Manual tests

These 10 lanes have no configured recurring GitHub runs and are excluded from ci, full, and Full Integration dispatch. Select a lane explicitly after completing its linked setup; see lane execution and cleanup.

• egress-connected (setup): select explicitly after preparing the protected controller, database, authenticated OpenShell stack, and synthetic HTTPS origin. CI runs the request preflight in checks-baseline-2; the generic openshell lane does not run this qualification.
• egress-custody-installed (setup): verify repository request dispatch and protected response handling on a separately prepared controller and OpenShell pair, with an independent dispatch observer.
• repository-credentials-live: requires an authorized disposable repository and cleanup. See repository credentials.
• postgres-azure-workload-identity: see Azure PostgreSQL tests.
• ssh-host: requires a disposable Linux/systemd host. Its optional model selector adds provider execution. See SSH tests.
• plugin-model: requires a disposable cluster with Envoy Gateway and cert-manager, its Gateway CA certificate and key, an authorized Codex account, an immutable Agent image and three distinct scenario databases. See plugin tests.
• openshell-linear: starts a shipped OpenShell installation and verifies a Linear read through a normal Agent turn. It requires the connected-account file, model and read fixture from Linear qualification.
• k3d-two-cluster: requires two separately prepared clusters, a private configuration file and an OpenAI API key. See two-cluster validation.
• openshell-oauth: requires a prepared OpenShell OAuth gateway, trust files, tokens and a Kubernetes context. See OpenShell OAuth tests.
• image-pair-qualification: requires staged old and new controller and broker images. See image-pair qualification.