[antuz123]

R5 needs an exact-head hosted route on its released-R4/5.1 source while the infrastructure is still unmerged. This draft adopts the existing reviewed patches, preserves private diagnostics, and adds a read-only candidate route. It keeps trusted acceptance fail-closed and makes hosted macOS/Android the default without requiring the owner's personal Mac.

Head: 17baf3b. Base: sprint. Core #7058 and 5.1 #7067 are inherited through c1c4b80; their app implementation remains separately reviewable.

Review units

• Infrastructure-only adoption.
• New reconciliation and hook delta.
• Bootstrap hosted native validation with private diagnostics and draft guards #7063 source0984c5b97e7e8326d6856ba662274ecf325e5e0f is preserved by source-linked commit83e46731a; ci: reusable cloud release acceptance foundation (Phase A, #7061) #7062 source59c821ce195a5c063d99045fd97b5ac605433f62 by c668454. Their original patch reviews remain intact.
• ci: hosted native validation and exact-head evidence gate (#7059) #7060 d865ca9 supplies only needed Nitro0.36.5/iOS dependency-provider repairs. Newer R4 crypto dependencies, versions, frozen installation and retired-credential guards remain preserved.
• Native feature test(r5): isolated production-worker native storage witness #7071, full-product measurements R5: full-product native startup and first-wallet measurement harness #7073 and protected release preparation ci: prepare protected cloud release authorization and R5 readiness #7072 remain separate packages. Their implementation is not copied into this producer branch.

Inherited infrastructure adoption is approximately53.6k changed code/test tokens by characters/4, with the new reconciliation approximately6.7k before hook additions. The original #7062 estimate of19k does not describe the aggregate. Root integration #7068 can adopt these source-linked commits without rewriting producer branches or transferring their passes to another SHA.

Resulting behavior

• keeper/native-diagnostic explicitly enables same-repository draft diagnostics. The worker checks out the exact head, rechecks source/opt-in, serializes iOS then Android, and does not cancel an active job. These results cannot supply trusted gate credit.
• After approved protected-base installation, the reusable route requires exact current/run-base CI fingerprints. keeper/legacy-native selects the serialized legacy fallback. The inherited Android package workflow is manual-dispatch-only with cancellation disabled, preventing competing automatic PR builds.
• The gate selects the current route, consumes only its newest run/current attempt, requires successful build/UI/probe steps and matching executable worker/harness fingerprints, and revokes same-head success after base/ref/repository/route races. Diagnostic, stale, skipped, cancelled, build-only or untrusted results provide no native credit. Hardware and genuine failures stay binding.
• Separate feature and full-product hooks run after startup/native persistence. Feature metadata requires committed HEAD source bytes, five fixed scenarios and five finite raw helper timing pairs. Helper timings remain distinct from full-product measurements. A missing source package fails execution.
• Only bounded metadata is uploaded. Disk preflight records a12GiB reserve before dependencies/build; platform ceilings are105/90minutes with no automatic retry. install_succeeded means installation from the unchanged built path; installed_artifact_verified remains false because on-device bytes are not independently hashed.

Exact-head evidence

• Local:95Node contracts PASS (Node24.19.0),53Python PASS, actionlint1.7.7 on8changed workflows PASS, diffcheckPASS.
• Hosted contracts 39734288244: SUCCESS.
• CodeQL 39734288291: SUCCESS.
• Public backend setup 39734288282: SUCCESS; this is setup coverage, not current-protocol protected-backup acceptance.
• General CI39734288258 remained running at readback. keeper/local-validation remains FAILURE.
• Legacy, diagnostic and inherited Android native jobs are SKIPPED. PhaseA39734288280 remains intentionally FAILURE because trusted installation/full app acceptance is incomplete.
• Independent agent review of the final hook found no blocking interface/privacy/source findings;8feature-runner controls were rerun and passed. This is not human/Claude approval or native evidence.

Actual iOS/Android R5 native feature checks, five full-product measurement results, combined paired-backend evidence and physical checks are NOT RUN on this branch. Historical #7060 results and inherited failures remain recorded in docs/r5-cloud-native-reconciliation.md. Root must combine the separate sources, verify completed5.2 handoff/ancestry, rerun affected checks and schedule the exact candidate. Full PhaseA and release readiness remain BLOCKED.

No merge, shared promotion, release signing, upload, distribution, deployment or publication.

Codex local handoff

State: NEEDS_LOCAL
PR: #7070
Base: sprint
Head branch: codex/r5-cloud-native-reconcile
Head commit: 17baf3b
Goal and acceptance criteria: repeatable hosted native validation and truthful exact-head evidence without the owner's personal Mac.
Changes made: source-linked infrastructure adoption, private diagnostics, native prerequisites, serialized candidate/default routes, feature/product hooks and fail-closed gates.
Cloud checks:95Node+53Python local PASS; actionlint/diff PASS; hosted contracts/CodeQL/public-backend setup SUCCESS; general CI running; native jobs SKIPPED; full acceptance BLOCKED.
Required local checks: IOS, ANDROID
Local checks requested: NONE on owner's Mac. Schedule hosted macOS/Xcode and Android emulator checks on the combined exact candidate.
Risks / known gaps: source packages must be integrated before hooks run; native feature/product/paired-backend/physical evidence outstanding; trusted baseline not installed; installed bytes not independently hashed; no release authorization.