ci: add bounded Depot PR canary gate

.agents/skills/manage-ci/references/current-inventory.md

@@ -163,9 +163,14 @@ comparison, and rollback run are still pending; `DEPOT_RUNNERS_ENABLED` or a
 successful manual canary does not prove PR isolation.
 
 Relevant repository variable names include `DEPOT_RUNNERS_ENABLED`,
-`DEPOT_PR_RUNNERS_ENABLED` (absent/false until protected PR activation),
-`CUDA_VERSION`, `VULKAN_SDK_VERSION`, smoke configuration variables, and
-release/deployment variables. Secret values never belong in this inventory;
+`DEPOT_PR_RUNNERS_ENABLED` (absent/false until protected PR activation), and
+`DEPOT_PR_CANARY_REF` (absent by default; one exact
+`refs/pull/<number>/merge` ref only). The latter is a bounded selector
+canary, not a cache-isolation proof or a replacement for the global PR gate.
+Native Actions-cache consumers remain a documented unresolved boundary for
+any future Depot PR run. Other variables include `CUDA_VERSION`,
+`VULKAN_SDK_VERSION`, smoke configuration variables, and release/deployment
+variables. Secret values never belong in this inventory;
 known names include `HF_TOKEN`, release-attestation keys, `CARGO_REGISTRY_TOKEN`
 and deployment tokens.
 

.github/actions/audit-depot-pr-isolation/action.yml

@@ -6,6 +6,9 @@ inputs:
     description: Original event used to derive the trust boundary.
     required: false
     default: ''
+  depot_selected:
+    description: Whether the centralized runner policy selected a Depot executor.
+    required: true
 
 runs:
   using: composite
@@ -14,6 +17,7 @@ runs:
       shell: bash
       env:
         INPUT_ORIGINAL_EVENT_NAME: ${{ inputs.original_event_name }}
+        INPUT_DEPOT_SELECTED: ${{ inputs.depot_selected }}
       run: |
         set -euo pipefail
         original_event="${INPUT_ORIGINAL_EVENT_NAME:-${GITHUB_EVENT_NAME:-}}"
@@ -22,6 +26,12 @@ runs:
           exit 0
         fi
 
+        depot_selected="${INPUT_DEPOT_SELECTED:-}"
+        if [[ "$depot_selected" != "true" && "$depot_selected" != "false" ]]; then
+          echo "depot_selected must be true or false, got: $depot_selected" >&2
+          exit 1
+        fi
+
         forbidden_names=(
           DEPOT_CACHE_TOKEN
           DEPOT_TOKEN
@@ -49,7 +59,21 @@ runs:
 
         for endpoint_name in ACTIONS_CACHE_URL ACTIONS_RESULTS_URL; do
           endpoint="${!endpoint_name:-}"
+          if [[ -z "$endpoint" ]]; then
+            continue
+          fi
           endpoint_lower="$(printf '%s' "$endpoint" | tr '[:upper:]' '[:lower:]')"
+          if [[ "$endpoint_lower" == *depot.dev* ]]; then
+            echo "PR runner received a Depot Actions endpoint: $endpoint_name" >&2
+            exit 1
+          fi
+          if [[ "$endpoint_lower" =~ ^https?://[^/]*@ ]]; then
+            echo "PR runner received an Actions endpoint with URL userinfo: $endpoint_name" >&2
+            exit 1
+          fi
+          if [[ "$depot_selected" != "true" ]]; then
+            continue
+          fi
           if [[ ! "$endpoint_lower" =~ ^https://([a-z0-9-]+\.)*actions\.githubusercontent\.com(:[0-9]+)?([/?#]|$) ]]; then
             echo "PR runner received a non-GitHub Actions endpoint: $endpoint_name" >&2
             exit 1

.github/actions/select-ci-runners/action.yml

@@ -26,6 +26,10 @@ inputs:
     description: Exact-string repository gate for direct pull-request Depot placement.
     required: false
     default: "false"
+  pr_canary_ref:
+    description: Optional exact pull-request merge ref selected for a protected canary.
+    required: false
+    default: ""
   force_hosted:
     description: Fail-closed planner signal for CI-control or runner-policy changes.
     required: false
@@ -88,6 +92,7 @@ runs:
         INPUT_REF: ${{ inputs.ref }}
         INPUT_DEPOT_MAIN_ENABLED: ${{ inputs.depot_main_enabled }}
         INPUT_DEPOT_PR_ENABLED: ${{ inputs.depot_pr_enabled }}
+        INPUT_PR_CANARY_REF: ${{ inputs.pr_canary_ref }}
         INPUT_FORCE_HOSTED: ${{ inputs.force_hosted }}
         INPUT_MANUAL_USE_DEPOT: ${{ inputs.manual_use_depot }}
       run: |
@@ -106,10 +111,18 @@ runs:
           fi
         done
 
+        pr_canary_ref="${INPUT_PR_CANARY_REF:-}"
+        if [[ -n "$pr_canary_ref" &&
+          ! "$pr_canary_ref" =~ ^refs/pull/[0-9]+/merge$ ]]; then
+          echo "INPUT_PR_CANARY_REF must be an exact pull-request merge ref" >&2
+          exit 1
+        fi
+
         # A direct PR may opt into Depot only when this protected repository
-        # explicitly enables the feature. Both the base and PR-head repository
-        # comparisons remain exact so a fork, mirror, or similarly named
-        # repository cannot opt in.
+        # explicitly enables the feature, or when one exact merge ref is
+        # selected for the protected canary. Both the base and PR-head
+        # repository comparisons remain exact so a fork, mirror, or similarly
+        # named repository cannot opt in.
         trusted_repository="Mesh-LLM/mesh-llm"
         depot_enabled=false
         allow_depot_remote_cache=false
@@ -128,7 +141,8 @@ runs:
               "$INPUT_HEAD_REPOSITORY" == "$trusted_repository" && \
               "$INPUT_REF" =~ ^refs/pull/[0-9]+/merge$ && \
               "$INPUT_FORCE_HOSTED" == "false" && \
-              "$INPUT_DEPOT_PR_ENABLED" == "true" ]]; then
+              ( "$INPUT_DEPOT_PR_ENABLED" == "true" ||
+                ( -n "$pr_canary_ref" && "$INPUT_REF" == "$pr_canary_ref" ) ) ]]; then
               is_direct_pull_request=true
               depot_enabled=true
             fi

.github/workflows/ci-linux-host-slice.yml

@@ -79,6 +79,7 @@ jobs:
           ref: ${{ github.ref }}
           depot_main_enabled: ${{ vars.DEPOT_RUNNERS_ENABLED == 'true' }}
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
           manual_use_depot: ${{ inputs.use_depot }}
 
@@ -104,9 +105,10 @@ jobs:
       RUSTC_WRAPPER: sccache
       RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_8, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-linux-product-slice.yml

@@ -62,6 +62,7 @@ jobs:
           # Product composition is not in the trusted-main Depot allowlist.
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
 
   linux_product:
@@ -81,9 +82,10 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-linux-runtime-slice.yml

@@ -72,6 +72,7 @@ jobs:
           ref: ${{ github.ref }}
           depot_main_enabled: ${{ vars.DEPOT_RUNNERS_ENABLED == 'true' }}
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
           manual_use_depot: ${{ inputs.use_depot }}
 
@@ -102,9 +103,10 @@ jobs:
       LLAMA_STAGE_SKIP_NCCL: "1"
       RUSTC_WRAPPER: sccache
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_16, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-macos-host-slice.yml

@@ -74,6 +74,7 @@ jobs:
           ref: ${{ github.ref }}
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
 
   macos_host:
@@ -88,9 +89,10 @@ jobs:
       matrix:
         host: ${{ fromJson(inputs.hosts_matrix) }}
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_macos, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-macos-product-slice.yml

@@ -60,6 +60,7 @@ jobs:
           ref: ${{ github.ref }}
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
 
   macos_product:
@@ -74,9 +75,10 @@ jobs:
       matrix:
         runtime: ${{ fromJson(inputs.runtime_matrix) }}
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_macos, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-macos-runtime-slice.yml

@@ -65,6 +65,7 @@ jobs:
           ref: ${{ github.ref }}
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
 
   macos_runtime:
@@ -82,9 +83,10 @@ jobs:
       LLAMA_STAGE_BACKEND: ${{ matrix.runtime.backend }}
       LLAMA_STAGE_BUILD_DIR: ${{ matrix.runtime.build_dir }}
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_macos, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-platform-checks-slice.yml

@@ -72,6 +72,7 @@ jobs:
           ref: ${{ github.ref }}
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
       - name: Map platform runners explicitly
         id: platform_runners
@@ -95,9 +96,10 @@ jobs:
       matrix:
         check: ${{ fromJson(inputs.platform_checks_matrix) }}
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(fromJSON(needs.runner_policy.outputs.runner_by_platform)[matrix.check.platform], 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-quality-slice.yml

@@ -81,6 +81,7 @@ jobs:
           ref: ${{ github.ref }}
           depot_main_enabled: ${{ vars.DEPOT_RUNNERS_ENABLED == 'true' }}
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
           manual_use_depot: ${{ inputs.use_depot }}
 
@@ -90,9 +91,10 @@ jobs:
     runs-on: ${{ needs.runner_policy.outputs.runner_4 }}
     timeout-minutes: 20
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_4, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}
@@ -124,9 +126,10 @@ jobs:
     runs-on: ${{ needs.runner_policy.outputs.runner_4 }}
     timeout-minutes: 15
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_4, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}
@@ -157,9 +160,10 @@ jobs:
       RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
       RUSTC_WRAPPER: sccache
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_8, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}
@@ -206,9 +210,10 @@ jobs:
     runs-on: ${{ needs.runner_policy.outputs.runner_4 }}
     timeout-minutes: 5
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_4, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-rust-tests-slice.yml

@@ -76,6 +76,7 @@ jobs:
           # Rust tests are not in the existing trusted-main Depot allowlist.
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
 
   rust_tests:
@@ -102,9 +103,10 @@ jobs:
       RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
       RUSTC_WRAPPER: sccache
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-ui-artifact-slice.yml

@@ -60,6 +60,7 @@ jobs:
           # producer. PR placement is independently gated and cache-isolated.
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
 
   ui_artifact:
@@ -71,9 +72,10 @@ jobs:
       run:
         working-directory: crates/mesh-llm-ui
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_4, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-web-slice.yml

@@ -58,6 +58,7 @@ jobs:
           # Website is not in the existing trusted-main Depot allowlist.
           depot_main_enabled: 'false'
           depot_pr_enabled: ${{ vars.DEPOT_PR_RUNNERS_ENABLED == 'true' }}
+          pr_canary_ref: ${{ vars.DEPOT_PR_CANARY_REF }}
           force_hosted: ${{ inputs.force_hosted }}
 
   ui_quality:
@@ -70,9 +71,10 @@ jobs:
       run:
         working-directory: crates/mesh-llm-ui
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_4, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}
@@ -115,9 +117,10 @@ jobs:
     runs-on: ${{ needs.runner_policy.outputs.runner_4 }}
     timeout-minutes: 20
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@4f9899c0c381b8cc225c9be73980ffa8db525c57
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
         with:
           original_event_name: ${{ inputs.original_event_name }}
+          depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_4, 'depot-') }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}