Non-Billable Runway CI Contract Gate

Overview

CI should catch client, request-shape, task-state, and storage regressions without generating media on untrusted code. Provider calls belong in a protected, manually approved canary lane with a hard credit ceiling and no fork secrets.

Prerequisites

• A CI system with protected environments and fork-secret isolation
• Pinned SDK lockfile plus redacted API and task fixtures
• A documented owner for the optional live canary budget

Instructions

Step 1: Inventory trust boundaries

Inspect workflow triggers, permissions, secret inheritance, dependency installation, artifact retention, and fork behavior. Mark every event on which Runway credentials must be unavailable.

Step 2: Build the offline gate