Portal v0.35.0 — Runner identity by hostname and pack behavior proven on real services

Runner identity now follows the host, and the pack catalog's behavior evidence runs against real services.

Operability

• A runner with no explicit runner.id presents its hostname as its identity. A reboot reconnects the same runner; a replaced ephemeral host enrolls as a new one. No generated identity file has to survive on disk for either to work.
• Pack retention never sweeps a version a connected runner still advertises, so a stable fleet keeps its version pins and trust decisions through quiet weeks. Previously an idle-window cleanup could delete them, and dispatch then failed closed as pack_untrusted until the runner reconnected.
• The hosted admin runner bootstraps from a version-pinned release download with retries instead of asking the GitHub API which release is current, so an anonymous rate limit can't keep a control-plane VM from starting.

Packs

• Every high or critical action changed by the argument-boundary sweep carries a successful behavior case or a declared machine-readable risk exception (requires_cluster, requires_external_service, …), and CI enforces that accounting on every change.
• Behavior cases run in their own disposable Compose project as a non-root identity against the real service, and readiness is proven on the network path the case dials — ZooKeeper answers every four-letter word its suite uses before the first case starts, and databases that seed through a temporary boot-time daemon are probed on the routable address, not loopback.
• The snmp pack's OSPF adjacency fixture builds its network namespace on AppArmor-confined hosts.
• The behavior matrix reports in less than half the wall-clock time: a plan's images are pulled before its first case runs, slow suites shard across CI rows, and heavyweight services cap how many of their cases run at once.

Website

• A clarity pass from founder review: the security page shows the signed-dispatch boundary at the point it acts, the home comparison states signed dispatch and the no-inbound-port posture in their own rows, and case studies and comparisons read at the docs rhythm.