Reuse authenticated ResearchSnapshot archives from a read-only worker cache

[proerror77]

Parent

#240

What to build

Allow the existing prediction research transport to reuse an immutable local ResearchSnapshot archive identified by its expected SHA-256, while preserving the same fail-closed trust checks and per-attempt extraction/result isolation used for signed OSS downloads. A valid cache hit avoids another OSS transfer; a missing or corrupt entry never reaches the evaluator as trusted input.

This slice adds the cache-consumption seam and focused proof only. It does not deploy cache infrastructure or change snapshot, evaluator, MCTS, label, or collector semantics.

Acceptance criteria

• The runner accepts an explicitly configured local cached snapshot archive only together with its expected SHA-256 and rejects incomplete input pairs.
• The cached archive bytes are hashed before evaluator start; a mismatch fails closed and does not reuse writable extracted state.
• Signed-URL snapshot execution remains supported and unchanged for cache misses or callers that do not configure a cache.
• Cache identity is content-addressed by the authenticated snapshot SHA rather than URL, filename, mission id, or mutable tag.
• Two missions may read the same cached archive while retaining separate private extraction directories, checkpoints, logs, and result bundles.
• A focused counterexample test corrupts cached bytes and proves the evaluator is not started.
• Execution evidence records whether the snapshot source was a verified cache hit or trusted remote fetch without changing the snapshot authority.
• No ACK resource, worker pool, collector, evaluator policy, or production service is changed by this issue.

Blocked by

None - can start immediately.

[proerror77]

Write ownership: this task owns branch codex/research-snapshot-cache-241 at HEAD 9aa1797. Scope is alpha-harness prediction snapshot cache consumption and focused tests only; #236, #242, ACK resources, collector, evaluator, and MCTS remain read-only/out of scope.