#30085 ci(nightly): admit Linux controls on fleet before paid overflow

Early NEXT nightly controls can queue on Blacksmith before the GCP fleet has had a chance to start. Request an identity-bound controller lease, reserve one unconsumed JIT runner per job, and permit paid overflow only with a matching recorded 180-second no-start. Stale, missing or invalid receipts retain the existing owned fleet routes. No job or workflow is cancelled.

Leo: “FOR OUR NIGHTLIES ARE THEY END TO END ON OUR FLEET? WE CAN'T BE RELYING ON BLACKSMITH THAT CUTS OUT”.

This routes four controls: the TUI resolver, helper resolver, input bundler and recovery finder. The credentialed Mac-build picker remains on its existing owned-mini placement; its routing App key never enters the secret-free GCP pool. Promotion is a separate owned-Mac change. Signer routing and compilation are unchanged by this PR; #30081 owns that route. Input-bundle notices bootstrap Rust with the already-used pinned setup action.

Only the NEXT track uses the new selectors; other nightly tracks retain their prior routes. The controller binds receipts to repository, run, attempt, source and job keys. The client accepts HTTPS with normal certificate validation or the existing encrypted Tailscale connection to a numeric online peer, with redirects and environment proxies disabled. Future-dated receipts and inconsistent no-start durations are refused. A fleet decision committed before expiry remains valid through delayed response delivery; readiness first observed after expiry cannot win. Each unique runner label belongs to one lease/job, so an unrelated queued job cannot consume it. The controller retains downstream listeners while their parent dependency runs and reclaims them after the exact job/run finishes. The client long-polls within a 200-second deadline with 35-second HTTP bounds; optional mini-capacity reads have a 30-second alarm, cleared and restored in finally. Durable receipts are uploaded as an Actions artifact.

Prior art: #29864 supplies portable placement; #29981 exposes GCP demand but does not provide a nightly-safe no-start handoff. Existing signer artifact caches and warm-source declarations remain; no Swift build or shared compile-cache change. The service prerequisite is HQ#5785, merged at c5353e24bf092f769eafbf49a9bb621515e159d9 after exact-head review at 4503b288 and fleet controller compilation/tests.

Observed / Not run

At 9e3ed62448f762a242aa41e695651c495f66f9a5, all 156 focused Python tests pass: admission and transport (25), portable placement (28), nightly trusted routes (29), nightly pooled routes (16), routing table (26), step coverage (5), fork routing (23), Linux runner-size policy (4). The test registry validates the new test's automatic PR execution. New workflow-selector regressions failed 48 assertions before wiring the caller. Review regressions reproduced future-dated/public-HTTP receipt acceptance and non-NEXT routing (six failed assertions), then passed after repair.

Two existing tests still fail on the base: nightly.yml exceeds the 490,000-byte margin (493,159 bytes on base), and the variable report omits CI_CONTROL_RUNNER. These exact named failures were reproduced on base. The self-hosted shell guard also reports eight unchanged offending selectors: each is present byte-for-byte on the base. The new output-name false positive from review is removed. HQ #5798 supplies the receipt-authority correction, and #5804 adds the GitHub CLI prerequisite. Both are deployed in controller version 80ada0f87e20. The final reviewed head 8ed7063314cc4a10f6ddb99d6f2236e1062f944d passes 134 relevant policy tests after merging the current base. End-to-end nightly admission evidence is pending; no runtime speedup is claimed yet.

Performance

Metric	Before	After	Delta	Harness or source
Resolver/signer/recovery waiting on Blacksmith	Still queued after 6m21s	Not measured	Pending deployment	Run 41265156038, controller job snapshot at 02:36:57Z
Blacksmith minutes/day	Not measured	Not measured	Not claimed	Same job timing telemetry after deployment

Changelog

none

Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes early NEXT nightly controls onto reserved fleet Linux runners before paid overflow, so builds no longer queue on Blacksmith waiting for the GCP fleet to start. Controls request an identity-bound lease from the fleet controller, which reserves an unconsumed JIT runner per job; paid overflow requires a matching recorded 180-second no-start receipt. Missing, stale, or invalid receipts keep the existing owned-fleet routes, and no job or workflow is cancelled.

Fleet admission

• Receipts bind to repository, run, attempt, source, and job keys; future-dated receipts and inconsistent no-start durations are refused.
• Transport requires HTTPS with normal certificate validation or an existing encrypted Tailscale peer; redirects and environment proxies are disabled.
• A committed fleet decision survives delayed response delivery; a runner first observed after expiry cannot win.
• Each unique runner label belongs to one lease/job, and the controller reclaims listeners once the exact job finishes.

Scope

• Only the NEXT track uses the new selectors; the credentialed Mac-build picker keeps its owned-mini placement, and the signer stays on its dedicated lane.
• The signer bootstraps Rust with the pinned setup action before generating third-party notices.
• The client long-polls within a 200-second deadline; all 156 focused Python tests pass on the base.
• Held until the receipt-authority correction HQ#5798 is reviewed, merged, and deployed before activation.