mtcollins1 runner: dispatch the floor to the attempt's slot and read the run back (leg 3)

dag/extdeps/github/git_database.dag

@@ -38,6 +38,8 @@ type GitRefObjectWire {
   sha: String
 }
 
+type GitRefDeletedBody {}
+
 type GitRefWire {
   ref: String
   object: GitRefObjectWire
@@ -111,10 +113,21 @@ data git_blob_encoding_base64: NonEmptyStr = "base64"
 // so no caller of UpdateRefFastForward can express a forced update; a moved branch answers 422
 // "Update is not a fast forward" and that refusal IS the compare-and-swap. A forced variant would be
 // a different operation with its own name and its own consumer.
+// CreateRef AND DeleteRef (docs.github.com/en/rest/git/refs#create-a-reference and
+// #delete-a-reference, read 2026-10-04). CreateRef takes the FULL ref name (`refs/tags/<name>`) in its
+// body and answers 201 with the reference; an existing ref answers 422 "Reference already exists",
+// so creation never moves a ref and that 422 is the create-once refusal. DeleteRef takes the
+// `tags/<name>` form in its path and answers 204 with no body; a ref already gone answers 422
+// "Reference does not exist". Their consumer is gunbc.runner.runner_qualification_ref_pin (a create-once branch per qualification attempt and its removal).
+//
+// THE BEARER IS AN INPUT WHEN ONE IS GIVEN. Every operation already took `auth_token`; the service read
+// only GITHUB_TOKEN. Declaring both lets a caller that holds an installation token present it, and a
+// caller passing "" (gunbc.heal_publication) falls through to GITHUB_TOKEN exactly as before.
 service github.GitDatabase {
   config {
     endpoint: default_api_base
     auth: Bearer
+    auth_input: auth_token
     auth_source: EnvVar { name: "GITHUB_TOKEN" }
   }
 
@@ -306,4 +319,58 @@ service github.GitDatabase {
       5xx => GitHubErrorShape
     }
   }
+
+  operation CreateRef {
+    requires Network
+    input {
+      auth_token: Secret
+      owner: String
+      repo: String
+      full_ref: String
+      sha: String
+    }
+    output {
+      reference: GitRefWire
+    }
+    transport rest {
+      method: POST,
+      path: "/repos/\{owner\}/\{repo\}/git/refs",
+      body: { ref: full_ref, sha: sha }
+    }
+    response {
+      201 => GitRefWire
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      409 => GitHubErrorShape
+      422 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
+
+  operation DeleteRef {
+    requires Network
+    input {
+      auth_token: Secret
+      owner: String
+      repo: String
+      ref: String
+    }
+    output {
+      result: GitRefDeletedBody
+    }
+    transport rest {
+      method: DELETE,
+      path: "/repos/\{owner\}/\{repo\}/git/refs/\{ref\}"
+    }
+    response {
+      204 => GitRefDeletedBody
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      409 => GitHubErrorShape
+      422 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
 }

dag/extdeps/github/org_actions.dag

@@ -130,6 +130,16 @@ type OrgRunnerGroupListWire {
 
 data org_runner_groups_max_per_page: Int = 100
 
+// UpdateOrganizationRunnerGroupWorkflows:
+// update a self-hosted runner group for an organization (docs.github.com/en/rest/actions/
+// self-hosted-runner-groups#update-a-self-hosted-runner-group-for-an-organization, REST
+// 2022-11-28, read 2026-10-04): PATCH sets restricted_to_workflows and selected_workflows and
+// answers 200 with the group. Each selected entry is `<owner>/<repo>/<workflow path>@<ref>`; per
+// docs.github.com/en/enterprise-cloud@latest/actions/how-tos/manage-runners/self-hosted-runners/
+// manage-access (read 2026-10-04), "Pin non-reusable workflows to a branch. Pin reusable
+// workflows to a branch, tag, or full SHA" -- a dispatched (non-reusable) workflow is selectable
+// only at a branch, which is why a qualification pin is a branch and not a SHA. Its consumer is
+// gunbc.runner.runner_qualification_ref_pin, which writes only the dedicated qualification group.
 service github.OrgRunnerGroupsRest {
   config {
     endpoint: default_api_base
@@ -161,4 +171,30 @@ service github.OrgRunnerGroupsRest {
       5xx => GitHubErrorShape
     }
   }
+
+  operation UpdateOrganizationRunnerGroupWorkflows {
+    requires Network
+    input {
+      installation_token: Secret
+      org: NonEmptyStr
+      runner_group_id: Int
+      selected_workflows: List<String>
+    }
+    output {
+      result: OrgRunnerGroupWire
+    }
+    transport rest {
+      method: PATCH,
+      path: "/orgs/\{org\}/actions/runner-groups/\{runner_group_id\}",
+      body: { restricted_to_workflows: true, selected_workflows: selected_workflows }
+    }
+    response {
+      200 => OrgRunnerGroupWire
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      422 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
 }

dag/extdeps/github/workflow_runs.dag

@@ -168,24 +168,20 @@ fn workflow_job_attempt_filter_wire(f: WorkflowJobAttemptFilter) -> String {
   }
 }
 
-// A THIRD FIELD WAS DELETED HERE AND STAYS DELETED, and this annotation is the second attempt to
-// settle it. An earlier lane added runner_name because the vendor machine name is corroborating --
-// the Biome baseline job reports "depot-1mw2k81zm2" -- found nothing read it, and deleted it on the
-// ground that interesting is not a consumer. This change put it back claiming a consumer had
-// arrived, in prose, while the diff carried no import and no call site; it is deleted again on the
-// original ground, which was right both times. DESIGN section 4c is the rule: an annotation is
-// never evidence that a machine claim holds.
+// THE RUNNER FIELDS RETURNED WHEN THEIR NAMED TRIGGER LANDED. An earlier lane added runner_name,
+// found nothing read it, and deleted it on the ground that interesting is not a consumer; a second
+// attempt claimed a consumer in prose with no import or call site and was deleted again. The trigger
+// that was named is a fold that IMPORTS this module and reads the field, landing in the same change
+// as the field: gunbc.runner.runner_qualification_dispatch job_ran_on is that fold, so the fields are
+// here with their consumer in the same change.
 //
-// The example survives the deletion because it is the part that was worth keeping.
-// "depot-1mw2k81zm2" is neither GitHub-hosted nor self-hosted but a third party's fleet, so any
-// provenance reading with two arms folds a paying provider customer in with a team running its own
-// hardware. The trigger that brings the field back is a fold that IMPORTS this module and reads
-// the field, landing in the same change as the field -- and that fold now has a further obligation
-// this lane learned the hard way: a runs-on LABEL already has an authority in
-// gunbc.runner.runner_label_resolution, backed by the per-provider catalogs
+// The example that survived both deletions still governs the reading. "depot-1mw2k81zm2" is neither
+// GitHub-hosted nor self-hosted but a third party's fleet, so any provenance reading with two arms
+// folds a paying provider customer in with a team running its own hardware. A runs-on LABEL has an
+// authority in gunbc.runner.runner_label_resolution, backed by the per-provider catalogs
 // gunbc.runner.runner_provider_survey enrolls, so a consumer may not re-answer the label question
 // with a fresh prefix roster. A runner NAME is a different vocabulary with no such authority, which
-// is the one thing this field would genuinely add.
+// is what these fields add.
 //
 // `name` is the only matrix-leg identifier this resource carries. The Jobs REST job object
 // (docs.github.com/en/rest/actions/workflow-jobs, X-GitHub-Api-Version 2026-03-10) publishes
@@ -194,6 +190,12 @@ fn workflow_job_attempt_filter_wire(f: WorkflowJobAttemptFilter) -> String {
 // rendered name. The parenthetical of combination VALUES in axis order is the rendering this
 // tree observed on those names; it is not a REST field. Standing is TranscribedUncited until
 // GitHub's Jobs docs state that encoding.
+// runner_id AND runner_name ARE WHICH RUNNER TOOK THE JOB, a third fact beside the declared runs-on
+// and the observed labels: two runners can carry identical labels. runner_id is the exact identity
+// GitHub returned when the JIT registration was minted (gunbc.runner.runner_qualification_dispatch
+// job_ran_on joins on it); runner_name is corroboration, since one name can resolve to several ids.
+// Upstream publishes both as nullable -- null until a runner takes the job -- and every record in
+// this tree written before the fields existed carries none rather than a guessed value.
 type WorkflowJobRun {
   id: Int
   run_id: Int
@@ -202,6 +204,8 @@ type WorkflowJobRun {
   status: WorkflowRunStatus
   conclusion: WorkflowRunConclusion?
   labels: List<String>
+  runner_id: Int?
+  runner_name: String?
   created_at: Timestamp?
   started_at: Timestamp?
   completed_at: Timestamp?
@@ -293,10 +297,17 @@ data structural_coverage_gap_workflow_run_codec_hand_rolled: List<String> = [
 // drops are execution that really happened and really occupied a runner. A caller measuring
 // occupancy needs "all"; a caller reading current state needs "latest"; neither is a property of
 // this operation, so the choice moves to the input with "latest" as the compatible default.
+// THE BEARER IS THE CALLER'S auth_token WHEN ONE IS GIVEN. Every operation already took auth_token,
+// and the service read only GITHUB_TOKEN, so a caller holding an installation token
+// (gunbc.github_effect_perform read_run_with / read_attempt_jobs_with) was silently read under the
+// ambient Actions credential. Declaring auth_input beside auth_source makes a non-empty auth_token the
+// bearer; a caller passing "" (gunbc.pr_base_freshness, gunbc.fleet_desired_admission,
+// gunbc.roadmap_launch_deployment_cli) falls through to GITHUB_TOKEN exactly as before.
 service github.WorkflowRuns {
   config {
     endpoint: default_api_base
     auth: Bearer
+    auth_input: auth_token
     auth_source: EnvVar { name: "GITHUB_TOKEN" }
   }
 

dag/extdeps/github/workflows.dag

@@ -3,13 +3,9 @@ module extdeps.github.workflows
 import extdeps.ietf.http_semantics { POST }
 import extdeps.github.github { default_api_base }
 import extdeps.github.errors { GitHubErrorShape }
-import std.credentials { EnvVar }
-import std.types { CommitSha, List, NonEmptyStr }
+import std.types { NonEmptyStr, Secret, String }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
-import std.roster_frontier { FrontierRow, frontier_row_decl }
-import std.dissolution { unbound_dissolution }
-import std.decl_ref { decl_ref }
 import std.resources { Network }
 import extdeps.ietf.http_semantics { POST }
 import extdeps.transports.rest { RestResult }
@@ -42,48 +38,45 @@ type WorkflowDispatchReceipt {
 // WorkflowDispatchReceipt would fabricate a run that was refused. The owning workflow may be
 // retriggered after diagnosis; this operation never assumes a git push created a run.
 //
-// FROZEN UPSTREAM SHAPE: tools.ci_heal_dispatch, the only production caller, is deleted. Restoring
-// heal auto-dispatch does not consume this operation. `expected_healed_sha` is the `inputs`
-// key GitHub accepts for this repository's workflow_dispatch contract; it is not a second heal
-// policy and must not grow more heal-specific keys here. Disposition:
-// create_dispatch_unconsumed_frontier_rows.
-
-data create_dispatch_unconsumed_frontier_rows: List<FrontierRow> = [
-  frontier_row_decl(
-    ref: decl_ref(module_path: "extdeps.github.workflows", decl_name: "WorkflowDispatchReceipt"),
-    reason: "github.Workflows CreateDispatch and WorkflowDispatchReceipt are the cited REST shape with no production caller after tools.ci_heal_dispatch was deleted; frozen: no new heal-specific keys or auto-invoke rows",
-    dissolution: unbound_dissolution(description: "a production fold that is not heal auto-dispatch calls github.Workflows CreateDispatch, or CreateDispatch and WorkflowDispatchReceipt are deleted. NOT satisfied by restoring tools.ci_heal_dispatch, nor by a witness constructing WorkflowDispatchReceipt"),
-  )
-]
-
+// `inputs` IS THE UPSTREAM'S OWN SHAPE: an object of input name to value, at most 25 properties,
+// each key a workflow_dispatch input the target workflow declares (extdeps.github.actions
+// DispatchInput). It once carried exactly one key, expected_healed_sha, because the deleted
+// tools.ci_heal_dispatch was its only caller -- a consumer's policy fused into the interface
+// (DESIGN section 3). Which keys a dispatch carries is the dispatching workflow's fact, so the
+// caller supplies the object and this module names no key. GitHub answers an undeclared key with
+// 422, which is the refusal arm below, never a silently dropped input.
+//
+// THE CREDENTIAL IS AN INPUT, NOT AN AMBIENT VARIABLE. It once read GITHUB_TOKEN from the
+// environment, which fixed the executing credential to whichever job happened to run the call.
+// Which credential performs a dispatch is the caller's authorization fact (gunbc.auth), so the
+// operation takes the bearer as auth_token, as the self-hosted-runner and gist services do.
 service github.Workflows {
   config {
     endpoint: default_api_base
     auth: Bearer
-    auth_source: EnvVar { name: "GITHUB_TOKEN" }
+    auth_input: auth_token
   }
 
   operation CreateDispatch {
     requires Network
     input {
+      auth_token: Secret
       owner: String
       repo: String
       workflow_id: String
       ref: String
-      expected_healed_sha: CommitSha
+      inputs: Map<String, String>
     }
     output {
-      workflow_run_id: Int
-      run_url: NonEmptyStr
-      html_url: NonEmptyStr
+      result: WorkflowDispatchReceipt
     }
     transport rest {
       method: POST,
       path: "/repos/\{owner\}/\{repo\}/actions/workflows/\{workflow_id\}/dispatches",
       headers: { "X-GitHub-Api-Version": workflows_api_version },
       body: {
         ref: ref,
-        inputs: { expected_healed_sha: expected_healed_sha }
+        inputs: inputs
       }
     }
     response {