diff --git a/.github/workflows/aragora-gauntlet.yml b/.github/workflows/aragora-gauntlet.yml
index 8b0fbc13c5..e7b7b72cf9 100644
--- a/.github/workflows/aragora-gauntlet.yml
+++ b/.github/workflows/aragora-gauntlet.yml
@@ -10,7 +10,7 @@ concurrency:
 jobs:
   gauntlet:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: read
diff --git a/.github/workflows/aragora-review-gate.yml b/.github/workflows/aragora-review-gate.yml
index 8085953199..9d64b449c1 100644
--- a/.github/workflows/aragora-review-gate.yml
+++ b/.github/workflows/aragora-review-gate.yml
@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 3
     outputs:
       should_review: ${{ steps.filter.outputs.code }}
@@ -69,7 +69,7 @@ jobs:
   review:
     needs: changes
     if: needs.changes.outputs.should_review == 'true' && !github.event.pull_request.draft
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
@@ -245,7 +245,7 @@ jobs:
   aragora-review:
     if: always()
     needs: [changes, review]
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Gate result
diff --git a/.github/workflows/autopilot-worktree-e2e.yml b/.github/workflows/autopilot-worktree-e2e.yml
index 9012411fc1..15c6ac9a53 100644
--- a/.github/workflows/autopilot-worktree-e2e.yml
+++ b/.github/workflows/autopilot-worktree-e2e.yml
@@ -17,7 +17,7 @@ jobs:
   scope:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Autopilot Scope
-    runs-on: aragora
+    runs-on: ubuntu-latest
     outputs:
       run_autopilot: ${{ steps.filter.outputs.run_autopilot }}
 
@@ -73,7 +73,7 @@ jobs:
 
   autopilot-api-e2e:
     name: Autopilot API E2E
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     needs: scope
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name != 'pull_request' || needs.scope.outputs.run_autopilot == 'true')
diff --git a/.github/workflows/backup-verification.yml b/.github/workflows/backup-verification.yml
index 0c263f9ebf..627db9f7fd 100644
--- a/.github/workflows/backup-verification.yml
+++ b/.github/workflows/backup-verification.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   backup-tests:
     name: Backup System Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
 
     steps:
@@ -90,7 +90,7 @@ jobs:
 
   dr-drill-tests:
     name: DR Drill Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     needs: backup-tests
 
@@ -144,7 +144,7 @@ jobs:
 
   backup-handler-tests:
     name: Backup Handler Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     needs: backup-tests
 
@@ -192,7 +192,7 @@ jobs:
 
   summary:
     name: Generate Summary
-    runs-on: aragora
+    runs-on: ubuntu-latest
     needs: [backup-tests, dr-drill-tests, backup-handler-tests]
     if: always()
 
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index d7a1dca741..855d5aef12 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -27,7 +27,7 @@ jobs:
   benchmark:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Performance Benchmarks
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
 
     steps:
@@ -118,7 +118,7 @@ jobs:
     # REQUIRED STATUS CHECK: This job must pass on all PRs.
     # Validates that fast-first routing reduces critique latency by >=25%.
     name: Orchestration Speed Smoke
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.ref == 'refs/heads/main' || github.event_name == 'pull_request')
 
@@ -168,7 +168,7 @@ jobs:
     # REQUIRED STATUS CHECK: This job must pass on all PRs.
     # Fails if any benchmark regresses by >20% vs main branch.
     name: Performance Regression Check
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request')
 
@@ -284,7 +284,7 @@ jobs:
 
   latency-tests:
     name: Latency Distribution
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     if: (github.event_name != 'pull_request' || github.event.pull_request.draft == false) && (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch')
 
@@ -345,7 +345,7 @@ jobs:
 
   baseline-comparison:
     name: Baseline Comparison
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.ref == 'refs/heads/main' || github.event_name == 'pull_request')
 
diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index c981c95e87..9d8f78dc37 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -33,7 +33,7 @@ jobs:
   regression-gate:
     if: github.event_name == 'merge_group' || github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Regression Gate
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
 
     steps:
diff --git a/.github/workflows/capability-gap.yml b/.github/workflows/capability-gap.yml
index 6a1578f327..ce6343b002 100644
--- a/.github/workflows/capability-gap.yml
+++ b/.github/workflows/capability-gap.yml
@@ -31,7 +31,7 @@ jobs:
   report:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Generate Capability Gap Report
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/contract-drift-governance.yml b/.github/workflows/contract-drift-governance.yml
index 6c092e5c9f..11f5371b94 100644
--- a/.github/workflows/contract-drift-governance.yml
+++ b/.github/workflows/contract-drift-governance.yml
@@ -25,7 +25,7 @@ concurrency:
 jobs:
   governance:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
diff --git a/.github/workflows/core-suites.yml b/.github/workflows/core-suites.yml
index 4e194947f2..550b9c89a0 100644
--- a/.github/workflows/core-suites.yml
+++ b/.github/workflows/core-suites.yml
@@ -25,7 +25,7 @@ jobs:
   core-suites:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Core Suites
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -70,7 +70,7 @@ jobs:
   security-boundaries:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Security Boundaries
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 1cef4d252c..d0e515d3a0 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   coverage:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
 
     steps:
@@ -167,7 +167,7 @@ jobs:
             }
 
   coverage-diff:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request')
     needs: coverage
diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
index 14f1c262b1..9dc49c09fc 100644
--- a/.github/workflows/docs-build.yml
+++ b/.github/workflows/docs-build.yml
@@ -36,7 +36,7 @@ env:
 jobs:
   build:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: aragora
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 40265241f7..a5502e5b04 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -20,7 +20,7 @@ jobs:
   e2e:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Playwright E2E Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
 
     services:
@@ -195,7 +195,7 @@ jobs:
   python-e2e:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Python E2E Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
 
     services:
@@ -266,7 +266,7 @@ jobs:
 
   visual-regression:
     name: Visual Regression Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     needs: e2e
     if: (github.event_name != 'pull_request' || github.event.pull_request.draft == false) && (github.event_name == 'pull_request')
diff --git a/.github/workflows/integration-gate.yml b/.github/workflows/integration-gate.yml
index 0ef49c72f1..234e9a1daf 100644
--- a/.github/workflows/integration-gate.yml
+++ b/.github/workflows/integration-gate.yml
@@ -21,7 +21,7 @@ jobs:
   smoke-tests:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Smoke Test Harness
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -84,7 +84,7 @@ jobs:
   api-contract-sync:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: API Contract Sync
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -136,7 +136,7 @@ jobs:
 
   frontend-build:
     name: Frontend Build
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 12
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name != 'workflow_call')
 
@@ -205,7 +205,7 @@ jobs:
   status-doc-validation:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Status Doc Validation
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
@@ -295,7 +295,7 @@ jobs:
 
   integration-summary:
     name: Integration Gate Summary
-    runs-on: aragora
+    runs-on: ubuntu-latest
     needs: [smoke-tests, api-contract-sync, status-doc-validation, frontend-build]
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (always())
     timeout-minutes: 2
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index cc15a4c40c..91642f936c 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -23,7 +23,7 @@ jobs:
   self-host-readiness:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Self-Hosted Compose Readiness
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 25
 
     steps:
@@ -101,7 +101,7 @@ jobs:
   e2e-harness:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: E2E Harness Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
 
     services:
@@ -230,7 +230,7 @@ jobs:
   integration-tests:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Integration Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
 
     services:
@@ -395,7 +395,7 @@ jobs:
   control-plane-tests:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Control Plane Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
 
     services:
@@ -511,7 +511,7 @@ jobs:
 
   summary:
     name: Integration Summary
-    runs-on: aragora
+    runs-on: ubuntu-latest
     needs: [e2e-harness, integration-tests, control-plane-tests]
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (always())
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 92f5f6456c..66021a33ab 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -25,7 +25,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 3
     outputs:
       python: ${{ steps.filter.outputs.python }}
@@ -81,7 +81,7 @@ jobs:
   lint-run:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -185,7 +185,7 @@ jobs:
   lint:
     needs: [changes, lint-run]
     if: always()
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Evaluate lint result
@@ -197,7 +197,7 @@ jobs:
           echo "Lint passed (or skipped — no Python-relevant changes)"
 
   connector-exception-hygiene:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Connector Exception Hygiene
     # PR fast path: this job is non-required and runs on push/workflow_dispatch.
@@ -252,7 +252,7 @@ jobs:
           echo "Reproduce locally: python scripts/check_connector_exception_handling.py --path aragora/connectors aragora/runtime"
 
   agent-registry-sync:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Agent Registry Sync
     if: github.event_name != 'pull_request'
@@ -318,7 +318,7 @@ jobs:
   typecheck-run:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -396,7 +396,7 @@ jobs:
   typecheck:
     needs: [changes, typecheck-run]
     if: always()
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Evaluate typecheck result
@@ -408,7 +408,7 @@ jobs:
           echo "Type check passed (or skipped — no Python-relevant changes)"
 
   typecheck-core:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     name: Core Module Type Safety
     if: github.event_name != 'pull_request'
@@ -519,7 +519,7 @@ jobs:
           echo "Core modules type check passed!"
 
   frontend-lint:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event_name != 'pull_request'
 
@@ -581,7 +581,7 @@ jobs:
         run: npm run check:types
 
   security:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     if: github.event_name != 'pull_request'
 
@@ -645,7 +645,7 @@ jobs:
           safety check --full-report --ignore 70612
 
   secrets:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Secret Scanning
     if: github.event_name != 'pull_request'
@@ -703,7 +703,7 @@ jobs:
           GITLEAKS_LICENSE: ${{ env.GITLEAKS_LICENSE }}
 
   helm-lint:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Helm Chart Validation
     if: github.event_name != 'pull_request'
@@ -824,7 +824,7 @@ jobs:
           echo "All charts passed Kubernetes schema validation!"
 
   todo-audit:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     name: TODO/FIXME Enforcement
     if: github.event_name != 'pull_request'
@@ -893,7 +893,7 @@ jobs:
           fi
 
   docs-sync:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event_name != 'pull_request'
 
diff --git a/.github/workflows/migration-tests.yml b/.github/workflows/migration-tests.yml
index 8afbbfa212..a2a8fd7aa1 100644
--- a/.github/workflows/migration-tests.yml
+++ b/.github/workflows/migration-tests.yml
@@ -27,7 +27,7 @@ jobs:
   migration-tests:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Migration Tests (SQLite)
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/new-features.yml b/.github/workflows/new-features.yml
index 007bcc5925..0e4e087fe2 100644
--- a/.github/workflows/new-features.yml
+++ b/.github/workflows/new-features.yml
@@ -14,7 +14,7 @@ jobs:
   test-migrations:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Test Migrations
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -80,7 +80,7 @@ jobs:
   test-workers:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Test Background Workers
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -138,7 +138,7 @@ jobs:
   test-api-endpoints:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Test API Endpoints
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -186,7 +186,7 @@ jobs:
   test-metrics:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Test Metrics Integration
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -264,7 +264,7 @@ jobs:
   validate-openapi:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Validate OpenAPI Spec
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
@@ -316,7 +316,7 @@ jobs:
   summary:
     name: Summary
     needs: [test-migrations, test-workers, test-api-endpoints, test-metrics, validate-openapi]
-    runs-on: aragora
+    runs-on: ubuntu-latest
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (always())
 
     steps:
diff --git a/.github/workflows/nightly-execution-gate-adversarial.yml b/.github/workflows/nightly-execution-gate-adversarial.yml
index 08c9ab4bb2..09a6facb13 100644
--- a/.github/workflows/nightly-execution-gate-adversarial.yml
+++ b/.github/workflows/nightly-execution-gate-adversarial.yml
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   adversarial-suite:
     name: Execution Gate Adversarial Regression
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 25
 
     steps:
diff --git a/.github/workflows/nightly-full-matrix.yml b/.github/workflows/nightly-full-matrix.yml
index 8495f6ccb1..892375dce6 100644
--- a/.github/workflows/nightly-full-matrix.yml
+++ b/.github/workflows/nightly-full-matrix.yml
@@ -16,7 +16,7 @@ permissions:
 jobs:
   pre-release-gates:
     name: Pre-release Gates
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 30
 
     steps:
@@ -74,7 +74,7 @@ jobs:
 
   regression-matrix:
     name: Regression Matrix (${{ matrix.shard.name }})
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -143,7 +143,7 @@ jobs:
 
   frontend-build:
     name: Frontend Build
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
 
     steps:
@@ -193,7 +193,7 @@ jobs:
 
   summary:
     name: Nightly Matrix Summary
-    runs-on: aragora
+    runs-on: ubuntu-latest
     needs: [pre-release-gates, regression-matrix, frontend-build]
     if: always()
 
diff --git a/.github/workflows/nightly-integration.yml b/.github/workflows/nightly-integration.yml
index b45cac075f..df9259d50c 100644
--- a/.github/workflows/nightly-integration.yml
+++ b/.github/workflows/nightly-integration.yml
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   live-debate:
     name: Live Debate E2E
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.repository == 'an0mium/aragora'
 
@@ -83,7 +83,7 @@ jobs:
 
   pypi-check:
     name: PyPI Build Verification
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
diff --git a/.github/workflows/nomic-ci.yml b/.github/workflows/nomic-ci.yml
index c00821e49a..acd5976a4e 100644
--- a/.github/workflows/nomic-ci.yml
+++ b/.github/workflows/nomic-ci.yml
@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   targeted-tests:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/onramp-integration.yml b/.github/workflows/onramp-integration.yml
index 86ddb69ffa..e368107899 100644
--- a/.github/workflows/onramp-integration.yml
+++ b/.github/workflows/onramp-integration.yml
@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 jobs:
   time-to-first-debate:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -44,7 +44,7 @@ jobs:
           ARAGORA_OFFLINE: "1"
 
   playground-build:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -79,7 +79,7 @@ jobs:
           npx next build --webpack
 
   sdk-parity:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index 56ec59d4cc..5f96d0be07 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   scope:
     name: OpenAPI Scope
-    runs-on: aragora
+    runs-on: ubuntu-latest
     outputs:
       run_openapi: ${{ steps.filter.outputs.run_openapi }}
 
@@ -81,7 +81,7 @@ jobs:
 
   generate-run:
     name: OpenAPI Generate & Validate
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: scope
     if: needs.scope.outputs.run_openapi == 'true'
@@ -477,7 +477,7 @@ jobs:
 
   sync:
     name: Sync Spec (main only)
-    runs-on: aragora
+    runs-on: ubuntu-latest
     needs: generate-run
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
@@ -578,7 +578,7 @@ jobs:
     name: Generate & Validate
     needs: [scope, generate-run]
     if: always()
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Evaluate OpenAPI result
diff --git a/.github/workflows/pr-debate.yml b/.github/workflows/pr-debate.yml
index 825b36e7c9..6d0760d9a1 100644
--- a/.github/workflows/pr-debate.yml
+++ b/.github/workflows/pr-debate.yml
@@ -48,7 +48,7 @@ permissions:
 
 jobs:
   review:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
 
diff --git a/.github/workflows/quality-smoke.yml b/.github/workflows/quality-smoke.yml
index b75efed0ed..c247ad5ec7 100644
--- a/.github/workflows/quality-smoke.yml
+++ b/.github/workflows/quality-smoke.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 3
     outputs:
       quality: ${{ steps.filter.outputs.quality }}
@@ -61,7 +61,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.quality == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
     name: Quality Pipeline Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -136,7 +136,7 @@ jobs:
   quality-smoke:
     needs: [changes, quality-smoke-run]
     if: always()
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Evaluate quality smoke result
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index d2161342a2..03e5ff6d8a 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -16,7 +16,7 @@ permissions:
 jobs:
   generate-python-sbom:
     name: Generate Python SBOM
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -83,7 +83,7 @@ jobs:
 
   generate-node-sbom:
     name: Generate Node.js SBOM
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     strategy:
@@ -153,7 +153,7 @@ jobs:
 
   generate-container-sbom:
     name: Generate Container SBOM
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     if: github.event_name == 'release'
 
@@ -217,7 +217,7 @@ jobs:
 
   vulnerability-scan:
     name: SBOM Vulnerability Scan
-    runs-on: aragora
+    runs-on: ubuntu-latest
     needs: [generate-python-sbom, generate-node-sbom]
     timeout-minutes: 15
 
diff --git a/.github/workflows/sdk-generate.yml b/.github/workflows/sdk-generate.yml
index e49a203571..ea31d17439 100644
--- a/.github/workflows/sdk-generate.yml
+++ b/.github/workflows/sdk-generate.yml
@@ -25,7 +25,7 @@ concurrency:
 jobs:
   generate-typescript-types:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: write
@@ -111,7 +111,7 @@ jobs:
   validate-typescript:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     needs: generate-typescript-types
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -171,7 +171,7 @@ jobs:
       (github.event_name != 'pull_request' || !github.event.pull_request.draft) &&
       (github.event_name == 'pull_request' ||
       (github.event_name == 'push' && !contains(github.event.head_commit.modified, 'docs/api/openapi')))
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/sdk-parity.yml b/.github/workflows/sdk-parity.yml
index 75d0da022d..f6d9209690 100644
--- a/.github/workflows/sdk-parity.yml
+++ b/.github/workflows/sdk-parity.yml
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 3
     outputs:
       relevant: ${{ steps.filter.outputs.relevant }}
@@ -72,7 +72,7 @@ jobs:
   sdk-parity-run:
     needs: changes
     if: needs.changes.outputs.relevant == 'true'
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 12
 
     steps:
@@ -193,7 +193,7 @@ jobs:
   sdk-parity:
     needs: [changes, sdk-parity-run]
     if: always()
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Evaluate sdk-parity result
diff --git a/.github/workflows/sdk-test.yml b/.github/workflows/sdk-test.yml
index 3061859405..d2969d46c1 100644
--- a/.github/workflows/sdk-test.yml
+++ b/.github/workflows/sdk-test.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     name: SDK Change Detection
     outputs:
@@ -74,7 +74,7 @@ jobs:
   python-sdk:
     needs: changes
     if: needs.changes.outputs.run_python == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Python SDK Tests
 
@@ -138,7 +138,7 @@ jobs:
   typescript-sdk-run:
     needs: changes
     if: needs.changes.outputs.run_typescript == 'true'
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     name: TypeScript SDK Build
 
@@ -200,7 +200,7 @@ jobs:
   sdk-integration:
     needs: changes
     if: needs.changes.outputs.run_python == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     name: SDK Integration Tests
 
@@ -259,7 +259,7 @@ jobs:
     name: TypeScript SDK Type Check
     needs: [changes, typescript-sdk-run]
     if: always()
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Evaluate TypeScript SDK result
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 1c178522b4..de4bfb48af 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -18,7 +18,7 @@ jobs:
   codeql:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: CodeQL Analysis
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 60
 
     strategy:
@@ -69,7 +69,7 @@ jobs:
   bandit:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Bandit Security Scan
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -123,7 +123,7 @@ jobs:
   aragora-security-scan:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Aragora Security Scanner
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -175,7 +175,7 @@ jobs:
   dependency-check:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Dependency Vulnerability Check
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -294,7 +294,7 @@ jobs:
   pentest-findings:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: "Security: Pentest Findings Gate"
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
@@ -334,7 +334,7 @@ jobs:
   rbac-coverage:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: RBAC Coverage Check
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
@@ -374,7 +374,7 @@ jobs:
   secret-scanning:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Secret Scanning
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/self-improve-hard-checks.yml b/.github/workflows/self-improve-hard-checks.yml
index a62faf6f17..f7ece2f153 100644
--- a/.github/workflows/self-improve-hard-checks.yml
+++ b/.github/workflows/self-improve-hard-checks.yml
@@ -37,7 +37,7 @@ jobs:
   hard-check-tests:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Self-Improve Hard Check Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
 
     steps:
@@ -143,7 +143,7 @@ jobs:
   live-dogfood-hard-checks:
     if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.run_live_dogfood == 'true')
     name: Live Dogfood Hard Checks
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 45
 
     steps:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 70bb80c787..457461b92e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -48,7 +48,7 @@ jobs:
   version-check:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Version Alignment
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 2
 
     steps:
@@ -168,7 +168,7 @@ jobs:
   sdk-typescript-compile-gate:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: SDK TypeScript Compile Gate
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 8
     needs: version-check
 
@@ -230,7 +230,7 @@ jobs:
   baseline-determinism:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Baseline Determinism
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 12
     needs: version-check
 
@@ -279,7 +279,7 @@ jobs:
   skip-audit:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Skip Marker Audit
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
@@ -350,7 +350,7 @@ jobs:
   status-reconciliation:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Status Doc Reconciliation
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
@@ -409,7 +409,7 @@ jobs:
   zero-coverage-check:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Zero Coverage Check
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: baseline-determinism
 
@@ -495,7 +495,7 @@ jobs:
   # Fast parallel tests by category (Ubuntu only, primary Python)
   test-fast:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     needs: baseline-determinism
     strategy:
@@ -571,7 +571,7 @@ jobs:
   epistemic-settlement-gate:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Epistemic Hygiene + Settlement Gate
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 12
     needs: baseline-determinism
 
@@ -643,7 +643,7 @@ jobs:
 
   v1-scope-lock-gate:
     name: V1 Scope Lock Gate
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     needs: baseline-determinism
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request')
@@ -691,7 +691,7 @@ jobs:
   integration-minimal:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Integration Minimal
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     needs: baseline-determinism
 
@@ -746,7 +746,7 @@ jobs:
   # Integration smoke lane for high-risk paths (PR only)
   integration-smoke:
     name: Integration Smoke
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     needs: baseline-determinism
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request')
@@ -824,7 +824,7 @@ jobs:
   test-pollution-randomized:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Randomized Order Pollution Guard
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     needs: test-fast
     strategy:
@@ -906,7 +906,7 @@ jobs:
   golden-paths:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Golden Path Smoke
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     needs: version-check
 
@@ -955,7 +955,7 @@ jobs:
   aragora-debate-tests:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Standalone Debate Package
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: test-fast
 
@@ -1136,7 +1136,7 @@ jobs:
   # Summary job: merge coverage from shards and enforce gates
   test-summary:
     name: Test Summary
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: [test]
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (always())
@@ -1340,7 +1340,7 @@ jobs:
   smoke:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: CLI Smoke
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: baseline-determinism
 
@@ -1433,7 +1433,7 @@ jobs:
 
   nightly-slow:
     name: Nightly Slow Tier
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     needs: baseline-determinism
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
@@ -1492,7 +1492,7 @@ jobs:
   frontend:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Frontend E2E Tests
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -1575,7 +1575,7 @@ jobs:
   # Lightweight frontend type checking (PR-only, path-filtered)
   frontend-typecheck:
     name: Frontend TypeScript Type Check
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request')
 
@@ -1638,7 +1638,7 @@ jobs:
   security:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Security Scan
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -1693,7 +1693,7 @@ jobs:
   typecheck:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Type Check
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
@@ -1747,7 +1747,7 @@ jobs:
   migration-test:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Database Migrations
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     services:
@@ -1849,7 +1849,7 @@ jobs:
 
   nightly-optional:
     name: Optional Deps (Full)
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     needs: baseline-determinism
     # Run on schedule, push to main, or workflow_dispatch
@@ -1944,7 +1944,7 @@ jobs:
   quality-gates:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Quality Gates
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: [test-fast, test-summary, epistemic-settlement-gate, v1-scope-lock-gate]
 
@@ -1994,7 +1994,7 @@ jobs:
 
   test-analytics:
     name: Test Analytics
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: [test-fast]
     if: (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (always() && github.event_name == 'pull_request')
diff --git a/.github/workflows/testfixer-auto.yml b/.github/workflows/testfixer-auto.yml
index 2f3f2f4a86..3f0de7fed3 100644
--- a/.github/workflows/testfixer-auto.yml
+++ b/.github/workflows/testfixer-auto.yml
@@ -32,7 +32,7 @@ jobs:
     # Disabled: auto-fix loop causes CI thrash (push→cancel→restart cycle).
     # Re-enable via workflow_dispatch when needed for targeted fix runs.
     if: github.event_name == 'workflow_dispatch'
-    runs-on: aragora
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     env:
       DEFAULT_TEST_COMMAND: >-