runner: bundle package — metadata.json and provenance writers

[marwen-abid]

This PR adds runner/internal/bundle, the package that owns the bundle root's own record. It writes metadata.json, the cross-repo manifest the converter reads, plus the two free-text provenance files. It also holds the checks a --resume must pass before any step of a resumed campaign runs. Layer 1 documents this manifest schema in SCHEMA.md.

What is in this PR

• Crash-safe manifest (metadata.go). The runner writes metadata.json twice per campaign: up front with status: "running" and no finished_at, then again at the end with finished_at and "finished" or "failed". A killed campaign still leaves a parseable bundle. campaign.resumed appears only on resumed bundles.
• Golden test (testdata/metadata.golden.json, testdata/campaign.toml) pins the exact manifest bytes, field order included. It covers the bash-era quirks the contract keeps: "yes"/"no" for query, the comma-string concurrency, and hardware facts that vanish when empty.
• Hardware facts (CollectHardware). IMDSv2 gives the EC2 instance type and id, with a 2 s timeout so an off-EC2 machine does not stall. Every fact is best-effort.
• Provenance writers (provenance.go) write binary.txt and machine-metadata.txt. machine-metadata.txt ends with a native Go O_SYNC disk probe.
• Resume integrity (bundle.go). ValidateResume refuses a bundle unless the campaign name, the built commit, the BENCH_ROOT path, and the stored config all match. The config guard compares bytes and prints diff -u on a mismatch.

Review focus

• The golden manifest is the contract with converter/convert.py. Check each field against SCHEMA.md.
• checkStoredConfig reads config_file from a file that travels with the bundle. It rejects any value that is not a bundle-root basename.
• Identity comes from metadata.json, never from the directory basename, so a copied bundle cannot pass as another campaign.
• Best-effort facts must never fail a campaign. Check that no probe returns an error to the caller.

Verification

cd runner && go vet ./... && go test ./...

make runner-test runs the same gate. CI runs it as .github/workflows/runner-go.yml.

---

Stack: part 5 of 8 · base runner-04-execute · replaces a slice of #16

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-02 00:49 UTC

[Copilot]

Pull request overview

This PR introduces a new runner/internal/bundle package responsible for writing and reading the bundle-root manifest (metadata.json), generating free-text provenance files (binary.txt, machine-metadata.txt), and validating integrity constraints required to safely --resume a prior campaign. It also adds golden/contract tests to pin the exact manifest bytes consumed cross-repo by converter/convert.py.

Changes:

• Add metadata.json writer + schema/quirks tests (golden bytes, bash-compat fields).
• Add provenance writers for binary.txt and machine-metadata.txt, including a native Go O_SYNC fsync probe.
• Add --resume validation that ties resumption to manifest identity + stored config byte equality (with diff -u output on mismatch).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
runner/internal/bundle/bundle.go	Reads metadata.json and enforces --resume integrity checks.
runner/internal/bundle/bundle_test.go	Tests resume validation, including bash-era manifest compatibility and refusal cases.
runner/internal/bundle/metadata.go	Implements metadata.json schema, deterministic marshaling, and best-effort hardware collection (IMDSv2 + local facts).
runner/internal/bundle/metadata_test.go	Golden/contract tests for manifest bytes and bash-era quirks; tests IMDSv2 behavior.
runner/internal/bundle/provenance.go	Writes binary.txt and machine-metadata.txt provenance; includes fsync probe and version capture.
runner/internal/bundle/provenance_test.go	Tests provenance file writing behavior and best-effort expectations.
runner/internal/bundle/testdata/campaign.toml	Golden-test campaign config used to drive pinned manifest output.
runner/internal/bundle/testdata/metadata.golden.json	Pinned metadata.json bytes (ordering and field shapes included).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marwen-abid]

@claude[agent] review

[Claude]

@claude[agent] review

Reviewed the current state at f1ef0dc. The three earlier threads are resolved: the reRunID NAME capture is discarded (results dir is rebuilt by plan.Build and run.go requires an exact match), and both fact-gathering commands and binaryVersion are bounded by factTimeout. go vet and go test ./internal/bundle/... pass locally and CI on runner-05-bundle is green. No further changes needed.