[jmcte]

SUPERSEDED — DO NOT MERGE. The maintainer clarified that the Linux runner groups were intentionally retired when Hetzner runners were turned down and only Synology runners remain. This draft targets retired infrastructure and is not a valid availability fix. Do not recreate the group or grant access based on this proposal. A replacement Docker execution design must be selected and verified first.

Summary

• Add OMT-Global/openclaw-control-plane only to the selected linux-docker-private repository inventory. Its Docker/PostgreSQL CI currently has no repository-visible runner, and the private repository is listed only in the Synology shell-only inventory.
• This is a repository-only proposal. It grants no live GitHub group access and provisions or deploys no compute. The separate control-plane proposal pins CI to the private Docker group.

Governing Issue

Direct maintainer request: “get this corrected,” following control-plane PR #57/run 37138896386 diagnosis. No governing fleet issue was supplied; this draft intentionally does not close an issue or create an unrelated backlog item.

Validation

• Current-config schema validation passed with node --import tsx src/cli.ts validate-linux-docker-config --config config/linux-docker-runners.yaml --env .env.example.
• Linux Docker compose and project manifest renders passed using the checked-in example environment.
• Focused existing config and group-access suites: 2 files, 9 tests passed (vitest run test/linux-docker-config.test.ts test/runner-group-access.test.ts --configLoader runner).
• Semantic assertions confirmed control-plane is in the private pool and absent from the public pool; patch/whitespace checks passed.
• Required PR CI is pending. Full lint/build/test suite was not rerun locally for this single config entry. Existing local dependencies were reused; locked dependency validation remains CI's responsibility.

Bootstrap Governance

• Scoped to the explicit runner repair request; selected access, visibility, public pool, labels, images and capacity unchanged.
• No contributor/PR guidance changes are applicable.
• No secrets, runtime auth or machine-local environment files committed.
• Auto-merge is deliberately disabled under the maintainer's repository-proposal-only instruction. No merge/deploy/live reconciliation is authorized by this draft.

Merge Automation

• Auto-merge is intentionally not enabled. Keep this draft pending operator review and separate live-access/compute decisions.

Notes

Live runner access remains a separately approved operation: verify the actual linux-docker-private group ID/policy, then add only this repository to selected membership. The current credential cannot list organization runner groups (HTTP 403). The fleet reconciliation command can add all configured missing repositories and must not be used as a blanket substitute for narrow approval.

Replacement compute is unverified: both CX33 hosts are off; their Docker-pool mapping is unproven. The local controller has no Linux Docker host configured, and existing NAS access cannot inspect Docker containers. Merely merging this inventory entry cannot restore CI availability. Flow/MailPlus retain linux-flow-trusted dependencies requiring separate replacement proof. No server or data deletion occurs in this PR.

Publication safety: both repositories reported no configured repository webhooks. Inspected branch/PR Actions and referenced CI scripts contain no live runner-group reconciliation or deployment commands; fleet Docker CI validates/renders only. This does not claim visibility into unlisted external organization integrations.

Paired routing draft: https://github.com/OMT-Global/openclaw-control-plane/pull/58 at eb2a76d3fd80414961b4a3d72dac78f96e264a22. Its CI run 37240365502 failed before executing any steps: “Required runner group 'linux-docker-private' not found”. This demonstrates the group is unavailable to control-plane, not that it is necessarily absent organization-wide. Fleet Docker contract run 37240358543/job 111547678690 passed.