Remote Infrastructure

Activate remote authority only when needed#

The normal local workflow requires no server. Remote infrastructure adds shared durable authority and repository-owned CI execution; it also adds operator responsibility for authentication, TLS, network exposure, backups, upgrades, and compatibility.

Component boundary#

• ait-server owns the repository registry, shared workflow state, policy, evidence, and Worker Job queue.
• ait-runner claims compatible typed jobs, materializes exact Snapshot content, executes the repository's declared CI entrypoint, and returns bounded results.

The runner does not become repository authority and does not choose a language-specific build system.

Evaluate the RC.5 server locally#

Bind the evaluation container to loopback unless a reviewed secure ingress is already available.

docker network create ait-native-rc
docker volume create ait-native-rc-data
docker run --detach \
  --name ait-server \
  --network ait-native-rc \
  --publish 127.0.0.1:8088:8088 \
  --restart unless-stopped \
  --volume ait-native-rc-data:/var/lib/ait \
  ghcr.io/weita2026/ait-server:1.0.0-rc.5

curl --fail http://127.0.0.1:8088/healthz

The public container index covers Linux amd64 and arm64.

Register and configure the repository#

Use the server's repository registration result and the generated AIT guidance for the exact repository index and remote name. Confirm effective routing before starting governed work.

ait remote list --json
ait config show --json

Do not copy a repository index from another repository. The index is part of remote authority routing.

Runner contract#

The runner accepts version-compatible jobs for one registered repository and executes its exact ci/run.sh or ci/run.ps1 entrypoint. Source roots, attempt roots, worker identity, and repository index are operator-selected values.

Keep attempt storage isolated, monitor failed deliveries, and verify that attempt-owned data is cleaned after terminal results.

Readiness and closeout#

Remote work publishes a selected Patchset and records completed CI, attestation, review, and policy evidence before final Task closeout.

ait workflow ready <change-id> --apply
ait task land <task-or-change-id>

The readiness commands report the exact next action when a gate is pending.