From 8aa341812ff0ccc64ad1b9fd194c7cd3ceca491d Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 6 Oct 2026 18:01:52 -0700
Subject: [PATCH 1/4] ci: refuse GitHub-hosted runner labels in workflows
 (failing guard)

A GitHub billing block or hosted outage must never stop CI. Replace
check_no_bare_github_hosted_runners, which let any job keep a GitHub-hosted
label behind a '# github-hosted-required:' comment, with
check_no_github_hosted_runners: no runner-selection position may name
ubuntu-*, macos-* or windows-* outside the fork branch, the CI_TRUSTED_RUNNER
selector's label list, and an exact exception list with reasons. It also
checks that the manaflow-ai fleet in .github/runners.json is GitHub-hosted
free. This commit fails on the 30 lines and the runners.json entry that the
next commit moves.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 tests/test_ci_self_hosted_guard.sh | 114 +++++++++++++++++++++++------
 1 file changed, 90 insertions(+), 24 deletions(-)

diff --git a/tests/test_ci_self_hosted_guard.sh b/tests/test_ci_self_hosted_guard.sh
index 972931a89198..bcda2576a94a 100755
--- a/tests/test_ci_self_hosted_guard.sh
+++ b/tests/test_ci_self_hosted_guard.sh
@@ -1172,31 +1172,97 @@ check_tmux_terminal_nightly_isolation() {
   echo "PASS: tmux corpus terminal-nightly uses isolated DerivedData, noninteractive xcodebuild, and expected-failure handling"
 }
 
-check_no_bare_github_hosted_runners() {
-  # Every product CI job must route its runner through a repo variable (LINUX_RUNNER,
-  # MACOS_RUNNER_*) so the Blacksmith<->Warp / Blacksmith<->macos-26 overflow
-  # switch is a single repo-variable flip with no PR. A bare GitHub-hosted
-  # label (ubuntu-*, macos-NN) cannot be redirected, so it is forbidden. A
-  # GitHub-hosted macOS label may appear only as the MACOS_RUNNER_BACKGROUND
-  # fallback; check_background_macos_lane enforces that.
-  # The CLA policy guard is a separate immutable control-plane job and is
-  # intentionally exempted below: it may pin ubuntu-24.04 or use the
-  # CI_TRUSTED_RUNNER selector, never another runner variable or a
-  # self-hosted label (validate-cla-policy.rb and check_cla_guard_runner).
-  # Backend migrations and web complexity hold trusted tokens and use the
-  # CI_TRUSTED_RUNNER selector, which can only pick ephemeral GitHub-hosted or
-  # Blacksmith labels; test_ci_fork_runner_routing.py pins its exact form.
-  # Bare paid-provider labels (blacksmith-*, warp-*, depot-*) stay allowed for
-  # deliberate single-runner pins such as the testmanagerd-wedged
-  # `app-host-unit-tests` job.
-  local hits
-  hits="$(grep -rnE "runs-on:[[:space:]]*(ubuntu-[a-z0-9.]+|macos-[a-z0-9]+)([[:space:]]*$|[[:space:]]+#)" "$ROOT_DIR/.github/workflows" | grep -v "github-hosted-required" | grep -v "/cla-policy-guard.yml:" || true)"
-  if [[ -n "$hits" ]]; then
-    echo "FAIL: these jobs use a bare GitHub-hosted runner; route them through vars.LINUX_RUNNER / vars.MACOS_RUNNER_IOS so Blacksmith<->overflow stays a repo-variable flip:"
-    echo "$hits"
+check_no_github_hosted_runners() {
+  # A GitHub billing block or a GitHub-hosted outage must never stop CI, so no
+  # job in manaflow-ai may select a GitHub-hosted runner (ubuntu-*, macos-*,
+  # windows-*). Jobs run on Blacksmith labels, the CI_TRUSTED_RUNNER selector
+  # (Blacksmith by default), or owned pools reached through the pickers.
+  # A `# github-hosted-required:` comment is no longer an exemption.
+  # Allowed GitHub-hosted forms:
+  #   - the fork branch `github.repository_owner != 'manaflow-ai' && '<label>'`
+  #     (and `&& matrix.hosted_runner`), which never evaluates in manaflow-ai;
+  #   - fork-only `hosted_runner` matrix values;
+  #   - the label list inside the exact CI_TRUSTED_RUNNER selector, where
+  #     GitHub-hosted is an operator choice and Blacksmith is the default;
+  #   - the exact lines in `exceptions` below, each with the reason it cannot move.
+  # Runner-selection positions: runs-on, labels/group, matrix os/runner keys,
+  # scalar list items, dispatch defaults, and every *RUNNER* key (env mirrors
+  # and inputs feed runs-on too).
+  local hosted='(^|[^A-Za-z0-9_-])(ubuntu-(latest|slim|[0-9]{2}[.][0-9]{2}(-arm)?)|macos-(latest|[0-9]+(-intel|-large|-xlarge|-arm64)?)|windows-(latest|[0-9]{4}(-arm)?|11-arm))([^A-Za-z0-9_.-]|$)'
+  local fork_branch="github[.]repository_owner != 'manaflow-ai' [&][&] ('[A-Za-z0-9._-]+'|matrix[.]hosted_runner)"
+  local trusted_list='fromJSON[(]'"'"'[[]"ubuntu-24[.]04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"[]]'"'"'[)], vars[.]CI_TRUSTED_RUNNER'
+  # "<workflow>:<line content>" -> why it stays GitHub-hosted. Exact lines only.
+  local -a exceptions=(
+    # npm trusted publishing and --provenance accept only GitHub-hosted runners.
+    "sdk-bootstrap-npm.yml:    runs-on: ubuntu-latest # github-hosted-required: npm provenance publishing"
+    "sdk-release-cut.yml:    runs-on: ubuntu-latest # github-hosted-required: npm provenance needs a github-hosted runner"
+    "sdk-release-cut.yml:    runs-on: ubuntu-latest # github-hosted-required: npm provenance verification"
+    "tui-publish-npm.yml:    runs-on: ubuntu-latest # github-hosted-required: npm provenance needs a github-hosted runner"
+    "relay-publish-npm.yml:    runs-on: ubuntu-latest # github-hosted-required: npm provenance needs a github-hosted runner"
+    "cmux-tui-build-package.yml:    runs-on: ubuntu-latest # github-hosted-required: artifact attestations need GitHub OIDC"
+    # Detects a Blacksmith outage, so it must run where Blacksmith is not.
+    "ci-cloud-overflow-probe.yml:    runs-on: ubuntu-24.04 # github-hosted-required: must run while Blacksmith starts nothing"
+    # validate-cla-policy.rb pins these to ubuntu-24.04 until #17453 lands.
+    "cla.yml:    runs-on: ubuntu-24.04 # github-hosted-required: write token on fork pull requests"
+    "cla-policy-guard.yml:    runs-on: ubuntu-24.04"
+    # Dispatch-only OS-compatibility legs; no Blacksmith image is macOS 14 or Intel.
+    "ci-macos-compat.yml:          - os: macos-14"
+    "ci-macos-compat.yml:          - os: macos-15-intel"
+  )
+  local probe
+  for probe in 'runs-on: ubuntu-24.04' 'runs-on: ubuntu-latest # github-hosted-required: x' \
+               "runs-on: \${{ vars.X || 'ubuntu-24.04' }}" '- os: macos-15' '          - windows-latest' \
+               "runs-on: \${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'blacksmith-4vcpu-ubuntu-2404' }}" \
+               "LINUX_ARM64_RUNNER: \${{ vars.LINUX_ARM64_RUNNER || 'ubuntu-24.04-arm' }}" \
+               "runs-on: \${{ vars.MACOS_RUNNER_BACKGROUND || 'macos-15' }}" 'runs-on: macos-15-intel' 'runs-on: windows-2025'; do
+    if ! printf '%s\n' "$probe" | sed -E "s/$fork_branch//g; s/$trusted_list//g" | grep -Eq "$hosted"; then
+      echo "FAIL: GitHub-hosted runner guard self-test missed a GitHub-hosted label: $probe"
+      exit 1
+    fi
+  done
+  for probe in "runs-on: \${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}" \
+               "runs-on: \${{ github.repository_owner != 'manaflow-ai' && 'windows-2025' || 'blacksmith-4vcpu-windows-2025' }}" \
+               "runs-on: \${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('[\"ubuntu-24.04\",\"blacksmith-2vcpu-ubuntu-2404\",\"blacksmith-4vcpu-ubuntu-2404\"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}" \
+               '- blacksmith-6vcpu-macos-15' 'runs-on: blacksmith-4vcpu-ubuntu-2404-arm' '- warp-macos-15-arm64-6x'; do
+    if printf '%s\n' "$probe" | sed -E "s/$fork_branch//g; s/$trusted_list//g" | grep -Eq "$hosted"; then
+      echo "FAIL: GitHub-hosted runner guard self-test flagged an allowed runner: $probe"
+      exit 1
+    fi
+  done
+
+  local line file content stripped exception allowed failed=0
+  while IFS= read -r line; do
+    file="${line%%:*}"
+    content="${line#*:*:}"
+    [[ "$content" =~ ^[[:space:]]*# ]] && continue
+    # Fork-only matrix rows: read only through the fork branch above.
+    [[ "$content" =~ (^|[^A-Za-z_])\"?hosted_runner\"?:[[:space:]] ]] && continue
+    stripped="$(printf '%s\n' "$content" | sed -E "s/$fork_branch//g; s/$trusted_list//g")"
+    printf '%s\n' "$stripped" | grep -Eq "$hosted" || continue
+    allowed=0
+    for exception in "${exceptions[@]}"; do
+      if [[ "$(basename "$file"):$content" == "$exception" ]]; then allowed=1; break; fi
+    done
+    [[ "$allowed" -eq 1 ]] && continue
+    echo "FAIL: GitHub-hosted runner label: ${line#"$ROOT_DIR"/}" | cut -c1-260
+    failed=1
+  done < <(grep -rnE "(runs-on:|^[[:space:]]+(labels|group):|[[:space:]\"](os|runner|runs_on|runs-on|macos_runner|linux_runner|windows_runner)\"?:[[:space:]]|[A-Za-z_]*RUNNER[A-Za-z_]*:[[:space:]]|^[[:space:]]*-[[:space:]]+[A-Za-z0-9._-]+[[:space:]]*$|^[[:space:]]+default:[[:space:]])" "$ROOT_DIR/.github/workflows")
+  # The capability map's manaflow-ai fleet feeds runs-on through resolve-runners.yml.
+  local owner_fleet fleet_hits
+  owner_fleet="$(python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); print(d["owners"]["manaflow-ai"])' "$ROOT_DIR/.github/runners.json")"
+  fleet_hits="$(python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); [print(k+" "+v) for k,v in d["fleets"][sys.argv[2]].items()]' "$ROOT_DIR/.github/runners.json" "$owner_fleet" | grep -E "$hosted" || true)"
+  if [[ -n "$fleet_hits" ]]; then
+    echo "FAIL: .github/runners.json fleet '$owner_fleet' (manaflow-ai) maps a capability to a GitHub-hosted label:"
+    echo "$fleet_hits"
+    failed=1
+  fi
+  if [[ "$failed" -ne 0 ]]; then
+    echo "      A GitHub billing block must not stop CI. Use a Blacksmith label (behind the"
+    echo "      fork branch), a runner variable with a Blacksmith fallback, or the CI_TRUSTED_RUNNER"
+    echo "      selector. Add an exception above only for a job that cannot run off GitHub-hosted."
     exit 1
   fi
-  echo "PASS: no workflow pins a bare GitHub-hosted runner; all route through runner repo variables"
+  echo "PASS: no workflow selects a GitHub-hosted runner outside the fork branch and the listed exceptions"
 }
 
 check_no_self_hosted_fleet_runners() {
@@ -1495,7 +1561,7 @@ PYTHON
 check_cla_guard_runner
 
 # ci-macos.yml jobs
-check_no_bare_github_hosted_runners
+check_no_github_hosted_runners
 check_no_self_hosted_fleet_runners
 check_owned_pools_route_through_picker
 check_macos_runner "$CI_MACOS_FILE" "app-host-unit-tests"

From ced1bb308078e5741bdad158c8de87fd4efef735 Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 6 Oct 2026 18:21:03 -0700
Subject: [PATCH 2/4] ci: move GitHub-hosted jobs to Blacksmith

Makes check_no_github_hosted_runners pass.

- 21 control-plane and trusted-token Linux jobs (attribution, janitors,
  triage, labels, claude, pr-media, merge receipt, resolve-runners, the
  cmux-browser host tests) use the CI_TRUSTED_RUNNER selector: Blacksmith by
  default, GitHub-hosted only as an explicit operator choice, forks GitHub-hosted.
- The MACOS_RUNNER_BACKGROUND lane falls back to blacksmith-6vcpu-macos-15
  behind the fork branch (build-ghosttykit, cmux-tui-artifacts).
- cmux-tui Windows jobs fall back to blacksmith-4vcpu-windows-2025, ARM64
  Linux to blacksmith-4vcpu-ubuntu-2404-arm (also in runners.json).
- web-complexity pull requests run on blacksmith-4vcpu-ubuntu-2404.
- relay smoke runs on Blacksmith Linux and macOS 15, owner-gated.

Still GitHub-hosted, listed with reasons in the guard: npm provenance and
attestation jobs, the cloud overflow probe watch job, the two CLA jobs
(until #17453 lands), and the macOS 14 and Intel compat legs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/runners.json                          |  2 +-
 .github/workflows/auto-triage.yml             |  4 +-
 .github/workflows/build-ghosttykit.yml        |  2 +-
 .github/workflows/ci-compile-attribution.yml  |  4 +-
 .github/workflows/ci-failure-attribution.yml  |  2 +-
 .github/workflows/ci-guard-attribution.yml    |  2 +-
 .github/workflows/ci-health-report.yml        |  4 +-
 .../workflows/ci-manual-dispatch-guard.yml    |  2 +-
 .github/workflows/ci-owned-pool-rescue.yml    |  6 +--
 .github/workflows/ci-repo-variables.yml       |  2 +-
 .github/workflows/ci-stale-run-janitor.yml    |  2 +-
 .github/workflows/ci-ui-tests.yml             |  2 +-
 .github/workflows/claude.yml                  |  2 +-
 .github/workflows/cmux-browser.yml            |  2 +-
 .github/workflows/cmux-tui-artifacts.yml      |  2 +-
 .github/workflows/cmux-tui-build-package.yml  |  4 +-
 .github/workflows/cmux-tui.yml                |  4 +-
 .github/workflows/contributor-welcome.yml     |  2 +-
 .github/workflows/labels-sync.yml             |  2 +-
 .github/workflows/merge-group-fail-fast.yml   |  4 +-
 .github/workflows/merge-receipt.yml           |  2 +-
 .github/workflows/pr-media.yml                |  6 +--
 .github/workflows/relay-publish-npm.yml       |  5 +-
 .github/workflows/resolve-runners.yml         |  7 +--
 .github/workflows/triage-radar.yml            |  2 +-
 .github/workflows/web-complexity.yml          |  4 +-
 docs/ci-runners.md                            | 50 +++++++++----------
 tests/test_ci_fork_runner_routing.py          | 26 +++++++++-
 tests/test_ci_self_hosted_guard.sh            | 28 +++++------
 29 files changed, 105 insertions(+), 81 deletions(-)

diff --git a/.github/runners.json b/.github/runners.json
index 9cdd87874306..01b4f494f601 100644
--- a/.github/runners.json
+++ b/.github/runners.json
@@ -28,7 +28,7 @@
   "fleets": {
     "blacksmith": {
       "linux": "blacksmith-4vcpu-ubuntu-2404",
-      "linux_arm64": "ubuntu-24.04-arm",
+      "linux_arm64": "blacksmith-4vcpu-ubuntu-2404-arm",
       "macos_15": "blacksmith-6vcpu-macos-15",
       "macos_15_gui": "blacksmith-6vcpu-macos-15",
       "macos_15_sdk15": "blacksmith-6vcpu-macos-15",
diff --git a/.github/workflows/auto-triage.yml b/.github/workflows/auto-triage.yml
index 6aa81117a227..a1d8a8268d8a 100644
--- a/.github/workflows/auto-triage.yml
+++ b/.github/workflows/auto-triage.yml
@@ -31,7 +31,7 @@ jobs:
       contents: read
       issues: write
     if: github.event_name == 'issues'
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted issue-write token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted issue-write token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 5
     steps:
       - name: Check out trusted triage code
@@ -50,7 +50,7 @@ jobs:
       contents: read
       issues: write
     if: github.event_name == 'workflow_dispatch' && fromJSON(inputs.backfill_limit || '0') > 0
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted issue-write token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted issue-write token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 30
     steps:
       - name: Check out trusted triage code
diff --git a/.github/workflows/build-ghosttykit.yml b/.github/workflows/build-ghosttykit.yml
index 778d3e20d860..596124d8c602 100644
--- a/.github/workflows/build-ghosttykit.yml
+++ b/.github/workflows/build-ghosttykit.yml
@@ -18,7 +18,7 @@ jobs:
     # Background lane: dispatch-only and off the PR critical path, so it runs
     # on free GitHub-hosted capacity instead of the shared paid macOS pool.
     # See docs/ci-runners.md "Background lane".
-    runs-on: ${{ vars.MACOS_RUNNER_BACKGROUND || 'macos-15' }}
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'macos-26' || vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15' }}
     timeout-minutes: 60
     env:
       GHOSTTYKIT_CRASH_REPORT_SUBDIR: cmux/crash
diff --git a/.github/workflows/ci-compile-attribution.yml b/.github/workflows/ci-compile-attribution.yml
index dfc6bb5f6ec6..530230356ccc 100644
--- a/.github/workflows/ci-compile-attribution.yml
+++ b/.github/workflows/ci-compile-attribution.yml
@@ -101,7 +101,7 @@ jobs:
     name: ${{ needs.analyze.outputs.headline || 'report' }}
     needs: analyze
     if: ${{ needs.analyze.outputs.state == 'red' || needs.analyze.outputs.state == 'green' }}
-    runs-on: ubuntu-24.04 # github-hosted-required: attribution must follow a failed compile within a minute
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: attribution must follow a failed compile within a minute; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 10
     permissions:
       actions: write # dispatches main-compile-probe.yml
@@ -162,7 +162,7 @@ jobs:
     name: Fix forward or revert
     needs: [analyze, report]
     if: ${{ needs.analyze.outputs.state == 'red' && needs.analyze.outputs.fix == 'true' && !inputs.dry_run && !inputs.head }}
-    runs-on: ubuntu-24.04 # github-hosted-required: holds the Claude token and the fix PR App key
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: holds the Claude token and the fix PR App key; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 30
     concurrency:
       group: ci-compile-attribution-fix
diff --git a/.github/workflows/ci-failure-attribution.yml b/.github/workflows/ci-failure-attribution.yml
index 33c4efd1ed34..f7822440a082 100644
--- a/.github/workflows/ci-failure-attribution.yml
+++ b/.github/workflows/ci-failure-attribution.yml
@@ -42,7 +42,7 @@ jobs:
   attribute:
     name: Attribute
     if: ${{ github.repository == 'manaflow-ai/cmux' && github.event.workflow_run.event == 'pull_request' && (github.event.action == 'requested' || contains(fromJSON('["success","failure","cancelled"]'), github.event.workflow_run.conclusion)) }}
-    runs-on: ubuntu-24.04 # github-hosted-required: write token; the re-run must follow CI within a minute
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: write token; the re-run must follow CI within a minute; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 10
     permissions:
       actions: write
diff --git a/.github/workflows/ci-guard-attribution.yml b/.github/workflows/ci-guard-attribution.yml
index c6b9ec64ef0f..4fb296a22d3a 100644
--- a/.github/workflows/ci-guard-attribution.yml
+++ b/.github/workflows/ci-guard-attribution.yml
@@ -106,7 +106,7 @@ jobs:
     name: ${{ needs.analyze.outputs.headline || 'report' }}
     needs: analyze
     if: ${{ needs.analyze.outputs.state == 'red' || needs.analyze.outputs.state == 'green' }}
-    runs-on: ubuntu-24.04 # github-hosted-required: attribution must follow the fast guard within a minute
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: attribution must follow the fast guard within a minute; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 10
     permissions:
       contents: read
diff --git a/.github/workflows/ci-health-report.yml b/.github/workflows/ci-health-report.yml
index 2343bda0b343..b5d6e72bdebd 100644
--- a/.github/workflows/ci-health-report.yml
+++ b/.github/workflows/ci-health-report.yml
@@ -85,7 +85,7 @@ jobs:
           # tests/test_runner_label_policy.py fails if a workflow reads a
           # runner variable this list leaves out. The background lane carries
           # its fallback because test_ci_self_hosted_guard.sh requires it on
-          # every read; `macos-15` is an approved label either way.
+          # every read.
           # CI_PR_POOL_ORDER is the one list that may also name owned pools.
           CMUX_CI_RUNNER_VARIABLES: |
             CI_LIGHT_LANE_RUNNER=${{ vars.CI_LIGHT_LANE_RUNNER }}
@@ -102,7 +102,7 @@ jobs:
             MACOS_RUNNER_15=${{ vars.MACOS_RUNNER_15 }}
             MACOS_RUNNER_26=${{ vars.MACOS_RUNNER_26 }}
             MACOS_RUNNER_26_LARGE=${{ vars.MACOS_RUNNER_26_LARGE }}
-            MACOS_RUNNER_BACKGROUND=${{ vars.MACOS_RUNNER_BACKGROUND || 'macos-15' }}
+            MACOS_RUNNER_BACKGROUND=${{ vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15' }}
             MACOS_RUNNER_DISPLAY=${{ vars.MACOS_RUNNER_DISPLAY }}
             MACOS_RUNNER_DUAL_XCODE=${{ vars.MACOS_RUNNER_DUAL_XCODE }}
             MACOS_RUNNER_IOS=${{ vars.MACOS_RUNNER_IOS }}
diff --git a/.github/workflows/ci-manual-dispatch-guard.yml b/.github/workflows/ci-manual-dispatch-guard.yml
index 20361af5f7be..4f886f19e3ec 100644
--- a/.github/workflows/ci-manual-dispatch-guard.yml
+++ b/.github/workflows/ci-manual-dispatch-guard.yml
@@ -23,7 +23,7 @@ jobs:
       github.event.workflow_run.path == '.github/workflows/ci.yml' &&
       github.event.workflow_run.event == 'workflow_dispatch' &&
       github.event.workflow_run.head_branch == 'main'
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted Actions control-plane token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted Actions control-plane token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 3
     permissions:
       actions: write
diff --git a/.github/workflows/ci-owned-pool-rescue.yml b/.github/workflows/ci-owned-pool-rescue.yml
index 1f8db1af6d31..67fc9cab1d2e 100644
--- a/.github/workflows/ci-owned-pool-rescue.yml
+++ b/.github/workflows/ci-owned-pool-rescue.yml
@@ -44,8 +44,8 @@ run-name: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow
 # owned pools are on (CI_PR_POOL_OWNED is 1), because a run on an owned pool
 # has no other way off it; CI_OWNED_POOL_RESCUE=0 turns it off. The switch
 # gets its default before the comparison: an unset variable is null, and
-# null == '0' in an expression. It only polls, so it runs on a GitHub-hosted
-# runner rather than holding a slot in CI's Linux pool.
+# null == '0' in an expression. It only polls; it runs on an ephemeral
+# Blacksmith runner (CI_TRUSTED_RUNNER), not on an owned pool it may rescue.
 on:
   schedule:
     - cron: "17 */2 * * *"
@@ -93,7 +93,7 @@ jobs:
   rescue:
     name: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' && !inputs.run_id) && 'Sweep runs on persistent pools' || 'Rescue a run stuck on a persistent pool' }}
     if: ${{ vars.CI_PR_POOL_OWNED == '1' && (vars.CI_OWNED_POOL_RESCUE || '1') != '0' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event.workflow_run.path != '.github/workflows/nightly.yml' && github.event.workflow_run.path != '.github/workflows/ios-screenshots.yml' && contains(fromJSON('["pull_request","push","schedule","workflow_dispatch"]'), github.event.workflow_run.event) && (startsWith(vars.CI_SIDE_LANE_RUNNER, 'glaeda-side-') || startsWith(vars.CI_LIGHT_LANE_RUNNER, 'glaeda-side-')) || github.event.workflow_run.path == '.github/workflows/ios-screenshots.yml' && github.event.workflow_run.event == 'workflow_dispatch' || github.event.workflow_run.path == '.github/workflows/nightly.yml' && (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') && github.event.workflow_run.head_branch == 'main' && startsWith(vars.CI_SEED_TRUSTED_POOL, 'glaeda-trusted-') && startsWith(vars.CI_NIGHTLY_TRUSTED_RUNNER, 'glaeda-runner-')) && github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.run_attempt == 1) }}
-    runs-on: ubuntu-24.04 # github-hosted-required: polls the Actions API; keeps CI's Linux pool free
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: polls the Actions API; keeps CI's Linux pool free; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     # A sweeper adopts runs for 300 minutes and gives a rescue 25 more to
     # settle (SWEEP_SECONDS, RESCUE_GRACE_SECONDS). A single run's watch is
     # at most 150 minutes plus the same grace (JOB_TIMEOUT_SECONDS).
diff --git a/.github/workflows/ci-repo-variables.yml b/.github/workflows/ci-repo-variables.yml
index c051a009cb5b..24046a3c0663 100644
--- a/.github/workflows/ci-repo-variables.yml
+++ b/.github/workflows/ci-repo-variables.yml
@@ -70,7 +70,7 @@ jobs:
             MACOS_RUNNER_15=${{ vars.MACOS_RUNNER_15 }}
             MACOS_RUNNER_26=${{ vars.MACOS_RUNNER_26 }}
             MACOS_RUNNER_26_LARGE=${{ vars.MACOS_RUNNER_26_LARGE }}
-            MACOS_RUNNER_BACKGROUND=${{ vars.MACOS_RUNNER_BACKGROUND || 'macos-15' }}
+            MACOS_RUNNER_BACKGROUND=${{ vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15' }}
             MACOS_RUNNER_DISPLAY=${{ vars.MACOS_RUNNER_DISPLAY }}
             MACOS_RUNNER_DUAL_XCODE=${{ vars.MACOS_RUNNER_DUAL_XCODE }}
             MACOS_RUNNER_IOS=${{ vars.MACOS_RUNNER_IOS }}
diff --git a/.github/workflows/ci-stale-run-janitor.yml b/.github/workflows/ci-stale-run-janitor.yml
index a4c26675787d..bf27be950b1a 100644
--- a/.github/workflows/ci-stale-run-janitor.yml
+++ b/.github/workflows/ci-stale-run-janitor.yml
@@ -36,7 +36,7 @@ jobs:
       actions: write
       contents: read
       pull-requests: read
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted Actions control-plane token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted Actions control-plane token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 15
     steps:
       - name: Check out trusted workflow code
diff --git a/.github/workflows/ci-ui-tests.yml b/.github/workflows/ci-ui-tests.yml
index c711d0e8d5b3..6d99d09cf7fe 100644
--- a/.github/workflows/ci-ui-tests.yml
+++ b/.github/workflows/ci-ui-tests.yml
@@ -45,7 +45,7 @@ jobs:
     # repaired. Re-enable with CI_UI_TESTS_ENABLED=1; await-request also keeps
     # non-UI diffs out of the downstream test runner.
     if: ${{ github.repository_owner == 'manaflow-ai' && vars.CI_UI_TESTS_ENABLED == '1' }}
-    runs-on: ubuntu-24.04 # github-hosted-required: holds actions write and mostly waits; keeps CI's Linux pool free
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: holds actions write and mostly waits; keeps CI's Linux pool free; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     # A request can follow a long compile admission; the dispatch then waits up
     # to 50 minutes for the compile it adopts, then runs the tests.
     timeout-minutes: 360
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 6920c239f89e..0840e4a7efc5 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -33,7 +33,7 @@ jobs:
       (github.event_name == 'issues' && github.event.issue.user.type == 'User' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     # Anyone can write @claude, and the job starts before the action checks
     # write access, so no runner variable may pick the machine.
-    runs-on: ubuntu-24.04 # github-hosted-required: any commenter can start it
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: any commenter can start it; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 15
     # The workflow-level group only deduplicates webhook retries by event ID.
     # The pinned action checks repository write access before it invokes Claude.
diff --git a/.github/workflows/cmux-browser.yml b/.github/workflows/cmux-browser.yml
index d3e3dd520e98..9baf195affd5 100644
--- a/.github/workflows/cmux-browser.yml
+++ b/.github/workflows/cmux-browser.yml
@@ -21,7 +21,7 @@ jobs:
   host-tests:
     # Browser pull requests are untrusted code and must not run on a
     # configurable self-hosted runner with private network access.
-    runs-on: ubuntu-24.04 # github-hosted-required: browser PRs run untrusted code
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: browser PRs run untrusted code; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 5
     steps:
       - name: Checkout
diff --git a/.github/workflows/cmux-tui-artifacts.yml b/.github/workflows/cmux-tui-artifacts.yml
index 4e1ac62a93f3..16fc603c0dcf 100644
--- a/.github/workflows/cmux-tui-artifacts.yml
+++ b/.github/workflows/cmux-tui-artifacts.yml
@@ -86,7 +86,7 @@ jobs:
       # Post-merge publication is off the PR critical path, so its two macOS
       # Rust legs run on the background lane (free GitHub-hosted capacity)
       # unless a dispatch names a runner. See docs/ci-runners.md.
-      macos_runner: ${{ inputs.macos_runner || vars.MACOS_RUNNER_BACKGROUND || 'macos-15' }}
+      macos_runner: ${{ inputs.macos_runner || github.repository_owner != 'manaflow-ai' && 'macos-26' || vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15' }}
 
   publish:
     # R2 upload credentials only. A commit-addressed cmux-tui build is not a
diff --git a/.github/workflows/cmux-tui-build-package.yml b/.github/workflows/cmux-tui-build-package.yml
index 244f53187c8c..f3540fc8af69 100644
--- a/.github/workflows/cmux-tui-build-package.yml
+++ b/.github/workflows/cmux-tui-build-package.yml
@@ -96,7 +96,7 @@ jobs:
           PACKAGE_PYPI: ${{ inputs.package_pypi }}
           MACOS_RUNNER: ${{ github.repository_owner != 'manaflow-ai' && 'macos-26' || (inputs.macos_runner != '' && inputs.macos_runner || vars.CI_PAID_MACOS_OVERFLOW == '1' && vars.MACOS_RUNNER_15 || 'blacksmith-6vcpu-macos-15') }}
           LINUX_RUNNER: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || (inputs.linux_runner != '' && inputs.linux_runner || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404') }}
-          LINUX_ARM64_RUNNER: ${{ vars.LINUX_ARM64_RUNNER || 'ubuntu-24.04-arm' }}
+          LINUX_ARM64_RUNNER: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04-arm' || vars.LINUX_ARM64_RUNNER || 'blacksmith-4vcpu-ubuntu-2404-arm' }}
           VERIFY_LINUX_ARM64: ${{ inputs.verify_linux_arm64 }}
         shell: bash
         run: |
@@ -412,7 +412,7 @@ jobs:
   build-windows:
     name: build x86_64-pc-windows-gnu
     if: inputs.include_windows
-    runs-on: ${{ inputs.windows_runner != '' && inputs.windows_runner || vars.WINDOWS_RUNNER || 'windows-latest' }}
+    runs-on: ${{ inputs.windows_runner || github.repository_owner != 'manaflow-ai' && 'windows-2025' || vars.WINDOWS_RUNNER || 'blacksmith-4vcpu-windows-2025' }}
     timeout-minutes: 60
     env:
       CARGO_TARGET_X86_64_PC_WINDOWS_GNU_RUSTFLAGS: -C link-arg=-fuse-ld=lld
diff --git a/.github/workflows/cmux-tui.yml b/.github/workflows/cmux-tui.yml
index a789fed2e50f..df54f7c2c537 100644
--- a/.github/workflows/cmux-tui.yml
+++ b/.github/workflows/cmux-tui.yml
@@ -626,7 +626,7 @@ jobs:
     name: test (windows)
     needs: validate-inputs
     if: inputs.mode == 'full'
-    runs-on: windows-latest
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'windows-2025' || vars.WINDOWS_RUNNER || 'blacksmith-4vcpu-windows-2025' }}
     timeout-minutes: 40
     env:
       CARGO_TARGET_X86_64_PC_WINDOWS_GNU_RUSTFLAGS: -C link-arg=-fuse-ld=lld
@@ -869,7 +869,7 @@ jobs:
       macos_runner: ${{ github.repository_owner != 'manaflow-ai' && 'macos-26' || vars.CI_PR_POOL_OWNED == '1' && contains(fromJSON('["pull_request","push","schedule","workflow_dispatch"]'), github.event_name) && github.run_attempt == 1 && vars.CI_SIDE_LANE_RUNNER || 'blacksmith-6vcpu-macos-15' }}
       macos_retry_runner: ${{ github.repository_owner != 'manaflow-ai' && 'macos-26' || 'blacksmith-6vcpu-macos-15' }}
       linux_runner: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'blacksmith-4vcpu-ubuntu-2404' || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
-      windows_runner: windows-latest
+      windows_runner: ${{ github.repository_owner != 'manaflow-ai' && 'windows-2025' || vars.WINDOWS_RUNNER || 'blacksmith-4vcpu-windows-2025' }}
       checkout_ref: ${{ inputs.commit }}
 
   hosted-verification:
diff --git a/.github/workflows/contributor-welcome.yml b/.github/workflows/contributor-welcome.yml
index b32134358628..a033922b8ecc 100644
--- a/.github/workflows/contributor-welcome.yml
+++ b/.github/workflows/contributor-welcome.yml
@@ -15,7 +15,7 @@ jobs:
     if: >-
       github.event.pull_request.user.type == 'User' &&
       contains(fromJSON('["FIRST_TIME_CONTRIBUTOR","FIRST_TIMER","NONE"]'), github.event.pull_request.author_association)
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted pull-request-write token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted pull-request-write token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 5
     permissions:
       contents: read
diff --git a/.github/workflows/labels-sync.yml b/.github/workflows/labels-sync.yml
index 5fdbf3100789..bc642d2b175a 100644
--- a/.github/workflows/labels-sync.yml
+++ b/.github/workflows/labels-sync.yml
@@ -35,7 +35,7 @@ jobs:
 
   apply:
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted issue-write token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted issue-write token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 5
     permissions:
       contents: read
diff --git a/.github/workflows/merge-group-fail-fast.yml b/.github/workflows/merge-group-fail-fast.yml
index ba47dcacd87e..421050f18a54 100644
--- a/.github/workflows/merge-group-fail-fast.yml
+++ b/.github/workflows/merge-group-fail-fast.yml
@@ -11,7 +11,7 @@ name: Merge-group fail fast
 # always comes from the default branch, and a queued pull request cannot change
 # it. The source workflow runs only for merge groups, so ordinary pull-request CI
 # never creates a skipped fail-fast run. This workflow checks out nothing and
-# runs on a GitHub-hosted runner.
+# runs on an ephemeral Blacksmith runner through the CI_TRUSTED_RUNNER selector.
 on:
   workflow_run:
     workflows: [Merge-group policy checks]
@@ -32,7 +32,7 @@ env:
 jobs:
   watch:
     name: watch merge group run
-    runs-on: ubuntu-24.04 # github-hosted-required
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 360
     permissions:
       actions: write
diff --git a/.github/workflows/merge-receipt.yml b/.github/workflows/merge-receipt.yml
index c57117dbec5c..e27f122a97c8 100644
--- a/.github/workflows/merge-receipt.yml
+++ b/.github/workflows/merge-receipt.yml
@@ -16,7 +16,7 @@ permissions: {}
 jobs:
   receipt:
     if: github.event.pull_request.merged == true
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted pull-request-write token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted pull-request-write token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 5
     permissions:
       contents: read
diff --git a/.github/workflows/pr-media.yml b/.github/workflows/pr-media.yml
index de60f33f0019..a81d8d1c9a77 100644
--- a/.github/workflows/pr-media.yml
+++ b/.github/workflows/pr-media.yml
@@ -53,7 +53,7 @@ jobs:
   plan:
     name: Pick tours
     if: ${{ github.repository_owner == 'manaflow-ai' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.head_repository.full_name == github.repository) }}
-    runs-on: ubuntu-24.04 # github-hosted-required: reads the pull request and mostly waits; keeps CI's Linux pool free
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: reads the pull request and mostly waits; keeps CI's Linux pool free; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     # CI has completed, so its reads return at once.
     timeout-minutes: 10
     permissions:
@@ -113,7 +113,7 @@ jobs:
     name: Tour ${{ matrix.tour }}
     needs: plan
     if: ${{ needs.plan.outputs.run != '' && needs.plan.outputs.run != '[]' }}
-    runs-on: ubuntu-24.04 # github-hosted-required: holds actions write and mostly waits for the tour run
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: holds actions write and mostly waits for the tour run; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     # CI's build is done, so a tour waits only for its run
     # (pr_media.RUN_WAIT_SECONDS, 90 minutes, most of it queueing).
     timeout-minutes: 120
@@ -225,7 +225,7 @@ jobs:
     name: Post media
     needs: [plan, tour]
     if: ${{ !cancelled() && needs.plan.result == 'success' && needs.plan.outputs.tours != '' && needs.plan.outputs.tours != '[]' }}
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted contents and pull-request write token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted contents and pull-request write token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 10
     concurrency:
       group: pr-media-publish-${{ needs.plan.outputs.pr }}
diff --git a/.github/workflows/relay-publish-npm.yml b/.github/workflows/relay-publish-npm.yml
index fb7eb1ab2c5b..6e491011c550 100644
--- a/.github/workflows/relay-publish-npm.yml
+++ b/.github/workflows/relay-publish-npm.yml
@@ -374,6 +374,7 @@ jobs:
 
   smoke:
     name: smoke published launcher (${{ matrix.os }})
+    if: github.repository_owner == 'manaflow-ai'
     needs:
       - version
       - publish
@@ -381,9 +382,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: blacksmith-4vcpu-ubuntu-2404
             package: cmux-relay-linux-x64
-          - os: macos-14
+          - os: blacksmith-6vcpu-macos-15
             package: cmux-relay-darwin-arm64
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
diff --git a/.github/workflows/resolve-runners.yml b/.github/workflows/resolve-runners.yml
index 0e075ede8219..341a21e06864 100644
--- a/.github/workflows/resolve-runners.yml
+++ b/.github/workflows/resolve-runners.yml
@@ -46,9 +46,10 @@ jobs:
   resolve:
     name: Resolve runner capabilities
     # Not a variable and not the map: the job that resolves the fleet cannot
-    # depend on the fleet. A Blacksmith fallback here queued forever on a fork,
-    # the one case this workflow exists for. GitHub-hosted Linux runs anywhere.
-    runs-on: ubuntu-24.04  # github-hosted-required: resolves the fleet, so cannot run on one
+    # depend on the fleet. A fork takes the GitHub-hosted owner branch (no
+    # Blacksmith there); manaflow-ai runs on Blacksmith so that a GitHub
+    # billing block cannot stop the graph that this job starts.
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: resolves the fleet, so reads no runner variable; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 5
     outputs:
       map: ${{ steps.resolve.outputs.map }}
diff --git a/.github/workflows/triage-radar.yml b/.github/workflows/triage-radar.yml
index 78ac41a04303..7f8f3be6ff91 100644
--- a/.github/workflows/triage-radar.yml
+++ b/.github/workflows/triage-radar.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read
       issues: write
       pull-requests: read
-    runs-on: ubuntu-24.04 # github-hosted-required: trusted issue-write token
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || contains(fromJSON('["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # ephemeral-required: trusted issue-write token; CI_TRUSTED_RUNNER picks Blacksmith (default) or GitHub-hosted
     timeout-minutes: 5
     steps:
       - name: Check out trusted radar code
diff --git a/.github/workflows/web-complexity.yml b/.github/workflows/web-complexity.yml
index fe6f179d2a3e..203f25884633 100644
--- a/.github/workflows/web-complexity.yml
+++ b/.github/workflows/web-complexity.yml
@@ -24,8 +24,8 @@ jobs:
   complexity:
     name: Web complexity candidate
     # Pull requests execute contributor-controlled package install scripts. Keep
-    # those runs on an ephemeral GitHub-hosted runner.
-    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || (github.event_name == 'pull_request' && 'ubuntu-latest' || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404') }}
+    # those runs on an ephemeral Blacksmith runner, never a runner variable.
+    runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || (github.event_name == 'pull_request' && 'blacksmith-4vcpu-ubuntu-2404' || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404') }}
     timeout-minutes: 10
     steps:
       - name: Checkout
diff --git a/docs/ci-runners.md b/docs/ci-runners.md
index bc92c44f9b47..f3af2cd84624 100644
--- a/docs/ci-runners.md
+++ b/docs/ci-runners.md
@@ -40,8 +40,9 @@ that takes effect on the next workflow run.
 
 Linux uses Blacksmith. macOS uses Blacksmith cloud runners, plus the owned
 glaeda minis for the lanes the pool picker routes to them. WarpBuild is paid overflow and is
-not a steady state for any lane. Non-urgent macOS work also uses free
-GitHub-hosted runners through the background lane described below.
+not a steady state for any lane. No job in `manaflow-ai` selects a
+GitHub-hosted runner, so a GitHub billing block or hosted outage cannot stop CI;
+see "Guard" for the few jobs that must stay GitHub-hosted and why.
 
 **The table below is the intended steady state, not a live readout.** Repository
 variables drift, and a stale table is worse than no table. For what is actually
@@ -65,7 +66,7 @@ gh variable list --repo manaflow-ai/cmux
 | `MACOS_RUNNER_DISPLAY` | macOS GUI, XCUITest, and virtual-display tests (`tests-build-and-lag`) | `blacksmith-6vcpu-macos-15` | `blacksmith-6vcpu-macos-15` |
 | `MACOS_RUNNER_IOS` | the iOS image: simulator tests, TestFlight upload, and `ios-streamed-validate.yml` (`test-ios.yml`, `ios-testflight.yml`) | `blacksmith-6vcpu-macos-26` | `blacksmith-6vcpu-macos-26` |
 | `CI_PAID_MACOS_OVERFLOW` | the repository-side switch for metered capacity; gates the four paid-overflow variables above (see "Break-glass" below) | unset (free capacity) | unset means the Blacksmith fallback wins |
-| `MACOS_RUNNER_BACKGROUND` | non-urgent macOS work only: `build-ghosttykit` and the macOS legs of `cmux-tui-artifacts` (post-merge). See "Background lane" below | unset | `macos-15` (GitHub-hosted, free) |
+| `MACOS_RUNNER_BACKGROUND` | non-urgent macOS work only: `build-ghosttykit` and the macOS legs of `cmux-tui-artifacts` (post-merge). See "Background lane" below | `blacksmith-6vcpu-macos-15` | `blacksmith-6vcpu-macos-15` |
 
 A runner variable names a **machine capability** — an OS version, a GUI, a
 simulator, both SDKs, or a larger instance — and every job needing that
@@ -688,8 +689,8 @@ contributor can start in the base repository's context (`pull_request_target`,
 `issue_comment`, `issues`, `pull_request_review`, `pull_request_review_comment`)
 cannot use this branch: `pull_request_target` carries a write token, and a
 comment event does not say whether the pull request comes from a fork. Their
-jobs pin a literal GitHub-hosted label instead, or use the exact `CI_TRUSTED_RUNNER`
-selector above, which can only pick an ephemeral label, and read no other runner variable.
+jobs use the `CI_TRUSTED_RUNNER` selector (an ephemeral Blacksmith VM by
+default) and read no other runner variable.
 The guard parses each
 expression rather than matching text, so this branch nested under another
 condition (for example the paid-overflow switch) does not count.
@@ -730,19 +731,10 @@ xcframework build), and the two macOS Rust legs of
 `cmux-tui-build-package.yml`; release and full-suite callers keep their own
 runner).
 
-The fallback is `macos-15`, never `macos-26`: the self-hosted fleet carries a
-`macos-26` label and GitHub prefers a matching self-hosted runner. The
-`macos-15` image ships Xcode 26.3 (macOS 26.2 SDK) next to its 16.4 default, so
-jobs that pin `CMUX_CI_XCODE_APP_MACOS_15` resolve there too.
-
-An admin can repoint the whole lane with one variable edit, for example back
-to Blacksmith if GitHub's macOS queue is ever the slower one:
-
-```bash
-gh variable set MACOS_RUNNER_BACKGROUND --repo manaflow-ai/cmux -b blacksmith-6vcpu-macos-15
-```
-
-Leaving it unset is the intended state.
+The fallback is `blacksmith-6vcpu-macos-15`, behind the fork branch (a fork
+gets GitHub-hosted `macos-26`). It was GitHub-hosted `macos-15` until
+2026-10; a GitHub billing block stopped that lane, so it moved to Blacksmith.
+An admin can repoint the whole lane with one variable edit.
 
 ## Owned Macs for pull request compiles
 
@@ -1034,13 +1026,21 @@ runs. These choices are available only through `workflow_dispatch`.
 ## Guard
 
 `tests/test_ci_self_hosted_guard.sh` (run by the `workflow-guard-tests` job)
-asserts that no job pins a bare GitHub-hosted runner (`ubuntu-*` / `macos-NN`):
-every job must route through a runner repo variable so the overflow switch stays
-a single variable flip. A GitHub-hosted macOS label may appear only as the
-`MACOS_RUNNER_BACKGROUND` fallback (`vars.MACOS_RUNNER_BACKGROUND || 'macos-15'`)
-in a workflow with no pull request, merge-queue or `workflow_call` trigger,
-apart from the pinned macOS 14 / Intel compatibility legs in
-`ci-macos-compat.yml` and `relay-publish-npm.yml`. It also asserts every paid macOS job references
+asserts (`check_no_github_hosted_runners`) that no runner-selection position
+names a GitHub-hosted label (`ubuntu-*`, `macos-*`, `windows-*`), including
+matrix values, dispatch defaults and `*RUNNER*` keys, and that the manaflow-ai
+fleet in `.github/runners.json` names none. A `# github-hosted-required:`
+comment is not an exemption. Allowed: the fork branch
+(`github.repository_owner != 'manaflow-ai' && '<label>'`), the label list
+inside the `CI_TRUSTED_RUNNER` selector, and an exact exception list in the
+guard: npm provenance publish and verify jobs (npm accepts only GitHub-hosted
+runners), the artifact-attestation job, the cloud overflow probe's `watch` job
+(it detects a Blacksmith outage), the two CLA jobs (pinned by
+`validate-cla-policy.rb` until the CLA migration lands), and the macOS 14 and
+Intel legs of the dispatch-only `ci-macos-compat.yml` (no Blacksmith image).
+The `MACOS_RUNNER_BACKGROUND` fallback (`vars.MACOS_RUNNER_BACKGROUND ||
+'blacksmith-6vcpu-macos-15'`) may appear only in a workflow with no pull
+request, merge-queue or `workflow_call` trigger. It also asserts every paid macOS job references
 `vars.MACOS_RUNNER_*` or a Blacksmith/Warp/Depot label so it can never silently
 fall back to a free runner. Bare third-party provider labels (`blacksmith-*`, `warp-*`,
 `depot-*`) stay allowed for deliberate single-runner pins. "Paid" there means
diff --git a/tests/test_ci_fork_runner_routing.py b/tests/test_ci_fork_runner_routing.py
index 13a0baed4d0f..1e53fdcdc844 100644
--- a/tests/test_ci_fork_runner_routing.py
+++ b/tests/test_ci_fork_runner_routing.py
@@ -34,6 +34,10 @@
 # app-host shards over macos-15 and macos-26. Accepted only when every
 # `hosted_runner:` value in the workflow is a GitHub-hosted macOS label.
 FORK_MACOS_MATRIX_BRANCH = "github.repository_owner != 'manaflow-ai' && matrix.hosted_runner"
+# Windows and ARM64 Linux jobs run on Blacksmith in manaflow-ai; a fork takes
+# GitHub's image of the same OS.
+FORK_WINDOWS_BRANCH = "github.repository_owner != 'manaflow-ai' && 'windows-2025'"
+FORK_LINUX_ARM64_BRANCH = "github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04-arm'"
 HOSTED_MACOS_LABELS = {"macos-15", "macos-26"}
 # Any Blacksmith runner label. Script names such as
 # scripts/blacksmith-bounded-command.sh have no `-Nvcpu-` part.
@@ -44,7 +48,14 @@
 BLACKSMITH_RUNNER_NAME_CHECK = re.compile(
     r"startsWith\(runner\.name, '" + BLACKSMITH_LABEL.pattern + r"-Runner-'\)"
 )
-FORK_BRANCHES = (FORK_LINUX_BRANCH, FORK_MACOS_BRANCH, FORK_MACOS_15_BRANCH, FORK_MACOS_MATRIX_BRANCH)
+FORK_BRANCHES = (
+    FORK_LINUX_BRANCH,
+    FORK_MACOS_BRANCH,
+    FORK_MACOS_15_BRANCH,
+    FORK_MACOS_MATRIX_BRANCH,
+    FORK_WINDOWS_BRANCH,
+    FORK_LINUX_ARM64_BRANCH,
+)
 OWNER_ONLY_JOB_IF = "if: github.repository_owner == 'manaflow-ai'"
 EXPRESSION = re.compile(r"\$\{\{(.*?)\}\}")
 JOB_HEADER = re.compile(r"^  ([A-Za-z0-9_-]+):\s*(?:#.*)?$")
@@ -54,6 +65,12 @@
     ("reload-build.yml", "macOS runner label to build on. Blacksmith (blacksmith-6vcpu-macos-26),"): (
         "description text of the runner input, not a value"
     ),
+    ("ci-health-report.yml", "MACOS_RUNNER_BACKGROUND=${{ vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15' }}"): (
+        "report text that prints the lane's effective label, not a runs-on value"
+    ),
+    ("ci-repo-variables.yml", "MACOS_RUNNER_BACKGROUND=${{ vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15' }}"): (
+        "report text that prints the lane's effective label, not a runs-on value"
+    ),
 }
 # (workflow, dispatch input) -> why its Blacksmith default and choices may be
 # read before the fork branch.
@@ -892,7 +909,12 @@ def test_every_fork_exercised_runner_has_a_hosted_path(self) -> None:
                 # condition selects, not a label appearing later on the line.
                 pull_request_linux = pull_request_selects(line, "ubuntu")
                 pull_request_macos = pull_request_selects(line, "macos")
-                hosted_linux = FORK_LINUX_BRANCH in line or pull_request_linux
+                hosted_linux = (
+                    FORK_LINUX_BRANCH in line
+                    or FORK_LINUX_ARM64_BRANCH in line
+                    or FORK_WINDOWS_BRANCH in line
+                    or pull_request_linux
+                )
                 hosted_macos = (
                     FORK_MACOS_BRANCH in line
                     or FORK_MACOS_15_BRANCH in line
diff --git a/tests/test_ci_self_hosted_guard.sh b/tests/test_ci_self_hosted_guard.sh
index bcda2576a94a..e69a9c426148 100755
--- a/tests/test_ci_self_hosted_guard.sh
+++ b/tests/test_ci_self_hosted_guard.sh
@@ -3,9 +3,10 @@
 # Ensures paid CI jobs use a paid macOS runner (Blacksmith or WarpBuild, routed
 # through the MACOS_RUNNER_15 / MACOS_RUNNER_26 repo variables), never a free
 # GitHub-hosted runner. Flip Blacksmith<->Warp by editing those repo variables;
-# see docs/ci-runners.md. The one sanctioned free lane is MACOS_RUNNER_BACKGROUND,
-# whose fallback is GitHub-hosted macos-15 and whose members must stay off the
-# pull request and merge path (check_background_macos_lane).
+# see docs/ci-runners.md. MACOS_RUNNER_BACKGROUND is the non-urgent lane, whose
+# fallback is Blacksmith macos-15 and whose members must stay off the pull
+# request and merge path (check_background_macos_lane). No job in manaflow-ai
+# selects a GitHub-hosted runner (check_no_github_hosted_runners).
 # Fork execution has a separate portability rule: the normal CI graph routes
 # every non-manaflow-ai repository owner to GitHub-hosted runners, because a
 # Blacksmith label in a personal fork queues forever. The upstream branch of
@@ -1953,7 +1954,7 @@ strip_background_lane_expr() {
   # stray hosted label: the non-blocking background lane, and the explicit
   # non-manaflow-ai fork branch used by the normal CI graph (macos-26, or
   # macos-15 for the jobs that need that image).
-  awk -v e="vars.MACOS_RUNNER_BACKGROUND || 'macos-15'" \
+  awk -v e="vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15'" \
       -v f="github.repository_owner != 'manaflow-ai' && 'macos-15' || " \
       -v g="github.repository_owner != 'manaflow-ai' && 'macos-26' || " '{
     while ((i = index($0, e)) > 0) $0 = substr($0, 1, i - 1) substr($0, i + length(e))
@@ -1964,20 +1965,19 @@ strip_background_lane_expr() {
 }
 
 check_background_macos_lane() {
-  # MACOS_RUNNER_BACKGROUND is the only place a free GitHub-hosted macOS label
-  # may appear: as that variable's in-workflow fallback. The lane moves
-  # non-urgent macOS work (dispatch-only, post-merge, on-demand packaging) off
-  # the shared macOS pool that pull requests queue on. Unset, the variable
-  # resolves to the fallback; an admin can repoint the whole lane with one
-  # variable edit. macos-26 is not allowed: the self-hosted fleet carries it.
-  local lane_expr="vars.MACOS_RUNNER_BACKGROUND || 'macos-15'"
+  # MACOS_RUNNER_BACKGROUND is the non-urgent macOS lane (dispatch-only,
+  # post-merge, on-demand packaging). Its in-workflow fallback is Blacksmith
+  # macos-15, behind the fork branch: a GitHub billing block must not stop it
+  # (check_no_github_hosted_runners). An admin can repoint the whole lane with
+  # one variable edit. GitHub-hosted macOS labels appear only in the fork
+  # branch and the exact compatibility-leg exceptions below.
+  local lane_expr="vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15'"
   local hosted_mac='(^|[^A-Za-z0-9_-])macos-(latest|[0-9]+)(-(intel|large|xlarge|arm64))?([^A-Za-z0-9_-]|$)'
   # Pre-existing OS-version compatibility legs that need a specific hosted
   # image (macOS 14, Intel) that no paid provider offers. Exact lines only.
   local -a hosted_exceptions=(
     "ci-macos-compat.yml:          - os: macos-14"
     "ci-macos-compat.yml:          - os: macos-15-intel"
-    "relay-publish-npm.yml:          - os: macos-14"
   )
   local failed=0 probe
 
@@ -2028,7 +2028,7 @@ check_background_macos_lane() {
     ref_count="$({ grep -o 'vars\.MACOS_RUNNER_BACKGROUND' "$file" || true; } | wc -l | tr -d ' ')"
     expr_count="$({ grep -oF "$lane_expr" "$file" || true; } | wc -l | tr -d ' ')"
     if [[ "$ref_count" != "$expr_count" ]]; then
-      echo "FAIL: $(basename "$file") references vars.MACOS_RUNNER_BACKGROUND without the fallback || 'macos-15'"
+      echo "FAIL: $(basename "$file") references vars.MACOS_RUNNER_BACKGROUND without the fallback || 'blacksmith-6vcpu-macos-15'"
       failed=1
     fi
     if ! grep -qE '^["\047]?on["\047]?:' "$file"; then
@@ -2045,7 +2045,7 @@ check_background_macos_lane() {
   done < <(grep -rlF 'vars.MACOS_RUNNER_BACKGROUND' "$ROOT_DIR/.github/workflows" || true)
 
   [ "$failed" -eq 0 ] || exit 1
-  echo "PASS: GitHub-hosted macOS labels appear only as the MACOS_RUNNER_BACKGROUND fallback on non-blocking workflows"
+  echo "PASS: the MACOS_RUNNER_BACKGROUND lane falls back to Blacksmith on non-blocking workflows; hosted macOS only in fork branches and compat legs"
 }
 
 check_dmg_signing_uses_build_keychain

From 135a5f68744e5fa6da26266dca392770c8b24afd Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 6 Oct 2026 18:45:23 -0700
Subject: [PATCH 3/4] test: pool rescue and runner resolver run on the trusted
 selector

Two workflow contract tests pinned these jobs to ubuntu-24.04. They now pin
the CI_TRUSTED_RUNNER selector: a fork still starts on GitHub-hosted Linux,
and manaflow-ai runs on Blacksmith.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 tests/test_ci_owned_pool_rescue.py          | 9 +++++++--
 tests/test_ci_runner_capability_resolver.py | 8 +++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/tests/test_ci_owned_pool_rescue.py b/tests/test_ci_owned_pool_rescue.py
index 99f7e4161f03..7f7795bcf6b0 100644
--- a/tests/test_ci_owned_pool_rescue.py
+++ b/tests/test_ci_owned_pool_rescue.py
@@ -2107,8 +2107,13 @@ def test_runs_the_rescue_script(self):
         self.assertEqual(step["env"]["RESCUE_SECONDS"], "${{ vars.CI_OWNED_POOL_RESCUE_SECONDS }}")
         self.assertEqual(step["env"]["POOL_OWNED"], "${{ vars.CI_PR_POOL_OWNED }}")
 
-    def test_polls_from_a_github_hosted_runner(self):
-        self.assertEqual(self.doc["jobs"]["rescue"]["runs-on"], "ubuntu-24.04")
+    def test_polls_from_an_ephemeral_runner(self):
+        # Never from an owned pool it may rescue, and never only from
+        # GitHub-hosted: a GitHub billing block must not stop the rescue.
+        self.assertEqual(
+            self.doc["jobs"]["rescue"]["runs-on"],
+            '${{ github.repository_owner != \'manaflow-ai\' && \'ubuntu-24.04\' || contains(fromJSON(\'["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]\'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || \'blacksmith-4vcpu-ubuntu-2404\' }}',
+        )
 
     def test_marker_steps_never_fail_the_changes_job(self):
         steps = yaml.safe_load((ROOT / ".github/workflows/ci.yml").read_text())["jobs"]["changes"]["steps"]
diff --git a/tests/test_ci_runner_capability_resolver.py b/tests/test_ci_runner_capability_resolver.py
index 447a4e60737e..f4c39ec93430 100755
--- a/tests/test_ci_runner_capability_resolver.py
+++ b/tests/test_ci_runner_capability_resolver.py
@@ -329,9 +329,15 @@ def test_the_resolver_job_does_not_run_on_a_fleet_it_resolves(self):
 
         workflow = Path(__file__).resolve().parents[1] / ".github/workflows/resolve-runners.yml"
         jobs = yaml.safe_load(workflow.read_text(encoding="utf-8"))["jobs"]
+        # A fork takes GitHub-hosted Linux first; manaflow-ai runs on
+        # Blacksmith through the CI_TRUSTED_RUNNER selector, so a GitHub
+        # billing block cannot stop the graph this job starts.
         for name, job in jobs.items():
             with self.subTest(job=name):
-                self.assertEqual(job["runs-on"], "ubuntu-24.04")
+                self.assertEqual(
+                    job["runs-on"],
+                    '${{ github.repository_owner != \'manaflow-ai\' && \'ubuntu-24.04\' || contains(fromJSON(\'["ubuntu-24.04","blacksmith-2vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]\'), vars.CI_TRUSTED_RUNNER) && vars.CI_TRUSTED_RUNNER || \'blacksmith-4vcpu-ubuntu-2404\' }}',
+                )
 
 
 if __name__ == "__main__":

From 852b9643a19f402eecc7e43bf4655d8de5c9b8f6 Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 6 Oct 2026 19:12:55 -0700
Subject: [PATCH 4/4] ci: retire the macos-14 compat leg (#17068 intent)

GitHub retired the macos-14 image. The macOS 15 arm64 leg already runs on
blacksmith-6vcpu-macos-15, so drop the macos-14 row instead of moving it, and
remove macos-14 from both guard exception lists so it cannot come back. Only
the Intel leg stays GitHub-hosted. The relay smoke row already moved from
macos-14 to Blacksmith macOS 15 in this PR.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci-macos-compat.yml | 15 +++------------
 docs/ci-runners.md                    |  5 +++--
 tests/test_ci_self_hosted_guard.sh    |  9 ++++-----
 3 files changed, 10 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/ci-macos-compat.yml b/.github/workflows/ci-macos-compat.yml
index 6979ccc8bf8e..288c76877b7a 100644
--- a/.github/workflows/ci-macos-compat.yml
+++ b/.github/workflows/ci-macos-compat.yml
@@ -9,15 +9,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-14
-            timeout: 60
-            run_unit_tests: false
-            run_mobile_transport_tests: true
-            startup_smoke: true
-            virtual_display: true
-            skip_zig: false
-            expected_arch: arm64
-            expected_os_major: "14"
           - os: macos-15-intel
             timeout: 90
             run_unit_tests: false
@@ -59,9 +50,9 @@ jobs:
           EXPECTED_OS_MAJOR: ${{ matrix.expected_os_major }}
         run: |
           set -euo pipefail
-          # Pick the latest Xcode installed on the runner. GitHub-hosted macos-14
-          # defaults to Xcode 15.4, but the project needs Xcode 16+ (Swift tools
-          # version 6.0 required by sentry-cocoa).
+          # Pick the latest Xcode installed on the runner. An image default can
+          # be older than the Xcode 16+ the project needs (Swift tools version
+          # 6.0 required by sentry-cocoa).
           XCODE_APP="$(
             find /Applications -maxdepth 1 -name 'Xcode*.app' -print 2>/dev/null \
               | sort \
diff --git a/docs/ci-runners.md b/docs/ci-runners.md
index f3af2cd84624..28790c732bf5 100644
--- a/docs/ci-runners.md
+++ b/docs/ci-runners.md
@@ -1036,8 +1036,9 @@ inside the `CI_TRUSTED_RUNNER` selector, and an exact exception list in the
 guard: npm provenance publish and verify jobs (npm accepts only GitHub-hosted
 runners), the artifact-attestation job, the cloud overflow probe's `watch` job
 (it detects a Blacksmith outage), the two CLA jobs (pinned by
-`validate-cla-policy.rb` until the CLA migration lands), and the macOS 14 and
-Intel legs of the dispatch-only `ci-macos-compat.yml` (no Blacksmith image).
+`validate-cla-policy.rb` until the CLA migration lands), and the Intel leg of
+the dispatch-only `ci-macos-compat.yml` (no Blacksmith image). GitHub retired
+`macos-14`, so no job may name it.
 The `MACOS_RUNNER_BACKGROUND` fallback (`vars.MACOS_RUNNER_BACKGROUND ||
 'blacksmith-6vcpu-macos-15'`) may appear only in a workflow with no pull
 request, merge-queue or `workflow_call` trigger. It also asserts every paid macOS job references
diff --git a/tests/test_ci_self_hosted_guard.sh b/tests/test_ci_self_hosted_guard.sh
index e69a9c426148..e3f3bd6cd410 100755
--- a/tests/test_ci_self_hosted_guard.sh
+++ b/tests/test_ci_self_hosted_guard.sh
@@ -1206,8 +1206,8 @@ check_no_github_hosted_runners() {
     # validate-cla-policy.rb pins these to ubuntu-24.04 until #17453 lands.
     "cla.yml:    runs-on: ubuntu-24.04 # github-hosted-required: write token on fork pull requests"
     "cla-policy-guard.yml:    runs-on: ubuntu-24.04"
-    # Dispatch-only OS-compatibility legs; no Blacksmith image is macOS 14 or Intel.
-    "ci-macos-compat.yml:          - os: macos-14"
+    # Dispatch-only Intel compatibility leg; Blacksmith has no Intel macOS image.
+    # GitHub retired macos-14, so it is no longer an exception (#17068).
     "ci-macos-compat.yml:          - os: macos-15-intel"
   )
   local probe
@@ -1973,10 +1973,9 @@ check_background_macos_lane() {
   # branch and the exact compatibility-leg exceptions below.
   local lane_expr="vars.MACOS_RUNNER_BACKGROUND || 'blacksmith-6vcpu-macos-15'"
   local hosted_mac='(^|[^A-Za-z0-9_-])macos-(latest|[0-9]+)(-(intel|large|xlarge|arm64))?([^A-Za-z0-9_-]|$)'
-  # Pre-existing OS-version compatibility legs that need a specific hosted
-  # image (macOS 14, Intel) that no paid provider offers. Exact lines only.
+  # The Intel compatibility leg needs a hosted image that no paid provider
+  # offers. Exact lines only. macos-14 is retired (#17068).
   local -a hosted_exceptions=(
-    "ci-macos-compat.yml:          - os: macos-14"
     "ci-macos-compat.yml:          - os: macos-15-intel"
   )
   local failed=0 probe