Repository navigation

D: gitlink mounts, pinned gitlink parents and a pre-launch tree check (#81, #99) #273

	name: Agent isolation
	on:
	push:
	branches: [main]
	paths:
	- 'agents/**'
	- 'git/clone.ts'
	- 'test/agent-*.test.ts'
	- 'runner/question-*.ts'
	- 'runner/questions.ts'
	- 'runner/workspace.ts'
	- 'runner/runner-repository.ts'
	- 'runner/execution.ts'
	- 'core/run-audit.ts'
	- 'runner/review.ts'
	- 'runner/store.ts'
	- 'git/history.ts'
	- 'test/runner-workspace.test.ts'
	- '.github/workflows/agent-isolation.yml'
	pull_request:
	paths:
	- 'agents/**'
	- 'git/clone.ts'
	- 'test/agent-*.test.ts'
	- 'runner/question-*.ts'
	- 'runner/questions.ts'
	- 'runner/workspace.ts'
	- 'runner/runner-repository.ts'
	- 'runner/execution.ts'
	- 'core/run-audit.ts'
	- 'runner/review.ts'
	- 'runner/store.ts'
	- 'git/history.ts'
	- 'test/runner-workspace.test.ts'
	- '.github/workflows/agent-isolation.yml'
	permissions:
	contents: read
	jobs:
	real-docker:
	runs-on: ubuntu-latest
	# Covers the 10 min image build, 2 min teardown and the per-test Docker budgets.
	timeout-minutes: 45
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: '26.7.0'
	cache: npm
	- run: npm ci --ignore-scripts
	- run: npm run typecheck
	# The Docker suites share one image tag and daemon, so run test files one at a time.
	- run: npx vitest run --no-file-parallelism test/agent-contract.test.ts test/agent-clone.test.ts test/agent-container.test.ts test/agent-network.test.ts test/agent-policy.test.ts test/agent-proxy.test.ts test/agent-adapter.test.ts test/agent-supervisor.test.ts test/agent-output.test.ts test/agent-gate.test.ts test/agent-question.test.ts test/runner-workspace.test.ts