From 7770fa00574048c8cde21d4c3f28d0b49e2236f7 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 08:31:54 +0900
Subject: [PATCH 1/2] test(actions): specify minimal hosted-runner admission
 canary

---
 ...hosted_runner_admission_canary_contract.py | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 tests/test_hosted_runner_admission_canary_contract.py

diff --git a/tests/test_hosted_runner_admission_canary_contract.py b/tests/test_hosted_runner_admission_canary_contract.py
new file mode 100644
index 0000000000..952e6110cd
--- /dev/null
+++ b/tests/test_hosted_runner_admission_canary_contract.py
@@ -0,0 +1,46 @@
+"""Contract tests for the bounded GitHub-hosted runner admission canary."""
+
+from __future__ import annotations
+
+from pathlib import Path
+import unittest
+
+
+CANARY = Path(".github/workflows/hosted-runner-admission-canary.yml")
+
+
+class HostedRunnerAdmissionCanaryContract(unittest.TestCase):
+    """Keep the canary minimal so queue evidence isolates runner admission."""
+
+    def setUp(self) -> None:
+        """Load the workflow whose shape is the diagnostic contract."""
+        self.workflow = CANARY.read_text(encoding="utf-8")
+
+    def test_trigger_is_bounded_to_canary_changes(self) -> None:
+        """Run only when this temporary diagnostic or its contract changes."""
+        self.assertIn("pull_request:", self.workflow)
+        self.assertIn(".github/workflows/hosted-runner-admission-canary.yml", self.workflow)
+        self.assertIn("tests/test_hosted_runner_admission_canary_contract.py", self.workflow)
+        self.assertNotIn("schedule:", self.workflow)
+        self.assertNotIn("workflow_dispatch:", self.workflow)
+
+    def test_job_requests_only_the_floating_hosted_image(self) -> None:
+        """Exclude checkout, dependencies, environments, matrices, and credentials."""
+        self.assertEqual(self.workflow.count("runs-on: ubuntu-latest"), 1)
+        self.assertIn("permissions: {}", self.workflow)
+        for forbidden in ("uses:", "needs:", "environment:", "matrix:", "env:"):
+            self.assertNotIn(forbidden, self.workflow)
+        self.assertEqual(self.workflow.count("\n      - name:"), 1)
+        self.assertIn('run: "true"', self.workflow)
+
+    def test_concurrency_identity_is_unique_per_run(self) -> None:
+        """Prevent the canary from cancelling or serializing another canary."""
+        self.assertIn(
+            "group: hosted-runner-admission-canary-${{ github.run_id }}",
+            self.workflow,
+        )
+        self.assertIn("cancel-in-progress: false", self.workflow)
+
+
+if __name__ == "__main__":
+    unittest.main()

From dd2c20bccefa604f972caf61900a26f942cc80a0 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 08:32:08 +0900
Subject: [PATCH 2/2] fix(actions): add bounded hosted-runner admission canary

---
 .../hosted-runner-admission-canary.yml        | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .github/workflows/hosted-runner-admission-canary.yml

diff --git a/.github/workflows/hosted-runner-admission-canary.yml b/.github/workflows/hosted-runner-admission-canary.yml
new file mode 100644
index 0000000000..40e663cc86
--- /dev/null
+++ b/.github/workflows/hosted-runner-admission-canary.yml
@@ -0,0 +1,23 @@
+name: Hosted Runner Admission Canary
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - .github/workflows/hosted-runner-admission-canary.yml
+      - tests/test_hosted_runner_admission_canary_contract.py
+
+concurrency:
+  group: hosted-runner-admission-canary-${{ github.run_id }}
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  admission:
+    name: Acquire a GitHub-hosted runner
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Record runner admission
+        run: "true"