[rdpollard]

GitHub rejects the spare Mint runner group's selected-workflow entry until that workflow exists on main. This isolated infrastructure PR registers a manual, read-only host-inventory workflow without activating it or merging the updater work in #73.

The inventory job is skipped unless an administrator sets MINT_RUNNER_ENABLED=true, MINT_RUNNER_ACCESS_READY=verified, and MINT_RUNNER_APPROVED_SHA to the exact reviewed main SHA. The access-ready value is an explicit administrator attestation after live runner-group, repository/workflow restrictions, main protection and the pre-existing required-review environment are verified; it does not claim automatic organization-policy inspection. The job uses org/sde-mint-isolated plus a routing label, has no token permissions/checkout/inputs/secrets, and only queries the KVM API, Mint release and QEMU version. No VM is created.

Focused static/unit checks run on GitHub-hosted Ubuntu. The existing CI scope classifier gets an exact seven-file infrastructure exception so neither this PR nor a future infrastructure-only main push prepares application installers. Complete main before/after diffs containing application or unknown paths, missing/malformed push metadata, release refs and explicit application dispatch keep the normal application CI policy. No application workflow steps or updater implementation are imported from #73.

Validation: 12 local policy/scope tests passed, actionlint 1.7.7 passed for both new workflows, inline inventory Python parsed without execution, whitespace passed, and the actual seven-file diff classified as application CI not required.

Keep all activation variables absent during review/merge. Do not register/start runners or dispatch the inventory. No settings were changed, no manual workflow dispatch occurred, and no guest tests/application builds/package workflows/releases were executed. #73 stays draft/unmerged. Merging this PR requires separate authorization; subsequent runner configuration and execution remain separate gates.

Administrator sequence and limitations: docs/MINT-HOST-INVENTORY.md.

[rdpollard]

Reviewed exact head ead2d62 for correctness and runner-access gaps. No blocking code change identified.

• Scheduler-side selected repository/workflow group restrictions are required; labels only route. Live group settings and environment/main protections still require organization-admin verification before activation. This integration cannot read branch protection or activation variables (403), so this is not an attestation that those live settings exist.
• Missing/partial activation flags or wrong event/repository/ref/workflow/SHA skip the job before scheduling. Naming an environment alone does not establish reviewer protections; the instructions explicitly prohibit enabling before those are verified.
• Fixed read-only inventory only: no checkout, input commands, token permissions, root operation, guest boot, package/build or registration step. Job timeout/ephemeral runner behavior are not claimed as cleanup proof.
• Exact infra diff only skips application CI; application/unknown/mixed changes retain normal CI. Local simulation against the real before/after git diff confirms infrastructure-only main push skips installers. Explicit application dispatch and release refs are unchanged.

QA: 12 focused local tests passed; actionlint 1.7.7 passed on both workflows; whitespace passed. GitHub reports no required checks for this branch; I am waiting for every actual non-skipped check to pass before a normal merge without bypass. Current scope/policy/workflow/Windows-fixture checks pass; Mint fixture check is still preparing its authenticated userland. Application/native/release jobs are skipped.

No runner settings/variables changed, no runner registration/start, no workflow dispatch or guest tests. PR #73 remains draft and unmerged. Merge is authorized by the user after checks pass; this review does not activate the runner.

[rdpollard]

Merged #74 after all PR checks passed. Its post-merge checks exposed a test-only dependency on inherited main-push environment variables. Reproduced it locally, corrected test isolation in #75, and merged that two-line follow-up after all its checks (including Mint fixtures) passed.

Current main: 28fb4d0. Both post-merge scope/application-pipeline and focused-policy runs pass:

• https://github.com/stormbots/Tactics-Strategy-Dev-Environments/actions/runs/39083713930
• https://github.com/stormbots/Tactics-Strategy-Dev-Environments/actions/runs/39083713989

Application/native/release jobs stayed skipped. No activation variables or organization/runner/environment settings changed; no runner registration/start, workflow dispatch or guest testing occurred. #73 remains draft/unmerged at 22c724d. Live administrator access controls remain a prerequisite to any activation.

The inventory workflow now exists at refs/heads/main and can be selected in the dedicated runner group. The earlier failed main runs remain preserved; the current main checks pass.