fix(prime): support self-contained managed release artifacts

[rynfar]

The first managed Prime archive omitted its runtime dependencies. The companion fork recipe now includes them, but three legitimate SDK declaration/source-map basenames exceed basic tar's 100-byte name field. Pylon rejected the resulting npm extended headers.

Accept bounded per-file path/size/mtime metadata immediately followed by a matching regular file, preserving existing package-root, collision, link, mode and size restrictions. Register self-contained recipe 2 and publication policy 4 while retaining all historical recipe/policy identities and exact provenance checks. The installer still runs no npm, lifecycle scripts or dependency downloads.

Validation: 100 focused tests pass, including 23 extended-header acceptance/rejection cases and the real immutable preview's cryptographic fixture. Scoped lint, server typecheck and independent adversarial checkpoint review pass. An explicitly unsigned local candidate passed the actual managed store in 89 seconds, CLI 0.9.4, native/recoverable SDK discovery, and native/WASM loading; all 196 runtime dependency manifests survived packing. Final signed publication, both OS artifact proofs and protected graduation remain required before stable promotion.

Part of #114. Model: GPT-6 Astra. Harness: Codex through Pylon.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Building	Preview	Sep 11, 2026 8:07pm UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.9 KiB	13.9 KiB	−4 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−12 B (−0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	+8 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.9 KiB	14.1 KiB	+177 B (+1.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.9 KiB	+176 B (+2.6%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.8 KiB	59.7 KiB	+928 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	10	+2 (+25.0%)	21	✅

Baseline: f743352 · PR result: bb090f4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.