Run ephemeral hosts

A campaign coordinates a frozen matrix of work. This skill owns its queue, admission, isolation and evidence. Manage remote resources owns paid provisioning, budget manifests, watchdogs and verified deletion; run remote builds owns source synchronization and collecting worker fixes. Use only the skills required by the requested work. A user-lent host is preserved after campaign-owned workloads are removed.

Read the project's operating contracts before acting: AGENTS.md, package scripts, harness --help, .env.example, and its operations/honesty documents. For this project's evals, read eval instructions, eval honesty, production operations and remote host requirements. Target authorization remains separate from host/workload permission.

Before host selection or authority exposure, read remote host secrets and assurance. Its standing maintainer approval covers named credential classes and local default SSH connections across threads. Honor its direct-copy decision and custody/disposal rules; ask only when existing authorization does not cover the exposure. Read custody mechanics before transfers, including canary placement. Keep values out of prompts, commands, logs and committed source.

Standing configuration and prompt overrides

The canonical copy authorization additionally pre-authorizes workload-needed keys explicitly defined in .env.remote-hosts for this workflow. Read that file as data and transfer only needed keys, never the whole file. Missing configured keys may use another source only when the canonical standing approval or an explicit decision covers it. Spending entries are configuration, not credentials.

Read DEFAULT_REMOTE_HOURLY_SPENDING_LIMIT and DEFAULT_REMOTE_DAILY_SPENDING_LIMIT from the configured environment, including .env.remote-hosts; explicit process environment values take precedence. These USD ceilings authorize spending for the requested work, aggregated across its hosts/providers, including bootstrap, canaries, idle, cleanup, storage, endpoints and egress. Enforce hourly limits against projected aggregate burn and daily limits against incurred plus committed costs in any rolling 24-hour window. Both apply when both exist. Partition allocations in ownership/watchdog manifests and bound a deadline with cleanup reserve.

Explicit prompt instructions override the corresponding configured permission or ceiling; record their effective source. A request to continue changes neither. Missing/blank limits grant no authorization for that dimension; use the explicit prompt budget instead. Invalid, negative, non-finite or ambiguous values require clarification; zero permits no spending. Obtain a concrete budget/deadline if the effective policy cannot bound the work. Configuration does not authorize unrelated work, target activity or additional sensitive-data exposure; apply the canonical host-assurance gates.

Execute the campaign

1. Freeze requested work items/families, repeats, routes/parameters, scoring, per-item caps, recordings, budget/deadline and capacity. Record source/dirty state, build/config identity and run ID. Complete local zero-cost gates and leakage checks before paid work. A canary alone does not satisfy the requested matrix.
2. Read campaign execution details for freeze, bootstrap and configured-path proof. Reuse valid prerequisite evidence under validation overhead. Use the lifecycle skill before renting; on a lent host, inventory existing processes/containers and confine changes to uniquely named owned workspaces/services/ports. Preserve existing SSH keys and authorized_keys.
3. Read synchronization before staging source, refreshing workers or collecting fixes. A coordinator commit/push requires checking applicability before the next affected job: sync the exact applicable revision, rebuild/restart as needed, and record what ran. Preserve worker edits first; unrelated changes do not require redeployment.
4. Prove real backing services, external routes, telemetry and fragile binaries under the exact job environment, then admit one representative canary per distinct failure domain. For parallel Docker/browser evals, read paid eval lanes; for GPU inference/judges, read inference readiness. Build-only workloads need neither model canaries nor browser recordings unless their command requires them.
5. Read the scheduling/recovery section of campaign execution details before parallel dispatch. Use atomic claims or drained immutable partitions, fresh isolated job resources and measured capacity. Apply batch failure policy. On paid infrastructure failure, close affected admissions, preserve the failed item, repair narrowly and prove recovery before reopening; shared/unknown faults stop all affected lanes.
6. Preserve every attempt, exact diagnostics, partial recordings, usage/cost provenance and off-host artifacts. Reconcile persisted valid, invalid, held and remaining cells against the frozen matrix. Publish the model queue and host utilization tables on the production-operations cadence and whenever admission/failure/concurrency/host state changes. Unknown cost remains unknown; preflight is not benchmark credit.

Finish

Stop admissions and reconcile active jobs before removing job-owned targets, containers, networks, volumes and services. Use resource lifecycle for exact-host retirement, credential disposition, verified paid-resource deletion and retained spend history. Keep periodic evidence copies and cleanup supervision active through final reconciliation.

On a lent host, remove only campaign-owned resources and exact appended public-key entries; preserve the host, existing keys and unrelated work. Verify credential removal in place under the canonical custody contract.

Report requested versus valid coverage, failed/replacement items, provenance, recording/trace verification, actual/estimated/unknown spend, credential disposition, cleanup evidence and blockers. Preserve source fixes as coordinator commits.

When adopting these skills elsewhere, copy the local lifecycle/build skills and applicable references, verify every linked contract/helper and record source hashes. Replace project-specific operating contracts with complete equivalents; a copied skill is a snapshot and grants no new spending or credential authorization.