feat: organize OpenShell workload bundles

.github/workflows/ai-review.yml

@@ -6,7 +6,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   review:

.github/workflows/images.yml

@@ -42,7 +42,7 @@ jobs:
         run: |
           if [[ "$GITHUB_REF_TYPE" == tag || -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
             changed=true
-          elif git diff --quiet "$BASE_SHA" HEAD -- "profiles/stackrox/image/${IMAGE_PROFILE}" .github/workflows/images.yml; then
+          elif git diff --quiet "$BASE_SHA" HEAD -- "images/stackrox/${IMAGE_PROFILE}" .github/workflows/images.yml; then
             changed=false
           else
             changed=true
@@ -73,7 +73,7 @@ jobs:
       - uses: docker/build-push-action@v6
         if: steps.changes.outputs.changed == 'true'
         with:
-          context: profiles/stackrox/image/${{ matrix.profile }}
+          context: images/stackrox/${{ matrix.profile }}
           platforms: ${{ matrix.platforms }}
           push: ${{ github.event_name == 'push' }}
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/pr-review-reusable.yml

@@ -29,7 +29,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   review:
@@ -60,7 +59,7 @@ jobs:
           path: harness
           persist-credentials: false
       - name: Install default review skill
-        run: install -D -m 0644 harness/examples/github-pr-reviewer/skills/pr-review/SKILL.md harness/skills/pr-review/SKILL.md
+        run: install -D -m 0644 harness/workloads/github-pr-reviewer/workflow/skills/pr-review/SKILL.md harness/skills/pr-review/SKILL.md
       - name: Install caller skill
         if: inputs.skill-path != ''
         env:

.gitignore

@@ -33,6 +33,9 @@ test.yaml
 reviewer.yaml
 skills-lock.json
 
+# Repository-owned workload documents are not scratch configs.
+!workloads/**/harness.yaml
+
 # Local audit working notes
 docs/audit-*.md
 docs/code-audit.md

Makefile

@@ -17,7 +17,7 @@ CONTAINER_CLI ?= podman
 PLATFORM      := linux/amd64
 VERSION       := $(shell git describe --tags --always 2>/dev/null || echo dev)
 LDFLAGS       := -s -w -X main.version=$(VERSION)
-STACKROX_IMAGE_DIR := profiles/stackrox/image/sandbox-default
+STACKROX_IMAGE_DIR := images/stackrox/sandbox-default
 
 # Pinned OpenShell CLI/gateway version — single source of truth for `make
 # openshell` and CI (.github/workflows/integration.yml).

README.md

@@ -208,9 +208,12 @@ stages the pull-request diff as data. The `ai-review` label is explicit opt-in
 and is not added automatically. A `pull_request` trigger is appropriate only
 for a credential-free demonstration.
 
-Future archetypes such as issue triage, issue-to-PR, security review, or
-auto-merge require separate mutation and approval contracts; they are not
-implicitly enabled by the runner.
+The repository carries two initial workload bundles: pull-request review and
+explicit pull-request merge. They are examples and policy contracts, not
+automatically enabled GitHub Actions. Each workload documents its trigger,
+providers, allowed mutation, and native OpenShell invocation. Pull-request
+creation, issue, watcher, and triage archetypes are intentionally deferred
+until these two are validated in consuming repositories.
 
 ## Commands
 
@@ -237,7 +240,8 @@ retain it for debugging.
 - [docs/workflow-format.md](docs/workflow-format.md) — version 1 workflow contract
 - [docs/ci.md](docs/ci.md) — trusted CI bootstrap and credential contract
 - [docs/compatibility.md](docs/compatibility.md) — tested OpenShell, ACP, and Go versions
-- [examples/github-pr-reviewer/](examples/github-pr-reviewer/) — workflow inputs and policy
+- [workloads/](workloads/) — workload bundles, native OpenShell artifacts, and Harness adapters
+- [images/](images/) — reusable sandbox image build contexts
 
 Fast checks:
 

cmd/workflow_apply_test.go

@@ -698,9 +698,9 @@ func TestCanonicalRunRequestRequiresOutputDirectory(t *testing.T) {
 
 func boolPtr(value bool) *bool { return &value }
 
-func TestGitHubReviewerCustomSkillUsesExamplePayloadPath(t *testing.T) {
+func TestGitHubReviewerCustomSkillUsesWorkflowPayloadPath(t *testing.T) {
 	dir := t.TempDir()
-	exampleDir := filepath.Join("..", "examples", "github-pr-reviewer")
+	exampleDir := filepath.Join("..", "workloads", "github-pr-reviewer", "workflow")
 	workflowPath := filepath.Join(dir, "opencode-harness.yaml")
 	workflowBytes, err := os.ReadFile(filepath.Join(exampleDir, "opencode-harness.yaml"))
 	if err != nil {

profiles/stackrox/README.md → images/stackrox/README.md

@@ -1,13 +1,13 @@
 # StackRox sandbox images
 
-StackRox profiles are optional OpenShell sandbox images for workflows that need
+StackRox images are optional OpenShell sandbox images for workloads that need
 repository-specific tools. Providers, credentials, skills supplied by a
 workflow, and task-specific policy remain outside the image.
 The image does not create or attach providers; a workflow must name providers
 that are already provisioned and attach them through `sandbox.providers` before
 provider credentials or inference routes are available.
 
-## Profiles
+## Images
 
 ### `sandbox-default`
 
@@ -41,7 +41,7 @@ Build it locally with:
 ```bash
 docker build --platform linux/amd64 \
   -t quay.io/rcochran/openshell:sandbox-stackrox-ci \
-  profiles/stackrox/image/sandbox-stackrox-ci
+  images/stackrox/sandbox-stackrox-ci
 ```
 
 ### `sandbox-collector-builder`
@@ -64,5 +64,5 @@ Build it locally with:
 ```bash
 docker build --platform linux/amd64 \
   -t quay.io/rcochran/openshell:sandbox-collector-builder \
-  profiles/stackrox/image/sandbox-collector-builder
+  images/stackrox/sandbox-collector-builder
 ```

profiles/stackrox/image/sandbox-collector-builder/Dockerfile → images/stackrox/sandbox-collector-builder/Dockerfile

@@ -75,7 +75,9 @@ RUN curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_$
 # Use the same uv-managed Python contract as the community base image. The
 # collector-builder image system Python is 3.9, while current MCP integrations require
 # 3.10+.
-COPY --from=ghcr.io/astral-sh/uv:0.10.8 /uv /usr/local/bin/uv
+# Pin the multi-architecture manifest so a mutable registry tag cannot change
+# the builder executable without an intentional source update.
+COPY --from=ghcr.io/astral-sh/uv@sha256:88234bc9e09c2b2f6d176a3daf411419eb0370d450a08129257410de9cfafd2a /uv /usr/local/bin/uv
 ARG PYTHON_VERSION=3.14.3
 ENV UV_PYTHON_INSTALL_DIR=/sandbox/.uv/python
 RUN uv python install "${PYTHON_VERSION}" \

profiles/stackrox/image/sandbox-collector-builder/settings.json → images/stackrox/sandbox-collector-builder/settings.json

@@ -46,8 +46,8 @@
       "Read(**/.claude.json)"
     ]
   },
-  "enableAllProjectMcpServers": true,
-  "trustedMcpServers": ["atlassian"],
+  "enableAllProjectMcpServers": false,
+  "trustedMcpServers": ["atlassian", "gopls-mcp"],
   "skipDangerousModePermissionPrompt": true,
   "env": {
     "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1"

profiles/stackrox/image/sandbox-default/Dockerfile → images/stackrox/sandbox-default/Dockerfile

@@ -71,9 +71,21 @@ RUN set -eux; \
 
 # Google Workspace CLI (Gmail, Calendar, Drive, Docs, Sheets)
 # https://github.com/googleworkspace/cli
-RUN ARCH=$(uname -m | sed 's/arm64/aarch64/') && \
-    curl -fsSL "https://github.com/googleworkspace/cli/releases/download/v0.22.5/google-workspace-cli-${ARCH}-unknown-linux-gnu.tar.gz" \
-    | tar xz -C /usr/local/bin
+ARG GWS_VERSION=0.22.5
+ARG GWS_SHA256_AMD64=de78ecdbd2f1a84cca0063a7ecbc440240fc14b6ebccbb17f4646b792a8c5c1f
+ARG GWS_SHA256_ARM64=94490295d9580e1e88574e715a0a162991747d12d62f8c7b8dcc8268b6c1cea0
+RUN set -eux; \
+    case "$(uname -m)" in \
+      x86_64) gws_arch=x86_64; gws_sha256="$GWS_SHA256_AMD64" ;; \
+      aarch64|arm64) gws_arch=aarch64; gws_sha256="$GWS_SHA256_ARM64" ;; \
+      *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/googleworkspace/cli/releases/download/v${GWS_VERSION}/google-workspace-cli-${gws_arch}-unknown-linux-gnu.tar.gz" -o /tmp/gws.tgz; \
+    echo "${gws_sha256}  /tmp/gws.tgz" | sha256sum -c -; \
+    mkdir -p /tmp/gws-extract; \
+    tar -xzf /tmp/gws.tgz -C /tmp/gws-extract; \
+    install -m 0755 /tmp/gws-extract/gws /usr/local/bin/gws; \
+    rm -rf /tmp/gws.tgz /tmp/gws-extract
 
 # OpenCode AI coding agent
 # https://github.com/opencode-ai/opencode

profiles/stackrox/image/sandbox-default/settings.json → images/stackrox/sandbox-default/settings.json

@@ -4,8 +4,8 @@
     "allow": ["Bash(*)", "Read(*)", "Write(*)", "Edit(*)", "Glob(*)", "Grep(*)", "WebFetch(*)", "WebSearch(*)", "mcp__*"],
     "deny": []
   },
-  "enableAllProjectMcpServers": true,
-  "trustedMcpServers": ["atlassian"],
+  "enableAllProjectMcpServers": false,
+  "trustedMcpServers": ["atlassian", "gopls-mcp"],
   "skipDangerousModePermissionPrompt": true,
   "env": {
     "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1"

profiles/stackrox/image/sandbox-stackrox-ci/settings.json → images/stackrox/sandbox-stackrox-ci/settings.json

@@ -44,8 +44,8 @@
       "Read(**/.claude.json)"
     ]
   },
-  "enableAllProjectMcpServers": true,
-  "trustedMcpServers": ["atlassian"],
+  "enableAllProjectMcpServers": false,
+  "trustedMcpServers": ["atlassian", "gopls-mcp"],
   "skipDangerousModePermissionPrompt": true,
   "env": {
     "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1"

scripts/dev-harness.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 # Build the CLI and run Harness with the NVIDIA community base image.
 #
 # Set HARNESS_OS_IMAGE when a workflow needs a custom image, such as the
-# StackRox image built from profiles/stackrox/image/sandbox-default.
+# StackRox image built from images/stackrox/sandbox-default.
 #
 # Usage:
 #   ./scripts/dev-harness.sh workflow apply harness.yaml