From 43caf0cf75afe43d7c9e013a70e7805812f402eb Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Mon, 10 Aug 2026 20:16:04 +0500
Subject: [PATCH] docs(memory): record the CI runner contract

CI-01-ACTIONS said only that CI memories record which checks prove integrity. It now carries the constraint the workflows actually depend on: every ci-workflows caller that accepts a runner passes ubuntu-latest explicitly, because the reusable's default belongs to the pinned commit and current main defaults 39 of 46 reusables to the estate self-hosted label. Also records the pin-bump review step and that the library enforces this for its own calls but not for external consumers.

Signed-off-by: rldyourmnd <danil@nddev.it.com>
---
 .serena/memories/CI-01-ACTIONS.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.serena/memories/CI-01-ACTIONS.md b/.serena/memories/CI-01-ACTIONS.md
index a5fdd773..a3918f06 100644
--- a/.serena/memories/CI-01-ACTIONS.md
+++ b/.serena/memories/CI-01-ACTIONS.md
@@ -1,6 +1,6 @@
 <!-- Memory Metadata
-Last updated: 2026-05-22
-Last verified: 2026-05-22
+Last updated: 2026-08-10
+Last verified: 2026-08-10
 Last commit: d93a558050d54a80e578035d0e1627385ec7c1e4 test(runtime): stabilize opencode debug resolve smoke
 Scope: GitHub Actions and local CI policy
 Area: CI
@@ -16,14 +16,17 @@ GitHub Actions and local CI policy
 - `path:README.md`
 
 ## Last verified
-- date: 2026-05-22
+- date: 2026-08-10
 - commit: `d93a558050d54a80e578035d0e1627385ec7c1e4`
 - checked by: Codex ry-start memory taxonomy sync
 
 ## Facts
+- Every caller of a `ci-workflows` reusable that exposes a `runner` input passes `runner: ubuntu-latest` explicitly. This repository is public, so `pull_request` executes untrusted fork code; the reusable's `runner` default is a property of the **pinned commit**, and on current ci-workflows main 39 of 46 reusables default it to the estate's self-hosted `amsterdam` label. At the pin in use the default is still `ubuntu-latest`, so the explicit value is currently a no-op and becomes load-bearing at the next pin bump. On any pin bump, diff `inputs.runner.default` between the old and new commit.
+- `ci-workflows` enforces the same rule for its own self-calls and its published examples, but nothing extends it to external consumers, so the constraint lives in this repository's `AGENTS.md` and `.claude/CLAUDE.md`.
 - CI memories record which checks prove repository integrity and which checks are intentionally lightweight.
 
 ## Evidence
+- `commit:11d5587` explicit hosted runner in ci-workflows callers
 - `commit:d93a558050d54a80e578035d0e1627385ec7c1e4`
 - `path:.github/workflows`
 - `path:README.md`