From a4db952d3fe6bbd4d581a3cf113201aa96d80667 Mon Sep 17 00:00:00 2001
From: Conrad Kramer <conrad@conradkramer.com>
Date: Sun, 7 Jun 2026 08:26:23 -0700
Subject: [PATCH] Fix Namespace Apple runner dispatch

---
 .../workflows/apple-distribute-testers.yml    |  12 ++++----
 Scripts/_burrow-flake.sh                      |   4 ++-
 Scripts/ci/ensure-nsc.sh                      |   2 +-
 Scripts/provision-forgejo-nsc.sh              |  16 ++++++++++-
 ...nfrastructure-and-store-upload-pipeline.md |  11 +++++++
 flake.nix                                     |  10 +++----
 nixos/hosts/burrow-forge/default.nix          |  27 ++++++++++++++++++
 .../infra/forgejo-nsc-autoscaler-config.age   | Bin 1506 -> 1767 bytes
 .../infra/forgejo-nsc-dispatcher-config.age   | Bin 1239 -> 1240 bytes
 secrets/infra/forgejo-nsc-token.age           | Bin 1309 -> 828 bytes
 services/forgejo-nsc/deploy/autoscaler.yaml   |   8 ++++++
 services/forgejo-nsc/deploy/dispatcher.yaml   |   2 +-
 12 files changed, 77 insertions(+), 15 deletions(-)

diff --git a/.forgejo/workflows/apple-distribute-testers.yml b/.forgejo/workflows/apple-distribute-testers.yml
index d3ca415..aed30e0 100644
--- a/.forgejo/workflows/apple-distribute-testers.yml
+++ b/.forgejo/workflows/apple-distribute-testers.yml
@@ -84,7 +84,7 @@ env:
 jobs:
   prepare:
     name: Prepare Apple Distribution
-    runs-on: namespace-profile-linux-medium
+    runs-on: namespace-profile-linux-medium-apple
     outputs:
       build_number: ${{ steps.plan.outputs.build_number }}
       sparkle_channel: ${{ steps.plan.outputs.sparkle_channel }}
@@ -123,7 +123,7 @@ jobs:
   build-ios:
     name: Build Apple iOS
     needs: prepare
-    runs-on: namespace-profile-macos-large
+    runs-on: namespace-profile-macos-large-apple
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -219,7 +219,7 @@ jobs:
   build-macos:
     name: Build Apple macOS
     needs: prepare
-    runs-on: namespace-profile-macos-large
+    runs-on: namespace-profile-macos-large-apple
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -319,7 +319,7 @@ jobs:
       - prepare
       - build-ios
       - build-macos
-    runs-on: namespace-profile-linux-medium
+    runs-on: namespace-profile-linux-medium-apple
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -398,7 +398,7 @@ jobs:
       - prepare
       - sign-apple
     if: ${{ github.event.inputs.upload_app_store == 'true' }}
-    runs-on: namespace-profile-macos-large
+    runs-on: namespace-profile-macos-large-apple
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -501,7 +501,7 @@ jobs:
       - prepare
       - sign-apple
     if: ${{ github.event.inputs.upload_sparkle == 'true' }}
-    runs-on: namespace-profile-linux-medium
+    runs-on: namespace-profile-linux-medium-apple
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
diff --git a/Scripts/_burrow-flake.sh b/Scripts/_burrow-flake.sh
index ba4e372..25fb6e1 100755
--- a/Scripts/_burrow-flake.sh
+++ b/Scripts/_burrow-flake.sh
@@ -27,7 +27,7 @@ burrow_prepare_flake_ref() {
   local resolved
   resolved="$(cd "${input}" && pwd)"
 
-  local cache_root="${HOME}/.cache/burrow"
+  local cache_root="${BURROW_FLAKE_CACHE_ROOT:-${HOME}/.cache/burrow}"
   mkdir -p "${cache_root}"
 
   local copy_root
@@ -37,6 +37,8 @@ burrow_prepare_flake_ref() {
   rsync -a \
     --delete \
     --exclude '.git' \
+    --exclude '.cache' \
+    --exclude '.derived-data' \
     --exclude '.direnv' \
     --exclude 'result' \
     --exclude 'burrow.sock' \
diff --git a/Scripts/ci/ensure-nsc.sh b/Scripts/ci/ensure-nsc.sh
index a4d3496..87cd9d9 100755
--- a/Scripts/ci/ensure-nsc.sh
+++ b/Scripts/ci/ensure-nsc.sh
@@ -31,7 +31,7 @@ if [[ "$os" != "linux" ]]; then
   exit 1
 fi
 
-version="${NSC_VERSION:-0.0.506}"
+version="${NSC_VERSION:-0.0.520}"
 expected_sha256=""
 case "${version}/${arch}" in
   0.0.506/amd64) expected_sha256="4a093e0269878a9514e7c00d99b88a924f307ad15fb9d1595ee5f6582f99a0f0" ;;
diff --git a/Scripts/provision-forgejo-nsc.sh b/Scripts/provision-forgejo-nsc.sh
index 890d9a2..b82757c 100755
--- a/Scripts/provision-forgejo-nsc.sh
+++ b/Scripts/provision-forgejo-nsc.sh
@@ -136,7 +136,20 @@ autoscaler_src="${REPO_ROOT}/services/forgejo-nsc/deploy/autoscaler.yaml"
 
 if [[ "${REFRESH_TOKEN}" -eq 1 || ! -s "${token_file}" ]]; then
   "${NSC_BIN}" auth check-login --duration 20m >/dev/null
-  "${NSC_BIN}" auth generate-dev-token --output_to "${token_file}" >/dev/null
+  token_name="${TOKEN_NAME_PREFIX}-namespace-$(date -u +%Y%m%dT%H%M%SZ)"
+  "${NSC_BIN}" token create \
+    --name "${token_name}" \
+    --description "Burrow Forgejo Namespace runner dispatcher" \
+    --expires_in "${NSC_TOKEN_EXPIRES_IN:-30d}" \
+    --grant '{"resource_type":"instance","resource_id":"*","actions":["create","destroy","dial_host","exec","get","list","refresh","ssh","wait"]}' \
+    --grant '{"resource_type":"instance/ingress","resource_id":"*","actions":["list","register"]}' \
+    --grant '{"resource_type":"instance/notification","resource_id":"*","actions":["list"]}' \
+    --grant '{"resource_type":"instance/o11y/logs","resource_id":"*","actions":["get"]}' \
+    --grant '{"resource_type":"cache/httpcache","resource_id":"*","actions":["ensure","read","write"]}' \
+    --grant '{"resource_type":"bazel/cache","resource_id":"*","actions":["ensure"]}' \
+    --grant '{"resource_type":"artifact","resource_id":"*","actions":["create","resolve","list"]}' \
+    --token_file "${token_file}" \
+    --output json >/dev/null
   chmod 600 "${token_file}"
 fi
 
@@ -155,6 +168,7 @@ forgejo_pat="$(
     -o StrictHostKeyChecking=accept-new \
     "${HOST}" \
     "set -euo pipefail; forgejo_bin=\$(systemctl show -p ExecStart forgejo.service --value | sed -E 's/^\\{ path=([^ ;]+).*/\\1/'); sudo -u forgejo \"\${forgejo_bin}\" --config /var/lib/forgejo/custom/conf/app.ini --custom-path /var/lib/forgejo/custom --work-path /var/lib/forgejo admin user generate-access-token --username '${CONTACT_USER}' --scopes all --raw --token-name '${token_name}'" \
+    | awk 'NF { line = $0 } END { print line }' \
     | tr -d '\r\n'
 )"
 
diff --git a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
index e3e8ad9..a4aab36 100644
--- a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
+++ b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
@@ -103,6 +103,17 @@ The same change also makes the forge itself the release authority: release tags
   - `namespace-profile-linux-medium`
   - `namespace-profile-macos-large`
   - `namespace-profile-windows-large`
+- Use dedicated Apple distribution labels for the focused tester-distribution
+  workflow so stale generic Namespace jobs cannot consume Apple release runners:
+  - `namespace-profile-linux-medium-apple`
+  - `namespace-profile-macos-large-apple`
+- Run forge Namespace services with the repo-owned `nsc` package and keep it
+  current with the token format expected by Namespace. `nsc 0.0.520` is the
+  first required baseline for revokable token-file auth.
+- Render the sealed Namespace runner token with `nsc token create --token_file`
+  instead of `nsc auth generate-dev-token`. The dev-token output is for direct
+  API/registry access, while the dispatcher needs the JSON token-file format
+  consumed by `nsc run`.
 - Add a Rust `burrow-windows-stub` binary so the Windows lane can validate packaging and upload mechanics before native Windows networking support is implemented.
 - Treat Sparkle as a macOS public-channel upload lane:
   - Generate staged appcast content from the signed macOS artifact when present.
diff --git a/flake.nix b/flake.nix
index dd81a6a..8727747 100644
--- a/flake.nix
+++ b/flake.nix
@@ -178,7 +178,7 @@ EOF
         nscPkg =
           if pkgs.stdenv.isLinux || pkgs.stdenv.isDarwin then
             let
-              version = "0.0.452";
+              version = "0.0.520";
               osName =
                 if pkgs.stdenv.isLinux then
                   "linux"
@@ -192,18 +192,18 @@ EOF
                     arch = "amd64";
                     hash =
                       if pkgs.stdenv.isLinux then
-                        "sha256-FBqOJ0UQWTv2r4HWMHrR/aqFzDa0ej/mS8dSoaCe6fY="
+                        "sha256-Fqy6baIGQOGwbMCYHECOy5GcJg23xSs8XaZRfia5aHE="
                       else
-                        "sha256-3fRKWO0SCCa5PEym5yCB7dtyEx3xSxXSHfJYz8B+/4M=";
+                        "sha256-dCOr3mjAAhaByXX4yUr0dXZan8Mx8nbfggUemK7psbM=";
                   }
                 else if pkgs.stdenv.hostPlatform.isAarch64 then
                   {
                     arch = "arm64";
                     hash =
                       if pkgs.stdenv.isLinux then
-                        "sha256-A6twO8Ievbu7Gi5Hqon4ug5rCGOm/uHhlCya3px6+io="
+                        "sha256-Vv+UUd0BpcxwEg2dCsGJ/7lFOcXrl9yNwHDoHrgivKY="
                       else
-                        "sha256-n363xLaGhy+a6lw2F+WicQYGXnGYnqRW8aTQCSppwcw=";
+                        "sha256-ASVXJhNwuWQ6T5nGTclZkv+5pPDPD/Q4i4nyAjVw2Gw=";
                   }
                 else
                   throw "nsc: unsupported host platform ${pkgs.stdenv.hostPlatform.system}";
diff --git a/nixos/hosts/burrow-forge/default.nix b/nixos/hosts/burrow-forge/default.nix
index 8de0d85..744dd43 100644
--- a/nixos/hosts/burrow-forge/default.nix
+++ b/nixos/hosts/burrow-forge/default.nix
@@ -50,6 +50,29 @@ let
   forgeAuthorizedKeys = map
     (username: builtins.readFile identities.${username}.sshPublicKeyPath)
     (builtins.attrNames (lib.filterAttrs (_: identity: identity.forgeAuthorized or false) identities));
+  forgejoNscMaterializeTokenCache = ''
+    install -d -m 700 -o forgejo-nsc -g forgejo-nsc /var/lib/forgejo-nsc/.config/ns
+    ${pkgs.python3}/bin/python3 - <<'PY'
+import json
+from pathlib import Path
+
+raw = Path("/var/lib/forgejo-nsc/nsc.token").read_text(encoding="utf-8").strip()
+if not raw:
+    raise SystemExit("empty Namespace token")
+if raw.startswith("{"):
+    data = json.loads(raw)
+    if "bearer_token" not in data and "session_token" not in data:
+        raise SystemExit("Namespace token JSON must contain bearer_token or session_token")
+else:
+    data = {"session_token": raw}
+Path("/var/lib/forgejo-nsc/.config/ns/token.json").write_text(
+    json.dumps(data) + "\n",
+    encoding="utf-8",
+)
+PY
+    chown forgejo-nsc:forgejo-nsc /var/lib/forgejo-nsc/.config/ns/token.json
+    chmod 600 /var/lib/forgejo-nsc/.config/ns/token.json
+  '';
 in
 
 {
@@ -250,6 +273,7 @@ in
 
   services.forgejo-nsc = {
     enable = true;
+    nscPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.nsc;
     nscTokenFile = config.age.secrets.burrowForgejoNscToken.path;
     dispatcher = {
       configFile = config.age.secrets.burrowForgejoNscDispatcherConfig.path;
@@ -260,6 +284,9 @@ in
     };
   };
 
+  systemd.services.forgejo-nsc-dispatcher.preStart = lib.mkAfter forgejoNscMaterializeTokenCache;
+  systemd.services.forgejo-nsc-autoscaler.preStart = lib.mkAfter forgejoNscMaterializeTokenCache;
+
   services.burrow.authentik = {
     enable = true;
     envFile = config.age.secrets.burrowAuthentikEnv.path;
diff --git a/secrets/infra/forgejo-nsc-autoscaler-config.age b/secrets/infra/forgejo-nsc-autoscaler-config.age
index 0194fbca166bcdb49788c957a2ec2746225dd9d7..3a37c7b29140c208716c2db9aea438e62adbb571 100644
GIT binary patch
delta 1723
zcmaFF{hW7#PQ965POgW)w?Rm9lwn??d3cIJSb&dPRAQO4X=q-Ad#byuqi;b(rbT72
zFPC?PS5A6WX;qnLVTxguWu8Teb6QDhj%!I^hPQscVOU9?S58%dr)5y4BbTn7LUD11
zZfc5=si~o*f@e`wu4B4FTB2uhimO*)iFR3~hp$nfyIWvpa!6sZXOf4Dds%X3RaH@x
zpJ|ARtA9=?mv4Ajc8+<uZ%#yRsdu@)W2K){u6s^-VX{ebrlosMT54dDzrR~bR#kcN
z#E;_jh2^PUCXq!&d7(xnF5b=&<)&4xRVnEy?kO3022r`@k%du~0VaheIR=qjUfE7g
z1|eC_kzsDZk*S6iDY<5zL4`iXS%#IliQa)>VcvNe1_l+zS^fqfpF}`B5mI92<L_%3
zX=YyNrR`&y?i~`E>z?N6o|cs6>RRvR>S<hBoR<}%A7Gr7%w_K6?NaID<>u;=6A}<u
zo?haX;Z_isR1j#GS{mS(84!?BmE`CYm>=%r$fc{Rs}Sh!o9dM4niO0X=ABqxUYO<*
z8t9+yXOd{79q1Ym?2?u48&Q><RS}wEz@?QVHm7QKXx=UBEqC99Y88L`C8S;d%IJQ}
z+BbHd-qWJ?)QD$Fn&t{D3vcHRX(<Ug=yhooo5|nlA2is5nr#}_Ro$Lxp0M1{%e7<?
z5A)4lo?~|y@7c@CKTB6x^=9_Go!2I8eQ{Ru-H(?~7yCc577ee6vfCTrn{o7;aY&0N
zx6`^)+d^$tJ-)x;Zq%x!dba;FogT~0dsW{pzq#GBh@a=vO{s9dUso1IEWOt%_Kx$;
z8=tS@A{Sik*BA30KiSVM*P?JY!)nT<I~*#pcQj)r<WzV~m^1UFnfocJc?aDuHyk~*
ztddiHu@2wLBhRJTcwF>v-Of6Ye`AOG40p*ZJ^|s|4oX+8@mRF<^!|uXW$x$AW)}D4
z*XFLfT|eo0?!0den^e;-e`|korsZ3OZunyTqwd)YJ*$2TFFfP-^Tf4XBDYwKzZGP0
z98jzke0M~}Z2HwRGgj<(Ub8q#?J2L%@;CDw!{7d><zKl-y;4`3AyK;d@m`sth=p24
zdV(?9^^Y3d<}(~|y0J)tZDvGe!ViOG9#^DZUiilIRn{}Res{zpgKNI~A1HSvKL})A
zJ$XaWrb`R2eX?Nj^Q^t|dhesx%mF|D@jMIZE={R2ES~+e;?H}h)tPk}e}9Gd9(vn*
z?BOzb=b%ORE^_6_8@#x}7yaJ#v8m&lJIC8iT%<$J&$Rlpl;cte)33#K(lh6COcjZL
z-X>XkW$n_Wzc<en@-7#tXSgS@b*-$HgF!UQ@)D6PVsDqPS|h~qttfnlRRXurw2Z?k
z1zLa1w#@u|$Mx)z{u|p|^x|9&JoxXm=;1Wu#kxPY<m|pDW`D|_kH0Kv;Y{Z*6XRS;
zmgnTUJ`+eP<_{~sc~@}bI(|VHN$1zo|5a}<58GwEl3o9NL|e`Exx1E~t=U^2rq(oj
zh0liQ4I9|LowH@;u<uChX*+PQyua7_^sC8tpa1@La^vi+H;Q!X+K-;isP8wgsJZXi
zEPE?XUv>4~le_=Vxm(mC`l|bjnB?;3|7+JB=Wy4EHH~d}uAlw=FW2|Uud>(sb?iRH
zHQTSzqF<rPt$ND;I#Z2qgXP+94=yy=-dw+G#jU!Nhi3TyGG3W3RI#|#{ka{l%htMr
zfX4f|H!Le8PTo7`b@5xhpDk0G0^{xT=YL$We)71km;d4ItFCOv=2YFyI3@1coW<55
z5We7Q2}7;rT}HWt?yH-ZYt^royl$Cjt$g;PQOGi8!R~zpeEW8?XZ=#UW}9Gi`d^Jf
zj_&_$^%jfx&A42G<3Ae+p9;y_6MFTbb%gGw{Hq&2C-E)j`Ta>g!E5VOZ7H?hxfzpu
zD!)CS`-gjz;$9Kar4nxKC5nN6FE&}<|N4^K*(F!&#}=KZVwW$Q-O_DPU3`=2+WTUb
zKs7g`|G^WvmrGg}bEF2?uKcvBY2&tAT&oywzOH#Y&wg9IvEaq)mfA}W)+BD=I{&uu
zsgB)0t>)y-+`Zc?4=wv6ays>(w}Aa^^MWZYUnSP9%~~b4{9UE1{r6k<dJNKvU)^gB
z3iz?8LvxWbb5YTT2`MM1aaG(t^sFz{uebMW);6|B^X+c@UQkqGd}E8(%pIL#p4GFo
zU%IB0Io)=Y((B%-yeuo)zC|wXve2R1X3yqYF13oE!|`d6vEUAAmyh!g^$BI{x3sTg
zE=`)Wr9d~pP=R5FV%Z8N%lOz+Tt>IT%HLl4`mtQ$^$&x94^!U<r?W|gw&^KrPigx!
bZI#NC&C~U^DKEXUb;WPbFVFl>EerqvWn&S9

delta 1460
zcmaFP`-ppjPQ9OdQb=ThyLn}}bA)3~R9<+Fp_f~3MY?H_cSNdRM2UM+rK^QunoDp-
zGFPgxt5<rix4T(zP;N<%c37B`uX%yKc|^8<a-eojkaI;qW@%z#RzO8mI+w1ULUD11
zZfc5=si~o*f@e`wu4B4_xoferg?C~~PGW#dUS7Vow_9+ApRsRLx_f1CfOl$HhG|kt
zq;t8Ki+*+_S4xSQYod>1l8aAzYMDu4T9BnvZmLD1PfCbOfn#n^L_w8FnXg}wZ$)VK
z#E;_jKBZn2mR06ifu%;JWv&IG-ocTPRiT-og~6qj#(tS5#^EJSzS$;a+QHdeZth0u
zg=yNw`Pos%K^_?)`6X%E+F2I)-rmLjDefT^=HcGyMv1}s7W$4LpF}`B5t40Qm2Fm-
z<x`Sg=pN;26zG@hQRozrRc@po?pyEW?_V06SP)U9U*?wU%jKUL5fD;lY?)yam6_%2
z9a&&jm8zYW5>S$AP?7Bsl$cu*;pk^xUQy*5$fc{Rt6<_DkQA8g993mhnpEnTnBwSC
zmX=zcYF1HbX_oArQDPQW>6Do5m|C8m&J}bf!MfCScCyX$WT$XJkrs&=A2-!=MVMUX
zJfPbDVD4N`(M=nk*&G%)_;B^#Ij5euW&buw=26)y^GSn8X)Ev9?Crser7s@&u)+LO
zW_4S~HNlT7+_%qhIoG4UHY~?6tlIeEBRP{xb0nVpIr4MHJ?{B3v76ZU)%&}8w8Ura
ziFCTq@7yOdT_DS{+xDPC(6IwAUo5M=_^!S}iIwx3eO+qkZO`qq-ixR#<=w@8NAb|)
z+p0F<UhD7roVS=Wdzsd}0`@hhjTb)ulBljYNkQ*x(Bwa}4pguhC>xgOrk>H6|M`gB
zOpoMuLB^g>*Ve7k%;`L^?OZ(T!jxHW0$UzdSRHkiIdvrUbmhuFGhcaX2MS3#o6HQZ
z?Aq~LrQTn|=jguk(~?wnKQ_Pj|HgqE^3kTf21Y0K{<?fnHTqF&cPssc){oMaZwj;i
zm%ZiBvWomU%d(_;UZ}pBx`^*b|NDV$IoUF{|D)Xwt$nn(cG=IRQf^r%<^)ZfBs-mV
zp63dUl{@xtS6FRhw%}9xhl16TUoCcBIvG<r>)O(Jn!j85>i6knHr>xXBv=|9RF;?h
z_~r3EmwUV?o^*2G<@8a<j$^OKgTAkZn@{k(-OKoI3#Y$MLGLoL#|wO~v-6*bDTp;b
z!kcNqcRH{&WBRpQx4vwdzE|f6|HfVaww@A@bjtsy|7&XcV`=uwfAemAHIt3p{CCB+
zdFE<qhukgq`Ye20a@wt@KGgrjOv&3qi^E-7tNH!s+Ad%S=Pf#T@_tmDnOfgNRjqgO
z``H^eK2Q9a^=)@u?bgHFc|ACF4ul?)<*wC@^q%K=?_-Dagm#`AhdGU$f1dhmnUFmH
zyIh%Yp|8Bkt)Jqz?Nzoe*_EPG`~0uW&TQsKZ2iyoG^JhM$Sxc|Q$8)hQL294`IxRZ
z3mr^4cppDzOt-7!EIz(S`QJIVcY4`P|GAFO{q=VB0p}fi<QEjyd*&1@p7Xx!c+tOm
zb}G?VOoYVd|J}*8xH9cg#m!yIXPi1KslWYg=aOd*CEp@n*Bfu_G|cRnWMIH;{(;lv
z(t7#BJI*$TnJhWEIG97xmfygz=zkYmQ~k6LGC4O+i@i+}dsS-R?9-6S%*gZkbmlWo
zwsTAFxb5C25h)&Ef9_n!-ed2JR#&eOI<NWS>dvg=UyQXB^O}OUWhQQ1c~q|R()Vo@
zQA`cnRPx2FBs<e8?O&{2`FE!?|33d9hu6Yh6JGGmTzozJo^F-tqZj_W4`r4-xv||$
z?>fVT<QP92kGOqvmon*2KeUDQ;Flf?h1~F|=U3J~(OFn{S+(8u(6inPueRDQ5?>g+
z<kN9||3b?;)lTW6``Y}fCod#ibMD-^R4jH;jY{;T>a}yU8-ypxeO}ZaEX?|=c+-}z
Khfi*oYX$)PR*b#?

diff --git a/secrets/infra/forgejo-nsc-dispatcher-config.age b/secrets/infra/forgejo-nsc-dispatcher-config.age
index ea48dbd375afebc8a629ecd551a42cb8aa4a46f0..ce726c33709672fe953afcffc6450ec7d7062d11 100644
GIT binary patch
delta 1192
zcmcc4d4qF;PQ7EUp|4A@zj;(<k#<m?rB7&~b6{aWfoZ6=qpO#BsJXXiTCTpAySa0w
z0asLxTXs&QNkO@La*Df0k(+5$U|LzSe?dTglBH2%n7MCZMS7u8nqRP?E0?aFLUD11
zZfc5=si~o*f@e`wu4B4_cX2?TewMzzNr`r;V`_0;qFY67prwJfhjvJwagMp8MSf0X
zNNKTliA7*2m!F%qdy${EM`>wExLb)wUW#{8MX0}piFaf~zH^#OL}^}mo<(u4XHc-o
z#E;_jz800*xdpy%#{M~}<yDobKKYS}<|)n@&Pj&)J`pKyZXS*i?*19YDM9I6Muo{1
zK}qiZt~nO2rS7hl`T7Cn2FcoK`7Ti|d5Qiep4p}Tl?7hK`XQkppF}`BQRwIqlHnVe
zndDyX73pi59~Bl99O{=*mTVCeQdXa25tW)-kz8a}X`Ymx&Q%_mo9tKV<{IH*>Y3*p
zm=RQ*Y+mS?m|x{v>1*O#X<Qy`?C9vB?-W^O!lkRLt59lC7FJS_7vWgt<`v+R6I_y2
zP@->Qp5j_mkZfXV8WiQ?=usGu=aHW4$mQWC{{FUO&C-jrUYDt4ZG7DGqW*Jz$fZOf
z=4bCG?s&57{v$2c$%`+%+u-bDS&_8pc>tg2r*9@FdG9Qqw!l;W=?1>9P19U=SX~ZJ
zsjia9tXRUxeg3(KNA1rS_ZyBC%{chHW1`IWF!viLzb<W)-<?)fr0Z0A<$_e_MGl`A
zv)u}~4!@gs=4E+j(Z}-v)0fY<%>I(KOhc{y*yeDHJ?BJE|5(hR_9}(_e~{c-P5<dU
zX;#JS|3@TC`k8D<sBOtPy8fQ9_qx@6?_ai9{6AuTQt<w#dbb6vF7iGbzN&n&Ymc{I
zXT%;qxl_{D-}_a>OdHozna#JgyzX+B92C%+s~MB>=uBe1aJ<fk`p+%l3Q==Do{g0I
zCdBtbu70UdaHZ=a-#zlVy6%>Wdhgxe2dgv5bu%q95z&6HloEKZa&dcPmt=zN&tzHd
zcYK<smPhaD5fztdc`F*7x2U({;sTB1(|6c5U+;6+>UC!G$^7l_o3bt{?lg9}zV-bg
z*O@Q**Hz3FD${sWt<`t>W2&EK$&&+d+3o%cLCe_c9(dPlY^daOseh+Z{G(}cW@%x%
z@ye);vu>&$%junP>(E)BtGS-P=f4e~zFniaQ0bC(yWW<6EoWx0`<o@BAat{Gi&?Tv
zt^1kzETO5zZ8A)2OH2>3{kdYMDqnvt>C2Xd?$u0ukqczq(iEotlG}Y+N2PL$-gYgm
z@-mgacQ>`)9DMu#WPMNcj=~@V>wSFgp`Wg1%s95@=JeU;rrrLcUe7Znb8E@*4-@=j
zQ-AJPv<$pe{OH1$n&Z_QUmV->W{s~#;Qe1}0c#xHf)jHcXUTu$+%^9?<G*vp3%_sY
zzi4LJSp53Q$M0>o?#AE$^R(!@{=ZLq0yc1|-*aj_*LRcsPP|SXr{$rAr^8Jdl%99R
zPR=@*$!Z`gd1U4hjYVt@la6%HnCM;fd-nc_@9`&czHHmrRB*2{Xm*~((*<u6Cm!Zh
mdw(TwtKbyL&yBVIz4J1?uAFya)b_44$*nl4y8n_7R}27)od@3l

delta 1191
zcmcb?d7X2DPQ9^#XO>T{n?YHTLAIA=c~Dt-v1d?jM1g5(Ri?R<k%v)WhF?ffx`nxG
zIafhtPP%qPS+ZYFVtHAyv1v(_vu~(&y1!R}Pnlb4PGn?-yFs{%L3*KMAeXM4LUD11
zZfc5=si~o*f@e`wu4B4FsZ)5lv1w(Vqgl8`QMR^8fm?Q-Wn{j$w{~_|Qdp61keg*_
zqG6PwVTy+%S7<?qc150rQD~lHNV0!kP<WM-p?OkHp}SF3R6w9>q+?=gQm|W2slG|%
z#E;_jNl9MDZia3qMwWS{nJLCasl{ntY5p0GNl})i-p;uhsV-io&UxuBl_A+&uKuOr
zPJxM`g~rA1Srwj%UjA7*Wl2V+UU>mkmVqw5egOdn5n(2YmWG}npF}`B;gXx0n_6O4
zQ572MS?=kcTT+%>;$%_~n4D&iUr?WGUY6|WoML1WnwC{%!j+ThS{$6{=bKh&lJ8lh
z?U<vV>gAP}=<eq37L?~(W|C9nZlv#Go|5O3&ZVoXtKb#r9%b&6Sm{$#;#8Dtk{A(I
zlICjYo|@&IpXL*2U}2Hy7@AmRVVs<l&6SXlADkC0@lNq1cXsOc&AZl`8`sw#4w)7<
z`{=TOk8(+sSG$Ux-w6iqO-&Ku&oQ~+&Uba;zs^rT6b(<>y_Em6uT^r%n<dlUaTiUI
z`dlrs@wWOY)8&~r=ZG({JJ5Ob&7J19Xz!-hwNXFnZA(LR`&IZ#eZ1!X``0yLb-VwZ
zjrYxVTQ5z?RGPcrbAi#+{Tg-cb`@I=ao1nC)xMS^<(=sXzS)mjPQ~TSV7JPzGmzI`
z82{bou6a(4(xv+WG9DQTvsSRIm{R4-b<uPBrJQvKy?gF(Cu9d&X~tS!_F%d>M{>_@
zmV^cY*3><jEfpbwGJ=sjW=B7lFEi}z)_Q&8OXS&-4y`|8J!_nKQ&P{IuXK3(=oFj%
zR$tb7tDV!=sQdSBT*7Lytar}KcYS*j%62io+PrY;QQdW+)yq6qUsAg~Gr(A0miKtH
zj@wfK-gk_8Zj<kw2u`xwsAhiruk5WIORv;_7MDvs&m^64<6(VRa6;1zlNA!bed6NN
zB2I42`H|1JwI}4~ucG|V^NxO8`qXYm)vB{E8m6iq3K6TnwyMhO-#>%IH{y9uCU3rV
zM`W6u{fvXR=ZLKc-Sa4ap642u!$$Jc&!u&%vwpsMKg3t3_`=eQeh0pqDdc;_<jBkP
zpZMsf*yhCOrWnq_QgOB}M%V6~DccW)&D$bE)n6@j65D$8y4>v-NuIg<0lk+urx;wf
zi&)2SGBoh{+6RK~7S-n_WG-aox$)w=32UQr=L8cWllqmOpH4k!+p&Jy&xc<B{w&j(
z`YqBg$izwTbXHE`vss27cAFB9JlptAyKdgG$je=a?=4+%vtNJ4g`5+dcV}z7Kk{?Q
zlhDLhQkUD=S8SUR6>+`r2-EA6#g0|;0_vNt6=l!T+vBiF>`0u85l_=iy|5Q6oaAy}
zx$=7HsN0@6oh-Ct<C4p*hvqK5mb&SenUG>chrx=^eO9xLTAOdM*eNb}vO>hDV3R|B
k_fD>4wNC;*D*sN_S4IBV?P#x@mt{Pg@zBJE-kgGb06q}_$^ZZW

diff --git a/secrets/infra/forgejo-nsc-token.age b/secrets/infra/forgejo-nsc-token.age
index ebbedd843151b541691ca8b11e357673e5b326b2..87ebd26ee0781c5589678da6ad6e69b3204ddba8 100644
GIT binary patch
delta 777
zcmbQswTEqjPQANjPMT+^M@2wjVTrR(PNijWmT_vbv%X=WUq-IEk)^wtZ-IH4c4}f+
zHdnq&v5#+JP*SnETcVR=NRVm1UtVZohHF+;q=#{VkwrjiUb=QjNI`L`1(&X!LUD11
zZfc5=si~o*f@e`wu4B4FcusCcMS(%0nQxAtlYdrmsat44rAbsoM5VWJsacs{zD2%C
zcv4A5g<-faS4fp}agb4ISb<A!zK3UcqM@a)QHFDVp}&h$Zdz4tRgS-RPI-ujVWhd^
z#E;_jUO8DIez``0W*)x2p-zE@sTCzgeilh($t4AaMM*B&A?86AK9*Ghd9Eg021!8$
zj)jH=zG0?O9%bc4PKBuvQRPW)xn;@esfFp8`mW`fDMij9Ie`WspF}`B;a+Z77H(8v
z;FFn~RAlJsR+SSO7#WdSSzKTl?ol5Ykeg+eUTT_d<PqrT%a!95=;h>-Wl(5ZoE1`1
z5#^p35bBiURvMn=<DKqR5}D>-RhV2*5atwS!lkRLtKd_dXCC4lYM2t0<m!=9YT#<=
z;#yD{=v3($>8u|b6>RL9lM<L%qHW;q%O&S<X>0PdLq7L5Tw^%j5bqin%I;qOZ2z)9
z*Wb4_F8}FsYY}_Gm9vhoUv%u3FD+yjJ*%@oX-C&`#lE|DLTYZm``rHBf42c|&VJ>)
zS{}{f?53~o&uZgtERWoyyVPmstXm%bYRMt@C&=@ueYCsdS=p0kbSS~;o!TdL+oN)S
z*RG2XIifdrs!i0jq)eN=J_(Fz|DGOr+gJa8<+B~UUv8uyUU$v$PlQMv$Jy5RO+i+#
zbC0jQ<z<`{{dem;gH!X26xO{-{r2Oa&+@;|cW^u~;-6XiX6?@<skw{oG-is*NZ0Y@
zraXF<d@DEI@6Ath=gy5bqIwNkt9EVr?4IQ%J8RvZe+ES&$_ph|ynnv1>`;I7p8lLS
ztIAcScUbVfWlCQ3bo&zftAS6afBv&L?9JI^*;QYj%+b2#pxu?V|8C*$9Rj9t52v>o
SpGi{^JtlSXlbp|n{ssW_Q$WZ7

delta 1262
zcmdnPHkWIHPJM7hX^LlIk(*gwkb8PmS$=M+wyBG2NV#d1n|FF}mX}MUen6n7c2Z%8
zBbS$3N_JpGSyn-^X-Il`kfn)#Wl2f8p{1i?Vrp7&xw&U<c$Al!S9n;cBbTn7LUD11
zZfc5=si~o*f@e`wu4B4_u}?^rr*UOOaB`k&U}Qz2mz#4|mRDd{N@hTIXo-h~r)zSt
zPjQi<aaLwBS5A<3aAKCLL6xh2gm!UJj!%|{x2d6XYNc0{cTjS=foEunv0q|HNvN~Q
z#E;_jrG+_WNuGwjMIru<`r(E8xw(bfh9wm~1*NVfrd4Sv230P(9%-3Q+1ajK;lW<v
z`GJMmrYQmb!GWnRK86ul5o!7sj=@>pW*JeA=21Zg?k;(mnW^a@pF}`B5fGm1nH5sz
zVPaV5mTRW(<L2yK7?_gcpPE=uo>HHm<7jT0mhEpG>Xz)B%w?7m5)$d?9bgfjRgj(G
zU7DAdZdRxtWSO0s5}K1_mL277S{`K><y@}q$)&5StKd=P;_78qR34gIW@%87p6a3P
zTwsu08fofLRTvdmS)37?Sdr`<;$t4}%VqWbi44apz14rFcMAmVNV(!<arJ3Eb6vv5
zn{GMXT6gVMU*$VF-S_O1h<Ph=w2drJMf?h!&2mnP?fSJjUoUdZv@G8C)8)W|S6o~d
zroELH`>9Ya8K?DW`M;3;dmWgT1X!Q`Y`snM>36xt72LNb`p7WeDf@T%%ds1e=KSK^
za69ny{<JqeF8woXE1$@SyCt7ql5Q)Pc}lPTYv?Y4Gf@Ipw6^b6v)MCy<AT4P-@eRO
zTU1u~_w6E%eP_KL8rhxdvQ-LY_gDN-yCt9TLrjyYeNpj;$=XZTE)v_`?{qt2#l=;J
zozC;+tSJ6hA}8a0-cITEr~i*SR(vY_64O>%7qRfY8S9gOhGr2Gbv#`rGy3P}Bq@LN
z&+BFodR+gY#8ydpOQqk+hi1+1Dme@nsjM|y!Pr?e(aAf}L*>oaPvz&|wmA8!%-<z&
zZLP;q+q9B*WgT(z9=a_0yvHNYAhBJUb^DC%5htFk`SFdfe{*Qbr^=b7SsX9!6g;`A
z=d%9eJgz6dws0x%B|VT!ZxCK_)yvhEi$z{O?&18O3(NoSs!z#uo~jfpYjMHtNVD~W
zotM-99@<dnlDG5xJth4$lN{6TY*LGVSDkhLq*Jh=;%+tXz>Gx>haYX>=l&Hr`B&?t
z_+!N{fB#<~FPn5}Zp!x~rR}AWm%sN-%AS(Al*J~$e##f|t!a%f>dwFBPL;g$?N{ap
zMVmWS!fG?JOyBJ>>{mZqA9L-M`QBSja#Q|g?>E^bck%I?b5gS%Rvx<IbD_3pR_2zd
z;2%>bIv?t<+b`4jZhCi9f5^ruZ-kDWC}>P+h%{WN%dB)Z`GQJyeOR1d)-{#?cRt^{
z^wYml=GB7-e=I6Ko!F<r6TsBLc)|XwYv<YN2BG%+*BsV-RTLGK|I3xXJe#pTJ3IB~
zJ>i?rZm^}V-q6F7-#kTr)2_EmX3b4=$UktcXOGJ3-V*|B=}WE&_8fouK)7+g-J=j8
z|Mjeg_xN694beTfZqCwet~rUnC-d<4t`PX9E^5MgR4IO)KVw!-zN;C}B)e5xY_v4D
zaQc{692V25V5<37Z*8-Gy4kmxZwx2P+Q@dFU@`lwy8UW^S(vcQ$rY2oNY8V6lzx8t
J9pm^pn*lK$E&l)j

diff --git a/services/forgejo-nsc/deploy/autoscaler.yaml b/services/forgejo-nsc/deploy/autoscaler.yaml
index 96b76b7..bafb81a 100644
--- a/services/forgejo-nsc/deploy/autoscaler.yaml
+++ b/services/forgejo-nsc/deploy/autoscaler.yaml
@@ -25,10 +25,18 @@ instances:
         min_idle: 0
         ttl: "20m"
         machine_type: "8x16"
+      - labels: ["namespace-profile-linux-medium-apple"]
+        min_idle: 0
+        ttl: "30m"
+        machine_type: "8x16"
       - labels: ["namespace-profile-macos-large"]
         min_idle: 0
         ttl: "60m"
         machine_type: "macos/arm64:8x16"
+      - labels: ["namespace-profile-macos-large-apple"]
+        min_idle: 0
+        ttl: "90m"
+        machine_type: "macos/arm64:8x16"
       - labels: ["namespace-profile-windows-large"]
         min_idle: 0
         ttl: "45m"
diff --git a/services/forgejo-nsc/deploy/dispatcher.yaml b/services/forgejo-nsc/deploy/dispatcher.yaml
index 8fea57c..28f55ac 100644
--- a/services/forgejo-nsc/deploy/dispatcher.yaml
+++ b/services/forgejo-nsc/deploy/dispatcher.yaml
@@ -15,7 +15,7 @@ forgejo:
 namespace:
   nsc_binary: "/run/current-system/sw/bin/nsc"
   compute_base_url: "https://ord4.compute.namespaceapis.com"
-  image: "code.forgejo.org/forgejo/runner:3"
+  image: "code.forgejo.org/forgejo/runner:11"
   machine_type: "8x16"
   macos_base_image_id: "tahoe"
   macos_machine_arch: "arm64"