One job per execution
No tenant source or runner state is intentionally reused between attempts.
Trusted repositories first
The private alpha rejects fork pull-request workloads by policy.
Scoped credentials
One-time runner configuration and workload credentials are erased after cleanup.
No public ingress
Private-alpha jobs receive public egress only and expose no public service.
Provenanced evidence
Authoritative lifecycle and cleanup events are separated from untrusted, guest-produced diagnostics.
Explicit uncertainty
Cleanup uncertainty and evidence gaps are visible states, never silently treated as success.
Bounded verification, not absolute safety.
A workflow can gain root inside its isolated execution and can tamper with guest-produced diagnostics. OpenRunners treats those diagnostics as untrusted while separately recording authoritative lifecycle and cleanup state. A passing workflow does not prove software is safe.