[infraclaw-dash]

Purpose

Companion to dashpay/platform#4702. Platform owns its desired locked runner requirements; a changed manifest builds a candidate before merge so actual PR jobs can run on it. After merge, promotion copies the same tested digest rather than rebuilding.

Trusted Platform bootstrap caller: dashpay/platform#4912

Implementation

• Parameterized, validated schema-2 lock, Dockerfile template and installed lock/recipe compatibility verifier. Platform's manifest pins the full recipe SHA and all dependency inputs; the standalone image lock is only a build fixture.
• Separate request, uncredentialed build, credentialed publisher and post-merge promotion jobs. The publisher never executes PR recipe, image or application code. OCI archive transfer preserves the exact digest, provenance and SBOM.
• PR/head/manifest-bound image tags and PR/head/digest/kind-bound runner labels. Status records are scoped per PR, including when two PRs share a head commit.
• Promotion requires the merged/current branch manifest, trusted successful publisher and latest real Rust plus Kotlin jobs on that exact digest. Skips, stale heads, different digests, older green runs and superseded requirements cannot advance a channel.
• Branch-specific platform-<base-branch> channels; main advances only for Platform's actual GitHub default branch. No automatic production-container restart.
• Operator-side JIT launcher with a dedicated GitHub App, Platform-only runner group, bounded pool/resources/lifetime/retries and owned-registration cleanup. Default mode is dry-run.
• One-job runners use uid/gid 1001, fresh work/registration volumes, all capabilities dropped, no-new-privileges and default policies. Only Kotlin receives /dev/kvm; jobs never receive the App key/token, host Docker socket/workspace or Docker Hub credentials.
• Existing trusted-fork rules remain; an exact-head controller approval does not override Platform's workflow guard.

Validation

• 20 focused image/contract/lifecycle tests pass; 7 Platform selector tests pass in the consumer PR.
• Python/Bash syntax, actionlint, strict manifest validation and git diff --check pass.
• The parameterized foundation passed a full clean image build, compiler/confinement checks, KVM VM creation and real Android boot.
• Current exact-head CI repeats those tests, then exports the full OCI archive and verifies digest/attestation-preserving transport on a separate VM, without registry credentials. Passed, including the full OCI transfer and preserved attestations.
• Full Platform application jobs on a JIT candidate and the privileged publishing/promotion path are not yet live-proved.

Activation order / not deployed

1. Review and land this implementation.
2. Land Platform's small trusted bootstrap caller (#4912) before testing an unmerged requirements PR.
3. Configure the documented dedicated App, candidate-only Platform runner group and reviewed host controller.
4. Run the real consumer PR jobs, then merge #4702 only after candidate evidence and provisioned-pool rollout are satisfied.

See the operational setup guide. No live runner, host controller, organization access scope or OpenClaw container was changed. The example's zero IDs deliberately fail closed. Existing Docker Hub credentials are used only by the trusted publisher.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e276b0a6-b392-4e4a-bad5-218e6c5e2205

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}