[#556] ✨ - feat select reusable runner profiles in setup and reconcile source workflow parity

[efraespada]

Setup can now select an existing self-hosted runner profile for each target repository, with a shared organization profile as a visible default. The review shows each job’s route, access/capacity observations and the complete installation diff in the paired local web view; terminal output lists routes and changed files without logging workflow bodies. Installed routing remains the default.

What changed

• Add bounded COPILOT_RUNNER_PROFILES discovery, explicit hosted/manual/shared choices and independent agent, ordinary validation, hosted credential verification, observer and publication routes in CLI and web, with four-language guidance, localized empty suggestions and control-stripped terminal metadata.
• Ask about optional runner discovery before PAT creation in Customize, organization reuse and batch setup. Generated and replacement PAT links include organization Self-hosted runners: read only when selected; manual routing remains available without it.
• Bind selected profile provenance and detect registry changes or lost target access before Apply. Fix the real provider inventory filter that previously omitted the runner registry during revalidation.
• Compare source and consumer installations using Copilot-specific root invocation evidence, preserve native source workflows and compatible guidance, and retain backups. Add the missing source CLI-provisioning and credential-health workflows; provisioning checks the provider-specific headless command.

Validation

• 673 suites, 10,631 passing tests and 35 pre-existing skips. Local full-suite LCOV changed executable lines: 495/495 covered (100%); LCOV also covers 763/763 modified branch alternatives with no partial lines. All coverage budgets pass. Existing setup acceptance ledger: 336/350 passed, 14 explicitly open.
• Codecov confirms every modified coverable line is covered on 4ab25db0, compared with the current develop base 1718068 (published report).
• Pure runner policies: 100% statements, branches, functions and lines. Discovery, composition, review and presentation meet their individual budgets.
• Build, TypeScript, ESLint, Svelte, specification catalog, agent documentation, documentation/workflow contracts, npm package and packaged CLI/API/local-web smoke checks.
• Add 17 Codecov regression cases covering legacy runner omission, safe merge defaults, runner documentation, disabled batch discovery, plan revision, explicit per-target overrides, terminal logger boundaries, incomplete registry metadata, YAML inventory and retained/replaced snapshots. Remove two unreachable alternatives; Codecov thresholds and exclusions are unchanged.
• Browser review: runner selection, role/readiness cards, full diff and blocked Apply; Spanish optional-PAT explanation; desktop/mobile layout.
• Real GitHub dogfooding with a temporary scoped PAT: both vypdev/copilot and vypdev/platform discover the eligible vypdev group and prepare/revalidate the same organization profile. Both plans require zero shared access grants and zero repository Variable writes. The temporary registry was restricted to these two repositories and removed after matching its value, timestamps and memberships.
• Clean-consumer rendering and existing-source parity pass. The actual trusted workflow execution remains a post-merge verification step; these live checks prepared plans and revalidated access without publishing installer branches.

Review notes

Existing configurations retain routing unless replacement is selected. Profile snapshots contain the selected non-secret route and provenance digest; inventory permission is optional. Unsupported consumer generator metadata blocks regeneration and source-owned assets remain explicit exceptions.

Credential verification stays hosted when replacing managed routes, including when ordinary validation uses the agent runner. Terminal summaries never emit workflow bodies, including unrecognized custom credential values. The explicit local web preview masks recognized credential formats and discloses that arbitrary hardcoded literals can remain visible. The specification DoD matches its 56-case test floor. Provisioning resolves each role's own executable/provider and supports quoted paths with spaces. PR route JSON uses a fence longer than any literal backtick run. Unknown repository Variable inventory keeps organization-profile freshness blocked so an inaccessible override cannot be assumed absent. The Windows verifier fixture uses bounded cleanup retries after its copied Node process exits; trust assertions are unchanged.

Closes #556

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~563

Documentation is deployed and generated using docs.page

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 4ab25db. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 4 potential problems when commit 095e2f5 was analyzed. This snapshot is historical; use the status block above for current state. 4 findings are linked to changed code.

Findings

• medium: Unrelated local actions trigger source-installation handling — src/utils/setup_installation_review.ts:74
• low: Questions without defaults show “undefined” as the suggested answer — web/src/i18n/questionOptions.ts:44
• low: Sanitize workflow metadata before terminal rendering — src/cli/setup_installation_review_presenter.ts:8
• low: The provisioning check does not exercise the headless command — .github/workflows/agent-cli-provisioning.yml:73

[vypbot]

Bugbot: 1 finding needs attention

Current status: 1 finding requires attention on 4ab25db.

Action: Review the linked threads or comment /copilot fix all.

Findings

• open — Pass the repository ID to the runner-group filter

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 4ab25db08373; base: 171806808429; reason: protected-path.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.96%. Comparing base (1718068) to head (4ab25db).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #563      +/-   ##
===========================================
+ Coverage    93.85%   93.96%   +0.10%     
===========================================
  Files          926      936      +10     
  Lines        29571    30061     +490     
  Branches      8608     8801     +193     
===========================================
+ Hits         27754    28246     +492     
- Misses         715      717       +2     
+ Partials      1102     1098       -4     

Files with missing lines	Coverage Δ
...plication/policies/merge_setup_overrides_policy.ts	100.00% <ø> (ø)
src/application/policies/setup_batch_policy.ts	100.00% <ø> (ø)
...rc/application/policies/setup_batch_view_policy.ts	100.00% <100.00%> (ø)
...ation/policies/setup_configuration_clone_policy.ts	87.50% <100.00%> (+4.16%)	⬆️
...plication/policies/setup_configuration_defaults.ts	96.72% <100.00%> (+1.80%)	⬆️
...c/application/policies/setup_configuration_plan.ts	94.18% <100.00%> (+0.03%)	⬆️
...ication/policies/setup_configuration_validation.ts	66.31% <100.00%> (+0.72%)	⬆️
...lication/policies/setup_pat_creation_url_policy.ts	100.00% <ø> (ø)
...rc/application/policies/setup_pat_intent_policy.ts	100.00% <100.00%> (ø)
...on/policies/setup_question_documentation_policy.ts	100.00% <100.00%> (ø)
... and 46 more

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[efraespada]

Addressed all four review findings in 21e6192. Source preservation now requires Copilot-specific invocation evidence, including a regression proving that an unrelated root Action still permits consumer upgrades. Missing suggestions use the localized empty label, all repository-controlled terminal metadata is control-stripped, and both provisioning workflows check provider-specific headless help.

Validation: 10,582 passing tests, 491/491 changed executable lines covered, plus executable Bash fixtures that reject broken headless commands. The 12 actual source workflows invoking the root Action remain recognized.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 4ab25db. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 2 potential problems when commit 21e6192 was analyzed. This snapshot is historical; use the status block above for current state. 2 findings are linked to changed code.

Findings

• medium: Sanitize runs-on before printing it to the terminal — src/cli/setup_installation_review_presenter.ts:8
• medium: Workflow review can display unredacted credentials — web/src/components/InstallationReview.svelte:21

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 4ab25db. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 3 potential problems when commit bdf02c6 was analyzed. This snapshot is historical; use the status block above for current state. 3 findings are linked to changed code.

Findings

• medium: Organization runner profiles require repository Variable access — src/application/policies/setup_runner_policy.ts:43
• medium: Generic executable override breaks checks for other providers — .github/workflows/agent-cli-provisioning.yml:50
• low: Runner route can escape the installation summary code fence — src/application/policies/setup_runner_installation_summary_policy.ts:15

[efraespada]

Addressed the final review in 4ab25db0:

• Source and consumer provisioning now use each role's own executable override or its provider-specific default. The generic agent executable cannot replace OpenCode for another role. The version probe also quotes paths with spaces. Twelve executed Bash cases cover every provider role and explicit/default overrides in both workflows.
• Installation PR route JSON uses a fence longer than every literal backtick run. Three adversarial group/label cases preserve the exact route as parseable JSON inside one block.
• Retained the intentional registry fail-closed boundary and added two regression cases plus code/spec/user-documentation rationale; see the inline reply on the registry finding.

673 suites / 10,631 passing tests, 35 existing local skips, all coverage budgets pass. The full LCOV report covers 495/495 changed executable lines and 763/763 changed branch alternatives with zero missing or partial lines. Build, types, lint, workflow/documentation/specification contracts and normal commit hooks pass. Source fingerprints are unchanged throughout coverage collection.

Verified final head 4ab25db0: CI Check, Ubuntu, macOS, Windows, Copilot Commit, Pull Request, Branch Sync and Review State pass. Codecov confirms every modified coverable line is covered, now compared with the current develop base 1718068; its reference CI also passed. All review threads are resolved, including the runner-filter false positive answered with the official API contract and real HTTP 200 evidence. Human review/approval checks remain neutral. RepoWise is still generating its advisory reports. The PR is open toward develop for human review.

[vypbot]

Current status: 1 finding originating in this review requires attention.
Last reconciled on 4ab25db. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 4ab25db was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Pass the repository ID to the runner-group filter — src/infrastructure/setup_runner_discovery_adapter.ts:26