# AWP I0 Actions Runner Controller substrate

AWP uses GitHub Actions for CI execution and ARC only for ephemeral runner infrastructure.

## Files

- `runner-namespaces.yaml` — separates ARC control, untrusted, trusted-internal and exceptional privileged-build trust tiers.
- `controller-values.yaml` — non-root controller baseline.
- `scale-set-untrusted-values.yaml` — default untrusted/general runner scale set, `minRunners: 0`, gVisor, no Kubernetes service-account token, unprivileged container.
- `scale-set-trusted-values.yaml` — internal trusted jobs, still non-root/gVisor/no service-account token.
- `scale-set-privileged-build-values.yaml` — explicit exceptional Docker-in-Docker build pool; never the default and never for fork/untrusted work.

The GitHub authentication object is a **secret reference** (`awp-arc-github-app`), not credential material in Git. The secret belongs in the scale-set namespace and is consumed by ARC control/listener mechanics. Runner Pods must not receive a reusable Git publication credential.

## Install model

ARC publishes the supported OCI charts `gha-runner-scale-set-controller` and `gha-runner-scale-set`. Pin the chart version selected by environment preflight rather than using an unqualified latest chart in production.

Example shape (version intentionally supplied by the operator/preflight):

```bash
helm upgrade --install awp-arc-controller \
  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller \
  --version "$ARC_CHART_VERSION" \
  --namespace awp-arc-system --create-namespace \
  -f infra/arc/controller-values.yaml

helm upgrade --install awp-untrusted \
  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set \
  --version "$ARC_CHART_VERSION" \
  --namespace awp-runners-untrusted \
  -f infra/arc/scale-set-untrusted-values.yaml
```

Install trusted and privileged pools into their corresponding namespaces with their own values files only when policy requires them.

## Routing and fork policy

Project workflows target the scale-set name with `runs-on`. Default/fork-capable jobs route only to `awp-untrusted`. Workflows that use protected secrets must explicitly reject fork/untrusted event contexts before selecting a trusted pool. The privileged pool is reserved for demonstrated build mechanics that cannot run under gVisor/unprivileged execution.

A runner scale set is not an AWP CI identity. `@awp/provider-ci-github` correlates GitHub workflow/check IDs to AWP operations/candidate revisions.

## Live proof gate

A green I0 ARC proof requires all of the following on the intended K3s cluster:

1. controller and one scale set installed with supported GitHub authentication;
2. a real repository workflow scheduled to the scale-set name;
3. ephemeral runner pod observed for the job and removed after completion;
4. runner pod inspection shows no reusable publication credential and no unexpected service-account token;
5. default runner is unprivileged and, for the untrusted profile, uses gVisor;
6. GitHub workflow/run result reconciles through the CI adapter.

Manifest rendering/static tests do not replace this live proof.