[snapetech]

Linux build and release jobs can use GitHub-hosted Ubuntu or the shared run-scoped JIT pool, including verified release-tag runs. Existing platform constraints and unsupported package-publishing routes are preserved.

The draft now also adds a narrow billing fallback for trusted same-repository owner PR validation: a main-pinned, metadata-only dispatcher passes the exact PR SHA to a separate no-secret JIT validation run. Forks, publishers, and secret-bearing jobs do not use this route.

The owner-only validation job is skipped while its dispatcher exists only in this draft; it must run from main to keep the trust boundary. The route depends on the Packer broker authorization update, runner-group workflow scope reconciliation, and guest drain before deployment. This draft is not active on main, and no billing-blocked live canary has run.

Validation: changed workflow YAML parsed; 5,960 runner-selection cases passed across the nine applications, covering hosted-first, forced JIT, retry, main/tag refs, PR isolation, and platform isolation. Shared policy suite: 132 passed, with ten existing socket tests still required on a capable host.

Host deployment and live hosted/JIT artifact canaries remain pending. Existing tags retain their original workflow source on rerun.

release-note: none

[snapetech]

Policy update: all 65 snapetech-org repositories are in scope. Every build, test, and security job must use a verified private JIT runner; do not use GitHub-hosted execution, legs, or fallback. Use platform-matched Linux, Windows, macOS, and ARM capacity. Keep Windows release jobs on the restored private Windows route named packer; never send them to Linux. Keep fork and untrusted code isolated from privileged runners, and retain all build, test, scanner, security, and publish checks. If a private route is unavailable, leave that job queued or blocked and report the repository, workflow, platform, and capacity gap. Coordinate allowlist and shared runner/broker changes with the policy owner. Preserve active releases and honor C0/current-slot-owner handoff before starting any job.

[snapetech]

This hybrid route needs an update before it can merge. The release requirement is private JIT runners only across all 65 snapetech-org repositories; hosted minutes are exhausted. This PR still contains ubuntu-latest fallbacks and currently has merge conflicts. Please remove every hosted fallback, route jobs only to compatible private JIT capacity (leave unsupported platforms queued until that capacity exists), resolve the conflicts, and validate the exact PR head on JIT. The rollout inventory and cutover rules are tracked in Packer’s organization-wide JIT plan.