250569aaf7269e71b2b667adb815e66c72b69a2373.

• All three actual upstream interpreter archives were downloaded and hash/layout checked. Windows execution/path measurements and the full Intel cryptography build were not executed on this arm64 host; their native CI legs must pass. Signing, clean standard-user machines, login/reboot lifecycle and public release qualification remain separate acceptance work. Signing must precede final consumed hashes.

• Open Code Review remote review completed all 10 selected files. Its actionable environment, workflow and diagnostics findings were fixed. The plugin's delegate workflow then reviewed the final 19/19 changed files, including docs/tests/lock files excluded by default selection, with an independent Astra review of Intel/bootstrap behavior. Final file hashes were checked before commit; no blocking findings remain.

AI usage statement

Implemented with Codex using GPT-6.1 Sol, with earlier GPT-6 Luna investigation. The primary agent coordinated integration and final acceptance; GPT-6 Astra independently reviewed the Intel build/bootstrap boundary. Open Code Review remote and delegate modes were used before submission, and confirmed findings were repaired and revalidated.