[congvc-bot-x99]

Status

Draft candidate. Independent verification and exact-head OCR remain with dev team. No merge authorization.

Conditions

CHE-584 and Cheese's 11:50 ICT directive authorize the migration. Option A record 01a15d83-b9f4-77f3-a6ce-edb758767249 authorizes the seccomp-only change. CHE-1945 comment 01a15f27-2c41-7530-8da5-dc5276e6bd05 reserves only runner-8 for Hermes until 07:00 ICT on 22 October 2026 or release.

Original grouped estimate: 1.5 hours. Keep all seven candidates draft. Preserve Docker-default AppArmor, existing capabilities, CHE-1802 hook bytes/environment/read-only mount, other runners, dind, images and services. No SYS_ADMIN, AppArmor relaxation, host sysctl change, all-runner rollout, sandbox bypass, merge or check waiver. Python failures remain unwaived.

Change

• Route CI and What's New to cheese-x99, with hosted fallback only outside cheese-work.
• Require cheese-x99-browser only for frontend. Remove unused SUID-helper setup.
• Keep SHA-pinned Chrome setup and CHROME_BIN export.
• Keep job-scoped libxcb1/libgl1 provisioning and the 45-minute Python timeout.

Files: .github/workflows/ci.yml, .github/workflows/whats-new.yml, .github/tests/test_runner_routing.py.

Evidence

Base: 775e7e72ce0d6058f697b814b0095f6940a28ce8.
Current head: 8d11990618e3b75785da2d017eb8d0cc4d673653.

Current delta observed test-first on X99:

Parent: 45f7e89451f634c27a642d95f0a5e488f82c9b8f
Command: python3 .github/tests/test_runner_routing.py -v
RED before workflow edit:
  test_only_frontend_requires_browser_runner: AssertionError: 0 != 1
  test_artemis_uses_x99_and_provisions_chrome: chrome-sandbox unexpectedly found
  Ran 3 tests / FAILED (failures=2)
GREEN after workflow edit:
  Ran 3 tests / OK
Head: 8d11990618e3b75785da2d017eb8d0cc4d673653

PASS on X99: routing tests, Ruff check/format, dependency-source check, quality ratchet, YAML/embedded-shell validation and git diff --check.

Applied runner-8 profile equals the reviewed Docker-default digest plus only the unfiltered clone/unshare allow rule. Docker-default AppArmor, capabilities and CHE-1802 hook remain intact. Real non-root Chrome returned SANDBOX_PAGE_OK. Renderer user/PID namespaces differ from the outer container, effective renderer capabilities are zero and Seccomp is 2. Root tmpfs mount is denied. Full acquisition, applied-state, rollback and release evidence returns on CHE-1922.

Current-head checks: all seven PASS. The foreground gh pr checks 226 -R cheese-work/artemis --watch --interval 30 returned exit 0.

Event / check	Result	Job
push / frontend	PASS, runner-8	https://github.com/cheese-work/artemis/actions/runs/39638521865/job/119355605983
pull_request / frontend	PASS, runner-8	https://github.com/cheese-work/artemis/actions/runs/39638528861/job/119355631549
push / Python 3.12	PASS	https://github.com/cheese-work/artemis/actions/runs/39638521865/job/119355606502
pull_request / Python 3.12	PASS	https://github.com/cheese-work/artemis/actions/runs/39638528861/job/119355631489
push / packages	PASS	https://github.com/cheese-work/artemis/actions/runs/39638521865/job/119355606789
pull_request / packages	PASS	https://github.com/cheese-work/artemis/actions/runs/39638528861/job/119355630839
pull_request / What's New	PASS	https://github.com/cheese-work/artemis/actions/runs/39638528709/job/119355630191

The older Python PR failure remains historical FAIL, not waived. Current green results do not substitute for independent review.

Earlier migration observed-red receipts remain in PR revision history: Blacksmith routing at base 775e7e72ce0d6058f697b814b0095f6940a28ce8; X99 owner expression at f191fa7; missing libxcb1/libgl1 at 7c4d57c90e01e480ed8be3797068d01e7566bfba.

AI Disclosure

Hermes Agent and Argon authored this candidate. Author probes do not satisfy independent verification.

Refs CHE-1922
Refs CHE-1921
This is one repository slice, not full acceptance of either issue. The parent coordinator reconciles all seven candidates and remaining gaps.
Close intent: none