feat(worker): package independent installed LAB container steps

Preserve local installer, offline validation and pinned component adapters; 62 focused packaging tests pass. No deployment performed by this commit.

tests/test_e4_full_session_segmentation.py

@@ -37,6 +37,25 @@ def _profile() -> dict[str, object]:
     return value
 
 
+def test_e4_portable_binding_distinguishes_public_and_physical_camera_ids() -> None:
+    worker = _worker_module()
+    profile = _profile()
+    public_job = {
+        "input": {
+            "kind": "canonical-camera-epoch",
+            "source_id": "recorded.camera.6a3945242828a038",
+        }
+    }
+
+    with pytest.raises(RuntimeError, match="profile does not match"):
+        worker._validate_source(public_job, profile)
+
+    worker._validate_source(public_job, profile, "sensor.camera.right")
+
+    with pytest.raises(RuntimeError, match="physical camera binding"):
+        worker._validate_source(public_job, profile, "sensor.camera.left")
+
+
 def test_e4_accepts_the_sealed_camera1_valid_fov() -> None:
     worker = _worker_module()
     root = (

tests/test_lab_v1_portable_static_asset_installer.py

@@ -17,8 +17,8 @@ def test_lab_v1_static_installer_is_fixed_offline_and_content_addressed() -> Non
     script = INSTALLER_PATH.read_text(encoding="utf-8")
 
     assert '"D:\\NDC_MISSIONCORE\\runtime"' in script
-    assert '"staging\\observatory-lab-v1-static-v1"' in script
-    assert '"eomt-runner-bundle-v1"' in script
+    assert '"staging\\observatory-lab-v1-static-v2"' in script
+    assert '"eomt-runner-bundle-v2"' in script
     assert '"lab-v1-static-files-v1"' in script
     assert "New-Item `\n                -ItemType HardLink" in script
     assert "Get-FileIdentity" in script
@@ -37,7 +37,7 @@ def test_lab_v1_static_installer_seals_expected_exact_payloads() -> None:
     script = INSTALLER_PATH.read_text(encoding="utf-8")
 
     expected = {
-        "651e8e06c3912dffb036b7fd08f2c0623f7563d8306cc7aee05db562798518f4",
+        "1e64869de48d10f1531c742e6067c4c3ae2a709c5eb0d770d1fab74b4a2431ff",
         "01881862d4eaa218955f776a948124bf19c34be2b5ec282115daeacb15c53ae6",
         "4dcc4fc8bdf33702651a199be69d0dd4fadb243d2e65aee1c3d1ae7a58fdf675",
         "25baf30c0df564734e08f38ace88cc4bc147cacf240c761622279511e361daa4",

tests/test_observatory_installed_lab_offline_launch.py

@@ -0,0 +1,76 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+LAUNCHER = (
+    REPOSITORY_ROOT
+    / "experiments/perception/worker/observatory_portable"
+    / "Invoke-ObservatoryInstalledLabOfflineValidation.ps1"
+)
+
+
+def _script() -> str:
+    return LAUNCHER.read_text(encoding="utf-8")
+
+
+def test_offline_launcher_uses_only_the_canonical_activation_chain() -> None:
+    script = _script()
+
+    assert "ExpectedActivationFileSha256" in script
+    assert "Read-Activation $activationFile" in script
+    assert "Read-InstallationReceipt" in script
+    assert "$packageId = [string]$current.package_id" in script
+    assert "$packageSha256 = [string]$current.package_sha256" in script
+    assert '"$RuntimeRoot\\releases\\observatory-installed-labs"' in script
+    assert '"$RuntimeRoot\\state\\observatory-installed-labs"' in script
+    assert '"$RuntimeRoot\\services\\observatory-installed-labs"' in script
+    assert '"lab-v1-eomt-ddrnet-portable-v2"' not in script
+
+
+def test_offline_launcher_has_one_fixed_non_claiming_command() -> None:
+    script = _script()
+
+    assert (
+        '$command = @("-m", "k1link.observatory.installed_lab_worker_service", '
+        '"--validate-only")'
+    ) in script
+    assert 'mode = "validation-only"' in script
+    assert 'backend_contacted = $false' in script
+    assert 'claim_attempted = $false' in script
+    assert 'queue_started = $false' in script
+    assert "--once" not in script
+    assert "MISSIONCORE_OBSERVATORY_WORKER_TOKEN" not in script
+    assert "MISSIONCORE_OBSERVATORY_WORKER_BASE_URL" not in script
+
+
+def test_offline_launcher_builds_a_hardened_exact_docker_run() -> None:
+    script = _script()
+
+    assert '"--network", "none"' in script
+    assert '"--cap-drop", "ALL"' in script
+    assert '"--security-opt", "no-new-privileges"' in script
+    assert '"--read-only"' in script
+    assert '"--pids-limit", "128"' in script
+    assert 'source = "/var/run/docker.sock"' in script
+    assert "Assert-ExactImage $imageSha256" in script
+    assert "$packageImages -cnotcontains $agentImageSha256" in script
+    assert "docker ps -a" in script
+    assert '"missioncore.observatory-installed-lab-offline-launch-plan/v1"' in script
+    assert '"missioncore.observatory-installed-lab-offline-launch-result/v1"' in script
+
+
+def test_offline_launcher_writes_only_content_checked_evidence() -> None:
+    script = _script()
+
+    assert "function Write-ExactFile" in script
+    assert '$receiptPayload = [string]::Join("`n", $output) + "`n"' in script
+    assert "[Environment]::NewLine" not in script
+    assert "installed LAB offline launch plan" in script
+    assert "installed LAB offline validation receipt" in script
+    assert "validation_receipt_file_sha256" in script
+    assert "validation_receipt_sha256" in script
+    assert "[IO.File]::Move(" in script
+    assert "Invoke-WebRequest" not in script
+    assert "Start-Service" not in script
+    assert "Start-ScheduledTask" not in script

tests/test_observatory_installed_lab_package_installer.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+INSTALLER = (
+    REPOSITORY_ROOT
+    / "experiments/perception/worker/observatory_portable"
+    / "Install-ObservatoryInstalledLabPackage.ps1"
+)
+
+
+def _script() -> str:
+    return INSTALLER.read_text(encoding="utf-8")
+
+
+def test_installer_uses_generic_content_addressed_package_roots() -> None:
+    script = _script()
+
+    assert '"$RuntimeRoot\\releases\\observatory-installed-labs"' in script
+    assert '"$RuntimeRoot\\state\\observatory-installed-labs"' in script
+    assert '"$RuntimeRoot\\services\\observatory-installed-labs"' in script
+    assert "$packageId = [string]$package.package_id" in script
+    assert "$targetRoot = Join-Path $packageReleaseParent $packageSha256" in script
+    assert '"missioncore.observatory-installed-lab-installation/v1"' in script
+    assert '"missioncore.observatory-installed-lab-activation/v1"' in script
+    assert '"missioncore.observatory-installed-lab-installation-result/v1"' in script
+    assert '"lab-v1-eomt-ddrnet-portable-v2.json"' not in script
+    assert "$packageImages.Count -lt 1" in script
+
+
+def test_installer_is_atomic_idempotent_and_retains_one_rollback_anchor() -> None:
+    script = _script()
+
+    assert '".install-$packageSha256-$PID"' in script
+    assert "Assert-InstalledRoot $stageRoot" in script
+    assert "Move-Item -LiteralPath $stageRoot -Destination $targetRoot" in script
+    assert "$alreadyInstalled = $true" in script
+    assert "New-ReleaseAnchor" in script
+    assert "$rollback = New-ReleaseAnchor" in script
+    assert '".activation-$PID.tmp"' in script
+    assert "[IO.File]::Replace(" in script
+    assert "[IO.File]::Move(" in script
+    assert "Read-Activation $activationPath" in script
+
+
+def test_installer_fails_closed_before_writing_canonical_state() -> None:
+    script = _script()
+    write_boundary = script.index("$alreadyInstalled = $false")
+    preflight = script[:write_boundary]
+
+    assert "$StagingPrefix" in preflight
+    assert "ExpectedPromotionSummarySha256" in preflight
+    assert "ExpectedPackageSha256" in preflight
+    assert "ExpectedValidationReceiptFileSha256" in preflight
+    assert "backend_contacted" in preflight
+    assert "claim_attempted" in preflight
+    assert "Assert-ExactImage $imageSha256" in preflight
+    assert "installed LAB binding work root is not canonical" in preflight
+    assert "installed LAB release binding is not canonical" in preflight
+    assert "installed LAB runtime binding is not canonical" in preflight
+
+
+def test_installer_never_starts_services_or_contacts_a_backend() -> None:
+    script = _script()
+    lowered = script.lower()
+
+    assert 'backend_changed = $false' in script
+    assert 'claim_attempted = $false' in script
+    assert 'queue_started = $false' in script
+    assert "docker image inspect" in lowered
+    assert "docker run" not in lowered
+    assert "docker start" not in lowered
+    assert "start-service" not in lowered
+    assert "start-scheduledtask" not in lowered
+    assert "invoke-webrequest" not in lowered
+    assert "curl " not in lowered
+    assert "http://" not in lowered
+    assert "https://" not in lowered

tests/test_observatory_installed_lab_v1_image_installer.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+INSTALLER = (
+    REPOSITORY_ROOT
+    / "experiments/perception/worker/observatory_portable"
+    / "Install-InstalledLabV1PackageImages.ps1"
+)
+
+
+def _script() -> str:
+    return INSTALLER.read_text(encoding="utf-8")
+
+
+def test_installed_lab_v1_image_installer_is_local_and_offline() -> None:
+    script = _script()
+
+    assert '"docker-commit-exact-layer-v1"' in script
+    assert "--network none" in script
+    assert "--cap-drop ALL" in script
+    assert "--security-opt no-new-privileges" in script
+    assert "target=/nodedc-build-source,readonly" in script
+    assert "docker rm -f $containerId" in script
+
+    lowered = script.lower()
+    assert "docker build" not in lowered
+    assert "docker buildx" not in lowered
+    assert "docker pull" not in lowered
+    assert "invoke-webrequest" not in lowered
+    assert "start-bitstransfer" not in lowered
+    assert "curl " not in lowered
+    assert "wget " not in lowered
+    assert "smb" not in lowered
+
+
+def test_agent_only_parameter_set_requires_no_component_inputs() -> None:
+    script = _script()
+
+    assert '[CmdletBinding(DefaultParameterSetName = "Full")]' in script
+    assert script.count(
+        '[Parameter(Mandatory = $true, ParameterSetName = "Full")]'
+    ) == 3
+    assert script.count('ParameterSetName = "AgentOnly"') == 1
+    assert script.count('ParameterSetName = "ComponentsOnly"') == 4
+    assert script.count('ParameterSetName = "EomtOnly"') == 3
+    assert script.count('ParameterSetName = "DdrnetOnly"') == 3
+    assert "[switch]$AgentOnly" in script
+    assert "[switch]$ComponentsOnly" in script
+    assert "[switch]$EomtOnly" in script
+    assert "[switch]$DdrnetOnly" in script
+
+    agent_only_branch = script.split("if ($AgentOnly) {", 1)[1].split(
+        "elseif ($EomtOnly) {", 1
+    )[0]
+    assert "$receipts = @(Install-Agent)" in agent_only_branch
+    assert "Install-Component" not in agent_only_branch
+    assert "$SharedAdapterSha256" not in agent_only_branch
+    assert "$EomtAdapterSha256" not in agent_only_branch
+    assert "$DdrnetAdapterSha256" not in agent_only_branch
+    assert "installed_lab_worker_container_main" in script
+
+
+def test_components_only_parameter_set_builds_no_agent() -> None:
+    script = _script()
+    component_branch = script.split("elseif ($ComponentsOnly) {", 1)[1].split(
+        "else {", 1
+    )[0]
+
+    assert component_branch.count("Install-Component `") == 2
+    assert '-Component "eomt"' in component_branch
+    assert '-Component "ddrnet"' in component_branch
+    assert "Install-Agent" not in component_branch
+    assert "$componentIdentity" in script
+
+
+def test_single_component_parameter_sets_build_only_requested_image() -> None:
+    script = _script()
+    eomt_branch = script.split("elseif ($EomtOnly) {", 1)[1].split(
+        "elseif ($DdrnetOnly) {", 1
+    )[0]
+    ddrnet_branch = script.split("elseif ($DdrnetOnly) {", 1)[1].split(
+        "elseif ($ComponentsOnly) {", 1
+    )[0]
+
+    assert eomt_branch.count("Install-Component `") == 1
+    assert '-Component "eomt"' in eomt_branch
+    assert '-Component "ddrnet"' not in eomt_branch
+    assert "Install-Agent" not in eomt_branch
+    assert ddrnet_branch.count("Install-Component `") == 1
+    assert '-Component "ddrnet"' in ddrnet_branch
+    assert '-Component "eomt"' not in ddrnet_branch
+    assert "Install-Agent" not in ddrnet_branch
+
+
+def test_full_parameter_set_still_builds_both_components_and_agent() -> None:
+    script = _script()
+    full_branch = script.rsplit("else {", 1)[1]
+
+    assert '-Component "eomt"' in full_branch
+    assert '-Component "ddrnet"' in full_branch
+    assert full_branch.count("Install-Component `") == 2
+    assert "Install-Agent" in full_branch

tests/test_observatory_installed_lab_v1_promotion.py

@@ -0,0 +1,225 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import sys
+from collections.abc import Callable
+from pathlib import Path
+
+import httpx
+import pytest
+
+from k1link.observatory.installed_lab_packages import InstalledLabPackageRegistry
+from k1link.observatory.portable_run_definitions import PortableRunDefinitionRegistry
+from k1link.observatory.portable_worker_runtime import PortableWorkerRuntimeRegistry
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+PROMOTION_SCRIPT = (
+    REPOSITORY_ROOT
+    / "experiments"
+    / "perception"
+    / "worker"
+    / "observatory_portable"
+    / "promote_installed_lab_v1_package.py"
+)
+_SPEC = importlib.util.spec_from_file_location(
+    "observatory_installed_lab_v1_promotion_test",
+    PROMOTION_SCRIPT,
+)
+assert _SPEC is not None and _SPEC.loader is not None
+promotion = importlib.util.module_from_spec(_SPEC)
+sys.modules[_SPEC.name] = promotion
+_SPEC.loader.exec_module(promotion)
+
+
+def test_generic_lab_v1_promotion_round_trips_all_three_registries(
+    tmp_path: Path,
+) -> None:
+    output = tmp_path / "release"
+
+    promotion.generate(
+        source_definitions=(
+            REPOSITORY_ROOT / "config" / "observatory-portable-run-definitions.json"
+        ),
+        source_runtime=(
+            REPOSITORY_ROOT / "config" / "observatory-worker-runtime-candidates.json"
+        ),
+        ddrnet_config=(
+            REPOSITORY_ROOT
+            / "config"
+            / "perception"
+            / "lab-v1-eomt-ddrnet-portable-v2.json"
+        ),
+        result_assembler_source=(
+            REPOSITORY_ROOT / "src" / "k1link" / "observatory" / "portable_lab_v1_executor.py"
+        ),
+        output_root=output,
+        source_tree_sha256="1" * 64,
+        agent_image_sha256="2" * 64,
+        eomt_image_sha256="3" * 64,
+        ddrnet_image_sha256="4" * 64,
+        engine_release_root="D:\\NDC_MISSIONCORE\\runtime\\releases\\lab-v1",
+        engine_runtime_root="D:\\NDC_MISSIONCORE\\runtime",
+        engine_work_root="D:\\NDC_MISSIONCORE\\runtime\\services\\lab-v1\\work",
+        image_resolver=lambda value: value,
+    )
+
+    definitions = PortableRunDefinitionRegistry.from_file(
+        output / "observatory-portable-run-definitions.json"
+    )
+    runtime = PortableWorkerRuntimeRegistry.from_file(
+        output / "observatory-worker-runtime-candidates.json",
+        definitions=definitions,
+    )
+    packages = InstalledLabPackageRegistry.from_file(
+        output / "observatory-installed-lab-packages.json",
+        definitions=definitions,
+        runtime_registry=runtime,
+    )
+    definition = definitions.resolve_setup("lab-v1-eomt-ddrnet-portable-v1")
+    candidate = runtime.resolve(definition.setup_id, definition.definition_sha256)
+    package = packages.resolve(definition.setup_id, definition.definition_sha256)
+    bindings = json.loads(
+        (output / "observatory-installed-lab-asset-bindings.json").read_text()
+    )
+
+    assert definition.executor.ready is True
+    assert candidate.ready is True
+    assert package.runtime_candidate_sha256 == candidate.candidate_sha256
+    assert [item.container_id for item in package.containers] == [
+        "assemble",
+        "ddrnet",
+        "eomt",
+        "prepare",
+    ]
+    assert len(bindings["assets"]) == len(candidate.reusable_assets)
+    assert (output / "promotion-summary.json").is_file()
+
+
+def test_generic_lab_v1_promotion_rejects_uninstalled_image_before_writing(
+    tmp_path: Path,
+) -> None:
+    output = tmp_path / "release"
+
+    def resolve_image(value: str) -> str:
+        if value == "3" * 64:
+            raise RuntimeError("image is absent")
+        return value
+
+    with pytest.raises(
+        promotion.InstalledLabV1PromotionError,
+        match="EoMT image is unavailable",
+    ):
+        _generate(output=output, image_resolver=resolve_image)
+
+    assert not output.exists()
+
+
+def test_generic_lab_v1_promotion_rejects_image_identity_drift_before_writing(
+    tmp_path: Path,
+) -> None:
+    output = tmp_path / "release"
+
+    with pytest.raises(
+        promotion.InstalledLabV1PromotionError,
+        match="agent image identity changed",
+    ):
+        _generate(
+            output=output,
+            image_resolver=lambda value: "9" * 64 if value == "2" * 64 else value,
+        )
+
+    assert not output.exists()
+
+
+def test_docker_engine_image_resolver_requires_exact_identity() -> None:
+    digest = "2" * 64
+
+    def exact(request: httpx.Request) -> httpx.Response:
+        assert request.url.path.endswith(f"/images/sha256:{digest}/json")
+        return httpx.Response(200, json={"Id": f"sha256:{digest}"})
+
+    assert (
+        promotion._resolve_docker_engine_image_sha256(
+            digest,
+            transport_factory=lambda: httpx.MockTransport(exact),
+        )
+        == digest
+    )
+
+
+def test_docker_engine_image_resolver_rejects_identity_drift() -> None:
+    digest = "2" * 64
+
+    def changed(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json={"Id": f"sha256:{'9' * 64}"})
+
+    with pytest.raises(
+        promotion.InstalledLabV1PromotionError,
+        match="local Docker image identity changed",
+    ):
+        promotion._resolve_docker_engine_image_sha256(
+            digest,
+            transport_factory=lambda: httpx.MockTransport(changed),
+        )
+
+
+@pytest.mark.parametrize(
+    "placeholder",
+    (
+        "D:\\NDC_MISSIONCORE\\runtime\\releases\\lab-v1$release",
+        "D:\\NDC_MISSIONCORE\\runtime\\releases\\{release}",
+        "D:\\NDC_MISSIONCORE\\runtime\\releases\\%RELEASE%",
+    ),
+)
+def test_generic_lab_v1_promotion_rejects_placeholder_path_before_writing(
+    tmp_path: Path,
+    placeholder: str,
+) -> None:
+    output = tmp_path / "release"
+
+    with pytest.raises(
+        promotion.InstalledLabV1PromotionError,
+        match="Engine release root is invalid",
+    ):
+        _generate(
+            output=output,
+            image_resolver=lambda value: value,
+            engine_release_root=placeholder,
+        )
+
+    assert not output.exists()
+
+
+def _generate(
+    *,
+    output: Path,
+    image_resolver: Callable[[str], str],
+    engine_release_root: str = "D:\\NDC_MISSIONCORE\\runtime\\releases\\lab-v1",
+) -> None:
+    promotion.generate(
+        source_definitions=(
+            REPOSITORY_ROOT / "config" / "observatory-portable-run-definitions.json"
+        ),
+        source_runtime=(
+            REPOSITORY_ROOT / "config" / "observatory-worker-runtime-candidates.json"
+        ),
+        ddrnet_config=(
+            REPOSITORY_ROOT
+            / "config"
+            / "perception"
+            / "lab-v1-eomt-ddrnet-portable-v2.json"
+        ),
+        result_assembler_source=(
+            REPOSITORY_ROOT / "src" / "k1link" / "observatory" / "portable_lab_v1_executor.py"
+        ),
+        output_root=output,
+        source_tree_sha256="1" * 64,
+        agent_image_sha256="2" * 64,
+        eomt_image_sha256="3" * 64,
+        ddrnet_image_sha256="4" * 64,
+        engine_release_root=engine_release_root,
+        engine_runtime_root="D:\\NDC_MISSIONCORE\\runtime",
+        engine_work_root="D:\\NDC_MISSIONCORE\\runtime\\services\\lab-v1\\work",
+        image_resolver=image_resolver,
+    )

tests/test_observatory_portable_lab_v1_component_adapters.py

@@ -99,8 +99,13 @@ def _mapping_payload() -> bytes:
     return ("\n".join(rows) + "\n").encode()
 
 
-def _camera_source(root: Path, *, frame_count: int = 2) -> dict[str, object]:
-    epoch = root / "input" / "camera" / "sensor.camera.right" / "epoch-1"
+def _camera_source(
+    root: Path,
+    *,
+    frame_count: int = 2,
+    source_id: str = "sensor.camera.right",
+) -> dict[str, object]:
+    epoch = root / "input" / "camera" / source_id / "epoch-1"
     segments = epoch / "segments"
     segments.mkdir(parents=True)
     files = {
@@ -125,7 +130,7 @@ def _camera_source(root: Path, *, frame_count: int = 2) -> dict[str, object]:
     input_document = {
         "kind": "canonical-camera-epoch",
         "session_id": "20260831T083000Z_viewer_live",
-        "source_id": "sensor.camera.right",
+        "source_id": source_id,
         "codec_epoch": 1,
         "synchronization": "camera-segment-sequence",
         "media_type": "video/mp4",
@@ -173,7 +178,7 @@ def _camera_source(root: Path, *, frame_count: int = 2) -> dict[str, object]:
         "camera_compute_job": {
             "job_id": camera_job_id,
             "input_sha256": input_sha256,
-            "source_id": "sensor.camera.right",
+            "source_id": source_id,
             "codec_epoch": 1,
             "input_byte_length": input_document["byte_length"],
             "frame_count": frame_count,
@@ -407,6 +412,82 @@ def test_component_request_and_camera_job_are_canonical_and_confined(
         contract.validate_camera_compute_job(camera_root, request.source)
 
 
+def test_component_request_accepts_the_persisted_public_camera_identity(
+    tmp_path: Path,
+) -> None:
+    camera_root = tmp_path / "camera"
+    source = _camera_source(
+        camera_root,
+        source_id="recorded.camera.6a3945242828a038",
+    )
+    expectations = (
+        contract.AssetExpectation(
+            "test-tree",
+            "/opt/nodedc/assets/test-tree",
+            "tree",
+            "identity-sha256",
+        ),
+    )
+    request_path = tmp_path / "request.json"
+    _write_canonical(
+        request_path,
+        _request_document(
+            component="eomt",
+            source=source,
+            expectations=expectations,
+            identities={"test-tree": ("c" * 64, 7)},
+        ),
+    )
+
+    request = contract.load_component_request(
+        request_path,
+        component="eomt",
+        expectations=expectations,
+    )
+
+    assert request.source.camera_source_id == "recorded.camera.6a3945242828a038"
+    contract.validate_camera_compute_job(camera_root, request.source)
+
+
+def test_component_adapter_accepts_only_exact_legacy_or_installed_package_layout() -> None:
+    expectations = (
+        contract.AssetExpectation(
+            "test-tree",
+            "/opt/nodedc/assets/test-tree",
+            "tree",
+            "identity-sha256",
+        ),
+    )
+
+    legacy = contract.resolve_runtime_layout(
+        ("--request", contract.FIXED_REQUEST_PATH),
+        component="eomt",
+        expectations=expectations,
+    )
+    assert legacy.request == Path(contract.FIXED_REQUEST_PATH)
+
+    installed = contract.resolve_runtime_layout(
+        ("--package-step", "ddrnet"),
+        component="ddrnet",
+        expectations=expectations,
+    )
+    assert installed.request == Path(
+        "/missioncore/input/steps/prepare/ddrnet-request.json"
+    )
+    assert installed.camera_job_root == Path(
+        "/missioncore/input/steps/prepare/camera-job"
+    )
+    assert installed.output_root == Path("/missioncore/output")
+    assert installed.eomt_result_root == Path("/missioncore/input/steps/eomt")
+
+    with pytest.raises(contract.ComponentAdapterError, match="accepts only"):
+        contract.resolve_runtime_layout(
+            ("--package-step", "eomt"),
+            component="ddrnet",
+            expectations=expectations,
+        )
+
+
 def test_sealed_tree_receipt_rehashes_payload_and_rejects_tamper(
     tmp_path: Path,
 ) -> None:
@@ -777,6 +858,8 @@ def test_eomt_adapter_uses_only_fixed_legacy_argv_and_publishes_frames(
             str(camera_root),
             "--profile",
             str(runner_root / "e3_k1_camera1_profile.json"),
+            "--physical-source-id",
+            "sensor.camera.right",
             "--valid-fov-root",
             str(asset_roots["k1-valid-fov-root"]),
             "--frames",
@@ -885,6 +968,13 @@ def test_eomt_adapter_uses_only_fixed_legacy_argv_and_publishes_frames(
     ]
 
 
+def test_eomt_default_disk_floor_retains_large_post_run_reserve() -> None:
+    assert eomt.DISK_FLOOR_BYTES == 350 * 1024**3
+    full_record_working_set = 6_830 * 800 * 600 * 7 + 556_912_640
+    assert full_record_working_set < 22 * 1024**3
+    assert (eomt.DISK_FLOOR_BYTES + full_record_working_set) < 372 * 1024**3
+
+
 def _effective_ddrnet_config(
     source: Mapping[str, object],
     *,
@@ -1152,7 +1242,7 @@ def test_ddrnet_adapter_uses_exact_candidate_argv_and_publishes_legacy_result(
         "--dataset-root",
         str(tmp_path / "ddrnet-work"),
         "--frames-root",
-        str(tmp_path / "ddrnet-work" / "source-frames"),
+        str(eomt_root / "source-frames"),
         "--output",
         str(output / ".ddrnet-component"),
         "--limit",
@@ -1201,7 +1291,9 @@ def test_ddrnet_mask_archive_rejects_class_id_outside_taxonomy(tmp_path: Path) -
         ddrnet._validate_mask_archive_inventory(archive_path, 1)
 
 
-def test_ddrnet_snapshot_rejects_same_length_source_frame_tamper(tmp_path: Path) -> None:
+def test_ddrnet_read_only_frame_verification_rejects_same_length_tamper(
+    tmp_path: Path,
+) -> None:
     eomt_root = tmp_path / "eomt-result"
     frames_root = eomt_root / "source-frames"
     frames_root.mkdir(parents=True)
@@ -1215,11 +1307,28 @@ def test_ddrnet_snapshot_rejects_same_length_source_frame_tamper(tmp_path: Path)
         sha256=hashlib.sha256(original).hexdigest(),
     )
     frame.write_bytes(b"\x89PNG\r\n\x1a\ntampered")
-    work = tmp_path / "work"
-    work.mkdir()
-
     with pytest.raises(contract.ComponentAdapterError, match="source frame identity changed"):
-        ddrnet._snapshot_source_frames(eomt_root, (row,), work / "source-frames")
+        ddrnet._verify_source_frames(eomt_root, (row,))
+
+
+def test_ddrnet_uses_verified_eomt_frames_without_tmpfs_snapshot(tmp_path: Path) -> None:
+    eomt_root = tmp_path / "eomt-result"
+    frames_root = eomt_root / "source-frames"
+    frames_root.mkdir(parents=True)
+    frame = frames_root / "frame-000001.png"
+    payload = b"\x89PNG\r\n\x1a\nverified"
+    frame.write_bytes(payload)
+    row = ddrnet.SourceFrameRow(
+        sequence=1,
+        path="source-frames/frame-000001.png",
+        byte_length=len(payload),
+        sha256=hashlib.sha256(payload).hexdigest(),
+    )
+
+    admitted = ddrnet._verify_source_frames(eomt_root, (row,))
+
+    assert admitted == frames_root.resolve(strict=True)
+    assert tuple(frames_root.iterdir()) == (frame,)
 
 
 def test_eomt_mask_archive_rejects_link_member(tmp_path: Path) -> None:

tests/test_observatory_portable_lab_v1_promotion.py

@@ -8,16 +8,6 @@ from typing import cast
 
 import pytest
 
-from k1link.observatory.portable_lab_v1_executor import (
-    PortableLabV1ReleaseCandidate,
-)
-from k1link.observatory.portable_run_definitions import (
-    PortableRunDefinitionRegistry,
-)
-from k1link.observatory.portable_worker_runtime import (
-    PortableWorkerRuntimeRegistry,
-)
-
 REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
 DEFINITIONS = REPOSITORY_ROOT / "config" / "observatory-portable-run-definitions.json"
 RUNTIME = REPOSITORY_ROOT / "config" / "observatory-worker-runtime-candidates.json"
@@ -102,8 +92,8 @@ def _input_document(
         _asset(
             "eomt-runner-bundle",
             "/runner",
-            "3bcfb73db5079deffe51173198f7a02e9e4c49f5fc5439d7976757a430fe91d3",
-            144_128,
+            "0d08f0492d5ad62903874ea224c505e54a6f6059c8283f586bc79e42d55156b7",
+            145_141,
             tree=True,
         ),
         _asset(
@@ -320,20 +310,7 @@ def _write_installation_evidence(tmp_path: Path) -> tuple[Path, Path]:
     return component, coordinator
 
 
-def _files(root: Path) -> dict[str, bytes]:
-    return {
-        path.relative_to(root).as_posix(): path.read_bytes()
-        for path in root.rglob("*")
-        if path.is_file()
-    }
-
-
-def _row(document: dict[str, object], collection: str, setup_id: str) -> object:
-    rows = cast(list[dict[str, object]], document[collection])
-    return next(row for row in rows if row["setup_id"] == setup_id)
-
-
-def test_ready_promotion_is_deterministic_additive_and_round_trips(
+def test_legacy_ready_promotion_refuses_an_already_promoted_source(
     tmp_path: Path,
 ) -> None:
     work_root = tmp_path / "work"
@@ -352,66 +329,20 @@ def test_ready_promotion_is_deterministic_additive_and_round_trips(
     )
     inputs = promotion.load_promotion_input(input_path)
 
-    first = promotion.generate_ready_lab_v1_artifacts(
-        promotion=inputs,
-        source_definition_registry=DEFINITIONS,
-        source_runtime_registry=RUNTIME,
-        ddrnet_portable_config=PORTABLE_CONFIG,
-        output_root=tmp_path / "ready-a",
-    )
-    second = promotion.generate_ready_lab_v1_artifacts(
-        promotion=inputs,
-        source_definition_registry=DEFINITIONS,
-        source_runtime_registry=RUNTIME,
-        ddrnet_portable_config=PORTABLE_CONFIG,
-        output_root=tmp_path / "ready-b",
-    )
+    output_root = tmp_path / "must-not-regenerate"
+    with pytest.raises(
+        promotion.PortableLabV1PromotionError,
+        match="source LAB V1 definition is already ready",
+    ):
+        promotion.generate_ready_lab_v1_artifacts(
+            promotion=inputs,
+            source_definition_registry=DEFINITIONS,
+            source_runtime_registry=RUNTIME,
+            ddrnet_portable_config=PORTABLE_CONFIG,
+            output_root=output_root,
+        )
 
-    assert _files(first.root) == _files(second.root)
-    source_definitions = json.loads(DEFINITIONS.read_text(encoding="utf-8"))
-    ready_definitions_document = json.loads(
-        first.definition_registry_path.read_text(encoding="utf-8")
-    )
-    assert _row(
-        ready_definitions_document,
-        "definitions",
-        "m49-tgs-portable-v2",
-    ) == _row(source_definitions, "definitions", "m49-tgs-portable-v2")
-
-    definitions = PortableRunDefinitionRegistry.from_file(
-        first.definition_registry_path
-    )
-    definition = definitions.resolve_setup(promotion.PORTABLE_LAB_V1_SETUP_ID)
-    runtime = PortableWorkerRuntimeRegistry.from_file(
-        first.runtime_registry_path,
-        definitions=definitions,
-    ).resolve(definition.setup_id, definition.definition_sha256)
-    release = PortableLabV1ReleaseCandidate.from_file(
-        first.release_candidate_path,
-        repository_root=first.root,
-    )
-    release.bind_definition(definition)
-
-    assert first.release_candidate_path.name == "lab-v1-executor-release.json"
-    assert definition.executor.ready
-    assert runtime.ready
-    assert [
-        asset.asset_id for asset in release.assets if asset.kind == "repository-file"
-    ] == [promotion.DDRNET_PORTABLE_CONFIG_ASSET_ID]
-    assert promotion.PORTABLE_LAB_V1_WORKER_INSTALLATION_RECEIPT_ASSET_ID not in {
-        asset.asset_id for asset in release.assets
-    }
-    receipt_requirement = next(
-        asset
-        for asset in runtime.reusable_assets
-        if asset.asset_id
-        == promotion.PORTABLE_LAB_V1_WORKER_INSTALLATION_RECEIPT_ASSET_ID
-    )
-    assert receipt_requirement.sha256 == first.installation_receipt_file_sha256
-    assert first.release_candidate_sha256 == second.release_candidate_sha256
-    assert first.release_sha256 == second.release_sha256
-    assert first.definition_sha256 == second.definition_sha256
-    assert first.runtime_candidate_sha256 == second.runtime_candidate_sha256
+    assert not output_root.exists()
 
 
 def test_promotion_rejects_bare_or_mismatched_installer_claims(