feat(runner): isolate structured workflows in one-attempt Kubernetes Pods

A `workflow-run` no longer enters the shared-daemon job protocol. One exact
attempt owns one Pod and one capability Secret, and every state mutation is
fenced by run ID, attempt ID, owner ID, lease, and command receipt.

Runner side:
- Add `src/runner/` (entry, WebSocket client, workflow executor, output
  sanitizer, token deadline, process boundary), replacing the deleted
  `src/daemon/workflow-executor.ts`.
- Add `native/daemon-process-guard.c` and `src/daemon/process-boundary.ts` so
  a worker cannot outlive its attempt.
- The runner deny set rejects App, PAT, database, Valkey, Kubernetes,
  Context7, global GitHub, and daemon-auth credentials.

Controller side:
- Add `src/orchestrator/workflow-runner-*.ts` (controller, dispatch, payload,
  store, result, reconciler, resources, capability, output) and
  `src/k8s/workflow-runner-spawner.ts`, which owns the per-attempt Secret.
- Add `src/shared/workflow-runner-messages.ts`: a separate protocol from the
  shared-daemon schema, deliberately not shared with it.
- Add migration `017_workflow_run_leases.sql`, which introduces the
  `attempt_id` / `offer_id` columns that `src/orchestrator/history.ts` and the
  daemon-disconnect fencing path query.
- The RPC output scanner is stricter than the general one: disablement,
  failure, or timeout rejects a command and converts a result to a fixed safe
  failure rather than failing open.

Also in this change:
- Orchestrator resilience: liveness reaper, queue worker, ws-server split into
  `ws-connection.ts`, dispatch outbox, completion reconciler, expiry notifier.
- The remaining `src/config.ts` surface, including the runner capability
  secret and namespace validation that only applies once the runner exists.
- Workflow handler and ship-rail updates that consume the Gate-2 policy.
- Move the last colocated `src/**/*.test.ts` files under `test/` and tighten
  `check:test-globs` to reject tests in production source.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUPpJPtxAaHWrBsjytRGyM

Author: chrisleekr

.env.example

@@ -26,11 +26,11 @@ ANTHROPIC_API_KEY=
 # CLAUDE_CODE_OAUTH_TOKEN=
 
 # Model override. Required when CLAUDE_PROVIDER=bedrock (Bedrock uses a different model ID
-# format than the Anthropic API). Optional for anthropic: defaults to claude-opus-4-7
+# format than the Anthropic API). Optional for anthropic: defaults to claude-opus-5
 # when unset.
 # Bedrock example:  us.anthropic.claude-sonnet-4-6
-# Anthropic example: claude-opus-4-7
-# CLAUDE_MODEL=claude-opus-4-7
+# Anthropic example: claude-opus-5
+# CLAUDE_MODEL=claude-opus-5
 
 # ──────────────────────────────────────────────────────────────────────────────
 # Amazon Bedrock (when CLAUDE_PROVIDER=bedrock)
@@ -141,6 +141,15 @@ AGENT_JOB_MODE=inline
 # the primary or this previous token (constant-time). Drop after rolling daemons.
 # DAEMON_AUTH_TOKEN_PREVIOUS=
 
+# Controller-only HMAC root for deadline-bound workflow-runner capabilities.
+# Never mount either value on shared daemons or isolated runners, and never
+# reuse either DAEMON_AUTH_TOKEN rotation value.
+# Generate at least 32 random bytes (e.g. openssl rand -hex 32).
+# WORKFLOW_RUNNER_CAPABILITY_SECRET=
+# Optional rotation-window predecessor. Remove after every capability minted
+# with the old root has reached its signed expiry.
+# WORKFLOW_RUNNER_CAPABILITY_SECRET_PREVIOUS=
+
 # Per-job cost ceiling in USD
 # JOB_MAX_COST_USD=80
 
@@ -154,6 +163,8 @@ AGENT_JOB_MODE=inline
 # STALE_EXECUTION_THRESHOLD_MS=600000
 # DAEMON_DRAIN_TIMEOUT_MS=300000
 # JOB_MAX_RETRIES=3
+# Maximum wall-clock age for a queued structured-workflow dispatch.
+# WORKFLOW_DISPATCH_TIMEOUT_MS=4200000
 # OFFER_TIMEOUT_MS=5000
 
 # Daemon-side settings (used by scripts/run-daemon.sh)
@@ -203,11 +214,14 @@ AGENT_JOB_MODE=inline
 # Enable debug logging of LLM prompts.
 # DEBUG_LLM_PROMPTS=1
 
+# Per-repo config file, read from each installed repo's DEFAULT BRANCH root only.
+# Deprecated alias: SCHEDULER_CONFIG_FILE.
+# REPO_CONFIG_FILE=.github-app.yaml
+
 # Scheduled actions (.github-app.yaml). The scheduler also requires
 # DATABASE_URL and a non-empty ALLOWED_OWNERS to start.
 # SCHEDULER_ENABLED=false
 # SCHEDULER_SCAN_INTERVAL_MS=300000
-# SCHEDULER_CONFIG_FILE=.github-app.yaml
 # Hard kill-switch for unattended auto-merge; per-action auto_merge is AND-ed
 # with this. Leave false unless you accept LLM-judged merges.
 # SCHEDULER_ALLOW_AUTO_MERGE=false

.github/skills/research.md

@@ -67,7 +67,7 @@ Read the key files for the focus area:
 | idempotency    | src/webhook/router.ts, src/core/tracking-comment.ts               |
 | security       | src/utils/, src/config.ts                                         |
 | observability  | src/logger.ts (and grep for logger usage across src/)             |
-| testing        | src/\*\*/\*.test.ts (sample 3-5; do not read all)                 |
+| testing        | test/\*\*/\*.test.ts (sample 3-5; do not read all)                |
 | docs           | CLAUDE.md, README.md, docs/                                       |
 | infrastructure | .github/workflows/, Dockerfile.\*, package.json                   |
 | agent-sdk      | src/core/prompt-builder.ts, src/core/executor.ts                  |

.github/workflows/ci.yml

@@ -112,9 +112,8 @@ jobs:
         run: bun run check:runner-pins
 
       - name: Test-glob drift guard
-        # Fails if any `*.test.ts` file is not reachable by the runner glob in
-        # scripts/test-isolated.sh, so a colocated test outside the globbed
-        # roots cannot go dark while CI stays green. See issue #201.
+        # Fails if any `*.test.ts` file is outside the canonical `test/` tree
+        # consumed by scripts/test-isolated.sh.
         run: bun run check:test-globs
 
       - name: Destructive-action guard (FR-009)
@@ -190,3 +189,22 @@ jobs:
         # build/resolve drift class that shipped in 001990d before the daemon
         # image hits production. Must run AFTER `bun run build`.
         run: bun run check:mcp-bundle
+
+  admission-policy:
+    name: Workflow runner admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .tool-versions
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Validate admission against Kubernetes 1.30
+        run: bun run test:admission

.github/workflows/docker-build.yml

@@ -6,7 +6,10 @@
 #   - chrisleekr/github-app:<tag>-daemon        (rich, Claude worker)
 # Orchestrator additionally publishes a bare `<tag>` alias so existing
 # consumers that pull `chrisleekr/github-app:<version>` keep working.
-# `:latest` is published on prod releases only, on the orchestrator variant.
+# Each variant also gets a mutable `:latest-<variant>` alias, so `latest-daemon`
+# resolves on Docker Hub the same way it does on the GitLab registry. Both that
+# alias and the bare `:latest` (orchestrator only) are prod-release only: a beta
+# prerelease must not move a tag prod consumers follow.
 #
 # Multi-platform via the documented split-and-merge pattern:
 #   https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
@@ -185,6 +188,22 @@ jobs:
             GIT_HASH=${{ steps.meta.outputs.git_hash }}
             NODE_ENV=production
 
+      - name: Smoke daemon process boundary
+        if: matrix.variant == 'daemon'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          docker pull "${IMAGE_NAME}@${DIGEST}"
+          docker run --rm \
+            --user 1000:1000 \
+            --read-only \
+            --network none \
+            --cap-drop ALL \
+            --security-opt no-new-privileges=true \
+            --entrypoint bun \
+            "${IMAGE_NAME}@${DIGEST}" \
+            run dist/daemon/process-boundary-smoke.js
+
       - name: Export digest
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
@@ -256,6 +275,7 @@ jobs:
             type=raw,value=${{ steps.tag.outputs.variant_tag }}
             type=raw,value=${{ steps.tag.outputs.version }},enable=${{ matrix.variant == 'orchestrator' }}
             type=raw,value=latest,enable=${{ matrix.variant == 'orchestrator' && inputs.is-dev-release == false }}
+            type=raw,value=latest-${{ matrix.variant }},enable=${{ inputs.is-dev-release == false }}
 
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests

.github/workflows/research.yml

@@ -195,7 +195,7 @@ jobs:
             | idempotency      | src/webhook/router.ts, src/core/tracking-comment.ts                  |
             | security         | src/utils/, src/config.ts                                            |
             | observability    | src/logger.ts (and grep for logger usage across src/)                |
-            | testing          | src/**/*.test.ts (sample 3-5; do not read all)                       |
+            | testing          | test/**/*.test.ts (sample 3-5; do not read all)                      |
             | docs             | CLAUDE.md, top-level README.md if present, docs/                     |
             | infrastructure   | .github/workflows/, Dockerfile, package.json                         |
             | agent-sdk        | src/core/prompt-builder.ts, src/core/executor.ts                     |