fix(canary): make cross-environment cache proofs environment-invariant

[kyle-sexton]

What

The canary contract's hosted↔self-hosted cache exchange used ${{ runner.temp }} paths. A cache entry's version is sha256(pathInput | compressionMethod | salt) (actions/cache dist at the pinned SHA), so the exchange can never hit across environments:

• Path: hosted resolves runner.temp to /home/runner/work/_temp; the fleet worker resolves differently.
• Compression: hosted has zstd; the fleet image is gzip-only (verified empirically in ghcr.io/melodic-software/ci-runner@be222b0e).

Live proof (first-ever governed dispatch, run 29371617183): the hosted save produced cache version fec98c1e…, reproduced byte-exactly as sha256('/home/runner/work/_temp/hosted-to-self-cache|zstd-without-long|1.0'); the self-hosted restore missed with fail-on-cache-miss.

Fix

Workspace-relative path (.canary-cache/…) in all four cache steps + payload create/verify steps — identical version component in every environment. The compression half of the fix (zstd in the worker image) ships separately in melodic-software/ci-runner; both are required before the laptop gate can pass.

Contract tests green (node --test local-runner-canary.test.cjs), actionlint clean.

Part of melodic-software/github-iac#88.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D5wqdo4adEZmWgjpY9ZjVx

[claude]

Claude finished @kyle-sexton's task in 1m 56s —— View job

---

Code Review

• Read PR diff and full workflow file
• Analyze correctness of path fix and cache version logic
• Check CLAUDE.md compliance (SHA pins, security rules)
• Post review findings

---

Summary

The root cause diagnosis and fix are both correct. The change is minimal and well-scoped.

---

Correctness

Path fix — correct. actions/cache computes the entry version as sha256(resolvedPath | compressionMethod | salt). The resolved path for a relative path: input is $GITHUB_WORKSPACE/<path>. Since both GitHub-hosted and self-hosted containers register their workspace under the same runner-default layout (/home/runner/work/ci-runner-canary/ci-runner-canary), .canary-cache/hosted-to-self expands to the same absolute string on both sides — where ${{ runner.temp }} did not. The live proof in run 29371617183 confirms the previous version mismatch.

All 8 path references updated consistently. The four create/save pairs and four restore/verify pairs across hosted-baseline, local-parity, and hosted-verify are all updated with matching paths. No dangling runner.temp references remain in the cache-path inputs.

Remaining runner.temp uses are intentional. Lines 227, 255, 480, 484, 494, 503, 525, 570, 575, 580 still use runner.temp for local artifact temp paths (probe script output, artifact download destinations). These are single-job-local files, not cache path inputs, so they are not subject to the cross-environment version hash and do not need to change.

fail-on-cache-miss: true retained on both restore steps — the right behavior for a canary proof.

---

One dependency to land together

The PR body correctly notes the compression fix (zstd in ghcr.io/melodic-software/ci-runner) ships separately, and both are required before the cache exchange passes end-to-end. The inline comment at hosted-baseline L232–235 alludes to this but doesn't call out the external dependency explicitly. Consider noting in the comment (or in a # TODO marker) that zstd in the worker image is gated on the companion ci-runner PR, so a future reader knows the proof can't pass until both land. Minor nit — the PR description covers it fully.

---

CLAUDE.md compliance

All uses: references remain SHA-pinned with # vX.Y.Z trailing comments. No security ground rules are affected. No pull_request_target / workflow_run trigger present.

---

Verdict

Looks good to merge. The fix is correct, complete for its stated scope, and the companion compression change in ci-runner is the remaining gate. No blocking issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c31091b4e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".