ci: stage all workflows on isolated self-hosted runners

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+# Source validation only; labels do not attest runtime isolation.
+self-hosted-runner:
+  labels:
+    - cwlab-ci-isolated
+    - cwlab-control

.github/actions/noema-review/two_phase.py

@@ -156,6 +156,7 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
         return 0
     expected_base = _canonical_base(pull_request)
     actor = _reviewer_actor()
+    author = gate.require_distinct_pr_author(pull_request, actor)
     if pull_request.get("isDraft"):
         print("PR is draft; Noema verdict preparation skipped.")
         return 0
@@ -190,6 +191,8 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number": number,
             "expected_head": expected,
             "expected_base": expected_base,
+            "reviewer_actor": actor,
+            "pull_request_author": author,
             "verdict": verdict,
         },
     )
@@ -250,6 +253,8 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number",
             "expected_head",
             "expected_base",
+            "reviewer_actor",
+            "pull_request_author",
             "verdict",
         }
         if set(payload) != required_keys:
@@ -277,6 +282,14 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             print("Pull request base advanced after model review; stale prepared verdict was not published.")
             return 0
         actor = _reviewer_actor(allow_refreshed_app=True)
+        author = gate.require_distinct_pr_author(current_pull_request, actor)
+        if payload["pull_request_author"] != author:
+            raise RuntimeError("Noema pull request author changed after verdict preparation")
+        reviewer_actor = payload["reviewer_actor"]
+        if not isinstance(reviewer_actor, str) or not reviewer_actor.strip():
+            raise RuntimeError("Noema prepared reviewer actor is invalid")
+        if reviewer_actor.strip().casefold() != actor.strip().casefold():
+            raise RuntimeError("Noema refreshed reviewer actor differs from verdict preparation")
         if current_pull_request.get("isDraft"):
             print("PR became draft after model review; prepared verdict was not published.")
             return 0

.github/workflows/actions-queue-health.yml

@@ -15,7 +15,9 @@ permissions:
 jobs:
   collect:
     name: Collect exact-head queue evidence
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 30
     permissions:
       contents: read

.github/workflows/agent-mention-noema-dispatch.yml

@@ -28,7 +28,9 @@ permissions:
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -28,7 +28,9 @@ permissions:
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-router-quality-ci.yml

@@ -46,7 +46,9 @@ env:
 
 jobs:
   quality:
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 20
     steps:
       - name: Harden runner

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -64,10 +64,16 @@ on:
       - "scripts/ci/zdr_policy.py"
       - "scripts/ci/contextual_orchestrator_review_policy.py"
       - "scripts/ci/contextual_orchestrator_review_launcher.py"
+      - "scripts/ci/personal_review_route.py"
       - "scripts/ci/contextual_orchestrator_review_sidecar.sh"
       - "tests/test_zdr_policy.py"
       - "tests/test_contextual_orchestrator_review_policy.py"
       - "tests/test_contextual_orchestrator_review_launcher.py"
+      - "tests/test_review_auto_route.py"
+      - "tests/test_personal_review_route.py"
+      - "tests/test_tokyo_review_consumer.py"
+      - "tests/test_review_auto_cost_admission.py"
+      - "tests/test_review_ai_app_independence.py"
       - "tests/test_review_preflight_concurrency.py"
       - "tests/test_contextual_orchestrator_review_sidecar_contract.py"
       - "tests/test_sidecar_disk_free_guard.py"
@@ -140,7 +146,9 @@ permissions:
 jobs:
   agent_review_runtime_quality:
     name: agent-review-runtime-quality
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 25
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -283,10 +291,16 @@ jobs:
               scripts/ci/zdr_policy.py|\
               scripts/ci/contextual_orchestrator_review_policy.py|\
               scripts/ci/contextual_orchestrator_review_launcher.py|\
+              scripts/ci/personal_review_route.py|\
               scripts/ci/contextual_orchestrator_review_sidecar.sh|\
               tests/test_zdr_policy.py|\
               tests/test_contextual_orchestrator_review_policy.py|\
               tests/test_contextual_orchestrator_review_launcher.py|\
+              tests/test_review_auto_route.py|\
+              tests/test_personal_review_route.py|\
+              tests/test_tokyo_review_consumer.py|\
+              tests/test_review_auto_cost_admission.py|\
+              tests/test_review_ai_app_independence.py|\
               tests/test_review_preflight_concurrency.py|\
               tests/test_contextual_orchestrator_review_sidecar_contract.py|\
               tests/test_sidecar_disk_free_guard.py|\
@@ -473,6 +487,11 @@ jobs:
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
             tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_auto_route.py \
+            tests/test_personal_review_route.py \
+            tests/test_tokyo_review_consumer.py \
+            tests/test_review_auto_cost_admission.py \
+            tests/test_review_ai_app_independence.py \
             tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \
@@ -514,6 +533,11 @@ jobs:
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
             tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_auto_route.py \
+            tests/test_personal_review_route.py \
+            tests/test_tokyo_review_consumer.py \
+            tests/test_review_auto_cost_admission.py \
+            tests/test_review_ai_app_independence.py \
             tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \

.github/workflows/audit-central-ruleset.yml

@@ -25,7 +25,9 @@ permissions:
 jobs:
   audit:
     name: Audit organization ruleset 18156473
-    runs-on: ubuntu-latest
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     env:
       GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
     steps:

.github/workflows/cloudflare-dns.yml

@@ -44,7 +44,9 @@ permissions:
 jobs:
   reconcile:
     name: Reconcile zones (${{ github.event.client_payload.mode || 'dry-run' }})
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/codeql-pr.yml

@@ -60,7 +60,9 @@ jobs:
     name: Detect CodeQL languages
     # Draft PRs get no runner; ready_for_review re-runs this on the same head.
     if: (github.event.action != 'closed') && (github.event.pull_request.draft != true || github.event.action == 'converted_to_draft' || github.event.action == 'closed')
-    runs-on: ${{ fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '"ubuntu-24.04"') }}
+    runs-on:
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -164,7 +166,9 @@ jobs:
     # dependency exactly; the only case where it's genuinely skipped is a
     # closed PR, where this job being implicitly skipped too is fine because
     # closed PRs need no required check.
-    runs-on: ${{ fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '"ubuntu-24.04"') }}
+    runs-on:
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     # Verdict reads have exceeded five minutes; retain the ten-minute control budget.
     timeout-minutes: 10
     permissions:
@@ -367,7 +371,9 @@ jobs:
       && github.event.pull_request.state != 'closed'
       && needs.detect-languages.result == 'success'
       && needs.detect-languages.outputs.code == 'true'
-    runs-on: ${{ fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '"ubuntu-24.04"') }}
+    runs-on:
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read

.github/workflows/company-default-head-trust-gate.yml

@@ -0,0 +1,64 @@
+name: Reusable company default-head trust gate
+
+on:
+  workflow_call:
+    inputs:
+      target_runner_label:
+        required: true
+        type: string
+      trusted_ref_sha:
+        required: false
+        type: string
+        default: ""
+      trusted_ref_ack:
+        required: false
+        type: string
+        default: ""
+    outputs:
+      runner_matrix:
+        value: ${{ jobs.validate.outputs.runner_matrix }}
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
+    timeout-minutes: 5
+    outputs:
+      runner_matrix: ${{ steps.runner.outputs.runner_matrix }}
+    steps:
+      - id: runner
+        shell: bash
+        env:
+          TARGET: ${{ inputs.target_runner_label }}
+        run: |
+          case "$TARGET" in
+            all) matrix='["itxllmpgw01","itxllmpgw02","xtrmsales-llmgw1","xtrmsales-llmgw2"]' ;;
+            itxllmpgw01|itxllmpgw02|itxllmpgw03|itxllmpgw04|xtrmsales-llmgw1|xtrmsales-llmgw2|llm-gateway-dev|itx-llm-operation-1|itx-llm-operation-2)
+              matrix="[\"$TARGET\"]"
+              ;;
+            *) echo "unsupported target_runner_label=$TARGET" >&2; exit 2 ;;
+          esac
+          echo "runner_matrix=$matrix" >> "$GITHUB_OUTPUT"
+      - shell: bash
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -Eeuo pipefail
+          if [ "$REF_NAME" != "$DEFAULT_BRANCH" ]; then
+            echo "self-hosted failure diagnostics require the protected default branch" >&2
+            exit 2
+          fi
+          current_sha="$(gh api "repos/$REPOSITORY/commits/$DEFAULT_BRANCH" --jq .sha)"
+          if [ "$SHA" != "$current_sha" ]; then
+            echo "refusing stale default-branch run sha=$SHA current_sha=$current_sha" >&2
+            exit 2
+          fi
+          echo "trusted_ref_status=current_default_head sha=$SHA"

.github/workflows/company-settlement-validate.yml

@@ -0,0 +1,56 @@
+# Source-only fixed-pool candidate. Caller-context group admission remains separate.
+name: Company settlement validate
+on:
+  workflow_call: {}
+permissions:
+  contents: read
+jobs:
+  validate:
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - name: Install locked test dependencies
+        run: uv pip install --system -r requirements.txt -r requirements-dev.txt
+      - name: Start isolated PostgreSQL without a TCP listener
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          pg_bin="$(pg_config --bindir)"
+          test -x "$pg_bin/initdb"
+          test -x "$pg_bin/pg_ctl"
+          "$pg_bin/postgres" --version
+          data_dir="$RUNNER_TEMP/settlement-verify-postgres"
+          socket_dir="$RUNNER_TEMP/settlement-verify-socket"
+          mkdir -m 700 "$data_dir" "$socket_dir"
+          printf 'SETTLEMENT_VERIFY_PG_BIN=%s\n' "$pg_bin" >> "$GITHUB_ENV"
+          printf 'SETTLEMENT_VERIFY_PG_DATA=%s\n' "$data_dir" >> "$GITHUB_ENV"
+          "$pg_bin/initdb" -D "$data_dir" --no-locale --encoding=UTF8 \
+            --auth-local=trust --auth-host=reject
+          "$pg_bin/pg_ctl" -D "$data_dir" \
+            -o "-F -h '' -k $socket_dir" -l "$RUNNER_TEMP/settlement-verify-postgres.log" -w start
+          printf 'SETTLEMENT_VERIFY_TEST_DSN=host=%s dbname=postgres\n' "$socket_dir" >> "$GITHUB_ENV"
+      - name: Verify exact-head PgCat and lock regressions
+        env:
+          SETTLEMENT_VERIFY_REQUIRE_POSTGRES: "1"
+        run: >-
+          python -m pytest -q tests/test_issue119_pgcat_endpoint_resolver.py
+          tests/test_issue119_settlement_live_verify.py
+          tests/test_issue119_settlement_replica_routing.py
+          tests/test_issue119_settlement_review_regressions.py
+          tests/test_multi_instance_runtime_contract.py
+      - name: Stop isolated test database
+        if: always()
+        shell: bash
+        run: |
+          if test -f "${SETTLEMENT_VERIFY_PG_DATA:-}/postmaster.pid"; then
+            "$SETTLEMENT_VERIFY_PG_BIN/pg_ctl" -D "$SETTLEMENT_VERIFY_PG_DATA" -m fast -w stop
+          fi