#30076 ci: admit nightly promotion on the owned fleet before paid overflow

HOLD: Activation remains disabled until (1) Glaeda #1787 (merged 58b40ae0, fixing #1782 with the locked-unassigned proof; 35 tests; hook digest unchanged at 524d682ff9f47140f61649264cba73694330af56ff2681b4749f95505083c6f4) is deployed; (2) the promotion-admit containing #1787 and hook 524d682ff9f47140f61649264cba73694330af56ff2681b4749f95505083c6f4 are both deployed on minis behind the barrier; and (3) Glaeda #1788 (recover ignores the assigned marker after supervisor death) is fixed and deployed. Glaeda #1789 is a P2 follow-up and does not block activation.

Leo: "FOR OUR NIGHTLIES ARE THEY END TO END ON OUR FLEET? WE CAN'T BE RELYING ON BLACKSMITH THAT CUTS OUT".

Promotion currently starts directly on Blacksmith. Add a portable bootstrap on the shared owned nightly pool, request a durable exclusive owned-Mac admission, and consume only its terminal runner decision. Paid overflow requires a recorded 180-second no-start. A controller error cannot select Blacksmith. The promotion retains its existing protected environment and verifies its exclusive claim before any release App credential is read. A policy regression test forbids an inline Blacksmith-first escape.

This depends on the separately deployed controller/provisioner and Glaeda lifecycle helper; it does not claim a live fleet admission yet. The existing controller variable is reused. No compile is performed; the installed runner is reused and compiler caches are not involved. No cancellation behavior, release guard, publish path or release credentials change.

Validation at 4d9f1a9636ec1546f1e515b156b700ecd9d90ad3: 13 admission/transport tests, 24 fork-routing tests, 6 runner-set tests, 96 existing promotion cases, 12 warm-source tests, 9 runs-on-variable tests, 9 owned-pool-source tests, self-hosted runner guards, workflow guard wiring, and test execution registration pass. The earlier fast-check run was cancelled and provides no verdict. Rebased on current main, preserving its quota-isolated read token with the exclusive claim check before either App secret. Independent Astra review: SHIP at this head (receipt). Deployment proof remains pending under the activation HOLD.

Performance:

Metric	Before	After	Delta	Evidence
Promotion Blacksmith minutes/day	Not separately measured; every promotion uses Blacksmith 2	0 for admitted owned-Mac promotions; paid runtime only for bounded overflow	Depends on live admissions	No measured reduction claimed before deployment

Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes nightly promotion through an admitted owned Mac first, with Blacksmith paid overflow only when the controller records a durable 180-second no-start receipt dated in the past. A picker job requests the exclusive owned-Mac admission and forwards its terminal runner decision to the promote job, which authenticates the controller over HTTPS or an online Tailscale peer, never following redirects, environment proxies, or oversized responses. A controller error never falls back to Blacksmith. The promote job verifies its exclusive claim before and after the promotion decision, before any release App credential is read, and a policy test forbids an inline Blacksmith-first escape.

Migration

• Requires the separately deployed controller/provisioner and Glaeda lifecycle helper to be live; the existing CMUX_FLEET_CONTROLLER variable is reused.

Summary by CodeRabbit

• Chores
  • Nightly promotions now use a runner selected for each request, with admission checks before and after the promotion decision.
  • Runner selection validates promotion requests and lease status, and allows a fallback runner when the preferred runner has not started within 180 seconds.
  • Promotion requests use validated connections, reject redirects, and enforce response-size limits.
  • Signing-runner claims are checked before promotion and rechecked after eligible promotion decisions.
• Documentation
  • Updated the runner-pool guide with the promotion pool and its fallback behavior.