Runnable can use Entire in two materially different ways. A GitHub repository can keep its GitHub identity and events while jobs fetch through an Entire mirror. Or an Entire-native repository can own its identity and enter Runnable through an authenticated event relay.
The runner and workflow semantics are shared. The source authority, status destination, and credential ownership are not. Choosing between the models starts with that distinction.
Model one: GitHub identity, Entire transport
A mirrored repository remains GitHub-backed. GitHub owns installation access, pull requests, webhook events, and Check Runs. Runnable validates that the Entire /gh/ coordinates match the connected GitHub owner and repository, then uses that Entire URL for checkout.
The repository-scoped ENTIRE_TOKEN is decrypted for the job and used by the checkout helper. Changing the clone transport does not give the workflow a second identity or make a mismatched mirror acceptable.
Model two: Entire owns the repository identity
An Entire-native connection uses an Entire repository ULID when available and validated entire://cluster/et/project/repository coordinates. The access token is stored as an encrypted repository secret, and initial workflow files can be supplied during registration.
Runnable returns a relay URL and a bearer credential once. Only the credential hash is retained, so losing the cleartext means rotating it rather than reading it back.
Events make the repository runnable
The Entire relay accepts push, pull_request, release, and repository_dispatch events. Each delivery carries a provider-unique ID, revision, ref, actor, and optionally the current workflow files. Delivery IDs are idempotent within the repository.
When workflow files are included, they update the stored definitions and disable paths that disappeared. When they are omitted, Runnable reuses the latest workflow snapshots. That keeps source discovery explicit without requiring the runner to guess what changed.
Checkout follows the selected provider
The assignment contains a canonical GitHub HTTPS URL or validated Entire URL. The runner refuses an Entire checkout without ENTIRE_TOKEN, keeps the destination inside GITHUB_WORKSPACE, fetches the requested revision, and then removes credentials from the persisted remote configuration when the workflow asks not to keep them.
Entire-native jobs still expose the familiar github.* expression context so portable workflows can evaluate repository, ref, actor, and event data. There is no GitHub token endpoint for a repository that is not GitHub-backed.
- GitHub + /gh/ mirrorGitHub identity and status; Entire checkout transport.
- Entire /et/ repositoryEntire identity and checkout; authenticated relay; Runnable is the run-status authority.
- Same executorBoth enter the same planner, scheduler, clean-machine, log, artifact, and usage path.
The current upstream boundary
Runnable cannot automatically enroll itself as an Entire CI provider today, and Entire does not currently expose repository commit-status writes for this integration. Entire-native conclusions, approvals, logs, and artifacts therefore remain authoritative in Runnable.
That boundary is why the relay and one-time credential exist. It is a narrow, authenticated contract for the product that is available now—not a claim about upstream capabilities that have not shipped.