Register a deployment runner and connections

Deployment runners are separate from AI runners. They keep SSH, encryption, registry, cloud, and platform credentials on their host and publish only non-secret facts: the adapters they can execute, their placement labels, and immutable authority aliases.

Who can do this

Workspace Owners and Administrators, under Deployments → Runners and the Connections panel of Deployments → Environments.

Register the runner

1. Choose Register runner.
2. Enter a Runner name and the Placement labels (default domain:deployment, environment:production). Labels select work; they never grant authority.
3. Choose Create registration plan.

The One-time handoff panel shows a single line, DEPLOYMENT_RUNNER_REGISTRATION_TOKEN=…. Inject it once through your secret deployment workflow; the runner exchanges it for its own revocable credential. The token cannot be shown again after I saved the handoff, and it expires after fifteen minutes.

Registration succeeds only for a planned runner whose deployed label set matches the plan. On success the runner is Registered, Active, and Online, and its card shows how many adapters and authority aliases it published. There is no rotation path for a deployment runner credential; register a new runner instead.

Control a runner

Drain lets it finish current work and stop claiming; Disable stops new assignments without interrupting work in progress; Activate returns it to scheduling and requires the runner to be registered. Revoked runners show no actions.

Create a connection

1. On Deployments → Environments, choose New connection in the Connections panel.
2. Enter a Name and pick the Adapter (only adapters that need a connection are listed).
3. Pick the Runner authority: an alias and revision a registered runner published. Aliases whose credential is not configured on the runner are shown as unavailable.
4. If the alias carries an endpoint allowlist, pick the Approved endpoint.
5. Choose Create connection.

No alias exists until a runner has published one, and the form says so. Alias and revision are fixed at creation.

Connection states

Pending, Ready, Error, and Disabled. Disable stops every environment workflow step bound to the connection from validating: deployments that use it cannot be queued or claimed until it is enabled again, and each status change increments the connection’s revision, which invalidates plans that referenced the old one. A legacy connection without an alias shows Rebind required.