# FactoryOS customer runner 0.3.0-rc.1

Preview adding repository enrollment, queued pickup and a local background user
service. FactoryOS offers the customer-hosted packaged harness and direct MCP
execution. The runner uses the customer's configured Codex authentication and
opens PRs through the ordinary harness; humans review and merge.

After one-time installation, configuration and consent, `watch-configure` pins
a repository, approved paths and a committed trusted verification script.
`watch-start --yes` installs a user service. **Run on my runner** saves an audited
request; a connected runner polls and claims it. Offline work waits. An explicit
`--pickup approved` enrollment also permits pickup without a ticket click.
`watch-stop` drains current work and persists a pause until the next start.

Migration 159 and the two automatic runner MCP tools are required. Assignments
are immutable and recovery requires the original grant and claim key. No offline
ownership transfer, automatic takeover, approval or merge authority is added.
Failed checks and unknown process state hold for attention. Keep the private
journal; do not create replacement keys to bypass an unresolved run.

The pinned upstream engine remains tree
`a1f16db8967658e0b1216f21771eb531a4ee6758`. New native and retained shallow external
contracts pass the same normal task/test/review/QA/publication flow. Direct
manual prepare/run/sync remains supported.

Qualification distinguishes local doubles from live service/provider evidence.
The preceding 0.2.0-rc.2 completed a real macOS ARM64 Node 22 Codex subscription
run that opened Demo PR #10, which was closed unmerged after acceptance. That
result does not establish live background pickup for this release. This release
has local protocol, PostgreSQL isolation/concurrency/recovery, deterministic
archive/installer and real-engine tests with declared coding/provider doubles.
Refer to the production rollout record for any later live acceptance.