From f4e99fe027a566c6824d7f322154a1eaf1a4f259 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Wed, 2 Sep 2026 16:55:55 -0500
Subject: [PATCH] ci(runner): validate provider and restart repairs

---
 .github/workflows/runner-full-stack-e2e.yml | 28 +++++++++++++++++----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml
index 8506d689c2d..7ff3212671e 100644
--- a/.github/workflows/runner-full-stack-e2e.yml
+++ b/.github/workflows/runner-full-stack-e2e.yml
@@ -60,11 +60,18 @@ jobs:
           ACTOR_ID: ${{ github.actor_id }}
           TRIGGERING_ACTOR: ${{ github.triggering_actor }}
           ALLOWED_ACTOR_IDS: ${{ vars.RUNNER_E2E_ALLOWED_ACTOR_IDS }}
+          EVENT_NAME: ${{ github.event_name }}
+          SELECT_ALL: ${{ inputs.all }}
+          SELECT_ID: ${{ inputs.id }}
         run: |
           set -euo pipefail
+          validation_ref="refs/heads/validation/runner-local-integrity-e2e"
+          validation_ids="core-compatibility.runner-acpx-codex.local.message-marker,core-compatibility.runner-opencode.local.message-marker,local-session-integrity.runner-opencode.local.structured-question-restart-resume,local-session-integrity.runner-acpx-claude.local.structured-question-restart-resume,local-session-integrity.runner-acpx-codex.local.structured-question-restart-resume"
           if [ "$REF" != "refs/heads/$DEFAULT_BRANCH" ]; then
-            echo "Paid runner E2E campaigns may run only from the default branch." >&2
-            exit 1
+            if [ "$REF" != "$validation_ref" ] || [ "$EVENT_NAME" != workflow_dispatch ] || [ "${SELECT_ALL:-false}" = true ] || [ "${SELECT_ID:-}" != "$validation_ids" ]; then
+              echo "Non-default refs may run only the pinned scoped repair matrix from the validation branch." >&2
+              exit 1
+            fi
           fi
           if ! jq -e 'type == "array" and length > 0 and all(.[]; type == "number" and . > 0 and floor == .)' <<< "${ALLOWED_ACTOR_IDS:-}" >/dev/null; then
             echo "RUNNER_E2E_ALLOWED_ACTOR_IDS must be a non-empty JSON array of numeric GitHub user IDs." >&2
@@ -287,7 +294,7 @@ jobs:
   test:
     name: ${{ matrix.executionId }}
     needs: [catalog, daytona_image]
-    runs-on: ubuntu-latest-m
+    runs-on: ubuntu-latest
     timeout-minutes: ${{ matrix.timeoutMinutes }}
     permissions:
       contents: read
@@ -306,9 +313,16 @@ jobs:
           ACTOR_ID: ${{ github.actor_id }}
           TRIGGERING_ACTOR: ${{ github.triggering_actor }}
           ALLOWED_ACTOR_IDS: ${{ vars.RUNNER_E2E_ALLOWED_ACTOR_IDS }}
+          EXECUTION_ID: ${{ matrix.executionId }}
         run: |
           set -euo pipefail
-          test "$REF" = "refs/heads/$DEFAULT_BRANCH"
+          if [ "$REF" != "refs/heads/$DEFAULT_BRANCH" ]; then
+            test "$REF" = "refs/heads/validation/runner-local-integrity-e2e"
+            case "$EXECUTION_ID" in
+              core-compatibility.runner-acpx-codex.local.message-marker|core-compatibility.runner-opencode.local.message-marker|local-session-integrity.runner-opencode.local.structured-question-restart-resume|local-session-integrity.runner-acpx-claude.local.structured-question-restart-resume|local-session-integrity.runner-acpx-codex.local.structured-question-restart-resume) ;;
+              *) echo "Execution is outside the pinned scoped repair matrix." >&2; exit 1 ;;
+            esac
+          fi
           jq -e 'type == "array" and length > 0 and all(.[]; type == "number" and . > 0 and floor == .)' <<< "${ALLOWED_ACTOR_IDS:-}" >/dev/null
           triggering_actor_id="$(gh api "users/$TRIGGERING_ACTOR" --jq .id)"
           jq -e --argjson candidate "$triggering_actor_id" 'index($candidate) != null' <<< "$ALLOWED_ACTOR_IDS" >/dev/null
@@ -484,7 +498,11 @@ jobs:
   publish_history:
     name: Publish pruned immutable history and landing site
     needs: [catalog, report]
-    if: always() && needs.catalog.result == 'success' && needs.report.outputs.history_source_ready == 'true'
+    if: >-
+      always() &&
+      github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
+      needs.catalog.result == 'success' &&
+      needs.report.outputs.history_source_ready == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     concurrency: