Build the sandbox image and a Linux amd64 installer

.github/workflows/cache-warm.yml

@@ -15,28 +15,6 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  companion:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: blacksmith-2vcpu-ubuntu-2204
-            github-runner: ubuntu-22.04
-          - runner: macos-15
-            github-runner: macos-15
-    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && matrix.github-runner || matrix.runner }}
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-      - uses: ./.github/actions/node
-        with:
-          node-version: '22.22.0'
-          lockfiles: |
-            packages/claude-sdk-adapter/pnpm-lock.yaml
-            packages/mcode-harness/package-lock.json
-      - run: pnpm --dir packages/claude-sdk-adapter fetch
-      - uses: ./.github/actions/mcode-companion
-
   linux:
     runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
     timeout-minutes: 15

.github/workflows/check.yml

@@ -190,8 +190,6 @@ jobs:
         include:
           - runner: ubuntu-24.04
             architecture: amd64
-          - runner: ubuntu-24.04-arm
-            architecture: arm64
     runs-on: ${{ matrix.runner }}
     env:
       GOARCH: ${{ matrix.architecture }}

.github/workflows/native.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       upload-artifacts:
-        description: Retain the three native installers for packaging
+        description: Retain the Linux amd64 installer for packaging
         type: boolean
         default: true
   workflow_call:
@@ -52,97 +52,56 @@ jobs:
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
-      - uses: ./.github/actions/node
-        with:
-          node-version: '22.22.0'
-          lockfiles: |
-            packages/claude-sdk-adapter/pnpm-lock.yaml
-            packages/mcode-harness/package-lock.json
-      - name: Build the native daemon and test bundle boundaries
-        id: build
-        run: |
-          go build -ldflags "-X github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/cli.Version=$(git rev-parse HEAD)" -o "$RUNNER_TEMP/oac-daemon${{ runner.os == 'Windows' && '.exe' || '' }}" ./apps/daemon/cmd/oac-daemon
-          if [[ "$RUNNER_OS" == Linux ]]; then
-            CGO_ENABLED=0 go build -mod=readonly -trimpath -o "$RUNNER_TEMP/oac-sandbox-io" ./apps/sandboxio/cmd/oac-sandbox-io
-          fi
-          node --test scripts/build-native-installer.test.mjs
       - name: Build and test the shared Core installer
         run: |
           go build -o "$RUNNER_TEMP/oac${{ runner.os == 'Windows' && '.exe' || '' }}" ./services/core/cmd/oac
           go test ./services/core/cmd/oac -count=1 -timeout=3m
+      - name: Reject unsupported self-hosted installations
+        if: runner.os != 'Linux'
+        run: go test ./apps/daemon/internal/cli -run '^TestNativeUnsupportedPlatformPrecedesInputAndState$' -count=1 -timeout=3m
       - name: Exercise the Windows Core launcher
         if: runner.os == 'Windows'
         shell: pwsh
         run: ./deploy/test_install.ps1 -Binary "$env:RUNNER_TEMP/oac.exe"
-      - name: Verify native download bootstrap and recovery
-        run: go test ./services/core/internal/nativeinstaller -count=1 -timeout=3m
-      - name: Native filesystem and process lifecycle
-        id: filesystem
-        run: >-
-          go test -race -count=1
-          ./internal/runtimefs
-          ./apps/daemon/internal/paths
-          ./apps/daemon/internal/daemonize
-          ./apps/daemon/internal/agent/clirunner
-      - name: Native Harness process ownership
-        id: harness
-        run: >-
-          go test -race -count=1
-          ./apps/daemon/internal/agent/codex
-          -run 'TestJSONRPCClientOwnsToolDescendants'
-      - name: Native installation
-        id: files
-        run: >-
-          go test -race -count=1
-          ./apps/daemon/internal/cli
-          -run 'TestNative'
-      - name: Build pinned native components
+      - uses: actions/setup-node@v6
+        if: runner.os == 'Linux'
+        with:
+          node-version: '22'
+      - name: Build the Linux amd64 launcher and Sandbox I/O
+        if: runner.os == 'Linux'
+        id: build
         run: |
-          pnpm --dir packages/claude-sdk-adapter install --frozen-lockfile
-          pnpm --dir packages/claude-sdk-adapter build --outDir "$RUNNER_TEMP/claude-compiled"
-          pnpm --dir packages/claude-sdk-adapter --config.extend-node-path=false --filter @oac/claude-sdk-adapter deploy --prod "$RUNNER_TEMP/claude-runtime"
-          rm -rf "$RUNNER_TEMP/claude-runtime/dist"
-          mv "$RUNNER_TEMP/claude-compiled" "$RUNNER_TEMP/claude-runtime/dist"
-          # Reify the dedicated frozen export lock without pnpm's symlink layout.
-          # Flattening isolated package links changes Node dependency resolution.
-          rm -rf "$RUNNER_TEMP/claude-runtime/node_modules"
-          pnpm --dir "$RUNNER_TEMP/claude-runtime" install --prod --frozen-lockfile --config.node-linker=hoisted --ignore-scripts
-          npm install --prefix "$RUNNER_TEMP/native-tools" --no-save @openai/codex@0.153.4
-      - name: Restore or build the pinned MiniMax companion on Unix
-        if: runner.os != 'Windows'
-        uses: ./.github/actions/mcode-companion
-      - name: Package and exercise CLI-only installation, additions and reuse
+          CGO_ENABLED=0 go build -ldflags "-X github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/cli.Version=$(git rev-parse HEAD)" -o "$RUNNER_TEMP/oac-daemon" ./apps/daemon/cmd/oac-daemon
+          CGO_ENABLED=0 go build -mod=readonly -trimpath -o "$RUNNER_TEMP/oac-sandbox-io" ./apps/sandboxio/cmd/oac-sandbox-io
+          node --test scripts/build-native-installer.test.mjs scripts/build-native-catalog.test.mjs
+      - name: Verify download recovery and launcher installation
+        if: runner.os == 'Linux'
+        id: files
+        run: go test -race -count=1 ./services/core/internal/nativeinstaller ./apps/daemon/internal/cli ./apps/daemon/internal/daemonize ./apps/daemon/internal/agent/clirunner ./internal/runtimefs
+      - name: Prepare Sandbox I/O directories
+        if: runner.os == 'Linux'
+        run: sudo install -d -o "$(id -u)" -g "$(id -g)" -m 0700 /environment/workspace /environment/initialization /environment/packages /home/runtime
+      - name: Package and exercise launcher installation and reuse
+        if: runner.os == 'Linux'
         id: package
-        run: |
-          if [[ "$RUNNER_OS" == Windows ]]; then
-            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
-          fi
-          node scripts/build-native-installer-ci.mjs
-      - name: Bootstrap, authenticate, install and connect natively
-        id: onboarding
+        run: node scripts/build-native-installer-ci.mjs
+      - name: Bootstrap, authenticate, install and connect
         if: runner.os == 'Linux'
+        id: onboarding
         run: node scripts/native-onboarding-smoke.mjs
-      - name: Verify native Harness protocols without model requests
-        id: protocol
-        run: |
-          if [[ "$RUNNER_OS" == Windows ]]; then
-            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
-          fi
-          node scripts/native-harness-smoke.mjs --codex-binary "$RUNNER_TEMP/native-installer/components/codex/bin/codex${{ runner.os == 'Windows' && '.exe' || '' }}" --claude-runtime "$RUNNER_TEMP/native-installer/components/claude"
-      - name: Archive the native distribution
-        run: |
-          cd "$RUNNER_TEMP"
-          tar -C native-installer -czf "oac-native-installer-${{ runner.os }}-${{ runner.arch }}.tar.gz" .
+      - name: Archive the Linux amd64 installer
+        if: runner.os == 'Linux'
+        run: tar -C "$RUNNER_TEMP/native-installer" -czf "$RUNNER_TEMP/oac-native-installer-Linux-X64.tar.gz" .
       - uses: actions/upload-artifact@v6
-        if: inputs.upload-artifacts
+        if: inputs.upload-artifacts && runner.os == 'Linux'
         with:
-          name: oac-native-installer-${{ runner.os }}-${{ runner.arch }}
-          path: ${{ runner.temp }}/oac-native-installer-*.tar.gz
+          name: oac-native-installer-Linux-X64
+          path: ${{ runner.temp }}/oac-native-installer-Linux-X64.tar.gz
           if-no-files-found: error
           retention-days: 7
           compression-level: 0
       - name: Record failed native check phases
-        if: failure()
+        if: failure() && runner.os == 'Linux'
         env:
           PHASES: ${{ toJSON(steps) }}
           PLATFORM: ${{ matrix.platform }}
@@ -157,7 +116,7 @@ jobs:
           writeFileSync(join(dir, 'phases.json'), JSON.stringify({ platform: process.env.PLATFORM, phases }, null, 2));
           JS
       - name: Retain native failure diagnostics
-        if: failure()
+        if: failure() && runner.os == 'Linux'
         uses: actions/upload-artifact@v6
         with:
           name: native-diagnostics-${{ matrix.platform }}-${{ github.run_attempt }}
@@ -178,3 +137,5 @@ jobs:
           go-version-file: go.mod
       - run: go test ./services/core/cmd/oac -count=1 -timeout=3m
       - run: go build -o "$RUNNER_TEMP/oac" ./services/core/cmd/oac
+      - name: Reject unsupported self-hosted installations
+        run: go test ./apps/daemon/internal/cli -run '^TestNativeUnsupportedPlatformPrecedesInputAndState$' -count=1 -timeout=3m

.github/workflows/release.yml

@@ -109,14 +109,10 @@ jobs:
           bash scripts/prepare-release-runtimes.sh
       - uses: actions/download-artifact@v6
         with:
-          pattern: oac-native-installer-*
-          merge-multiple: true
+          name: oac-native-installer-Linux-X64
           path: ${{ runner.temp }}/native-artifacts
       - name: Assemble the native installation catalog
         run: node scripts/build-native-catalog.mjs "$RUNNER_TEMP/native-artifacts" "$RUNNER_TEMP/native-installers"
-      - uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
       - uses: ./.github/actions/e2b-provider
       - name: Build matched artifacts
         env:

CONTRIBUTING.md

@@ -23,7 +23,6 @@ This guide owns how to work in the repository: documentation ownership, the repo
 | Provider registration and lifecycle | [Sandbox Provider guide](docs/sandbox-provider.md) |
 | Sandbox deployment, selection and administrative transitions | [Sandbox deployment](contracts/agents-api/sandbox-deployment.md) |
 | Operator node tasks | [Nodes guide](docs/getting-started/nodes.md) |
-| Codex, Claude and MiniMax Runtime adapters and images | [Codex](services/core/deploy/codex/README.md), [Claude](services/core/deploy/claude/README.md), [MiniMax](services/core/deploy/mcode/README.md) |
 | Claude private SDK bridge | [Claude SDK adapter](packages/claude-sdk-adapter/README.md) |
 | E2B template construction | [E2B template builder](services/core/deploy/e2b/README.md) |
 | E2B and microsandbox Provider helper implementation | [E2B helper](services/core/tools/e2b-provider/README.md), [microsandbox helper](services/core/tools/microsandbox-provider/README.md) |

Makefile

@@ -3,7 +3,7 @@ SQLC_VERSION ?= v1.29.0
 SQLC ?= go run github.com/sqlc-dev/sqlc/cmd/sqlc@$(SQLC_VERSION)
 SWAG_VERSION ?= v1.16.4
 
-.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-web check-mcode-harness build-daemon build-sandbox-io build-core check-core check-core-packages check-core-integration docker-build-core check-core-container build-codex-runtime build-claude-runtime build-claude-sdk-runtime build-mcode-harness build-mcode-runtime
+.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-web check-mcode-harness build-daemon build-sandbox-io build-core check-core check-core-packages check-core-integration docker-build-core check-core-container build-claude-sdk-runtime build-mcode-harness
 
 help:
 	@printf '%s\n' 'make build-core        Build standalone Core commands' 'make build-daemon      Build the execution daemon' 'make build-sandbox-io  Build the Sandbox I/O service for Linux' 'make check             Run Core, persistence and runtime checks' 'See README.md for runtime prerequisites and deployment.'
@@ -158,18 +158,9 @@ check-mcode-harness:
 	@for script in packages/mcode-harness/*.mjs; do node --check "$$script"; done
 	bash -n scripts/build-mcode-harness.sh scripts/build-mcode-runtime.sh
 
-build-codex-runtime:
-	./scripts/build-codex-runtime.sh
-
-build-claude-runtime:
-	./scripts/build-claude-runtime.sh
-
 build-mcode-harness:
 	./scripts/build-mcode-harness.sh
 
-build-mcode-runtime:
-	./scripts/build-mcode-runtime.sh
-
 .PHONY: build-microsandbox-provider check-microsandbox-provider
 build-microsandbox-provider:
 	@test "$$(go env GOOS)" = linux || { echo 'The microsandbox provider helper requires Linux' >&2; exit 1; }

apps/daemon/internal/agent/claudesdk/installation.go

@@ -1,23 +1,14 @@
 package claudesdk
 
 import (
-	"context"
-	"fmt"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"path/filepath"
-	"runtime"
 )
 
 func Installation() agent.Installation {
-	return agent.Installation{AgentKind: "claude_sdk", Version: "0.3.269", Supported: func() bool { return runtime.GOOS == "linux" || runtime.GOOS == "darwin" || runtime.GOOS == "windows" },
+	return agent.Installation{AgentKind: "claude_sdk",
 		Environment: func(dir, node string) map[string]string {
 			return map[string]string{"OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT": filepath.Join(dir, "dist", "main.js"), "OAC_RUNTIME_CLAUDE_SDK_NODE": node}
 		},
-		Check: func(ctx context.Context, dir, node string, env []string) error {
-			got, err := CheckRuntime(ctx, Config{Node: node, Entrypoint: filepath.Join(dir, "dist", "main.js"), Env: env})
-			if err != nil || got.SDK != "0.3.269" || !got.SupportsLocalRuntime() {
-				return fmt.Errorf("Claude installation is incompatible; Windows requires Git Bash")
-			}
-			return nil
-		}}
+	}
 }

apps/daemon/internal/agent/codex/installation.go

@@ -1,10 +1,7 @@
 package codex
 
 import (
-	"context"
-	"fmt"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/installroot"
 	"path/filepath"
 	"runtime"
 )
@@ -17,15 +14,9 @@ func Installation() agent.Installation {
 		}
 		return filepath.Join(dir, "bin", name)
 	}
-	return agent.Installation{AgentKind: "codex", Version: "0.153.4", Supported: func() bool { return runtime.GOOS == "linux" || runtime.GOOS == "darwin" || runtime.GOOS == "windows" },
+	return agent.Installation{AgentKind: "codex",
 		Environment: func(dir, node string) map[string]string {
 			return map[string]string{"OAC_RUNTIME_CODEX_BIN": binary(dir)}
 		},
-		Check: func(ctx context.Context, dir, node string, env []string) error {
-			got, err := installroot.Probe(ctx, binary(dir), []string{"--version"}, env, dir)
-			if err != nil || got != "codex-cli 0.153.4" {
-				return fmt.Errorf("Codex installation is incompatible")
-			}
-			return nil
-		}}
+	}
 }

apps/daemon/internal/agent/installation.go

@@ -2,7 +2,6 @@ package agent
 
 import (
 	"bytes"
-	"context"
 	"encoding/json"
 	"fmt"
 	"maps"
@@ -11,15 +10,10 @@ import (
 	"slices"
 )
 
-// Installation is an optional adapter-owned native distribution contract.
-// It supplies activation paths and readiness checks, never execution or model
-// configuration. Runtime owns copying, checksums, publication and installation locks.
+// Installation supplies adapter-owned activation paths for agent-host images.
 type Installation struct {
 	AgentKind   string
-	Version     string
-	Supported   func() bool
 	Environment func(directory, node string) map[string]string
-	Check       func(context.Context, string, string, []string) error
 }
 
 // ManifestEnvironment reads the installation manifest at path, which an