quest: plan landing follow-ups from the 2026-11-02 complete session

quest/m0/host-land/README.md

@@ -111,4 +111,3 @@ can hand off instead.
 - [Gate host](/quest/m0/host-land/host.md) - kixelated/nixos runs the daemon as its own user, checks in nspawn containers, and retires the Actions runner
 - [Fixer proxy access](/quest/m0/host-land/fixer.md) - connect the nixos fixer container to CLIProxyAPI with the gate client key and maintainer login
 - [Fixer TLS](/quest/m0/host-land/fixer-tls.md) - the fixer's container trusts public certificates, so workerd and the Worker tests run there
-- [Pushed heads get a check](/quest/m0/host-land/pushed-head-ci.md) - the gate dispatches or reports the required checks on heads it or its fixer pushed

quest/m0/kix/sandbox/README.md

@@ -78,3 +78,4 @@ Shipped in [moq-dev/quest#212](https://github.com/moq-dev/quest/pull/212)
 ## Required
 
 - [Head approval](/quest/m0/kix/sandbox/head-approval.md) - a maintainer approves an exact head, such as one kix pushed, for host runners
+- [Boundary test in CI](/quest/m0/kix/sandbox/live-test.md) - the opencode sandbox's hostile-repository test runs on Linux CI with a scripted model

quest/m0/kix/sandbox/live-test.md

@@ -0,0 +1,33 @@
+# [S] The opencode sandbox's boundary test runs in CI
+
+## Goal
+
+The opencode sandbox's hostile-repository boundary test is checked in as
+`test/live/runner-sandbox.test.ts`, drives opencode and srt with a scripted
+model, and runs on Linux in this repository's checks, on `main` and in the
+merge group. An srt or opencode bump that weakens the boundary fails CI
+before it lands.
+
+## Plan
+
+Decided 2026-11-02 (user, /quest-plan of
+[moq-dev/quest#338](https://github.com/moq-dev/quest/pull/338)'s suggested
+follow-ups):
+
+- How it runs:
+  - ✅ CI on Linux: a scripted model needs no login and spends no usage
+  - A manual recipe, like `just review-sandbox`
+- Milestone: ✅ m0 · m1
+
+#338 ran the test by hand against srt 0.0.79. Merging main moved srt to
+0.0.81, which the maintainer accepted from the release notes and a direct
+srt run, without rerunning the full test. The checked-in test covers what
+that run did: a checkout that tries to read a denied file, write outside the
+checkout and attempt directory, create `.opencode/plugin`, `opencode.json` or
+`opencode.jsonc`, and reach the network. Each attempt is refused, and nothing
+is left behind in the checkout. Follow `test/live/review-sandbox.test.ts`
+for the layout. Since this test needs no login, it runs without
+`QUEST_LIVE`, skipping only where srt can't run (macOS and Windows).
+
+[opencode 2.x](/quest/m0/opencode-sdk.md) reruns the boundary test on 2.x;
+with this quest done, that rerun is this test.

quest/m0/merge-driver-upkeep.md

@@ -32,3 +32,11 @@ Decided 2026-11-01 (user, /quest-plan of the follow-ups from the
   added the `quest-pinned` input, which only a manual `nix flake update
   quest-pinned` bumps. Pick how it stays current, such as Dependabot's nix
   updates, a step in the release checklist, or a recurring quest, and do it.
+- Bump `quest-pinned` now (decided 2026-11-02, user, /quest-plan of the
+  follow-ups from that day's `/quest-complete` session): the dev shell's
+  `quest` still reads a leftover `quest:merge` label as a hold, which current
+  `quest` no longer does. In that session it reported 25-hour-old holds on
+  [moq-dev/quest#342](https://github.com/moq-dev/quest/pull/342),
+  [#338](https://github.com/moq-dev/quest/pull/338) and
+  [#324](https://github.com/moq-dev/quest/pull/324) that the checkout's
+  `quest iterate` ignored.

quest/m0/opencode-sdk.md

@@ -57,3 +57,7 @@ What the change does:
 - Run the runner's live opencode checks that the
   [Kix decision UI](/quest/m0/kix/README.md) rehearsal lists, if a runner is
   available.
+
+## Required
+
+- [Boundary test in CI](/quest/m0/kix/sandbox/live-test.md) - the boundary test this quest reruns on 2.x is checked in and runs in CI

quest/m0/queue-watcher/README.md

@@ -134,6 +134,7 @@ Shared shape, for the children to follow:
 - [Flaky failures](/quest/m0/queue-watcher/flaky.md) - a flaky failure is re-enqueued unchanged, and a test seen flaking twice is disabled in a separate PR with a follow-up quest
 - [Watcher on the host](/quest/m0/queue-watcher/host.md) - kixelated/nixos runs the watcher for moq-dev/moq beside its fixer container
 - [The other repositories follow](/quest/m0/queue-watcher/follow.md) - condition: moq's queue is proven; then moq-dev/quest switches and the others plan theirs
+- [Harden the queue runners](/quest/m0/queue-watcher/runners.md) - each queue runner runs only its repository's queue workflow, and every outside fork PR needs approval
 - [Retire the batching gate](/quest/m0/queue-watcher/retire.md) - once no repository lands through `quest land serve`, its batching code and host units go
 
 ## Related

quest/m0/queue-watcher/follow.md

@@ -20,6 +20,14 @@ those workflows land:
 
 - Keep the existing picks and their head SHAs; do not pick previously
   unqueued PRs or a head that moved after approval.
+- Remove the leftover `quest:merge` labels from the old gate first, such as
+  those on [moq-dev/quest#324](https://github.com/moq-dev/quest/pull/324) and
+  [moq-dev/rust2#446](https://github.com/moq-dev/rust2/pull/446),
+  [#442](https://github.com/moq-dev/rust2/pull/442) and
+  [#437](https://github.com/moq-dev/rust2/pull/437), none of which has
+  auto-merge armed. An older pinned `quest` still reads them as holds
+  (decided 2026-11-02, user, /quest-plan; the pin itself is
+  [Merge driver upkeep](/quest/m0/merge-driver-upkeep.md)'s).
 - Require `Queue` and a serialized squash merge queue in each `main`
   ruleset, replacing `quest land` and the old PR-side checks. Keep the
   administrator emergency bypass; remove the fixer's direct-merge bypass.

quest/m0/queue-watcher/runners.md

@@ -0,0 +1,41 @@
+# [S] Harden the merge-queue runners
+
+## Goal
+
+The self-hosted `quest-queue`, `rind-queue` and `rust2-queue` runners that
+[kixelated/nixos#19](https://github.com/kixelated/nixos/pull/19) adds run only
+their own repository's merge-queue workflow, and nothing else on the host
+reaches them:
+
+- kixelated/nixos's quest-land module creates no check launcher, users,
+  networks, kvm access or storage tagging for a repository in watch mode.
+- Each runner group admits only its repository's
+  `.github/workflows/queue.yml`.
+- moq-dev/quest, moq-dev/rind and moq-dev/rust2 require approval before
+  running workflows from any outside contributor's fork PR, not only a
+  first-time contributor's (moq-dev/quest was `first_time_contributors` on
+  2026-11-02).
+
+## Plan
+
+Decided 2026-11-02 (user, /quest-plan of the follow-ups from Claude's review
+of kixelated/nixos#19 in that day's `/quest-complete` session): ✅ all three
+items, m0, ranked right after the [cutover](/quest/m0/queue-watcher/follow.md).
+
+- Watch-mode cleanup: the review found the base branch
+  ([kixelated/nixos#16](https://github.com/kixelated/nixos/pull/16)) already
+  creates check sockets and users for moq in watch mode, which only that
+  repository's daemon user can reach. Gate them on `quest land serve` mode.
+- Runner groups: #19 puts each runner in its own group, limited to its one
+  repository. Limit each group to its repository's `queue.yml` too, through
+  the org's runner group settings (`restricted_to_workflows`).
+- Fork approval: a returning contributor's fork PR runs its own copy of the
+  workflows, which can name a self-hosted label. Set each repository's
+  `fork-pr-contributor-approval` policy to all outside contributors. Do this
+  no later than the cutover registers the runners, if it's still open then.
+- Verify by checking that a fork PR's workflow waits for approval, and by
+  listing each group's allowed workflows.
+
+## Related
+
+- [Watcher on the host](/quest/m0/queue-watcher/host.md) - the host module these runners and daemons share