[snapetech]

What changed

Trusted, same-repository owner PR validation uses private JIT as the standard route. A main-pinned, metadata-only dispatcher sends the exact PR number and head SHA to a separate validation run. The broker must independently verify the open PR, owner, repository origin, base branch, workflow, and job labels.

Only no-secret validation jobs use this route. Public-fork PR code must use a separate disposable VM-backed JIT sandbox with no secrets, minimal read permissions, and restricted egress. Publishers and secret-bearing release jobs remain on private JIT and run only for trusted release events. The checks use exact PR-head SHAs and do not persist checkout credentials.

Missing routes or capacity are rollout blockers, not a reason to use hosted runners.

Rollout

This PR is open and the change is not active on main. Its owner-only validation job is skipped while the dispatcher exists only in this branch; it must run from main to keep the trust boundary. Preserve active JIT jobs and check the current broker queue before any deployment or dispatch.

[snapetech]

Policy update: all 65 snapetech-org repositories are in scope. Every build, test, and security job must use a verified private JIT runner; do not use GitHub-hosted execution, legs, or fallback. Use platform-matched Linux, Windows, macOS, and ARM capacity. Keep Windows release jobs on the restored private Windows route named packer; never send them to Linux. Keep fork and untrusted code isolated from privileged runners, and retain all build, test, scanner, security, and publish checks. If a private route is unavailable, leave that job queued or blocked and report the repository, workflow, platform, and capacity gap. Coordinate allowlist and shared runner/broker changes with the policy owner. Preserve active releases and honor C0/current-slot-owner handoff before starting any job.