bind M4.7 graph results to Worker runtime

tests/test_m47_worker_graph_shadow_artifact.py

@@ -43,18 +43,16 @@ def test_m47_worker_artifact_is_deterministic_and_self_contained(tmp_path: Path)
     with tarfile.open(first["artifact"], "r:gz") as archive:
         regular = _regular_files(archive)
     payload_names = sorted(
-        name.removeprefix("payload/")
-        for name in regular
-        if name.startswith("payload/")
+        name.removeprefix("payload/") for name in regular if name.startswith("payload/")
     )
     assert payload_names == first["payload_files"]
     assert regular["files.txt"].decode().splitlines() == first["payload_files"]
     assert _sha256(regular[f"payload/{BUILDER.WHEEL_NAME}"]) == first["wheel_sha256"]
     assert regular[f"payload/{BUILDER.RUNNER.name}"] == BUILDER.RUNNER.read_bytes()
     for relative in BUILDER.CONFIG_PATHS:
-        assert regular[f"payload/{relative.name}"] == (
-            BUILDER.REPOSITORY_ROOT / relative
-        ).read_bytes()
+        assert (
+            regular[f"payload/{relative.name}"] == (BUILDER.REPOSITORY_ROOT / relative).read_bytes()
+        )
 
 
 def test_m47_descriptor_preserves_nonparticipants_and_separates_readiness() -> None:
@@ -70,9 +68,7 @@ def test_m47_descriptor_preserves_nonparticipants_and_separates_readiness() -> N
     assert descriptor["transition"] == "m47-canonical-graph-isolated-shadow-v1"
     assert descriptor["boundary"]["external_deploy_registry"] is False
     assert descriptor["container"]["public_ports"] is False
-    assert descriptor["container"]["triton_name"] == (
-        "ndc-mission-core-m47-triton-shadow"
-    )
+    assert descriptor["container"]["triton_name"] == ("ndc-mission-core-m47-triton-shadow")
     assert descriptor["container"]["model_repository_host_path"] == (
         "D:\\NDC_MISSIONCORE\\runtime\\models"
     )
@@ -111,9 +107,7 @@ def test_m47_descriptor_preserves_nonparticipants_and_separates_readiness() -> N
         "terminal_accounting_required": True,
         "actuation_allowed": False,
     }
-    assert set(descriptor["release"]["configs"]) == {
-        path.name for path in BUILDER.CONFIG_PATHS
-    }
+    assert set(descriptor["release"]["configs"]) == {path.name for path in BUILDER.CONFIG_PATHS}
     serialized = json.dumps(descriptor).encode()
     assert b"PRIVATE KEY" not in serialized
     assert b"password=" not in serialized.lower()
@@ -127,6 +121,9 @@ def test_m47_runner_calls_only_the_canonical_graph_entrypoint() -> None:
     assert '"--mode", $descriptor.acceptance.run_mode' in runner
     assert '"--temporal-parity-frames"' in runner
     assert '"--threat-parity-frames"' in runner
+    assert '"--runtime-identity", "/run/mission-core/runtime-identity.json"' in runner
+    assert 'schema_version = "missioncore.reference-graph-runtime-identity/v3"' in runner
+    assert "patch_id = $descriptor.patch_id" in runner
     assert 'Write-Output "PROVIDER_READINESS=accepted"' in runner
     assert 'Write-Output "GRAPH_READINESS=accepted"' in runner
     assert 'Write-Output "DURABLE_WORKER_ACTION=none"' in runner

tests/test_reference_graph_result.py

@@ -14,12 +14,41 @@ from k1link.perception.graph_contracts import (
     build_graph_run_result_v2,
 )
 from k1link.perception.providers import ReferencePerceptionGraphConfigV2
+from k1link.perception.reference_graph_identity import ReferenceGraphRuntimeIdentity
 from k1link.perception.reference_graph_parity import ReferenceGraphParityReport
 from k1link.perception.reference_graph_result import seal_reference_graph_result
 
 REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
 
 
+def _runtime() -> ReferenceGraphRuntimeIdentity:
+    return ReferenceGraphRuntimeIdentity.from_dict(
+        {
+            "schema_version": "missioncore.reference-graph-runtime-identity/v3",
+            "worker_id": "worker-006",
+            "worker_node": "DESKTOP-OPJ8J04",
+            "worker_container_id": "c" * 64,
+            "worker_image_id": "sha256:" + "d" * 64,
+            "isolated_triton_container_id": "e" * 64,
+            "isolated_triton_image_id": "sha256:" + "d" * 64,
+            "historical_worker_container_id": "f" * 64,
+            "historical_worker_running": False,
+            "historical_triton_container_id": "a" * 64,
+            "historical_triton_running": False,
+            "artifact_sha256": "b" * 64,
+            "patch_id": "mission-core-m47-test",
+            "code_revision": "1" * 40,
+            "graph_id": "reference-perception-graph/v2",
+            "started_at_utc": "2026-08-23T12:00:00.000Z",
+            "source_mount_read_only": True,
+            "isolated_model_service": True,
+            "public_worker_port_added": False,
+            "commands_enabled": False,
+            "actuation_allowed": False,
+        }
+    )
+
+
 def _parity(accepted: bool = True) -> ReferenceGraphParityReport:
     return ReferenceGraphParityReport(
         expected_frames=1,
@@ -110,12 +139,16 @@ def test_reference_graph_result_is_content_addressed_and_reproducible(tmp_path:
         output_root=tmp_path / "one",
         expected_frames=1,
         parity=_parity(),
+        runtime_identity=_runtime(),
+        execution_elapsed_seconds=1.25,
     )
     second = seal_reference_graph_result(
         _result(),
         output_root=tmp_path / "two",
         expected_frames=1,
         parity=_parity(),
+        runtime_identity=_runtime(),
+        execution_elapsed_seconds=1.25,
     )
 
     assert first.accepted is True
@@ -134,9 +167,13 @@ def test_reference_graph_result_is_content_addressed_and_reproducible(tmp_path:
         "no_unavailable_frames": True,
         "accepted_m45r_m46_parity": True,
     }
-    assert {
-        path.name: path.read_bytes() for path in first.result_root.iterdir()
-    } == {path.name: path.read_bytes() for path in second.result_root.iterdir()}
+    assert {path.name: path.read_bytes() for path in first.result_root.iterdir()} == {
+        path.name: path.read_bytes() for path in second.result_root.iterdir()
+    }
+    runtime = json.loads((first.result_root / "runtime.json").read_text("utf-8"))
+    assert runtime == _runtime().to_dict()
+    assert first.manifest["runtime"] == runtime
+    assert first.manifest["files"]["runtime.json"]["sha256"]
 
 
 def test_reference_graph_result_fails_closed_on_supersession(tmp_path: Path) -> None:
@@ -145,6 +182,8 @@ def test_reference_graph_result_fails_closed_on_supersession(tmp_path: Path) ->
         output_root=tmp_path,
         expected_frames=1,
         parity=_parity(),
+        runtime_identity=_runtime(),
+        execution_elapsed_seconds=1.25,
     )
 
     assert sealed.accepted is False