Repository navigation
Prove existing App runner-group restrictions before ARC activation #4597
Description
🤖 Generated by the Agentic Engineer
Before the inactive ARC pool can serve KSail, prove that the existing verified App can enforce the intended runner-group restrictions through GitHub’s real API. Static configuration and App identity reads do not establish this capability.
Prepare the proof inside the protected verifier process. Retain authenticated transport and exact App identity verification; keep any temporary installation token in memory, revoke it on every exit and print only a fixed verdict. Do not expose a token through workflow outputs, files, arguments or logs.
Acceptance:
- Credential-free positive and negative fixtures exercise the actual group API proof, including complete pagination, exact repository/workflow policy, missing fields, duplicates, malformed responses and failed cleanup.
- Prefer an existing correctly restricted group through read-only proof. Otherwise create only a uniquely owned zero-runner disposable group, read back the complete policy, delete only that proven owned group and verify absence. Refuse ambiguous ownership or nonzero membership.
- Require exactly KSail and its protected-main canary workflow, public-repository allowance and workflow restrictions. A passing canary does not establish managed-analysis eligibility or authorize an expanded workflow list.
- The protected-main workflow retains the production environment and deployment lock, refuses retry and arbitrary refs, and runs tests/build before production access.
- Coordinate the existing identity-verifier entry points with feat(arc): verify transport health without credential access #4582’s owner. Keep feat(ci): activate bounded organization runners for KSail preflight #4544’s activation artifacts untouched.
- Native execution waits for fix(arc): encrypt credential transport before runner activation #4575’s protected deployment, same-node TLS proof and an existing-App identity PASS. No new App, permission grant, key copy, credential rotation, runner activation, route change or spending is included.
- Complete exact-head CI and substantive review. Retain the named native prerequisite while it is unmet; never treat fixture success as production capability.
Part of #4462. The current integration design is recorded in the parent’s preparation note.
Native acceptance remains blocked by #4570. Source preparation is tracked by #4599 and draft PR #4600 at signed head bfdd8419ff2cc7201b43dedc107cd1165e64ee1e; its current-head CI and substantive review are pending. Landing that reviewed preparation does not complete this issue or authorize a native trial. Corrected same-node transport and existing-App identity must pass on actual protected main first. No App/grant, runner activation, workflow expansion, route change or spend is included.
Metadata
Metadata
Assignees
Labels
Type
Fields
Projects
- Status
Activity
chore: agent-claim #4597 nonce=b9a02e07ae601db9d45887aac62dfe47
devantler commentedon Oct 6, 2026
The zero-runner capability verifier is published in draft PR #4600 at signed head
5aae7c999ea78e9978f1bcd7ad8407a3f21f28d3, with source delivery tracked separately in #4599. The bounded #4582 handoff has been integrated on our own branch; its frozen transport branch has not been changed. Land #4582 first, then refresh this branch against actual protected main before queue entry.The check uses the existing verified App inside the verifier process. No App credential or temporary installation token becomes a workflow output, file, argument or log. It does not activate runners, change routing, widen grants or add capacity.
Credential-free synthetic validation covers:
The integrated identity, transport and runner-group race suite, Go vet, configured actionlint, concurrency queue validation and offline zizmor pass. Native CI run 37536827313 and credential-free verifier run 37536827318 completed successfully at this head. The verifier's production job was correctly skipped. All 34 reported checks are settled, with no failed or pending checks and no unresolved review threads. Substantive current-head review reports no actionable findings.
Only three existing integration points changed: the internal post-identity callback, routing the two new CLI modes while preserving the transport modes, and one watch-path entry in the existing credential-free fixture workflow. The existing job supplies PR coverage; the new production workflow is manual-only and adds no duplicate PR fixture allocation.
These results establish source readiness, not production capability. #4575 has merged, but the corrected production transport acceptance is still pending the repair in #4602. #4600 remains a draft on the live #4582 dependency; this Spike retains its native blocker #4570. Actual group API execution still requires corrected same-node TLS and an existing-App identity PASS. No native group check, credential retrieval, runner registration or production dispatch has been performed by this delivery. Source merge closes #4599 only; #4597 stays open for the native capability proof and decision.
chore: agent-claim #4597 nonce=396c1874aa59802f74a36e8edbeedfcf