Runner

How the self-hosted runner executes checks, stores local artifacts, and uploads normalized evidence.

Role

The runner is the execution boundary. It runs inside CI, a developer machine, or a customer-controlled environment. It should execute engines locally, normalize results, write artifacts, and upload only the metadata the control plane needs.

Runner boundary

Source credentials, private documents, full traces, customer rows, and raw schemas should stay local unless the customer explicitly enables redacted artifact upload.

Inputs

Input	Example	Stays local by default
Source sets	docs, tickets, runbooks, schemas	Yes
Policy suites	tenant isolation, PII minimization, RLS drift	Yes
Representative traces	tool calls, SQL, retrieval contexts	Yes
Release metadata	commit, release candidate, environment	Uploaded
Tool versions	DocPull, PolicyStrata, runner	Uploaded

Configuration

assurance.runner.yaml

project: support-bi-copilot
release: release_2026_07_06
apiUrl: https://app.policystrata.com
outputs:
  directory: .assurance
  uploadArtifacts: false
engines:
  docpull:
    source: customer-support-docs
    out: .assurance/docpull
  policystrata:
    suite: customer-data-access
    out: .assurance/policystrata
gates:
  blockOn:
    - tenant_scope_required
    - pii_minimization_failed
    - rls_drift
  reviewOn:
    - stale_context
    - missing_citation

Exit Codes

Code	Meaning	CI behavior
`0`	Passed or review-only findings	Continue
`1`	One or more fail gates	Fail job
`2`	Blocking gate	Stop release
`3`	Invalid runner configuration	Fail job
`4`	Upload or auth failure	Retry or fail based on CI policy

Upload Contract

runner-upload.json

{
  "project": "support-bi-copilot",
  "release": "release_2026_07_06",
  "run": {
    "schemaVersion": "0.1.0",
    "runId": "run_20260706_001",
    "status": "blocked"
  },
  "artifactRefs": [
    {
      "name": "docpull.summary.json",
      "sha256": "..."
    }
  ]
}

Local Artifact Directory

.assurance/

.assurance/
  assurance-run.json
  evidence-pack.json
  docpull/
    summary.json
    source-diff.json
  policystrata/
    findings.json
    witnesses.redacted.json