feat(ci): reuse trusted shared runner state across picker steps
CI picker steps repeatedly listed the same runner registrations until the routing App exhausted its 5000/h REST budget. Read a shared runner-state/v1 document from trusted repository workflow context first, so a fresh complete document avoids the live runner-list requests across cmux-next, cmux-tui, guards, nightly and the other shared picker entrypoints.
pr_runner_pool.GitHub.runners() validates the existing repository/group scope, field types including the OS used by platform-sensitive pickers, complete roster, unique IDs and a five-minute timestamp with up to five seconds of clock skew. Documents missing OS fall back to live runner data. Missing, malformed, partial, future beyond the clock-skew allowance, stale or oversized state retains the existing live API path. The separate macOS cascade uses complete shared scale-set counts when present and otherwise retains its group reads. Workflow edits pass vars.CI_RUNNER_STATE only to picker steps; runner selectors and token permissions are unchanged.
Publisher: https://github.com/manaflow-ai/cmuxterm-hq/pull/6163. Design: https://github.com/manaflow-ai/cmux/issues/31420#issuecomment-6569359191. Prior art read: #31824, #31272, #31284 and #31307. Request: “have the pickers read that document first and call GET /actions/runners only when the document is missing or stale.” Invalid or incomplete documents also fall back.
Performance
| metric | before | after | delta | harness or run link |
|---|---|---|---|---|
| routing-App runner-list requests/h at 1000 picker invocations/h with a complete fresh document | 4000 | 0 from picker listings | -4000/h (-100% for these listings) | same request-count harness over baseline 9ce095b907c689c2733d136882530877552ed2a0 and this head; 1000 actual GitHub.runners() invocations, two approved groups |
| complete scale-set cascade reads per invocation | 3 | 0 | -3 | SharedRunnerStateCascadeTests; partial counts retain all 3 live reads |
| shared publisher overhead on the separate repair-owner org-admin budget | 0 | up to 360 broker operations/h; 120/h for one-group fixture | +120 to +360/h | HQ publisher has ten-read plus update/create cap, two-minute refresh; existing runner-heal org-admin gh; no routing-App publisher overhead |
| total live installation demand | ~11000/h before rollout | pending full reset-to-reset verification | not yet measured | github_spend remaining lines; no claim that the total is already below 5000/h |
Validation: shared-reader regressions and cascade tests pass, including actual fast-checks, nightly-control and portable selectors reading Linux OS from the document. The cross-repository old-publisher/old-consumer harness reproduces empty fleet selections at the blocked heads and selects the fleet with OS preserved. The accepted-document behavioral regression fails on the source baseline with an actual unwanted live read, then passes with this reader. All 254 shared runner-pool tests, 136 cascade tests, 36 portable placement tests and the nightly sign-picker tests pass; cross-repository publisher encoder -> actual consumer validator round trip passes. Final-head pre-push gate reports no new violations.
The broad static verifier also reports localization debt and a workspace grouping mismatch in files unchanged from the source baseline. These are unrelated warnings; this diff changes workflow context, Python picker reads and their tests only. No app compile is needed for this change.
The existing trusted publisher must activate after its HQ change lands. Until then this reader uses the live API fallback. A delayed job with an old workflow context also uses that fallback. The rollout still requires one entire quota reset-to-reset window with no remaining=0 observation; synthetic counts do not establish that result.
Agent session: agent session