Repository navigation
ci: centralize law-agent quality on dedicated self-hosted capacity #2580
Description
Activity
Procurement CI consumer handoff — ownership decision requested
The product owner has directed a central
ContextualWisdomLab/.githubreusable workflow, self-hosted execution only, and retirement of GitHub-hosted-only paths without treating removed evidence as pass.Proposed bounded consumer lane:
- New procurement-specific reusable workflow and its policy tests/docs only; no edits to the existing org-wide runner policy owned by ci: stage all workflows on isolated self-hosted runners #2565 and no edits to law/BandScope/fast-mlsirm consumer files.
- Preserve the product quality contract: Python 3.12/3.14,
uv lock --check, frozen dev sync, full pytest, Ruff, and Node syntax check. - Reject non-owned callers/fork code before checkout; pin central and source identity; no secrets, arbitrary commands, dynamic runners, or hosted fallback.
- Keep the product caller in
procurement-workbench/.github/workflows/ci.ymlwith its current owner (Add OpenCode review merge automation #4) until central immutable SHA and runner provisioning are verified, then coordinate the thin caller edit with that owner.
Please confirm or correct:
- May this lane create a separate central branch/worktree from an owner-approved base, and what exact base SHA and owned path set should it use while ci: stage all workflows on isolated self-hosted runners #2565 remains Draft?
- Who owns provisioning the procurement-only runner group/repository ACL/label and isolated canary? Current read API did not show a group with procurement access; no existing law/MCP/control group will be reused without an explicit decision.
- Which GitHub-hosted-only producers are in scope for retirement, and which owner may disable them? Removal must leave dependent checks unavailable/failing, not green or skipped.
- Who owns the final required-check mapping and protection update after real self-hosted run IDs/job IDs/check names exist?
Current product CI failure history remains separate: issue #5 is open and its documented STARTUP_FAILURE reason is unknown. This handoff is not a claim that central migration fixes that admission failure.
No runner, ACL, workflow, branch protection, secret, product file, or PR/issue body has been changed by this request so far. A reply can narrow the base/paths/owner; until then the next safe step is to prepare a local-only central lane design, not publish or alter shared policy.
K-CSAP additive central quality lane ownership — 2026-10-09 KST
사용자 self-hosted-only eligible CI 지시에 따라
k-csap-skills전용 additive reusable workflow를 진행합니다.- salmon owns new
.github/workflows/k-csap-quality.ymland its contract test in a separate central worktree from protected main7554587c. - oscar remains owner of the product-local caller (
ContextualWisdomLab/k-csap-skillsPR Add OpenCode review merge automation #4 currently changes.github/workflows/ci.yml). The caller changes only after central immutable SHA and real self-hosted evidence. - anchovy does not modify ci: stage all workflows on isolated self-hosted runners #2565 global policy, runner provisioning/ACL, shared OpenCode/Noema sources, or API-key custody.
- Existing online groups are not suitable by assumption: central control is privileged, OpenCode group 5 currently has its sole runner offline and lacks k-csap access, CI-isolated group 13 has no k-csap ACL and currently has no online runner. Do not reuse them without the owning decision and verified isolation.
- No hosted fallback is to be added. Hosted-only negative evidence that cannot run self-hosted stays NOT_RUN/blocked rather than green.
Acceptance remains: exact caller/event/head admission before checkout; dedicated job-private clean paths; Python 3.11 locked uv sync + Ruff/full pytest/validate/diff; actual self-hosted runner ID/job ID; central Noema/OpenCode
autosubstantive independent approval; then local hosted workflow retirement by its owner. Zero-job private Actions and local tests are not central-run success.- salmon owns new
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Goal and scope
Centralize the law-ai-agent Python/native-PostgreSQL quality lane in this repository; keep a SHA-pinned consumer caller. Requested by owner on 2026-10-05 KST. Link ContextualWisdomLab/law-ai-agent#1 and ContextualWisdomLab/law-ai-agent#2 without publishing private source.
Bounded ownership
New reusable workflow law-ai-agent-ci.yml, its isolated shell helper, contract tests, and doctoring record. Existing scanner/control/signing workflows and runner groups remain untouched.
Acceptance
Environment and delivery
Coordinator law run_38922d4058e7; technical Lead accepted ctx_935a3467cd2f. Disjoint central branch feat/law-agent-central-ci from protected37b10243. Initial KST14:25 check, revised integration checkpoint14:50.
A new restricted group and an isolated non-root, no-host-mount runner are being provisioned with2GiB/2CPU/PID512/no-new-privileges/cap-dropALL. This is not a production isolation certification.