Share the external Runner lifecycle and add strict Muse contracts (#16444)

Add the external Runner foundation with distinct Dot/Grok V6, canonical home-mode V7 and Muse V8 contracts.

Keep generated schemas and profiles synchronized. Bound default question-answer command IDs in a disjoint namespace while preserving existing IDs and durable replay. Preserve canonical migration history and add normally generated, replay-safe Muse schema milestones with literal preview-history fixtures.

Refs #16444.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip authored and GitHub committed 2026-10-16 13:46:50 -05:00
1 parent 4de6335c3b
commit 2cc7992369
95 files changed
+12594 -1600

No files matched your search

@@ -275,11 +275,18 @@ function assertNoPrWorkflowCredentials(source) {
test("PR credential guard permits filenames but rejects secret expressions", () => {
assertNoPrWorkflowCredentials("run: node --test scripts/docker-compose-secrets.test.mjs");
assertNoPrWorkflowCredentials("if: ${{ always() }}\nrun: node --test scripts/docker-compose-secrets.test.mjs");
assertNoPrWorkflowCredentials("if: ${{ startsWith(github.ref, 'ref') }}\nrun: 'node --test scripts/docker-compose-secrets.test.mjs'");
for (const source of ["env: ${{ secrets.EXAMPLE }}", "env: ${{ secrets['EXAMPLE'] }}", "env: ${{ toJSON(secrets) }}", "env: ${{ format('}}', secrets.EXAMPLE) }}",
"# Expressions start with '${{'.\nTOKEN: ${{ secrets.PR_TOKEN }}",
"name: Example # Expressions start with '${{'.\nTOKEN: ${{ secrets.PR_TOKEN }}"]) {
assert.throws(() => assertNoPrWorkflowCredentials(source));
}
for (const source of [
"${{secrets.EXAMPLE_TOKEN}}", '${{ secrets["EXAMPLE_TOKEN"] }}',
"${{ failure() && secrets.EXAMPLE_TOKEN }}", "${{\n secrets.EXAMPLE_TOKEN\n}}",
"${{ format('{0}', secrets.EXAMPLE_TOKEN) }}", "HONEYCOMB_CI_API_KEY",
]) assert.throws(() => assertNoPrWorkflowCredentials(source));
assert.throws(() => assertNoPrWorkflowCredentials("HONEYCOMB_API_KEY: example"));
assert.throws(() => assertNoPrWorkflowCredentials("${{ format('secrets.EXAMPLE', 'literal') }}"));
});