docs(infra): design Compass self-host runner + adoption strategy (RIG-3070)

[rigel-mintaka]

Documents Matt's ruled runner topology + adoption strategy as a frozen-on-merge contract in a new design record under docs/designs/infra/runtime/compass-runner-adoption-strategy/. Mints DL-318.

What this record freezes

The security boundary follows the trust model, not the deployment uniformly (Matt, 2026-08-31):

• Managed multi-tenant service = microVM-only end state. It runs untrusted tenant code and needs the KVM hardware-isolation boundary. Podman is its transitional running boundary only, dropped to microVM-sole at the OQ-1 readiness bar (floor) and no later than the frozen first-external-multi-tenant-tenant milestone (ceiling).
• Self-host single-tenant = podman is a permanent, supported entry tier requiring no /dev/kvm — runs on any cheap VPS/box. microVM is the recommended (not required) self-host upgrade, for defense-in-depth or an operator running untrusted code / sharing their box. This amends the frozen KVM-only amendment with a self-host carve-out (honestly flagged as reopening a frozen decision — and distinguished from the amendment's own already-rejected carve-out, which was about the untrusted-multi-tenant boundary, not this single-tenant case).
• Embedded-local is REVIVED as the cross-OS developer front door. With podman permanent for self-host, a developer's own laptop is the single-tenant case in its purest form (no untrusted tenant to isolate), so embedded-local is legitimate: brew install the app, launch, sign in with your own Claude Code/Codex subscription, and go — same as any local harness. On the user's own box, restricted-tier subscription sign-in is allowed (their box, their IP, their risk), which is the zero-friction on-ramp managed cannot offer. This record records the direction only; the app-architecture reversal (un-retiring compass-app's supervisor invocation / embedded config arm / bundle, reversing DL-235's client-only charter) is designed in the compass-native lane's own embedded-revival record, carrying its own ledger row there — not designed here.
• The always-on-server argument survives as the graduation motivation, not an argument against embedded. The funnel: embedded-local (front door, your box) → self-host stack (always-on, dedicated box/VPS) → managed (hosted always-on). "Dual runtimes" here means the two existing SelectBackend stack backends (podman + microVM), both already shipping — embedded-local runs the same podman backend locally, not a third runtime.
• macOS: podman-machine is the Mac embedded-local front-door path and a permanent Mac self-host option (no nested virt, any Mac); microVM-on-Mac stays nested-only/unsupported; the remote-Linux client path (DL-235-era) stands.

Changes from the prior draft

Two reshapes stack here. First, after Matt's VPS gut-check the earlier uniform-KVM-only draft was reshaped to the trust-model split: cheap VPS (Hetzner Cloud, Contabo VPS) don't even expose /dev/kvm, and a self-host user running their own agents on their own box gains ~nothing from hardware isolation that existed to isolate untrusted managed tenants. Second (this reshape), Matt ruled that committing to the permanent podman tier brings back full embedded stack mode as the developer front door — reversing the prior "no embedded mode" clause. Managed-service adoption strategy (the cheap managed on-ramp, model-set cost optimization) is product strategy and is designed in the private monorepo's own records — excised from this public OSS record.

Tasks (filed at freeze)

T1 (managed microVM cutover), T2 (guided onboarding: embedded-local front door + both self-host podman/microVM graduation paths). The embedded app-architecture is deliberately NOT a task here — it is the compass-native lane's record. OQ-1 (managed readiness bar), OQ-2 (VPS provider pick), OQ-3 (macOS podman-machine socket spike — now the Mac embedded front-door path, so it matters more) are deferred/non-freeze-blocking.

Ledger-impact: mints DL-318 in docs/designs/DECISIONS.md.
Spec-impact: none (design record; the runner-topology spec follows the impl tasks post-freeze).
Refs RIG-3070

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-3070

[github-actions]

Compass engineering docs preview: https://compass-obs-rig-3070-runner.compass-eng-docs.pages.dev

Deployed from compass-obs/rig-3070-runner-adoption-strategy at 43fb66c.

Changed pages:

• docs/designs/DECISIONS.md
• docs/designs/infra/runtime/compass-runner-adoption-strategy/design.md