Private heal publisher on microVMs: restricted runner-group roster, self-hosted pin for the private federation

[gunbai-bot]

Operator, 2026-09-29: gunbc-private's heal publisher moves onto our microVMs. A larger hosted runner isn't available, and a private repo's standard hosted runner (7 GB) is too small for gunbc: an empty gunbc run already peaks at 6.4 GiB.

The wall will move from the token to the runner group, in order. GitHub's runner_environment claim is only github-hosted or self-hosted, so a self-hosted pin admits every self-hosted runner. This PR models the group that will justify that pin, restricted to exactly that workflow and repository. The private federation stays pinned to github-hosted (review 72445). The flip lands in one change with the controller path that mints into the group after reading its restriction back, and with the live provider condition update.

• gunbc.runner_group_restriction_ensure:
  • restricted_runner_group_subject is the one group shape.
  • restricted_runner_groups is the roster: microvm-shakedown and the new heal-publisher-private.
  • The private group's selected workflow is heal_publisher_federation_workflow_ref(private), so the group and the identity pin one string.
• gunbc.runner_group_restriction_observation:
  • The observer takes the expected workflow as a parameter.
  • ShakedownRunnerGroupRestriction → RestrictedRunnerGroup. It's still sole_constructor and still minted only by the observer.
  • The shakedown wrapper keeps runner_jit_mint and the slot controller unchanged.
• gunbc.runner_group_restriction_ensure_run: the approval-gated ensure walks the roster, with one escalation per group and one receipt line per group. The step timeout covers every group's approval window (the only fleet-converge.yml change).
• gunbc.auth.heal_publisher_federation: runner_environment is a record field. Both records say github-hosted today.

Witnesses (local, claim_batch built from main): the runner-group ensure and observation witnesses plus heal_publisher_provision, 40/40, and github_app_registry, 48/48. The two new controls:

• the private group selects the federation's workflow;
• the private group is admitted for its own workflow and refused when restricted to the shakedown's.

Not in this PR, and needed before it runs:

• At cutover, in one change: flip the private record to self-hosted, land the controller path that mints into heal-publisher-private, and update the live provider's condition to match.
• The org group gets created by fleet-converge mode microvm_runner_group_ensure, under one approval.
• The microVM controller must register one guest per queued job into heal-publisher-private with that label. That's the microVM lane's frontier (jit_mint_lifecycle_controller_consumer_frontier), along with guest egress.
• The guest image must provide what the job uses: gh, python3, curl, openssl, sudo and a cgroup v2 memory controller for the publisher prelude.

Private half: gunbc-private branch claude/private-heal-microvm, where the publish job selects the group's label.

🤖 Generated with Claude Code

[gunbai-bot]

Review 72445: agreed, and fixed by ordering rather than by a rung-drop row, in d33e35b.

The private federation stays pinned to github-hosted. runner_environment remains a per-record field and the heal-publisher-private group stays in the ensure roster; creating a group restricted to one workflow narrows and widens nothing. The flip to self-hosted lands in one change with the wall that justifies it: the controller path that mints one guest per job into heal-publisher-private after reading its restriction back (today only runner_microvm_slot_controller mints, and only into the shakedown group), plus the live provider's condition update.

Until then, a private publish job placed on the microVM label (gunbc-private#186) cannot federate at all, so the arm refuses rather than widens. The comments in heal_publisher_federation and runner_group_restriction_ensure now say this, instead of claiming the identity already admits a self-hosted runner.

— sent from swift-swift-630