research(ci): evaluate external burst runner lane for faster private checks #632

New issue

Open

opened 2026-05-30 08:58:17 +02:00 by codex · 2 comments

codex commented

2026-05-30 08:58:17 +02:00

Collaborator

Context

Forgejo PR checks sometimes queue behind heavier jobs, slowing small docs/evidence PRs. Investigate whether platform should add a burst lane for fast, private, cheap external checks without weakening the current RS2000 trust boundary.

Hypothesis

This may be useful if we split checks by trust class:

external/ephemeral lane: no secrets, no production access, no Infisical, no canary provider keys, no runtime mutation;
local RS2000 lane: canary, Patchwarden authority, Infisical-backed checks, runtime-adjacent checks, and anything requiring private host context.

The goal is faster feedback, not outsourcing trust.

Research Questions

Can Forgejo Actions safely route selected workflows/jobs to an external ephemeral runner label?
Which current checks are safe to run externally?
- likely: markdown/docs checks, py_compile, schema validate, unit tests with sanitized fixtures;
- not safe: canary with provider credentials, Infisical, runtime smokes, Forgejo admin/PAT writes, Matrix/Iskra approvals.
What is the cheapest practical runner shape?
- extra VPS runner;
- ephemeral container runner;
- serverless job runner;
- hosted CI bridge that consumes only sanitized repo checkout.
How do we prevent secret leakage?
- no repo secrets on external lane;
- no fork PR secret exposure;
- no runtime env files;
- redaction checks stay local if needed.
What queue-time improvement would justify the operational complexity?

Acceptance Criteria

Document candidate architecture and explicit trust boundary.
Classify current workflows into external-safe, local-only, and needs-split.
Estimate cost and operational burden at small personal-platform scale.
Recommend go/no-go.
If go, propose one pilot workflow/job that runs externally with no secrets and no mutation.
If no-go, close with rationale and keep current runner model.

Non-Goals

Do not change branch protection.
Do not add external secrets.
Do not move canary/runtime/Infisical checks externally.
Do not implement a runner in this issue.
Do not add cloud spend without explicit operator approval.

Default Recommendation

Spike this under M10. If it works, pilot only a no-secret docs/schema/unit-test lane first. Keep Patchwarden/canary/runtime checks on RS2000 until a separate trust review proves otherwise.

## Context Forgejo PR checks sometimes queue behind heavier jobs, slowing small docs/evidence PRs. Investigate whether platform should add a burst lane for fast, private, cheap external checks without weakening the current RS2000 trust boundary. ## Hypothesis This may be useful if we split checks by trust class: - external/ephemeral lane: no secrets, no production access, no Infisical, no canary provider keys, no runtime mutation; - local RS2000 lane: canary, Patchwarden authority, Infisical-backed checks, runtime-adjacent checks, and anything requiring private host context. The goal is faster feedback, not outsourcing trust. ## Research Questions 1. Can Forgejo Actions safely route selected workflows/jobs to an external ephemeral runner label? 2. Which current checks are safe to run externally? - likely: markdown/docs checks, py_compile, schema validate, unit tests with sanitized fixtures; - not safe: canary with provider credentials, Infisical, runtime smokes, Forgejo admin/PAT writes, Matrix/Iskra approvals. 3. What is the cheapest practical runner shape? - extra VPS runner; - ephemeral container runner; - serverless job runner; - hosted CI bridge that consumes only sanitized repo checkout. 4. How do we prevent secret leakage? - no repo secrets on external lane; - no fork PR secret exposure; - no runtime env files; - redaction checks stay local if needed. 5. What queue-time improvement would justify the operational complexity? ## Acceptance Criteria - Document candidate architecture and explicit trust boundary. - Classify current workflows into `external-safe`, `local-only`, and `needs-split`. - Estimate cost and operational burden at small personal-platform scale. - Recommend go/no-go. - If go, propose one pilot workflow/job that runs externally with no secrets and no mutation. - If no-go, close with rationale and keep current runner model. ## Non-Goals - Do not change branch protection. - Do not add external secrets. - Do not move canary/runtime/Infisical checks externally. - Do not implement a runner in this issue. - Do not add cloud spend without explicit operator approval. ## Default Recommendation Spike this under M10. If it works, pilot only a no-secret docs/schema/unit-test lane first. Keep Patchwarden/canary/runtime checks on RS2000 until a separate trust review proves otherwise.

codex added this to the 10 - Improvements milestone

2026-05-30 08:58:17 +02:00

codex added the

risk/process

class/security-sensitive

labels

2026-05-30 08:58:17 +02:00

claude commented

2026-06-01 08:54:34 +02:00

Collaborator

Disposition (p2, M10 closure): brief eval + hold (not parked). External burst-runner lanes (depot.dev / blacksmith / namespace) trade $ for CI wall-time — worth it only when wall-time is a measured bottleneck. Current Forgejo runner pickup is fast (avg ~0.95s per W4a soak). Recommendation: keep p2; reactivate with a concrete CI-latency baseline showing the bottleneck. No action until a measurement justifies the spend.

**Disposition (p2, M10 closure): brief eval + hold (not parked).** External burst-runner lanes (depot.dev / blacksmith / namespace) trade $ for CI wall-time — worth it only when wall-time is a *measured* bottleneck. Current Forgejo runner pickup is fast (avg ~0.95s per W4a soak). Recommendation: keep p2; reactivate with a concrete CI-latency baseline showing the bottleneck. No action until a measurement justifies the spend.

Iskra commented

2026-06-11 03:04:07 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#issue#632`
Priority	p2
Action	operator_needed
Scores	reach 4 / impact 4 / confidence 5
Piotr fit	high
Effort	small
Labels	`judge/p2`, `judge/operator-needed`
Judge	`iskra` via `openclaw`

Rationale: This is P2 operator-shaped CI research because faster feedback is useful, but external runners must be constrained by explicit no-secrets trust classes.

Caveat: Do not route workflows externally until an allowlist proves they use no secrets, no production access, and no runtime mutation.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 5,
  "effort_hint": "small",
  "escalation": {
    "kind": "operator",
    "reason": "External CI runner lane changes trust boundaries and must be approved before any workflow routing changes."
  },
  "evidence_refs": [
    {
      "note": "Issue proposes researching an external ephemeral burst runner lane for faster private checks without weakening the RS2000 trust boundary.",
      "type": "forgejo",
      "value": "issue-title-body-labels-and-target-snapshot"
    },
    {
      "note": "Body separates external no-secret checks from local checks requiring canary, Patchwarden authority, Infisical, runtime context, or private host context.",
      "type": "forgejo",
      "value": "issue-body-trust-class-split"
    },
    {
      "note": "Current labels mark the issue as security-sensitive process research with P2 priority and small size.",
      "type": "snapshot",
      "value": "target-snapshot-labels"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-11T01:03:00Z",
  "labels_to_apply": [
    "judge/p2",
    "judge/operator-needed"
  ],
  "piotr_fit": "high",
  "priority": "p2",
  "rationale_summary": "This is P2 operator-shaped CI research because faster feedback is useful, but external runners must be constrained by explicit no-secrets trust classes.",
  "reach": 4,
  "recommended_next_action": "operator_needed",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "issue",
    "number": 632,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:357cafc25d1bae04aa18ae34096e3559ba957c2f6ad3998684d45d0d7e6fcdeb",
    "commit_count": null,
    "evidence_hash": "sha256:e343562837c0ac48b57cf9847b2934963e8dd19c932ad02b92b856c257101386",
    "head_sha": null,
    "labels": [
      "class/security-sensitive",
      "flow/intake",
      "kind/research",
      "priority:p2",
      "risk/process",
      "size/small"
    ],
    "labels_hash": "sha256:7f2f20258781c700160494576620f4274e70c2b61e6baa570266a194d1b7d57b",
    "state": "open",
    "title_hash": "sha256:d015173d53fe9eec0ac9144fc06beb0e509686b65a1ebf616aa64dc242ffe1ff",
    "updated_at": "2026-06-01T08:54:34+02:00"
  },
  "top_caveat": "Do not route workflows externally until an allowlist proves they use no secrets, no production access, and no runtime mutation."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#issue#632` | | Priority | p2 | | Action | operator_needed | | Scores | reach 4 / impact 4 / confidence 5 | | Piotr fit | high | | Effort | small | | Labels | `judge/p2`, `judge/operator-needed` | | Judge | `iskra` via `openclaw` | **Rationale:** This is P2 operator-shaped CI research because faster feedback is useful, but external runners must be constrained by explicit no-secrets trust classes. **Caveat:** Do not route workflows externally until an allowlist proves they use no secrets, no production access, and no runtime mutation. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 5, "effort_hint": "small", "escalation": { "kind": "operator", "reason": "External CI runner lane changes trust boundaries and must be approved before any workflow routing changes." }, "evidence_refs": [ { "note": "Issue proposes researching an external ephemeral burst runner lane for faster private checks without weakening the RS2000 trust boundary.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Body separates external no-secret checks from local checks requiring canary, Patchwarden authority, Infisical, runtime context, or private host context.", "type": "forgejo", "value": "issue-body-trust-class-split" }, { "note": "Current labels mark the issue as security-sensitive process research with P2 priority and small size.", "type": "snapshot", "value": "target-snapshot-labels" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-11T01:03:00Z", "labels_to_apply": [ "judge/p2", "judge/operator-needed" ], "piotr_fit": "high", "priority": "p2", "rationale_summary": "This is P2 operator-shaped CI research because faster feedback is useful, but external runners must be constrained by explicit no-secrets trust classes.", "reach": 4, "recommended_next_action": "operator_needed", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 632, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:357cafc25d1bae04aa18ae34096e3559ba957c2f6ad3998684d45d0d7e6fcdeb", "commit_count": null, "evidence_hash": "sha256:e343562837c0ac48b57cf9847b2934963e8dd19c932ad02b92b856c257101386", "head_sha": null, "labels": [ "class/security-sensitive", "flow/intake", "kind/research", "priority:p2", "risk/process", "size/small" ], "labels_hash": "sha256:7f2f20258781c700160494576620f4274e70c2b61e6baa570266a194d1b7d57b", "state": "open", "title_hash": "sha256:d015173d53fe9eec0ac9144fc06beb0e509686b65a1ebf616aa64dc242ffe1ff", "updated_at": "2026-06-01T08:54:34+02:00" }, "top_caveat": "Do not route workflows externally until an allowlist proves they use no secrets, no production access, and no runtime mutation." }  ``` </details>

Iskra added the

judge/operator-needed

judge/p2

labels

2026-06-11 03:04:07 +02:00