runner v0.24.0

Runner v0.24.0 adds startup capability negotiation, external executor ownership,
exact operational payload commitments and an explicitly enrolled experimental
manual Pack admission profile. Runner remains a single-owner local Jobs research
preview. These changes cover all four source commits since published v0.23.0
(#158–#161); they do not adopt a portable Policy standard.

What an operator must do

• Installing this version alone does not enroll a workspace. Published Desk still
  pins Runner v0.23.0 and Runtime v0.34.0; coordinated companion adoption and
  installed activation remain pending. A successful capability probe grants no
  permission. A supporting trusted host must explicitly enroll the entire
  workspace in local-admin-manual-pack/1, retain its independent ownership and
  Policy authority, and require matching capabilities in the actual boot.
• Before enrollment, stop Desk and Runner and back up the entire Jobs workspace,
  including SQLite/WAL, runtimes, releases and attempts, as
  State and backups describes. Desk chat
  backups do not include Jobs. Keep the external trusted enrollment and authority
  separate from portable Jobs copies; a copied store or backup is not authority.
• Enrollment requires explicit offline prepare-manual-store under the host's
  continuously held external exclusive lease. It accepts only an untouched
  schema-3 store with no triggers (even paused), queued/running work or pending
  acquisition/occurrences, then durably publishes its marker and schema 4.
  Ordinary enabled Open refuses older/restored schemas; it does not migrate
  them. The earlier ownership-era Runner was tested to refuse schema 4. There is
  no supported in-place downgrade or automatic undo of enrollment: a pre-enrollment
  backup alone does not clear the independently retained execution demand.
• A refusal, partial preparation or lost reply can follow durable changes. Only
  the original fresh committed preparation response can advance activation;
  a recovered observation cannot. Hold the workspace for explicit reviewed
  reconciliation rather than retrying automatically or stripping markers/demands.
• The enrolled workspace permits only immutable, registered, manual single-Pack
  jobs. Triggers, acquisition/provider operations, workflows, prepared or mapped
  inputs, input-profile installation and job upgrades are held across the entire
  workspace, including legacy resources. Choose a workspace compatible with this
  scope before enrolling it.

Exact operational payloads (#158)

The private judgment-pack-runner/execution-payload/1 descriptor commits the
existing frozen Release identity, exact Pack/configuration/lock and facts bytes,
evidence presence and bytes, typed preparation/SourceInput commitments and actual
operational signing mode/public key. It does not change legacy release digests or
invent a portable Policy canonical encoding. Raw facts and evidence retain number
spelling and whitespace. The codec alone interprets no Policy and grants no
execution permission; the manual gate uses its commitment at the actual starter.
See the payload contract.

Probe and ownership before startup (#159–#160)

The trusted host probes the exact executable using
jpack-runner capabilities --format json before sending boot authority, pins
that executable through launch, and repeats its requirements in the boot object.
Closed version 3 on supported admission hosts lists only the manual profile
alongside jobs/1, required boot capabilities and executor-ownership/1.
Unsupported hosts retain the closed ownership-only version-2 response; unknown
shapes or missing requirements must hold startup.

With explicit ownership configured, Runner acquires the existing independently
pinned external exclusive lease before portable state, recovery, providers or
workers. Every Service Runtime invocation, including utility checks, inherits
that ownership through the actual child lifetime. Closing or killing the parent
does not release it while an inheriting Runtime remains alive. A failed or stopped
configured service cannot fall back to unowned execution. The supported boundary
is cooperative exclusion on suitable local filesystems, described in
executor ownership.

Anchored local manual admission (#161)

local-admin-manual-pack/1 is a private experimental host contract. Its capability
response is support information, not authority or normative Policy conformance.
RFC 0023 remains Review and unadopted; Runtime prototype 0.0.2 and its explicit
proposed-draft candidate 1.0.0 remain distinct offline formats.

The same independently anchored Desk Policy authority governs registration,
current eligibility, intent, reservation and start commitment. Runner checks
matching external, store and boot demands, holds actual ownership, fixes signing
and activates a fresh authenticated session before recovery or workers. The
owner-only execution-binding export grants no registration or launch authority.

Manual admission preserves the original Idempotency-Key and exact original
request body, facts and optional evidence. Reusing the key with even a changed
outer whitespace body conflicts. The existing payload descriptor, exact resource
and registration bind reserve and commitStart. Actual files, Runtime, signing,
job/release tuple and custody are checked before commitment and again at the
common operational starter. Only an original fresh successful start reply,
durably journaled locally, can mint one in-memory launch consumed once through
the ownership-aware starter. No private workflow or alternate evaluator path can
substitute an ordinary utility call for that permit.

Withdrawal committed first blocks the start. A start committed first is the
irrevocable logical start: its physical process may spawn after a later
withdrawal. There is no atomic ledger/OS transaction. Lost reserve/start replies,
recovered receipts or history, uncertain outcomes and restart recovery never
authorize a launch or automatic replay. This does not resist hostile code under
the same OS user, an administrator, or rollback/replacement of the entire trusted
plane. See the manual gate and
offline preparation contract.

Source evidence and pending release gates

Existing reviewed source evidence is reused for this documentation-only release
preparation:

• Runner native Linux/macOS CI
  39270753757
  passed at d903728fb38368a5f0574990e01bc27acb2a2803. Its normal real-Runtime
  suite pins Runtime 09206e743cdf410d7b5ee970f1c9d09ca7c015ca (included in
  published v0.34.0), plus earlier signing Runtime v0.27.1 at
  7a2fcfe20cedba5f164246fc544c4920971d2c56; Gateway is v0.9.1 at
  5b49e1e094b55fdd1deb9f613815c2beebd411f1. The old-Runner schema-refusal
  fixture pins 1cc6b29885b344716a970cd21fefeaca0a4edaeb.
• Combined actual Desk/Runner/Runtime source acceptance passed all seven required
  manual checks in Desk CI
  39275718610,
  using reviewed Desk 2ff3773a55b61c84317474fd80753f933c04ec5d (merged as
  c4e6ef5c6170e7d134c8c3960adc7a9c909bc2bb with the same tree), Runner
  d903728fb38368a5f0574990e01bc27acb2a2803 and Runtime
  55a23b884f0ce67fe6a9141b04e081a518fd5d61. They cover exact registered
  input/withdrawal-first, commitment-first, lost-start and lost-reserve replies,
  actual MCP refusal when Jobs is unavailable, and the actual old-Desk registry
  rollback fence. These are source-fixture results, not installed archive tests.
• The Runtime release source 0554c43d2bea08e06b9a1e7be39834494ee29d5e has
  the same tree as that tested Runtime and passed main CI
  39165392059.
  Runtime v0.35.0 remains a held unpublished draft at
  515724946fe83e7db800b4281e74d5daf06524fa; it is not the tested candidate.

Tag-time CI, four packaged archives, checksums, attestations, native archive smoke
and draft/publication verification for v0.24.0 remain pending under
the release procedure. No Windows archive is released; the
darwin/amd64 archive is read but not run by release checks, and no release check
starts jpack-google-relay. Coordinated Desk pins and acceptance against exact
attested companion archives are still required before installed enablement.