[G01] Prove Scale Set delivery, acquisition and drain contracts #1

Goal

Select and pin one supported Scale Set integration path and produce a reusable evidence packet for recovery at message acknowledgement, acquisition and JIT boundaries, rerunning only changed-boundary checks while keeping unchanged evidence and live gaps explicit.

Create one active Codex goal from the statement above when this issue is dispatched. The Project Goal field is a work specification; it does not start an agent. Do not invent a token budget.

Execution contract

Use one issue branch/worktree and one focused PR. Independent gpt-luna-max review is required for authentication, protocol, concurrency, resource ownership, cleanup or service identity boundaries; other changes need independent contract review. Model fields are routing instructions, not GitHub user assignments. New work uses gpt-luna-max by default or an explicit grok-high override; Astra is historical-only.

Dependencies

None. This issue is initially Ready.

Dependencies must be Done before implementation begins. A new issue is not blocked simply because its future evidence has not been collected.

Scope

Isolated protocol spike and ADR; compare release v0.4.0 with audited commit cb0405b2d874500e75ae34eff8d582ab75956b45. Do not implement production providers or copy the demo shutdown policy.

TDD and failure evidence

1. Red: fake session server reproduces ACK-before-callback crash and missing lifecycle callback.
2. Cover pre/post ACK, acquisition, >50 events, repeated/stale statistics, 202, 401/403/429, callback failure and session replacement with deterministic barriers.
3. Test idle-assignment races while drain withdraws capacity; mocks alone cannot prove server deregistration/acquisition behavior. Run an explicitly authorized disposable private live canary before closing the gate.

Capture a meaningful failing case before the implementation, then green evidence and relevant refactor checks. During iteration, keep intermediate commits local, batch one stable candidate push, and rerun full validation only when the head or relevant risk boundary changes. Reuse unchanged evidence by immutable SHA. Tooling/prose-only work uses appropriate negative checks without artificial application tests. Live/runtime profiles require reviewed commits, a dedicated trusted test environment and explicit authorization for the concrete experiment. Public PR CI uses hosted environments without credentials. Planned or skipped tests never count as passed.

Acceptance criteria

• Record exact module/runner versions and supported JIT bootstrap transports, including any secret exposure. SDK/Go selection, current runner inputs, JIT transports and exposure.
• Choose high-level listener plus independent reconciliation OR a lower-level supported message loop; do not simply reverse ordering without evidence. Reviewed ADR decision.
• Document recoverable state versus quarantine for lost callback/request IDs; no exactly-once claim. Recovery and quarantine contract.
• Keep the live-evidence gate explicitly unresolved and obtain independent gpt-luna-max protocol review (PR #139 review and scope, current exact-head readiness record).
• Record exact validation commands, actual results, skipped/live-test gaps and applicable rollback notes in the PR (PR #139).
• Use one change-impact ledger and a stable candidate CI/review cycle; reuse unchanged evidence by immutable SHA and rerun only changed-boundary checks (ledger, PR #139).
• Independent review is resolved and the focused PR is merged under the repository execution policy (PR #139, PR #140).
• Update issue/Project accurately and keep the issue OPEN / Project In progress while any live gate remains. Mark the active goal complete only after all required evidence and work are complete.

The first three checks above record reviewed offline documentation and selection, not live qualification or production implementation. The offline evidence-cycle items above are complete, but full G01 closure remains open. Authenticated production provenance and trust-root authority, broker-only execution, server-side conditional cleanup, current runtime/isolation/resource qualification, and any separately authorized Linux ARM64/JIT Scale Set canary remain unresolved. The issue and Project therefore stay OPEN / In progress.

Safety invariants

Preserve existing manual runners; no global Docker prune/context switching, broad process kill, implicit App enrollment, busy-job cancellation during ordinary scale-down or transparent workflow replay. Use only verifiably owned resources. Keep management credentials and raw secret-bearing SDK errors out of worker environments, logs, fixtures and commits; per-worker JIT transport follows G01. Native pools remain trusted-only.

Design references

• Architecture and gates
• Language decision
• Security design
• TDD strategy
• Goal/model execution policy
• Ordered backlog

Current evidence update — 2026-11-03 (PR #159, head a35220b089d3a3bd79ab1575620892f138739a42)

The compound read-token revocation persistence gap found by independent review is addressed in the current offline candidate. The broker syncs an account-wide intent before DELETE, bound to the phase and exact attempt/journal inodes; an unmatched intent blocks later inspect/cleanup before token issuance or handoff. The regression failed at prior head 1ea3558 and now passes against the corrected path.

G02 full suite, go vet, focused race tests and git diff --check pass on this candidate. The hosted Go check and fresh exact-head reviews are pending. No live credentials, GitHub provider, Scale Set, runner or host operation was used. PR #159 remains open while those gates run. Issue state remains OPEN / Project #2 In progress. Live canary, authenticated production provenance, trust-root custody, broker-only execution, read-to-handoff race, management-token lifecycle, conditional Scale Set deletion and trusted runtime/isolation/resource qualification remain unresolved.

Review status update — 2026-11-03

PR #159 exact head a35220b089d3a3bd79ab1575620892f138739a42 passed hosted Go checks and GitHub Codex review (no findings). The independent Luna Max review is still awaiting its final Orca result. Issue #1 remains OPEN and Project #2 remains In progress; the live gates remain unresolved.

Current evidence update — 2026-11-04 (supersedes earlier status snapshots)

• Selected and pinned path: Go 1.27.3 with github.com/actions/scaleset v0.5.0; the reviewed design remains the high-level listener plus independent reconciliation.
• PR [G01] Revoke read-only broker token after preflight #159: merged at a4d6f03b81cbc77f51bf9eb0d37fdf47d67c02f3 from reviewed head efa05d8fb142a687fa58264ba119fef1558a33c7.
• PR [G01] Align command fixtures with workflow provenance #162: open at exact head 707164b1b1cab0198f376e18244b11140b3bd044; hosted Go checks pass and exact-head Codex review completed with no findings. The exact-head independent Luna Max review is a merge gate.
• PR [G01] Account workflow provenance GET lifecycle #161: open at a1181bff77027cb436ba9fc8bb1c3dfe5bb60051; hosted Go checks pass. The combined PR [G01] Account workflow provenance GET lifecycle #161/[G01] Align command fixtures with workflow provenance #162 ACK, acquisition-loss and drain fixture race checks pass. After [G01] Align command fixtures with workflow provenance #162 merges, rebase [G01] Account workflow provenance GET lifecycle #161 on current main and repeat its exact-head review/checks before merge.
• Offline G01 evidence: the current [G01] Align command fixtures with workflow provenance #162 source passes the exact-claim provenance mutation test, ACK/acquisition-loss/drain fixture race selectors, and separate-process handoff race selectors. The original-context ACK continue/cancel and acquisition-loss continue/cancel cases also passed five race-instrumented repetitions each. These are offline fixture results, not live canary qualification.
• Current disposition: Issue [G01] Prove Scale Set delivery, acquisition and drain contracts #1 remains OPEN and Project [G02] Prove local App enrollment and launchd credential access #2 remains In progress. Authenticated production provenance and trust-root authority, broker-only execution, server-side conditional cleanup, current runtime/isolation/resource qualification, and the separately authorized Linux ARM64/JIT canary remain unresolved. No live runner, Scale Set, credential, or host operation was performed.

Additional offline gaps retained after the PR #161/#162 fixture work

The latest docs/evidence/g01-live-canary.md still records the read-to-handoff race and management-token expiry/revocation as unresolved. The current PR #161/#162 fixture evidence does not close either item. Supported conditional Scale Set cleanup also remains unresolved; these offline gaps are separate from production trust/custody, runtime qualification, and the authorized live canary.

Canary target readiness recheck — 2026-11-04

Read-only gh metadata confirms 1XP-AI/gh-runnerd-canary is private, but its main branch reports protected: false and the repository has zero Actions environments. The checked-in github.ref_protected == true guard therefore cannot pass in the current configuration. No repository settings, workflow, runner, or canary execution were changed or triggered. Any configuration change and the actual Linux ARM64/JIT experiment remain separately authorized gates.

Current evidence update — 2026-11-04 (after PR #162 merge)

• PR [G01] Align command fixtures with workflow provenance #162 merged as 14d22c0 from exact reviewed head 707164b. Exact-head Codex review had no findings; independent Luna Max review APPROVED with no P0–P3 findings; hosted Go checks passed.
• PR [G01] Account workflow provenance GET lifecycle #161 was rebased onto that main at exact base 14d22c0, producing head 85baf46. G02 full race suite, go vet, gofmt and git diff --check passed locally with Go 1.27.3 and all caches/temp on /Volumes/worktree; hosted Go checks also pass. Exact-head Codex review is running and independent Luna Max review is dispatched.
• Issue [G01] Prove Scale Set delivery, acquisition and drain contracts #1 remains OPEN / Project [G02] Prove local App enrollment and launchd credential access #2 In progress. Offline gaps remain the read-to-handoff race and management-token expiry/revocation. The pinned SDK still lacks conditional Scale Set deletion. Production provenance/trust-root custody, broker-only execution, runtime/isolation/resource qualification and the separately authorized Linux ARM64/JIT canary remain open. No live provider, credential, runner, Scale Set or host operation was performed.

Current evidence update — 2026-11-04 (PR #163)

This update supersedes earlier status snapshots that still described PR #161 as open.

• PR [G01] Align command fixtures with workflow provenance #162 is merged from exact head 707164b1b1cab0198f376e18244b11140b3bd044; PR [G01] Account workflow provenance GET lifecycle #161 is merged from exact head 85baf46dc45831fd673bd2f7958f863945270a94 onto 14d22c0e351924cb413bbb3f395f82d33796ae15. Current main is fae718d307920ff60fda64e92b8b094a11af1753.
• Offline follow-up PR #163 is open at exact head aa4e8544eaf0ebb35d120d2b238c988b861a78ab, based on current main. It covers workflow status/final handoff ordering and management-token revocation/account-ledger recovery.
• Fresh exact-head independent gpt-5.6-luna / max review completed: no P0–P3 source findings; the P2 at prior head 51b167f65f600c8de48400c1e532e9a09976e02a is resolved. Its overall G01 disposition is HOLD solely because the required live acceptance gates remain untested.
• Local Go 1.27.3 go test -race -p=1 -count=1 -timeout=300s ./..., go vet -p=1 ./..., formatting and diff checks pass at the PR head; build/module/temp caches were on /Volumes/worktree. Hosted Go quick check is in progress. GitHub Codex exact-head review was requested with @codex review and is pending.
• No live provider, credential, runner, Scale Set, Docker, host or canary operation was performed. Production provenance/trust-root authority, broker-only execution, conditional Scale Set deletion, runtime/isolation/resource qualification, protected canary configuration and the authorized Linux ARM64/JIT canary remain unresolved.

Issue #1 remains OPEN and Project #2 remains In progress until all required live acceptance criteria are satisfied.

PR #163 review progress — 2026-11-04

• Hosted PR quick check passed at exact head aa4e8544eaf0ebb35d120d2b238c988b861a78ab: run 41691896174.
• GitHub Codex manual review was requested with @codex review; the Codex status comment confirms it is running on that exact head.
• No source changes have been made after the independent Luna Max review. Issue [G01] Prove Scale Set delivery, acquisition and drain contracts #1 remains OPEN and Project [G02] Prove local App enrollment and launchd credential access #2 remains In progress; do not merge until Codex review completes and all findings are triaged.

PR #163 merged — 2026-11-04

• PR [G01] Close broker token and handoff evidence gaps #163 merged by squash from reviewed head aa4e8544eaf0ebb35d120d2b238c988b861a78ab as main commit 325effa8408f87ca51769d683b0a0862623d1ea5.
• Exact-head Luna Max review found no source findings; its overall G01 HOLD remains only for outstanding live acceptance criteria. GitHub Codex reviewed the same PR head and reported no major issues. The hosted PR Go check passed.
• Post-merge Public CI run 41692414897 is running on the merge commit; integration result is pending.
• Rechecked canary repository state: main is still unprotected at 3b555b3398fbb2b989df51b031681f95b13a6e33, and there are zero Actions environments. The checked-in protected-ref guard cannot pass. No settings or workflow were changed and no canary was triggered.

Issue #1 remains OPEN and Project #2 remains In progress. Live provenance/trust-root, broker-only execution, conditional deletion, runtime/isolation/resource, protected-canary and authorized Linux ARM64/JIT requirements remain open.