From f8bd621f181aa2a2d6ed07531168150fd3deea13 Mon Sep 17 00:00:00 2001
From: Nomads_Reach <144523850+NomadsReach@users.noreply.github.com>
Date: Mon, 17 Aug 2026 15:51:31 -0400
Subject: [PATCH] Route acceptance to isolated CO-SERVER runner

---
 .github/workflows/acceptance.yml | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/acceptance.yml b/.github/workflows/acceptance.yml
index 6405d9b..3eef26c 100644
--- a/.github/workflows/acceptance.yml
+++ b/.github/workflows/acceptance.yml
@@ -1,11 +1,5 @@
 name: Acceptance (end-to-end TCP)
 
-# Issue #15 acceptance matrix, executed end-to-end: stands up the real
-# AuthoritativeServer behind the real TCP transport on a loopback port and drives
-# real client sockets through it. If the runner cannot bind a loopback listener,
-# the harness prints SKIP and exits 0 (it still runs for real on dev machines and
-# the NAS runner).
-
 on:
   push:
     paths:
@@ -17,17 +11,22 @@ on:
       - ".github/workflows/acceptance.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   acceptance:
     name: End-to-end TCP acceptance
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: [self-hosted, Linux, X64, co-server]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
 
       - name: Enforce repository runtime policy
         run: bash server/scripts/verify-no-legacy-runtime.sh
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
         env:
           DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
         with: