feat(runner): isolate structured workflows in one-attempt Kubernetes Pods

.env.example

@@ -26,11 +26,11 @@ ANTHROPIC_API_KEY=
 # CLAUDE_CODE_OAUTH_TOKEN=
 
 # Model override. Required when CLAUDE_PROVIDER=bedrock (Bedrock uses a different model ID
-# format than the Anthropic API). Optional for anthropic: defaults to claude-opus-4-7
+# format than the Anthropic API). Optional for anthropic: defaults to claude-opus-5
 # when unset.
 # Bedrock example:  us.anthropic.claude-sonnet-4-6
-# Anthropic example: claude-opus-4-7
-# CLAUDE_MODEL=claude-opus-4-7
+# Anthropic example: claude-opus-5
+# CLAUDE_MODEL=claude-opus-5
 
 # ──────────────────────────────────────────────────────────────────────────────
 # Amazon Bedrock (when CLAUDE_PROVIDER=bedrock)
@@ -141,6 +141,15 @@ AGENT_JOB_MODE=inline
 # the primary or this previous token (constant-time). Drop after rolling daemons.
 # DAEMON_AUTH_TOKEN_PREVIOUS=
 
+# Controller-only HMAC root for deadline-bound workflow-runner capabilities.
+# Never mount either value on shared daemons or isolated runners, and never
+# reuse either DAEMON_AUTH_TOKEN rotation value.
+# Generate at least 32 random bytes (e.g. openssl rand -hex 32).
+# WORKFLOW_RUNNER_CAPABILITY_SECRET=
+# Optional rotation-window predecessor. Remove after every capability minted
+# with the old root has reached its signed expiry.
+# WORKFLOW_RUNNER_CAPABILITY_SECRET_PREVIOUS=
+
 # Per-job cost ceiling in USD
 # JOB_MAX_COST_USD=80
 
@@ -154,6 +163,8 @@ AGENT_JOB_MODE=inline
 # STALE_EXECUTION_THRESHOLD_MS=600000
 # DAEMON_DRAIN_TIMEOUT_MS=300000
 # JOB_MAX_RETRIES=3
+# Maximum wall-clock age for a queued structured-workflow dispatch.
+# WORKFLOW_DISPATCH_TIMEOUT_MS=4200000
 # OFFER_TIMEOUT_MS=5000
 
 # Daemon-side settings (used by scripts/run-daemon.sh)
@@ -203,11 +214,14 @@ AGENT_JOB_MODE=inline
 # Enable debug logging of LLM prompts.
 # DEBUG_LLM_PROMPTS=1
 
+# Per-repo config file, read from each installed repo's DEFAULT BRANCH root only.
+# Deprecated alias: SCHEDULER_CONFIG_FILE.
+# REPO_CONFIG_FILE=.github-app.yaml
+
 # Scheduled actions (.github-app.yaml). The scheduler also requires
 # DATABASE_URL and a non-empty ALLOWED_OWNERS to start.
 # SCHEDULER_ENABLED=false
 # SCHEDULER_SCAN_INTERVAL_MS=300000
-# SCHEDULER_CONFIG_FILE=.github-app.yaml
 # Hard kill-switch for unattended auto-merge; per-action auto_merge is AND-ed
 # with this. Leave false unless you accept LLM-judged merges.
 # SCHEDULER_ALLOW_AUTO_MERGE=false

.github/skills/research.md

@@ -67,7 +67,7 @@ Read the key files for the focus area:
 | idempotency    | src/webhook/router.ts, src/core/tracking-comment.ts               |
 | security       | src/utils/, src/config.ts                                         |
 | observability  | src/logger.ts (and grep for logger usage across src/)             |
-| testing        | src/\*\*/\*.test.ts (sample 3-5; do not read all)                 |
+| testing        | test/\*\*/\*.test.ts (sample 3-5; do not read all)                |
 | docs           | CLAUDE.md, README.md, docs/                                       |
 | infrastructure | .github/workflows/, Dockerfile.\*, package.json                   |
 | agent-sdk      | src/core/prompt-builder.ts, src/core/executor.ts                  |

.github/workflows/ci.yml

@@ -112,9 +112,8 @@ jobs:
         run: bun run check:runner-pins
 
       - name: Test-glob drift guard
-        # Fails if any `*.test.ts` file is not reachable by the runner glob in
-        # scripts/test-isolated.sh, so a colocated test outside the globbed
-        # roots cannot go dark while CI stays green. See issue #201.
+        # Fails if any `*.test.ts` file is outside the canonical `test/` tree
+        # consumed by scripts/test-isolated.sh.
         run: bun run check:test-globs
 
       - name: Destructive-action guard (FR-009)
@@ -190,3 +189,22 @@ jobs:
         # build/resolve drift class that shipped in 001990d before the daemon
         # image hits production. Must run AFTER `bun run build`.
         run: bun run check:mcp-bundle
+
+  admission-policy:
+    name: Workflow runner admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .tool-versions
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Validate admission against Kubernetes 1.30
+        run: bun run test:admission

.github/workflows/docker-build.yml

@@ -6,7 +6,10 @@
 #   - chrisleekr/github-app:<tag>-daemon        (rich, Claude worker)
 # Orchestrator additionally publishes a bare `<tag>` alias so existing
 # consumers that pull `chrisleekr/github-app:<version>` keep working.
-# `:latest` is published on prod releases only, on the orchestrator variant.
+# Each variant also gets a mutable `:latest-<variant>` alias, so `latest-daemon`
+# resolves on Docker Hub the same way it does on the GitLab registry. Both that
+# alias and the bare `:latest` (orchestrator only) are prod-release only: a beta
+# prerelease must not move a tag prod consumers follow.
 #
 # Multi-platform via the documented split-and-merge pattern:
 #   https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
@@ -185,6 +188,22 @@ jobs:
             GIT_HASH=${{ steps.meta.outputs.git_hash }}
             NODE_ENV=production
 
+      - name: Smoke daemon process boundary
+        if: matrix.variant == 'daemon'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          docker pull "${IMAGE_NAME}@${DIGEST}"
+          docker run --rm \
+            --user 1000:1000 \
+            --read-only \
+            --network none \
+            --cap-drop ALL \
+            --security-opt no-new-privileges=true \
+            --entrypoint bun \
+            "${IMAGE_NAME}@${DIGEST}" \
+            run dist/daemon/process-boundary-smoke.js
+
       - name: Export digest
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
@@ -256,6 +275,7 @@ jobs:
             type=raw,value=${{ steps.tag.outputs.variant_tag }}
             type=raw,value=${{ steps.tag.outputs.version }},enable=${{ matrix.variant == 'orchestrator' }}
             type=raw,value=latest,enable=${{ matrix.variant == 'orchestrator' && inputs.is-dev-release == false }}
+            type=raw,value=latest-${{ matrix.variant }},enable=${{ inputs.is-dev-release == false }}
 
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests

.github/workflows/research.yml

@@ -195,7 +195,7 @@ jobs:
             | idempotency      | src/webhook/router.ts, src/core/tracking-comment.ts                  |
             | security         | src/utils/, src/config.ts                                            |
             | observability    | src/logger.ts (and grep for logger usage across src/)                |
-            | testing          | src/**/*.test.ts (sample 3-5; do not read all)                       |
+            | testing          | test/**/*.test.ts (sample 3-5; do not read all)                      |
             | docs             | CLAUDE.md, top-level README.md if present, docs/                     |
             | infrastructure   | .github/workflows/, Dockerfile, package.json                         |
             | agent-sdk        | src/core/prompt-builder.ts, src/core/executor.ts                     |