Package portable Linux runtime and verify Google CPU search

docs/VALIDATION.md

@@ -5,7 +5,56 @@ inference, FFmpeg decoding and WebView tests use CPU only. UI launches set
 `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS='--disable-gpu --disable-accelerated-video-decode'`
 and `SEARCHI_FORCE_CPU=1`.
 
-## Native Linux media checkpoint (2026-10-13)
+## Native Linux runtime and headless checkpoint (2026-10-13)
+
+The normal native Linux x86-64 worker now builds with Vulkan plus shared CPU
+dispatch. All 19 packaged libraries (14 CPU modules, Vulkan and four core
+libraries) pass dependency/RUNPATH checks and hashed resource staging. Actual
+copies outside the build tree pass genuine Google code-query inference on
+`libggml-cpu-zen4.so` and on a baseline-only `libggml-cpu-x64.so` extraction.
+Both produce finite normalized 768-dimensional vectors and report CPU with no
+Vulkan module loaded. See [dispatch evidence](evidence/linux-worker-cpu-dispatch.json)
+and [baseline evidence](evidence/linux-worker-cpu-baseline.json). These establish
+startup, origin-relative packaging and CPU inference, not broad retrieval
+quality, text/media reference parity, older hardware or GPU behavior.
+
+An actual loader-free chroot also passes with requested device `auto` and no
+forced-CPU override. Its private mount namespace contains only the verified
+runtime, declared C/C++ ABI libraries and a read-only pinned model; Vulkan
+loaders, driver/ICD configuration and GPU devices are absent. It returns a
+normalized Google vector on CPU and reports Vulkan not loaded. See
+[missing-loader evidence](evidence/linux-worker-missing-loader.json). This proves
+Linux missing-loader CPU fallback without GPU execution; actual device loss,
+GPU precision and driver recovery remain open. The reusable check verifies
+namespace separation before any mount changes; two guard regressions pass.
+
+Native Linux builder tests pass 7/7; staging passes 25 with two Windows-only
+skips; archive regressions pass 15/15. Packaging regressions use inert ELF
+fixtures and controlled metadata, so actual extracted CLI deployment remains
+a distinct gate. The Linux release CLI build passed (25m43s cold compilation).
+Initial actual archive preflight detected its glibc `libmvec.so.1` dependency;
+Ubuntu identifies that component as part of `libc6`. Adding that exact declared
+ABI component preserves unknown-dependency rejection. Actual archive creation
+now passes. The resulting unsigned headless archive is 148,157,038 bytes,
+SHA-256 `1e5a07edd4d94b49d2550914163637eca84087c802df0bb59b68168b849544e5`.
+All 29 listed files and permissions pass extraction verification into a path
+containing spaces. Installed release CLI startup, mixed document/code/audio
+indexing, automatic decoder discovery, real German semantic retrieval, code
+line citations and strict extension filtering pass. See
+[archive evidence](evidence/linux-headless-archive.json). This is an unpublished
+development candidate, not an installer or clean-machine certification.
+
+Five genuine Google integration tests pass on native Linux, serially with one
+inference thread. Code task/debug/offset checks pass; text reference cosines
+range from 0.99981764 to 0.99994252 and debug/normal parity is 1.00000001.
+Image budgets 280/140/70 have reference cosines 0.99993253, 0.99976889 and
+0.99914157; audio parity is 0.99979352. These meet the 0.999 reference threshold.
+They establish runtime equivalence on this CPU host, not broad retrieval
+quality or GPU parity. Two additional genuine Google service tests pass:
+restart/stale-change/deletion behavior and failed rebuild policy preservation
+with retry. Seven real-model tests passed in total. No GPU provider executed.
+Exact model/worker hashes, test counts and reference similarities are retained
+in [Google CPU parity evidence](evidence/linux-google-cpu-parity.json).
 
 Pinned BtbN Linux x86-64 FFmpeg/FFprobe archive size and SHA-256 verification
 passed under Ubuntu 24.04 WSL. Both native tools report the pinned version;