ci: live-admit and rescue nightly-next controls

TE
5d ago
+544-0

The NEXT tick and feed-watch controls now admit through a reviewed, live runner read and have a bounded no-start rescue. A control run accepts a declared fleet label only after GitHub proves that exact runner is registered, online, and idle; if the first attempt never starts, the adapter cancels and requests one full retry so admission runs again. Other rescue events continue through the default branch's existing rescue script.

The shared runner reader includes the explicitly approved cmux-fleet-linux organization group alongside glaeda-minis, and fails closed when an advertised group cannot be read. The adapter is fetched by the main workflow and has no secrets, permission, trust, or runner registration changes.

Validation:

  • python3 -m unittest -v tests/test_nightly_next_control_rescue.py tests/test_nightly_next_control_runner.py (16 passed)
  • python3 -m unittest -v tests/test_ci_pr_runner_pool.py (258 passed on the feat-cmux-next base)
  • python3 -m py_compile scripts/ci/pr_runner_pool.py scripts/ci/nightly_next_control_runner.py scripts/ci/nightly_next_control_rescue.py
  • git diff --check

Integration contract: helper-only prerequisite for cmux #30509. The main workflow sets CI_CONTROL_CANDIDATE explicitly, fetches the merged helper commit bd5924c58a6e1bc666ead879d6c0b0089347a9d4 read-only, invokes nightly_next_control_runner.py for admit, and invokes nightly_next_control_rescue.py with MAIN_RESCUE_SCRIPT pointing at main's unchanged rescue for workflow_run events. This branch intentionally does not edit workflow activation or permissions.

Agent session: agent session

Summary by cubic

The NEXT tick and feed-watch control jobs now admit runners through a live GitHub read instead of trusting repository variables, and a bounded rescue retries a control run once when its first attempt never starts.

  • A declared fleet label is accepted only after GitHub proves that exact runner is registered, online, and idle; if no proof arrives within three minutes, attempt one falls back to hosted Ubuntu and later attempts use the measured blacksmith overflow.
  • The rescue cancels the first attempt and requests a full rerun only when no control job starts; cancelled queued jobs with a zero runner id remain eligible for rescue.
  • Runner reads and snapshot reads use separate tokens, and an explicit CI_CONTROL_CANDIDATE overrides inherited side-lane runner variables.
  • The shared runner reader now includes the explicitly approved cmux-fleet-linux org group alongside glaeda-minis and fails closed when an approved group cannot be read.
  • The adapter is fetched by the main workflow and makes no secrets, permission, trust, or runner registration changes.