jobtrackingapp/docs/redesign/phase-9/p9-requal-01/CI_OPERATOR_HANDOFF.md

Hosted MariaDB lane: operator handoff

Status: BLOCKED. The workflow intentionally exits at its first step before checkout, SDK setup, repository scripts and workflow Docker/Compose/database execution. Run 847 at 75cd04cfc2da0837b556bdcf1424846349c4c73d verifies the explicit BLOCKED/exit1 outcome. No repository-variable toggle can enable it. The existing runner already injects a host Docker socket and host networking; this task has not changed or used those facilities. Runner-owned job-container creation and action prefetch still occur before the first step.

The infrastructure owner must supply sanitized evidence for the following before a reviewed workflow change can enable native services:

1. Identify actual runner 5 Live-Runner and its host/daemon ownership. Show its registration scope, labels, binary version/build identity, and relation to offline repository runner 3. Prove it is dedicated non-production CI infrastructure, with no production containers, volumes, networks, mounts or credentials reachable by jobs. A name or ubuntu-latest label is insufficient.
2. Provide only the relevant effective runner container network, Docker-host-mount, privilege, allowed-volume and option fields, with credentials redacted. Prove job/service containers use a fresh per-job private network, no Docker socket/daemon endpoint exposed to jobs/services, no privileged mode, no host networking and no published MariaDB ports. Source examples and custom pre-merge HostConfig are insufficient; capture merged runtime configuration. No host configuration or credential changes are authorized by this handoff.
3. On infrastructure the owner has established as isolated, prove service readiness and DNS reachability from the job, no cross-job database reachability, and disposable service storage. Use the pinned 12.2.2 linux/amd64 image digest already recorded in the repository, generated test schemas and synthetic data only.
4. Prove removal of service containers, private networks and test data after success, test failure, cancellation and interrupted-runner recovery. Retain before/after resource inventories scoped to that generated job. Cleanup source code and an AutoRemove:true flag alone are insufficient.
5. Supply a dedicated routing label (for example jobtracker-mariadb-isolated) and sanitized identity/configuration evidence for every eligible runner. The repository owner then reviews the workflow and fixture/runner transport changes together. Native services: starts before steps; isolation must be established before adding it. Preserve default loopback protection and the pinned image/version requirement.

Only after those evidence checks: replace the unconditional blocker and Compose path with the approved private service transport, retain fail-closed readiness and cleanup checks, and execute a fresh hosted lane. It must produce all 32 MariaDB integration results, zero skips, process exit codes, source SHA, server version/image identity and lifecycle evidence. Do not call an expected BLOCKED workflow run, five guard tests, a label match or a green unrelated main workflow a successful MariaDB qualification.

The API credential currently reports repository administration but receives 403 for instance runners. The owner can provide the narrowly scoped operator evidence without exporting credentials or full configuration. The next action is operator evidence collection, followed by review; no production deployment, socket/privilege grant, DinD, public port or live infrastructure mutation is part of this task.