From 99fe7e1ca2e4768ed68b3dd6e2d2b5e406a68f7a Mon Sep 17 00:00:00 2001 From: JB Date: Sat, 19 Sep 2026 00:20:41 -0400 Subject: [PATCH] docs: record unverified runner boundary --- docs/release-safety.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/docs/release-safety.md b/docs/release-safety.md index 486704b..6f720ef 100644 --- a/docs/release-safety.md +++ b/docs/release-safety.md @@ -114,9 +114,14 @@ locally but has not run remotely. The source job runs a strict staging release check after building the client. The separate container job is currently **disabled** (`if: ${{ false }}`), not merely push-filtered: its rootless runner and protected-ref policy require operator verification and approval -before enablement. Its draft commands use per-run image, volume, and container -names and clean up only those names, but are not release evidence while the job -is disabled. No browser automation, OAuth callback failure injection, Convex +before enablement. The local infrastructure plan mentions `personal-isolated`, +`ubuntu-latest`, and `ubuntu-22.04` labels, but those are not confirmed +registered labels. The plan describes a dedicated runner VM with a +Docker-socket-backed daemon; rootless execution, online status, action +availability, and protected refs remain unverified. Its draft commands use +per-run image, volume, and container names and clean up only those names, but +are not release evidence while the job is disabled. No browser automation, +OAuth callback failure injection, Convex migration rollback, instance-credential backup/restore, key rotation, or live revocation/transfer evidence is claimed by this lane. Those remain explicit operator/integration gates and must use synthetic or separately consented