feat: promote a local Claude Code workflow into the serverless harness

.github/workflows/ci.yml

@@ -118,6 +118,16 @@ jobs:
       - name: Run deploy shell tests
         run: make test-deploy
 
+      - name: Verify sandbox inventory against the image
+        run: |
+          jq --version
+          IMAGE=ghcr.io/rossoctl/serverless-harness-sandbox:latest
+          docker pull "$IMAGE" || {
+            echo "::warning title=Sandbox inventory drift check skipped::could not pull $IMAGE; inventory drift is UNVERIFIED"
+            exit 0
+          }
+          bash deploy/knative/verify-sandbox-inventory.sh "$IMAGE"
+
   proto:
     runs-on: ubuntu-latest
     timeout-minutes: 10

Makefile

@@ -21,6 +21,7 @@ typecheck:
 	cd harness && pnpm exec tsc --noEmit
 	cd packages/k8s-sandbox && pnpm exec tsc --noEmit
 	cd packages/knative-server && pnpm exec tsc --noEmit
+	cd packages/config-bundle && pnpm exec tsc --noEmit
 	cd experiments && pnpm exec tsc --noEmit
 
 # Laptop showcase: harness on kind, remote worker as a host container dialing out.

README.md

@@ -102,6 +102,9 @@ flowchart LR
   `RuntimeDefault` seccomp, no service-account token automount.
 - **Built on Pi** — wraps a pinned [`kagenti/pi`](https://github.com/kagenti/pi) coding agent through
   an injectable `SessionStorageBackend` seam; the agent itself is unmodified.
+- **Promote a local Claude Code workflow** — `cd harness && pnpm promote` bundles skills, `CLAUDE.md`,
+  memory, and a slash command from your local `~/.claude` into a content-addressed bundle a leaf can
+  dispatch by digest (see [Promoting a local Claude Code workflow](#promoting-a-local-claude-code-workflow)).
 
 ---
 
@@ -178,6 +181,41 @@ troubleshooting — is in **[`deploy/knative/README-ocp.md`](deploy/knative/READ
 
 ---
 
+### Promoting a local Claude Code workflow
+
+Iterate on a workflow locally in Claude Code — skills, `CLAUDE.md`, memory, a slash command —
+then promote it:
+
+```bash
+cd harness && pnpm promote --entry my-workflow --project /path/to/your/project
+```
+
+`promote` reads the workflow — skills, `CLAUDE.md` chain, and memory — from `--project`, so
+running it from the harness checkout without `--project` promotes the harness's own
+configuration, not yours.
+
+`promote` dedupes and classifies your local configuration, drops what cannot work in the harness
+(with a reason for each), and scans for credentials before uploading. The scan has two tiers: a
+structural match on a known key shape (an AWS access key, a PEM private-key block, a GitHub or
+Slack token, an OpenAI-style key) **refuses the upload** and exits non-zero; a weaker prose
+heuristic (`token: <value>`-shaped lines) only **warns and proceeds**, leaving the judgement to
+you — that heuristic matches code and documentation placeholders too often to block on safely. It
+writes a committable `.claude/promoted.lock.json` and uploads a content-addressed bundle; an
+unchanged re-promotion uploads nothing.
+
+Dispatch it by adding one field to any prompt leaf:
+
+```json
+{ "sessionId": "run-1/item-1", "kind": "prompt", "prompt": "…", "configRef": "sha256:…" }
+```
+
+Memory travels **read-only** — a promoted run consumes what you taught it locally and reports
+discoveries back in the leaf result, which keeps leaf replay reproducible
+([ADR-0031](docs/adrs/0031-promoted-memory-read-only.md)). MCP servers and subagents are not
+promoted; see the [design](docs/specs/2026-09-02-claude-code-workflow-promotion-design.md) §2, §9.
+
+---
+
 ## Dispatch Archetypes
 
 The same backend serves three orchestration patterns, all validated end-to-end on Kind:

deploy/knative/sandbox-inventory/README.md

@@ -0,0 +1,30 @@
+# Sandbox binary inventories
+
+Each file declares the commands one sandbox image provides. The promote CLI (`cd harness && pnpm promote`; see
+[`../../../docs/specs/2026-09-02-claude-code-workflow-promotion-design.md`](../../../docs/specs/2026-09-02-claude-code-workflow-promotion-design.md) §4.5)
+preflights a workflow's detected binaries against these **without cluster access**, so a
+promotion can be checked on a laptop.
+
+- **Filename** is the image ref with `:` and `/` replaced by `_`, plus `.json`.
+- **Contract:** `{ "image": "<ref>", "binaries": ["<sorted, unique>"] }`.
+- `tar`, `base64`, `flock` and `git` are required by `converge.ts` and `config-overlay.ts`.
+
+Two checks guard these files, because they catch different failures:
+
+| Check                             | Runs                   | Catches                                                                |
+| --------------------------------- | ---------------------- | ---------------------------------------------------------------------- |
+| `tests/sandbox-inventory.test.sh` | every PR, no cluster   | malformed JSON, wrong filename, unsorted list, a missing required tool |
+| `../verify-sandbox-inventory.sh`  | where the image exists | **drift** — the file claiming something the image does not have        |
+
+A file that has drifted makes preflight lie, and a lying preflight is worse than none because
+people stop checking it. Re-run the verify script whenever the sandbox Dockerfile changes.
+
+## Provenance
+
+`ghcr.io_rossoctl_serverless-harness-sandbox_latest.json` was generated from the real
+published image, not curated by hand:
+
+- Image: `ghcr.io/rossoctl/serverless-harness-sandbox:latest`
+- Digest: `sha256:0683379d6368ab14c41d9bb46683178946091abba47b1832756d89f39afcdb9f`
+- 347 binaries
+- Enumerated 2026-09-03 by listing every executable on `PATH` inside the image