diff --git a/README.md b/README.md
index 9358e5a..04c2aee 100644
--- a/README.md
+++ b/README.md
@@ -90,55 +90,10 @@ Checks or polls the status of a GitHub Actions workflow run.
     timeout: "30m"
 ```
 
-### Step: `step.gh_compute_gateway`
-
-Submits a GitHub-origin workload to workflow-compute's protected gateway. The
-compute server remains in the execution path; raw agents are not registered as
-GitHub runners. When `write_check` is enabled, the check target must match the
-repository and SHA verified by the compute server.
-
-```yaml
-- type: step.gh_compute_gateway
-  config:
-    server_url: "${COMPUTE_SERVER_URL}"
-    token: "${COMPUTE_GITHUB_TOKEN}"
-    repository: "GoCodeAlone/workflow-compute"
-    oidc_token: "{{.github_oidc_token}}"
-    workflow_run_id: "{{.run_id}}"
-    workflow_job_id: "{{.job_id}}"
-    workflow_job_name: "build"
-    ref: "{{.ref}}"
-    sha: "{{.sha}}"
-    org_id: "org-1"
-    pool_id: "pool-1"
-    policy_id: "policy-1"
-    command_args: ["go", "test", "./..."]
-    wait: true
-    write_check: true
-    check_owner: "GoCodeAlone"
-    check_repo: "workflow-compute"
-    check_sha: "{{.sha}}"
-    check_name: "workflow-compute"
-    check_token: "${GITHUB_TOKEN}"
-```
-
-### Step: `step.gh_create_check`
-
-Creates a GitHub Check Run (commit status check).
-
-```yaml
-- type: step.gh_create_check
-  config:
-    owner: "GoCodeAlone"
-    repo: "workflow"
-    sha: "abc123"
-    name: "workflow-ci"
-    status: "completed"
-    conclusion: "success"
-    title: "CI Pipeline"
-    summary: "All tests passed"
-    token: "${GITHUB_TOKEN}"
-```
+Workflow-compute workloads should be routed through a workflow-compute provider
+or through GitHub's normal self-hosted runner/webhook surfaces. This plugin does
+not expose workflow-compute gateway client steps or generic check-run creation
+steps.
 
 ## Building
 
diff --git a/cmd/github-actions-runner-job/main.go b/cmd/github-actions-runner-job/main.go
index 86f8174..29590c5 100644
--- a/cmd/github-actions-runner-job/main.go
+++ b/cmd/github-actions-runner-job/main.go
@@ -334,6 +334,9 @@ func (d *runnerDriver) RunGitHubJob(ctx context.Context, mode internal.Ephemeral
 		if completion.WorkflowJobID != 0 {
 			result.WorkflowJobID = completion.WorkflowJobID
 		}
+		if completion.WorkflowJobStatus != "" {
+			result.WorkflowJobStatus = completion.WorkflowJobStatus
+		}
 		if err != nil {
 			return result, err
 		}
@@ -367,11 +370,13 @@ func (d *runnerDriver) workflowDispatchInputs(spec internal.EphemeralRunnerJobSp
 }
 
 type githubJobCompletion struct {
-	WorkflowRunID int64
-	WorkflowJobID int64
-	Success       bool
-	Terminal      bool
-	Message       string
+	WorkflowRunID     int64
+	WorkflowJobID     int64
+	WorkflowJobStatus string
+	Assigned          bool
+	Success           bool
+	Terminal          bool
+	Message           string
 }
 
 func (d *runnerDriver) waitForGitHubCompletion(ctx context.Context, runner *runningCommand, runnerName string, dispatchedAfter time.Time) (githubJobCompletion, error) {
@@ -385,7 +390,14 @@ func (d *runnerDriver) waitForGitHubCompletion(ctx context.Context, runner *runn
 			if err != nil {
 				return last, fmt.Errorf("%s failed: %w: %s", filepath.Base(runner.path), err, runner.output())
 			}
-			if completion, err := d.observeTerminalGitHubJob(ctx, runnerName, dispatchedAfter, githubJobExitGracePolls); err == nil && completion.WorkflowRunID != 0 {
+			completion, observeErr := d.observeTerminalGitHubJob(ctx, runnerName, dispatchedAfter, githubJobExitGracePolls)
+			if observeErr != nil {
+				return last, fmt.Errorf("observe GitHub workflow job after runner exit: %w", observeErr)
+			}
+			if completion.WorkflowRunID != 0 {
+				if !completion.Assigned {
+					return completion, fmt.Errorf("%s exited before GitHub workflow job was assigned: %s", filepath.Base(runner.path), completion.Message)
+				}
 				if !completion.Terminal {
 					return completion, fmt.Errorf("%s exited before GitHub workflow job completed: %s", filepath.Base(runner.path), completion.Message)
 				}
@@ -394,7 +406,7 @@ func (d *runnerDriver) waitForGitHubCompletion(ctx context.Context, runner *runn
 				}
 				return completion, nil
 			}
-			return last, nil
+			return last, fmt.Errorf("%s exited before GitHub workflow job was assigned to runner %s", filepath.Base(runner.path), runnerName)
 		case result := <-runner.result:
 			runner.cancel()
 			err, _ := runner.waitAfterCancel(githubRunnerShutdownGrace)
@@ -479,19 +491,32 @@ func (d *runnerDriver) observeGitHubJob(ctx context.Context, runnerName string,
 	if err != nil {
 		return githubJobCompletion{}, err
 	}
+	var unassigned githubJobCompletion
 	for _, run := range runs {
 		jobs, err := d.sidecar.workflowRunJobs(ctx, d.req.Repository, run.ID)
 		if err != nil {
 			return githubJobCompletion{}, err
 		}
 		for _, job := range jobs {
-			if strings.TrimSpace(job.RunnerName) != runnerName {
+			jobRunner := strings.TrimSpace(job.RunnerName)
+			if jobRunner == "" && unassigned.WorkflowRunID == 0 && d.jobLabelsMatchRunner(job.Labels, runnerName) && !strings.EqualFold(job.Status, "completed") && !strings.EqualFold(run.Status, "completed") {
+				unassigned = githubJobCompletion{
+					WorkflowRunID:     run.ID,
+					WorkflowJobID:     job.ID,
+					WorkflowJobStatus: job.Status,
+					Message:           fmt.Sprintf("run=%d job=%d status=%s conclusion=%s runner=unassigned", run.ID, job.ID, job.Status, job.Conclusion),
+				}
+				continue
+			}
+			if jobRunner != runnerName {
 				continue
 			}
 			completion := githubJobCompletion{
-				WorkflowRunID: run.ID,
-				WorkflowJobID: job.ID,
-				Message:       fmt.Sprintf("run=%d job=%d status=%s conclusion=%s runner=%s", run.ID, job.ID, job.Status, job.Conclusion, job.RunnerName),
+				WorkflowRunID:     run.ID,
+				WorkflowJobID:     job.ID,
+				WorkflowJobStatus: job.Status,
+				Assigned:          true,
+				Message:           fmt.Sprintf("run=%d job=%d status=%s conclusion=%s runner=%s", run.ID, job.ID, job.Status, job.Conclusion, job.RunnerName),
 			}
 			if !strings.EqualFold(job.Status, "completed") && !strings.EqualFold(run.Status, "completed") {
 				return completion, nil
@@ -505,7 +530,29 @@ func (d *runnerDriver) observeGitHubJob(ctx context.Context, runnerName string,
 			return completion, nil
 		}
 	}
-	return githubJobCompletion{}, nil
+	return unassigned, nil
+}
+
+func (d *runnerDriver) jobLabelsMatchRunner(jobLabels []string, runnerName string) bool {
+	if len(jobLabels) == 0 {
+		return false
+	}
+	labels := make(map[string]struct{}, len(jobLabels))
+	for _, label := range jobLabels {
+		label = strings.ToLower(strings.TrimSpace(label))
+		if label != "" {
+			labels[label] = struct{}{}
+		}
+	}
+	for _, want := range []string{"self-hosted", strings.ToLower(strings.TrimSpace(runnerName))} {
+		if want == "" {
+			return false
+		}
+		if _, ok := labels[want]; !ok {
+			return false
+		}
+	}
+	return true
 }
 
 func (d *runnerDriver) RemoveOrgRunner(ctx context.Context, organization string, runnerID int64) error {
diff --git a/cmd/github-actions-runner-job/main_test.go b/cmd/github-actions-runner-job/main_test.go
index d5408eb..b4c9f56 100644
--- a/cmd/github-actions-runner-job/main_test.go
+++ b/cmd/github-actions-runner-job/main_test.go
@@ -78,7 +78,10 @@ func TestT915CommandRunsDynamicProviderEnvelopeThroughSidecarAndRunner(t *testin
 			w.WriteHeader(http.StatusNoContent)
 		case r.Method == http.MethodGet && r.URL.Path == "/v1/actions/repos/GoCodeAlone/workflow-compute/workflows/dogfood.yml/runs":
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte(`{"workflow_runs":[]}`))
+			_, _ = w.Write([]byte(`{"workflow_runs":[{"id":28449657934,"status":"completed","conclusion":"success"}]}`))
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/actions/repos/GoCodeAlone/workflow-compute/actions/runs/28449657934/jobs":
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"jobs":[{"id":84308154551,"run_id":28449657934,"status":"completed","conclusion":"success","runner_name":"wfc-stg-ghp-linux-abcdef987249-543210f71ee4"}]}`))
 		default:
 			t.Fatalf("unexpected sidecar request: %s %s", r.Method, r.URL.Path)
 		}
@@ -150,7 +153,7 @@ func TestT915CommandRunsDynamicProviderEnvelopeThroughSidecarAndRunner(t *testin
 		t.Fatalf("artifacts = %#v", result.Artifacts)
 	}
 	proof := readFile(t, filepath.Join(workspace, "github-runner-proof.json"))
-	for _, want := range []string{"wfc-stg-ghp-linux-abcdef987249-543210f71ee4", "task-abcdef9876543210", "removed"} {
+	for _, want := range []string{"wfc-stg-ghp-linux-abcdef987249-543210f71ee4", "task-abcdef9876543210", "28449657934", "84308154551", "completed", "removed"} {
 		if !strings.Contains(proof, want) {
 			t.Fatalf("proof missing %q:\n%s", want, proof)
 		}
@@ -599,6 +602,146 @@ func TestT915CommandRejectsRunnerExitBeforeGitHubJobTerminal(t *testing.T) {
 	}
 }
 
+func TestT916CommandRejectsRunnerExitBeforeGitHubJobAssignment(t *testing.T) {
+	oldPoll := githubJobPollInterval
+	githubJobPollInterval = 10 * time.Millisecond
+	t.Cleanup(func() { githubJobPollInterval = oldPoll })
+
+	workspace := t.TempDir()
+	sidecar := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Bearer provider-token" {
+			t.Fatalf("authorization = %q", got)
+		}
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/actions/orgs/GoCodeAlone/runners/registration-token":
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write([]byte(`{"token":"runner-registration-token","expires_at":"2026-06-26T22:00:00Z"}`))
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/actions/repos/GoCodeAlone/workflow-compute/workflows/dogfood.yml/dispatches":
+			w.WriteHeader(http.StatusNoContent)
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/actions/repos/GoCodeAlone/workflow-compute/workflows/dogfood.yml/runs":
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"workflow_runs":[{"id":28469568301,"status":"queued"}]}`))
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/actions/repos/GoCodeAlone/workflow-compute/actions/runs/28469568301/jobs":
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"jobs":[{"id":84378204611,"run_id":28469568301,"status":"queued","runner_name":"","labels":["self-hosted","linux","wfc-stg-ghp-linux-abcdef987249-543210f71ee4","wfc-ghp-stg","wfc-ghp-ephemeral"]}]}`))
+		case r.Method == http.MethodDelete && r.URL.Path == "/v1/actions/orgs/GoCodeAlone/runners/42":
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Fatalf("unexpected sidecar request: %s %s", r.Method, r.URL.String())
+		}
+	}))
+	t.Cleanup(sidecar.Close)
+
+	runnerDir := t.TempDir()
+	writeExecutable(t, filepath.Join(runnerDir, "config.sh"), "#!/bin/sh\nprintf '{\"agentId\":42}\\n' > .runner\n")
+	writeExecutable(t, filepath.Join(runnerDir, "run.sh"), "#!/bin/sh\nexit 0\n")
+	t.Chdir(workspace)
+	t.Setenv("COMPUTE_GITHUB_RUNNER_PROVIDER_URL", sidecar.URL)
+	t.Setenv("COMPUTE_GITHUB_RUNNER_PROVIDER_TOKEN", "provider-token")
+	t.Setenv("GITHUB_ACTIONS_RUNNER_DIR", runnerDir)
+	t.Setenv("GITHUB_ACTIONS_RUNNER_JOB_TEST_DIR", workspace)
+
+	input := strings.NewReader(`{
+	  "protocol_version":"compute.v1alpha1",
+	  "task_id":"task-abcdef9876543210",
+	  "lease_id":"lease-1",
+	  "provider_config":{"plugin_id":"workflow-plugin-github","provider_id":"github-actions-runner"},
+	  "operation":"ephemeral_runner_job",
+	  "input":{
+	    "mode":"dispatch_then_wait",
+	    "environment":"stg",
+	    "os":"linux",
+	    "worker_id":"worker-0123456789abcdef",
+	    "task_id":"task-abcdef9876543210",
+	    "organization":"GoCodeAlone",
+	    "repository":"GoCodeAlone/workflow-compute",
+	    "workflow":"dogfood.yml",
+	    "ref":"main",
+	    "runner_group":"ephemeral",
+	    "timeout_seconds":2
+	  }
+	}`)
+	var stdout, stderr bytes.Buffer
+	err := runWithIO([]string{}, input, &stdout, &stderr)
+	if err == nil || !strings.Contains(err.Error(), "exited before GitHub workflow job was assigned") {
+		t.Fatalf("expected unassigned runner exit error, got %v\nstderr:\n%s", err, stderr.String())
+	}
+	proof := readFile(t, filepath.Join(workspace, "github-runner-proof.json"))
+	for _, want := range []string{"28469568301", "84378204611", "queued"} {
+		if !strings.Contains(proof, want) {
+			t.Fatalf("proof missing %q:\n%s", want, proof)
+		}
+	}
+}
+
+func TestT916CommandPropagatesObservationErrorAfterRunnerExit(t *testing.T) {
+	oldPoll := githubJobPollInterval
+	githubJobPollInterval = time.Hour
+	t.Cleanup(func() { githubJobPollInterval = oldPoll })
+
+	workspace := t.TempDir()
+	sidecar := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Bearer provider-token" {
+			t.Fatalf("authorization = %q", got)
+		}
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/actions/orgs/GoCodeAlone/runners/registration-token":
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write([]byte(`{"token":"runner-registration-token","expires_at":"2026-06-26T22:00:00Z"}`))
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/actions/repos/GoCodeAlone/workflow-compute/workflows/dogfood.yml/dispatches":
+			w.WriteHeader(http.StatusNoContent)
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/actions/repos/GoCodeAlone/workflow-compute/workflows/dogfood.yml/runs":
+			http.Error(w, "sidecar unavailable", http.StatusBadGateway)
+		case r.Method == http.MethodDelete && r.URL.Path == "/v1/actions/orgs/GoCodeAlone/runners/42":
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Fatalf("unexpected sidecar request: %s %s", r.Method, r.URL.String())
+		}
+	}))
+	t.Cleanup(sidecar.Close)
+
+	runnerDir := t.TempDir()
+	writeExecutable(t, filepath.Join(runnerDir, "config.sh"), "#!/bin/sh\nprintf '{\"agentId\":42}\\n' > .runner\n")
+	writeExecutable(t, filepath.Join(runnerDir, "run.sh"), "#!/bin/sh\nexit 0\n")
+	t.Chdir(workspace)
+	t.Setenv("COMPUTE_GITHUB_RUNNER_PROVIDER_URL", sidecar.URL)
+	t.Setenv("COMPUTE_GITHUB_RUNNER_PROVIDER_TOKEN", "provider-token")
+	t.Setenv("GITHUB_ACTIONS_RUNNER_DIR", runnerDir)
+	t.Setenv("GITHUB_ACTIONS_RUNNER_JOB_TEST_DIR", workspace)
+
+	input := strings.NewReader(`{
+	  "protocol_version":"compute.v1alpha1",
+	  "task_id":"task-abcdef9876543210",
+	  "lease_id":"lease-1",
+	  "provider_config":{"plugin_id":"workflow-plugin-github","provider_id":"github-actions-runner"},
+	  "operation":"ephemeral_runner_job",
+	  "input":{
+	    "mode":"dispatch_then_wait",
+	    "environment":"stg",
+	    "os":"linux",
+	    "worker_id":"worker-0123456789abcdef",
+	    "task_id":"task-abcdef9876543210",
+	    "organization":"GoCodeAlone",
+	    "repository":"GoCodeAlone/workflow-compute",
+	    "workflow":"dogfood.yml",
+	    "ref":"main",
+	    "runner_group":"ephemeral",
+	    "timeout_seconds":2
+	  }
+	}`)
+	var stdout, stderr bytes.Buffer
+	err := runWithIO([]string{}, input, &stdout, &stderr)
+	if err == nil || !strings.Contains(err.Error(), "observe GitHub workflow job after runner exit") || !strings.Contains(err.Error(), "status 502") {
+		t.Fatalf("expected observation error, got %v\nstderr:\n%s", err, stderr.String())
+	}
+	proof := readFile(t, filepath.Join(workspace, "github-runner-proof.json"))
+	for _, want := range []string{"wfc-stg-ghp-linux-abcdef987249-543210f71ee4", "removed"} {
+		if !strings.Contains(proof, want) {
+			t.Fatalf("proof missing %q:\n%s", want, proof)
+		}
+	}
+}
+
 func TestT915CommandAllowsBriefGitHubJobAPICompletionLagAfterRunnerExit(t *testing.T) {
 	oldPoll := githubJobPollInterval
 	githubJobPollInterval = 10 * time.Millisecond
diff --git a/gen/github.pb.go b/gen/github.pb.go
index 3b0db3b..aa4d592 100644
--- a/gen/github.pb.go
+++ b/gen/github.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.0
+// 	protoc        v7.35.1
 // source: github.proto
 
 package githubv1
@@ -669,652 +669,6 @@ func (x *ActionStatusOutput) GetUrl() string {
 	return ""
 }
 
-// ComputeGatewayConfig is the typed config for step.gh_compute_gateway.
-type ComputeGatewayConfig struct {
-	state                 protoimpl.MessageState `protogen:"open.v1"`
-	ServerUrl             string                 `protobuf:"bytes,1,opt,name=server_url,json=serverUrl,proto3" json:"server_url,omitempty"`
-	Token                 string                 `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
-	Repository            string                 `protobuf:"bytes,3,opt,name=repository,proto3" json:"repository,omitempty"`
-	OidcToken             string                 `protobuf:"bytes,4,opt,name=oidc_token,json=oidcToken,proto3" json:"oidc_token,omitempty"`
-	WorkflowRunId         string                 `protobuf:"bytes,5,opt,name=workflow_run_id,json=workflowRunId,proto3" json:"workflow_run_id,omitempty"`
-	WorkflowRunAttempt    string                 `protobuf:"bytes,6,opt,name=workflow_run_attempt,json=workflowRunAttempt,proto3" json:"workflow_run_attempt,omitempty"`
-	WorkflowJobId         string                 `protobuf:"bytes,7,opt,name=workflow_job_id,json=workflowJobId,proto3" json:"workflow_job_id,omitempty"`
-	WorkflowJobName       string                 `protobuf:"bytes,8,opt,name=workflow_job_name,json=workflowJobName,proto3" json:"workflow_job_name,omitempty"`
-	Ref                   string                 `protobuf:"bytes,9,opt,name=ref,proto3" json:"ref,omitempty"`
-	Sha                   string                 `protobuf:"bytes,10,opt,name=sha,proto3" json:"sha,omitempty"`
-	OrgId                 string                 `protobuf:"bytes,11,opt,name=org_id,json=orgId,proto3" json:"org_id,omitempty"`
-	PoolId                string                 `protobuf:"bytes,12,opt,name=pool_id,json=poolId,proto3" json:"pool_id,omitempty"`
-	PolicyId              string                 `protobuf:"bytes,13,opt,name=policy_id,json=policyId,proto3" json:"policy_id,omitempty"`
-	CommandArgs           []string               `protobuf:"bytes,14,rep,name=command_args,json=commandArgs,proto3" json:"command_args,omitempty"`
-	WorkingDirectory      string                 `protobuf:"bytes,15,opt,name=working_directory,json=workingDirectory,proto3" json:"working_directory,omitempty"`
-	ArtifactAllowlist     []string               `protobuf:"bytes,16,rep,name=artifact_allowlist,json=artifactAllowlist,proto3" json:"artifact_allowlist,omitempty"`
-	Labels                *structpb.Struct       `protobuf:"bytes,17,opt,name=labels,proto3" json:"labels,omitempty"`
-	ExecutorProvider      string                 `protobuf:"bytes,18,opt,name=executor_provider,json=executorProvider,proto3" json:"executor_provider,omitempty"`
-	ExecutionSecurityTier string                 `protobuf:"bytes,19,opt,name=execution_security_tier,json=executionSecurityTier,proto3" json:"execution_security_tier,omitempty"`
-	ProofTier             string                 `protobuf:"bytes,20,opt,name=proof_tier,json=proofTier,proto3" json:"proof_tier,omitempty"`
-	HardwareClass         string                 `protobuf:"bytes,21,opt,name=hardware_class,json=hardwareClass,proto3" json:"hardware_class,omitempty"`
-	Wait                  bool                   `protobuf:"varint,22,opt,name=wait,proto3" json:"wait,omitempty"`
-	PollInterval          string                 `protobuf:"bytes,23,opt,name=poll_interval,json=pollInterval,proto3" json:"poll_interval,omitempty"`
-	Timeout               string                 `protobuf:"bytes,24,opt,name=timeout,proto3" json:"timeout,omitempty"`
-	WriteCheck            bool                   `protobuf:"varint,25,opt,name=write_check,json=writeCheck,proto3" json:"write_check,omitempty"`
-	CheckOwner            string                 `protobuf:"bytes,26,opt,name=check_owner,json=checkOwner,proto3" json:"check_owner,omitempty"`
-	CheckRepo             string                 `protobuf:"bytes,27,opt,name=check_repo,json=checkRepo,proto3" json:"check_repo,omitempty"`
-	CheckSha              string                 `protobuf:"bytes,28,opt,name=check_sha,json=checkSha,proto3" json:"check_sha,omitempty"`
-	CheckName             string                 `protobuf:"bytes,29,opt,name=check_name,json=checkName,proto3" json:"check_name,omitempty"`
-	CheckToken            string                 `protobuf:"bytes,30,opt,name=check_token,json=checkToken,proto3" json:"check_token,omitempty"`
-	unknownFields         protoimpl.UnknownFields
-	sizeCache             protoimpl.SizeCache
-}
-
-func (x *ComputeGatewayConfig) Reset() {
-	*x = ComputeGatewayConfig{}
-	mi := &file_github_proto_msgTypes[9]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ComputeGatewayConfig) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ComputeGatewayConfig) ProtoMessage() {}
-
-func (x *ComputeGatewayConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[9]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ComputeGatewayConfig.ProtoReflect.Descriptor instead.
-func (*ComputeGatewayConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{9}
-}
-
-func (x *ComputeGatewayConfig) GetServerUrl() string {
-	if x != nil {
-		return x.ServerUrl
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetToken() string {
-	if x != nil {
-		return x.Token
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetRepository() string {
-	if x != nil {
-		return x.Repository
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetOidcToken() string {
-	if x != nil {
-		return x.OidcToken
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetWorkflowRunId() string {
-	if x != nil {
-		return x.WorkflowRunId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetWorkflowRunAttempt() string {
-	if x != nil {
-		return x.WorkflowRunAttempt
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetWorkflowJobId() string {
-	if x != nil {
-		return x.WorkflowJobId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetWorkflowJobName() string {
-	if x != nil {
-		return x.WorkflowJobName
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetRef() string {
-	if x != nil {
-		return x.Ref
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetSha() string {
-	if x != nil {
-		return x.Sha
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetOrgId() string {
-	if x != nil {
-		return x.OrgId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetPoolId() string {
-	if x != nil {
-		return x.PoolId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetPolicyId() string {
-	if x != nil {
-		return x.PolicyId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetCommandArgs() []string {
-	if x != nil {
-		return x.CommandArgs
-	}
-	return nil
-}
-
-func (x *ComputeGatewayConfig) GetWorkingDirectory() string {
-	if x != nil {
-		return x.WorkingDirectory
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetArtifactAllowlist() []string {
-	if x != nil {
-		return x.ArtifactAllowlist
-	}
-	return nil
-}
-
-func (x *ComputeGatewayConfig) GetLabels() *structpb.Struct {
-	if x != nil {
-		return x.Labels
-	}
-	return nil
-}
-
-func (x *ComputeGatewayConfig) GetExecutorProvider() string {
-	if x != nil {
-		return x.ExecutorProvider
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetExecutionSecurityTier() string {
-	if x != nil {
-		return x.ExecutionSecurityTier
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetProofTier() string {
-	if x != nil {
-		return x.ProofTier
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetHardwareClass() string {
-	if x != nil {
-		return x.HardwareClass
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetWait() bool {
-	if x != nil {
-		return x.Wait
-	}
-	return false
-}
-
-func (x *ComputeGatewayConfig) GetPollInterval() string {
-	if x != nil {
-		return x.PollInterval
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetTimeout() string {
-	if x != nil {
-		return x.Timeout
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetWriteCheck() bool {
-	if x != nil {
-		return x.WriteCheck
-	}
-	return false
-}
-
-func (x *ComputeGatewayConfig) GetCheckOwner() string {
-	if x != nil {
-		return x.CheckOwner
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetCheckRepo() string {
-	if x != nil {
-		return x.CheckRepo
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetCheckSha() string {
-	if x != nil {
-		return x.CheckSha
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetCheckName() string {
-	if x != nil {
-		return x.CheckName
-	}
-	return ""
-}
-
-func (x *ComputeGatewayConfig) GetCheckToken() string {
-	if x != nil {
-		return x.CheckToken
-	}
-	return ""
-}
-
-// ComputeGatewayInput carries runtime inputs for step.gh_compute_gateway.
-type ComputeGatewayInput struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Data          *structpb.Struct       `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ComputeGatewayInput) Reset() {
-	*x = ComputeGatewayInput{}
-	mi := &file_github_proto_msgTypes[10]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ComputeGatewayInput) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ComputeGatewayInput) ProtoMessage() {}
-
-func (x *ComputeGatewayInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[10]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ComputeGatewayInput.ProtoReflect.Descriptor instead.
-func (*ComputeGatewayInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{10}
-}
-
-func (x *ComputeGatewayInput) GetData() *structpb.Struct {
-	if x != nil {
-		return x.Data
-	}
-	return nil
-}
-
-// ComputeGatewayOutput holds the result of step.gh_compute_gateway.
-type ComputeGatewayOutput struct {
-	state          protoimpl.MessageState `protogen:"open.v1"`
-	TaskId         string                 `protobuf:"bytes,1,opt,name=task_id,json=taskId,proto3" json:"task_id,omitempty"`
-	Status         string                 `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
-	Conclusion     string                 `protobuf:"bytes,3,opt,name=conclusion,proto3" json:"conclusion,omitempty"`
-	ProofId        string                 `protobuf:"bytes,4,opt,name=proof_id,json=proofId,proto3" json:"proof_id,omitempty"`
-	ArtifactHash   string                 `protobuf:"bytes,5,opt,name=artifact_hash,json=artifactHash,proto3" json:"artifact_hash,omitempty"`
-	ContributionId string                 `protobuf:"bytes,6,opt,name=contribution_id,json=contributionId,proto3" json:"contribution_id,omitempty"`
-	WorkerId       string                 `protobuf:"bytes,7,opt,name=worker_id,json=workerId,proto3" json:"worker_id,omitempty"`
-	CheckRunId     int64                  `protobuf:"varint,8,opt,name=check_run_id,json=checkRunId,proto3" json:"check_run_id,omitempty"`
-	CheckUrl       string                 `protobuf:"bytes,9,opt,name=check_url,json=checkUrl,proto3" json:"check_url,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
-}
-
-func (x *ComputeGatewayOutput) Reset() {
-	*x = ComputeGatewayOutput{}
-	mi := &file_github_proto_msgTypes[11]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ComputeGatewayOutput) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ComputeGatewayOutput) ProtoMessage() {}
-
-func (x *ComputeGatewayOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[11]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ComputeGatewayOutput.ProtoReflect.Descriptor instead.
-func (*ComputeGatewayOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{11}
-}
-
-func (x *ComputeGatewayOutput) GetTaskId() string {
-	if x != nil {
-		return x.TaskId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayOutput) GetStatus() string {
-	if x != nil {
-		return x.Status
-	}
-	return ""
-}
-
-func (x *ComputeGatewayOutput) GetConclusion() string {
-	if x != nil {
-		return x.Conclusion
-	}
-	return ""
-}
-
-func (x *ComputeGatewayOutput) GetProofId() string {
-	if x != nil {
-		return x.ProofId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayOutput) GetArtifactHash() string {
-	if x != nil {
-		return x.ArtifactHash
-	}
-	return ""
-}
-
-func (x *ComputeGatewayOutput) GetContributionId() string {
-	if x != nil {
-		return x.ContributionId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayOutput) GetWorkerId() string {
-	if x != nil {
-		return x.WorkerId
-	}
-	return ""
-}
-
-func (x *ComputeGatewayOutput) GetCheckRunId() int64 {
-	if x != nil {
-		return x.CheckRunId
-	}
-	return 0
-}
-
-func (x *ComputeGatewayOutput) GetCheckUrl() string {
-	if x != nil {
-		return x.CheckUrl
-	}
-	return ""
-}
-
-// CreateCheckConfig is the typed config for step.gh_create_check.
-type CreateCheckConfig struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Owner         string                 `protobuf:"bytes,1,opt,name=owner,proto3" json:"owner,omitempty"`
-	Repo          string                 `protobuf:"bytes,2,opt,name=repo,proto3" json:"repo,omitempty"`
-	Sha           string                 `protobuf:"bytes,3,opt,name=sha,proto3" json:"sha,omitempty"`
-	Name          string                 `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
-	Status        string                 `protobuf:"bytes,5,opt,name=status,proto3" json:"status,omitempty"`
-	Conclusion    string                 `protobuf:"bytes,6,opt,name=conclusion,proto3" json:"conclusion,omitempty"`
-	Title         string                 `protobuf:"bytes,7,opt,name=title,proto3" json:"title,omitempty"`
-	Summary       string                 `protobuf:"bytes,8,opt,name=summary,proto3" json:"summary,omitempty"`
-	Token         string                 `protobuf:"bytes,9,opt,name=token,proto3" json:"token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateCheckConfig) Reset() {
-	*x = CreateCheckConfig{}
-	mi := &file_github_proto_msgTypes[12]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateCheckConfig) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateCheckConfig) ProtoMessage() {}
-
-func (x *CreateCheckConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[12]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateCheckConfig.ProtoReflect.Descriptor instead.
-func (*CreateCheckConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{12}
-}
-
-func (x *CreateCheckConfig) GetOwner() string {
-	if x != nil {
-		return x.Owner
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetRepo() string {
-	if x != nil {
-		return x.Repo
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetSha() string {
-	if x != nil {
-		return x.Sha
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetStatus() string {
-	if x != nil {
-		return x.Status
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetConclusion() string {
-	if x != nil {
-		return x.Conclusion
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetTitle() string {
-	if x != nil {
-		return x.Title
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetSummary() string {
-	if x != nil {
-		return x.Summary
-	}
-	return ""
-}
-
-func (x *CreateCheckConfig) GetToken() string {
-	if x != nil {
-		return x.Token
-	}
-	return ""
-}
-
-// CreateCheckInput carries runtime inputs for step.gh_create_check.
-type CreateCheckInput struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Data          *structpb.Struct       `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateCheckInput) Reset() {
-	*x = CreateCheckInput{}
-	mi := &file_github_proto_msgTypes[13]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateCheckInput) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateCheckInput) ProtoMessage() {}
-
-func (x *CreateCheckInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[13]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateCheckInput.ProtoReflect.Descriptor instead.
-func (*CreateCheckInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{13}
-}
-
-func (x *CreateCheckInput) GetData() *structpb.Struct {
-	if x != nil {
-		return x.Data
-	}
-	return nil
-}
-
-// CreateCheckOutput holds the result of step.gh_create_check.
-type CreateCheckOutput struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	CheckRunId    int64                  `protobuf:"varint,1,opt,name=check_run_id,json=checkRunId,proto3" json:"check_run_id,omitempty"`
-	Status        string                 `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
-	Url           string                 `protobuf:"bytes,3,opt,name=url,proto3" json:"url,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateCheckOutput) Reset() {
-	*x = CreateCheckOutput{}
-	mi := &file_github_proto_msgTypes[14]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateCheckOutput) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateCheckOutput) ProtoMessage() {}
-
-func (x *CreateCheckOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[14]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateCheckOutput.ProtoReflect.Descriptor instead.
-func (*CreateCheckOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{14}
-}
-
-func (x *CreateCheckOutput) GetCheckRunId() int64 {
-	if x != nil {
-		return x.CheckRunId
-	}
-	return 0
-}
-
-func (x *CreateCheckOutput) GetStatus() string {
-	if x != nil {
-		return x.Status
-	}
-	return ""
-}
-
-func (x *CreateCheckOutput) GetUrl() string {
-	if x != nil {
-		return x.Url
-	}
-	return ""
-}
-
 // PRCreateConfig is the typed config for step.gh_pr_create.
 type PRCreateConfig struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -1332,7 +686,7 @@ type PRCreateConfig struct {
 
 func (x *PRCreateConfig) Reset() {
 	*x = PRCreateConfig{}
-	mi := &file_github_proto_msgTypes[15]
+	mi := &file_github_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1344,7 +698,7 @@ func (x *PRCreateConfig) String() string {
 func (*PRCreateConfig) ProtoMessage() {}
 
 func (x *PRCreateConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[15]
+	mi := &file_github_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1357,7 +711,7 @@ func (x *PRCreateConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRCreateConfig.ProtoReflect.Descriptor instead.
 func (*PRCreateConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{15}
+	return file_github_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *PRCreateConfig) GetOwner() string {
@@ -1426,7 +780,7 @@ type PRCreateInput struct {
 
 func (x *PRCreateInput) Reset() {
 	*x = PRCreateInput{}
-	mi := &file_github_proto_msgTypes[16]
+	mi := &file_github_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1438,7 +792,7 @@ func (x *PRCreateInput) String() string {
 func (*PRCreateInput) ProtoMessage() {}
 
 func (x *PRCreateInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[16]
+	mi := &file_github_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1451,7 +805,7 @@ func (x *PRCreateInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRCreateInput.ProtoReflect.Descriptor instead.
 func (*PRCreateInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{16}
+	return file_github_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *PRCreateInput) GetData() *structpb.Struct {
@@ -1474,7 +828,7 @@ type PRCreateOutput struct {
 
 func (x *PRCreateOutput) Reset() {
 	*x = PRCreateOutput{}
-	mi := &file_github_proto_msgTypes[17]
+	mi := &file_github_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1486,7 +840,7 @@ func (x *PRCreateOutput) String() string {
 func (*PRCreateOutput) ProtoMessage() {}
 
 func (x *PRCreateOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[17]
+	mi := &file_github_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1499,7 +853,7 @@ func (x *PRCreateOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRCreateOutput.ProtoReflect.Descriptor instead.
 func (*PRCreateOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{17}
+	return file_github_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *PRCreateOutput) GetNumber() int64 {
@@ -1545,7 +899,7 @@ type PRMergeConfig struct {
 
 func (x *PRMergeConfig) Reset() {
 	*x = PRMergeConfig{}
-	mi := &file_github_proto_msgTypes[18]
+	mi := &file_github_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1557,7 +911,7 @@ func (x *PRMergeConfig) String() string {
 func (*PRMergeConfig) ProtoMessage() {}
 
 func (x *PRMergeConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[18]
+	mi := &file_github_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1570,7 +924,7 @@ func (x *PRMergeConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRMergeConfig.ProtoReflect.Descriptor instead.
 func (*PRMergeConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{18}
+	return file_github_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *PRMergeConfig) GetOwner() string {
@@ -1625,7 +979,7 @@ type PRMergeInput struct {
 
 func (x *PRMergeInput) Reset() {
 	*x = PRMergeInput{}
-	mi := &file_github_proto_msgTypes[19]
+	mi := &file_github_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1637,7 +991,7 @@ func (x *PRMergeInput) String() string {
 func (*PRMergeInput) ProtoMessage() {}
 
 func (x *PRMergeInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[19]
+	mi := &file_github_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1650,7 +1004,7 @@ func (x *PRMergeInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRMergeInput.ProtoReflect.Descriptor instead.
 func (*PRMergeInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{19}
+	return file_github_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *PRMergeInput) GetData() *structpb.Struct {
@@ -1672,7 +1026,7 @@ type PRMergeOutput struct {
 
 func (x *PRMergeOutput) Reset() {
 	*x = PRMergeOutput{}
-	mi := &file_github_proto_msgTypes[20]
+	mi := &file_github_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1684,7 +1038,7 @@ func (x *PRMergeOutput) String() string {
 func (*PRMergeOutput) ProtoMessage() {}
 
 func (x *PRMergeOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[20]
+	mi := &file_github_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1697,7 +1051,7 @@ func (x *PRMergeOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRMergeOutput.ProtoReflect.Descriptor instead.
 func (*PRMergeOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{20}
+	return file_github_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *PRMergeOutput) GetMerged() bool {
@@ -1735,7 +1089,7 @@ type PRCommentConfig struct {
 
 func (x *PRCommentConfig) Reset() {
 	*x = PRCommentConfig{}
-	mi := &file_github_proto_msgTypes[21]
+	mi := &file_github_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1747,7 +1101,7 @@ func (x *PRCommentConfig) String() string {
 func (*PRCommentConfig) ProtoMessage() {}
 
 func (x *PRCommentConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[21]
+	mi := &file_github_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1760,7 +1114,7 @@ func (x *PRCommentConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRCommentConfig.ProtoReflect.Descriptor instead.
 func (*PRCommentConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{21}
+	return file_github_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *PRCommentConfig) GetOwner() string {
@@ -1808,7 +1162,7 @@ type PRCommentInput struct {
 
 func (x *PRCommentInput) Reset() {
 	*x = PRCommentInput{}
-	mi := &file_github_proto_msgTypes[22]
+	mi := &file_github_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1820,7 +1174,7 @@ func (x *PRCommentInput) String() string {
 func (*PRCommentInput) ProtoMessage() {}
 
 func (x *PRCommentInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[22]
+	mi := &file_github_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1833,7 +1187,7 @@ func (x *PRCommentInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRCommentInput.ProtoReflect.Descriptor instead.
 func (*PRCommentInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{22}
+	return file_github_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *PRCommentInput) GetData() *structpb.Struct {
@@ -1854,7 +1208,7 @@ type PRCommentOutput struct {
 
 func (x *PRCommentOutput) Reset() {
 	*x = PRCommentOutput{}
-	mi := &file_github_proto_msgTypes[23]
+	mi := &file_github_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1866,7 +1220,7 @@ func (x *PRCommentOutput) String() string {
 func (*PRCommentOutput) ProtoMessage() {}
 
 func (x *PRCommentOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[23]
+	mi := &file_github_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1879,7 +1233,7 @@ func (x *PRCommentOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRCommentOutput.ProtoReflect.Descriptor instead.
 func (*PRCommentOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{23}
+	return file_github_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *PRCommentOutput) GetCommentId() int64 {
@@ -1911,7 +1265,7 @@ type PRReviewConfig struct {
 
 func (x *PRReviewConfig) Reset() {
 	*x = PRReviewConfig{}
-	mi := &file_github_proto_msgTypes[24]
+	mi := &file_github_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1923,7 +1277,7 @@ func (x *PRReviewConfig) String() string {
 func (*PRReviewConfig) ProtoMessage() {}
 
 func (x *PRReviewConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[24]
+	mi := &file_github_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1936,7 +1290,7 @@ func (x *PRReviewConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRReviewConfig.ProtoReflect.Descriptor instead.
 func (*PRReviewConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{24}
+	return file_github_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *PRReviewConfig) GetOwner() string {
@@ -1991,7 +1345,7 @@ type PRReviewInput struct {
 
 func (x *PRReviewInput) Reset() {
 	*x = PRReviewInput{}
-	mi := &file_github_proto_msgTypes[25]
+	mi := &file_github_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2003,7 +1357,7 @@ func (x *PRReviewInput) String() string {
 func (*PRReviewInput) ProtoMessage() {}
 
 func (x *PRReviewInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[25]
+	mi := &file_github_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2016,7 +1370,7 @@ func (x *PRReviewInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRReviewInput.ProtoReflect.Descriptor instead.
 func (*PRReviewInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{25}
+	return file_github_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *PRReviewInput) GetData() *structpb.Struct {
@@ -2038,7 +1392,7 @@ type PRReviewOutput struct {
 
 func (x *PRReviewOutput) Reset() {
 	*x = PRReviewOutput{}
-	mi := &file_github_proto_msgTypes[26]
+	mi := &file_github_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2050,7 +1404,7 @@ func (x *PRReviewOutput) String() string {
 func (*PRReviewOutput) ProtoMessage() {}
 
 func (x *PRReviewOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[26]
+	mi := &file_github_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2063,7 +1417,7 @@ func (x *PRReviewOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PRReviewOutput.ProtoReflect.Descriptor instead.
 func (*PRReviewOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{26}
+	return file_github_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *PRReviewOutput) GetReviewId() int64 {
@@ -2103,7 +1457,7 @@ type IssueCreateConfig struct {
 
 func (x *IssueCreateConfig) Reset() {
 	*x = IssueCreateConfig{}
-	mi := &file_github_proto_msgTypes[27]
+	mi := &file_github_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2115,7 +1469,7 @@ func (x *IssueCreateConfig) String() string {
 func (*IssueCreateConfig) ProtoMessage() {}
 
 func (x *IssueCreateConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[27]
+	mi := &file_github_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2128,7 +1482,7 @@ func (x *IssueCreateConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueCreateConfig.ProtoReflect.Descriptor instead.
 func (*IssueCreateConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{27}
+	return file_github_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *IssueCreateConfig) GetOwner() string {
@@ -2190,7 +1544,7 @@ type IssueCreateInput struct {
 
 func (x *IssueCreateInput) Reset() {
 	*x = IssueCreateInput{}
-	mi := &file_github_proto_msgTypes[28]
+	mi := &file_github_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2202,7 +1556,7 @@ func (x *IssueCreateInput) String() string {
 func (*IssueCreateInput) ProtoMessage() {}
 
 func (x *IssueCreateInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[28]
+	mi := &file_github_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2215,7 +1569,7 @@ func (x *IssueCreateInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueCreateInput.ProtoReflect.Descriptor instead.
 func (*IssueCreateInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{28}
+	return file_github_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *IssueCreateInput) GetData() *structpb.Struct {
@@ -2238,7 +1592,7 @@ type IssueCreateOutput struct {
 
 func (x *IssueCreateOutput) Reset() {
 	*x = IssueCreateOutput{}
-	mi := &file_github_proto_msgTypes[29]
+	mi := &file_github_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2250,7 +1604,7 @@ func (x *IssueCreateOutput) String() string {
 func (*IssueCreateOutput) ProtoMessage() {}
 
 func (x *IssueCreateOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[29]
+	mi := &file_github_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2263,7 +1617,7 @@ func (x *IssueCreateOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueCreateOutput.ProtoReflect.Descriptor instead.
 func (*IssueCreateOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{29}
+	return file_github_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *IssueCreateOutput) GetNumber() int64 {
@@ -2308,7 +1662,7 @@ type IssueCloseConfig struct {
 
 func (x *IssueCloseConfig) Reset() {
 	*x = IssueCloseConfig{}
-	mi := &file_github_proto_msgTypes[30]
+	mi := &file_github_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2320,7 +1674,7 @@ func (x *IssueCloseConfig) String() string {
 func (*IssueCloseConfig) ProtoMessage() {}
 
 func (x *IssueCloseConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[30]
+	mi := &file_github_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2333,7 +1687,7 @@ func (x *IssueCloseConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueCloseConfig.ProtoReflect.Descriptor instead.
 func (*IssueCloseConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{30}
+	return file_github_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *IssueCloseConfig) GetOwner() string {
@@ -2381,7 +1735,7 @@ type IssueCloseInput struct {
 
 func (x *IssueCloseInput) Reset() {
 	*x = IssueCloseInput{}
-	mi := &file_github_proto_msgTypes[31]
+	mi := &file_github_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2393,7 +1747,7 @@ func (x *IssueCloseInput) String() string {
 func (*IssueCloseInput) ProtoMessage() {}
 
 func (x *IssueCloseInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[31]
+	mi := &file_github_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2406,7 +1760,7 @@ func (x *IssueCloseInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueCloseInput.ProtoReflect.Descriptor instead.
 func (*IssueCloseInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{31}
+	return file_github_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *IssueCloseInput) GetData() *structpb.Struct {
@@ -2428,7 +1782,7 @@ type IssueCloseOutput struct {
 
 func (x *IssueCloseOutput) Reset() {
 	*x = IssueCloseOutput{}
-	mi := &file_github_proto_msgTypes[32]
+	mi := &file_github_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2440,7 +1794,7 @@ func (x *IssueCloseOutput) String() string {
 func (*IssueCloseOutput) ProtoMessage() {}
 
 func (x *IssueCloseOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[32]
+	mi := &file_github_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2453,7 +1807,7 @@ func (x *IssueCloseOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueCloseOutput.ProtoReflect.Descriptor instead.
 func (*IssueCloseOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{32}
+	return file_github_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *IssueCloseOutput) GetNumber() int64 {
@@ -2492,7 +1846,7 @@ type IssueLabelConfig struct {
 
 func (x *IssueLabelConfig) Reset() {
 	*x = IssueLabelConfig{}
-	mi := &file_github_proto_msgTypes[33]
+	mi := &file_github_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2504,7 +1858,7 @@ func (x *IssueLabelConfig) String() string {
 func (*IssueLabelConfig) ProtoMessage() {}
 
 func (x *IssueLabelConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[33]
+	mi := &file_github_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2517,7 +1871,7 @@ func (x *IssueLabelConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueLabelConfig.ProtoReflect.Descriptor instead.
 func (*IssueLabelConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{33}
+	return file_github_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *IssueLabelConfig) GetOwner() string {
@@ -2572,7 +1926,7 @@ type IssueLabelInput struct {
 
 func (x *IssueLabelInput) Reset() {
 	*x = IssueLabelInput{}
-	mi := &file_github_proto_msgTypes[34]
+	mi := &file_github_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2584,7 +1938,7 @@ func (x *IssueLabelInput) String() string {
 func (*IssueLabelInput) ProtoMessage() {}
 
 func (x *IssueLabelInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[34]
+	mi := &file_github_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2597,7 +1951,7 @@ func (x *IssueLabelInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueLabelInput.ProtoReflect.Descriptor instead.
 func (*IssueLabelInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{34}
+	return file_github_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *IssueLabelInput) GetData() *structpb.Struct {
@@ -2618,7 +1972,7 @@ type IssueLabelOutput struct {
 
 func (x *IssueLabelOutput) Reset() {
 	*x = IssueLabelOutput{}
-	mi := &file_github_proto_msgTypes[35]
+	mi := &file_github_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2630,7 +1984,7 @@ func (x *IssueLabelOutput) String() string {
 func (*IssueLabelOutput) ProtoMessage() {}
 
 func (x *IssueLabelOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[35]
+	mi := &file_github_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2643,7 +1997,7 @@ func (x *IssueLabelOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IssueLabelOutput.ProtoReflect.Descriptor instead.
 func (*IssueLabelOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{35}
+	return file_github_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *IssueLabelOutput) GetAdded() []string {
@@ -2677,7 +2031,7 @@ type ReleaseCreateConfig struct {
 
 func (x *ReleaseCreateConfig) Reset() {
 	*x = ReleaseCreateConfig{}
-	mi := &file_github_proto_msgTypes[36]
+	mi := &file_github_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2689,7 +2043,7 @@ func (x *ReleaseCreateConfig) String() string {
 func (*ReleaseCreateConfig) ProtoMessage() {}
 
 func (x *ReleaseCreateConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[36]
+	mi := &file_github_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2702,7 +2056,7 @@ func (x *ReleaseCreateConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseCreateConfig.ProtoReflect.Descriptor instead.
 func (*ReleaseCreateConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{36}
+	return file_github_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *ReleaseCreateConfig) GetOwner() string {
@@ -2771,7 +2125,7 @@ type ReleaseCreateInput struct {
 
 func (x *ReleaseCreateInput) Reset() {
 	*x = ReleaseCreateInput{}
-	mi := &file_github_proto_msgTypes[37]
+	mi := &file_github_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2783,7 +2137,7 @@ func (x *ReleaseCreateInput) String() string {
 func (*ReleaseCreateInput) ProtoMessage() {}
 
 func (x *ReleaseCreateInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[37]
+	mi := &file_github_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2796,7 +2150,7 @@ func (x *ReleaseCreateInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseCreateInput.ProtoReflect.Descriptor instead.
 func (*ReleaseCreateInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{37}
+	return file_github_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *ReleaseCreateInput) GetData() *structpb.Struct {
@@ -2821,7 +2175,7 @@ type ReleaseCreateOutput struct {
 
 func (x *ReleaseCreateOutput) Reset() {
 	*x = ReleaseCreateOutput{}
-	mi := &file_github_proto_msgTypes[38]
+	mi := &file_github_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2833,7 +2187,7 @@ func (x *ReleaseCreateOutput) String() string {
 func (*ReleaseCreateOutput) ProtoMessage() {}
 
 func (x *ReleaseCreateOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[38]
+	mi := &file_github_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2846,7 +2200,7 @@ func (x *ReleaseCreateOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseCreateOutput.ProtoReflect.Descriptor instead.
 func (*ReleaseCreateOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{38}
+	return file_github_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *ReleaseCreateOutput) GetReleaseId() int64 {
@@ -2906,7 +2260,7 @@ type ReleaseUploadConfig struct {
 
 func (x *ReleaseUploadConfig) Reset() {
 	*x = ReleaseUploadConfig{}
-	mi := &file_github_proto_msgTypes[39]
+	mi := &file_github_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2918,7 +2272,7 @@ func (x *ReleaseUploadConfig) String() string {
 func (*ReleaseUploadConfig) ProtoMessage() {}
 
 func (x *ReleaseUploadConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[39]
+	mi := &file_github_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2931,7 +2285,7 @@ func (x *ReleaseUploadConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseUploadConfig.ProtoReflect.Descriptor instead.
 func (*ReleaseUploadConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{39}
+	return file_github_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *ReleaseUploadConfig) GetOwner() string {
@@ -2986,7 +2340,7 @@ type ReleaseUploadInput struct {
 
 func (x *ReleaseUploadInput) Reset() {
 	*x = ReleaseUploadInput{}
-	mi := &file_github_proto_msgTypes[40]
+	mi := &file_github_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2998,7 +2352,7 @@ func (x *ReleaseUploadInput) String() string {
 func (*ReleaseUploadInput) ProtoMessage() {}
 
 func (x *ReleaseUploadInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[40]
+	mi := &file_github_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3011,7 +2365,7 @@ func (x *ReleaseUploadInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseUploadInput.ProtoReflect.Descriptor instead.
 func (*ReleaseUploadInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{40}
+	return file_github_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *ReleaseUploadInput) GetData() *structpb.Struct {
@@ -3034,7 +2388,7 @@ type ReleaseUploadOutput struct {
 
 func (x *ReleaseUploadOutput) Reset() {
 	*x = ReleaseUploadOutput{}
-	mi := &file_github_proto_msgTypes[41]
+	mi := &file_github_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3046,7 +2400,7 @@ func (x *ReleaseUploadOutput) String() string {
 func (*ReleaseUploadOutput) ProtoMessage() {}
 
 func (x *ReleaseUploadOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[41]
+	mi := &file_github_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3059,7 +2413,7 @@ func (x *ReleaseUploadOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseUploadOutput.ProtoReflect.Descriptor instead.
 func (*ReleaseUploadOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{41}
+	return file_github_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *ReleaseUploadOutput) GetAssetId() int64 {
@@ -3104,7 +2458,7 @@ type RepoDispatchConfig struct {
 
 func (x *RepoDispatchConfig) Reset() {
 	*x = RepoDispatchConfig{}
-	mi := &file_github_proto_msgTypes[42]
+	mi := &file_github_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3116,7 +2470,7 @@ func (x *RepoDispatchConfig) String() string {
 func (*RepoDispatchConfig) ProtoMessage() {}
 
 func (x *RepoDispatchConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[42]
+	mi := &file_github_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3129,7 +2483,7 @@ func (x *RepoDispatchConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RepoDispatchConfig.ProtoReflect.Descriptor instead.
 func (*RepoDispatchConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{42}
+	return file_github_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *RepoDispatchConfig) GetOwner() string {
@@ -3177,7 +2531,7 @@ type RepoDispatchInput struct {
 
 func (x *RepoDispatchInput) Reset() {
 	*x = RepoDispatchInput{}
-	mi := &file_github_proto_msgTypes[43]
+	mi := &file_github_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3189,7 +2543,7 @@ func (x *RepoDispatchInput) String() string {
 func (*RepoDispatchInput) ProtoMessage() {}
 
 func (x *RepoDispatchInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[43]
+	mi := &file_github_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3202,7 +2556,7 @@ func (x *RepoDispatchInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RepoDispatchInput.ProtoReflect.Descriptor instead.
 func (*RepoDispatchInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{43}
+	return file_github_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *RepoDispatchInput) GetData() *structpb.Struct {
@@ -3225,7 +2579,7 @@ type RepoDispatchOutput struct {
 
 func (x *RepoDispatchOutput) Reset() {
 	*x = RepoDispatchOutput{}
-	mi := &file_github_proto_msgTypes[44]
+	mi := &file_github_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3237,7 +2591,7 @@ func (x *RepoDispatchOutput) String() string {
 func (*RepoDispatchOutput) ProtoMessage() {}
 
 func (x *RepoDispatchOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[44]
+	mi := &file_github_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3250,7 +2604,7 @@ func (x *RepoDispatchOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RepoDispatchOutput.ProtoReflect.Descriptor instead.
 func (*RepoDispatchOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{44}
+	return file_github_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *RepoDispatchOutput) GetDispatched() bool {
@@ -3297,7 +2651,7 @@ type DeploymentCreateConfig struct {
 
 func (x *DeploymentCreateConfig) Reset() {
 	*x = DeploymentCreateConfig{}
-	mi := &file_github_proto_msgTypes[45]
+	mi := &file_github_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3309,7 +2663,7 @@ func (x *DeploymentCreateConfig) String() string {
 func (*DeploymentCreateConfig) ProtoMessage() {}
 
 func (x *DeploymentCreateConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[45]
+	mi := &file_github_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3322,7 +2676,7 @@ func (x *DeploymentCreateConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeploymentCreateConfig.ProtoReflect.Descriptor instead.
 func (*DeploymentCreateConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{45}
+	return file_github_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *DeploymentCreateConfig) GetOwner() string {
@@ -3384,7 +2738,7 @@ type DeploymentCreateInput struct {
 
 func (x *DeploymentCreateInput) Reset() {
 	*x = DeploymentCreateInput{}
-	mi := &file_github_proto_msgTypes[46]
+	mi := &file_github_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3396,7 +2750,7 @@ func (x *DeploymentCreateInput) String() string {
 func (*DeploymentCreateInput) ProtoMessage() {}
 
 func (x *DeploymentCreateInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[46]
+	mi := &file_github_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3409,7 +2763,7 @@ func (x *DeploymentCreateInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeploymentCreateInput.ProtoReflect.Descriptor instead.
 func (*DeploymentCreateInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{46}
+	return file_github_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *DeploymentCreateInput) GetData() *structpb.Struct {
@@ -3433,7 +2787,7 @@ type DeploymentCreateOutput struct {
 
 func (x *DeploymentCreateOutput) Reset() {
 	*x = DeploymentCreateOutput{}
-	mi := &file_github_proto_msgTypes[47]
+	mi := &file_github_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3445,7 +2799,7 @@ func (x *DeploymentCreateOutput) String() string {
 func (*DeploymentCreateOutput) ProtoMessage() {}
 
 func (x *DeploymentCreateOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[47]
+	mi := &file_github_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3458,7 +2812,7 @@ func (x *DeploymentCreateOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeploymentCreateOutput.ProtoReflect.Descriptor instead.
 func (*DeploymentCreateOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{47}
+	return file_github_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *DeploymentCreateOutput) GetDeploymentId() int64 {
@@ -3510,7 +2864,7 @@ type SecretSetConfig struct {
 
 func (x *SecretSetConfig) Reset() {
 	*x = SecretSetConfig{}
-	mi := &file_github_proto_msgTypes[48]
+	mi := &file_github_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3522,7 +2876,7 @@ func (x *SecretSetConfig) String() string {
 func (*SecretSetConfig) ProtoMessage() {}
 
 func (x *SecretSetConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[48]
+	mi := &file_github_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3535,7 +2889,7 @@ func (x *SecretSetConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecretSetConfig.ProtoReflect.Descriptor instead.
 func (*SecretSetConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{48}
+	return file_github_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *SecretSetConfig) GetOwner() string {
@@ -3583,7 +2937,7 @@ type SecretSetInput struct {
 
 func (x *SecretSetInput) Reset() {
 	*x = SecretSetInput{}
-	mi := &file_github_proto_msgTypes[49]
+	mi := &file_github_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3595,7 +2949,7 @@ func (x *SecretSetInput) String() string {
 func (*SecretSetInput) ProtoMessage() {}
 
 func (x *SecretSetInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[49]
+	mi := &file_github_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3608,7 +2962,7 @@ func (x *SecretSetInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecretSetInput.ProtoReflect.Descriptor instead.
 func (*SecretSetInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{49}
+	return file_github_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *SecretSetInput) GetData() *structpb.Struct {
@@ -3631,7 +2985,7 @@ type SecretSetOutput struct {
 
 func (x *SecretSetOutput) Reset() {
 	*x = SecretSetOutput{}
-	mi := &file_github_proto_msgTypes[50]
+	mi := &file_github_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3643,7 +2997,7 @@ func (x *SecretSetOutput) String() string {
 func (*SecretSetOutput) ProtoMessage() {}
 
 func (x *SecretSetOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[50]
+	mi := &file_github_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3656,7 +3010,7 @@ func (x *SecretSetOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecretSetOutput.ProtoReflect.Descriptor instead.
 func (*SecretSetOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{50}
+	return file_github_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *SecretSetOutput) GetName() string {
@@ -3699,7 +3053,7 @@ type GraphQLConfig struct {
 
 func (x *GraphQLConfig) Reset() {
 	*x = GraphQLConfig{}
-	mi := &file_github_proto_msgTypes[51]
+	mi := &file_github_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3711,7 +3065,7 @@ func (x *GraphQLConfig) String() string {
 func (*GraphQLConfig) ProtoMessage() {}
 
 func (x *GraphQLConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[51]
+	mi := &file_github_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3724,7 +3078,7 @@ func (x *GraphQLConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GraphQLConfig.ProtoReflect.Descriptor instead.
 func (*GraphQLConfig) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{51}
+	return file_github_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *GraphQLConfig) GetQuery() string {
@@ -3758,7 +3112,7 @@ type GraphQLInput struct {
 
 func (x *GraphQLInput) Reset() {
 	*x = GraphQLInput{}
-	mi := &file_github_proto_msgTypes[52]
+	mi := &file_github_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3770,7 +3124,7 @@ func (x *GraphQLInput) String() string {
 func (*GraphQLInput) ProtoMessage() {}
 
 func (x *GraphQLInput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[52]
+	mi := &file_github_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3783,7 +3137,7 @@ func (x *GraphQLInput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GraphQLInput.ProtoReflect.Descriptor instead.
 func (*GraphQLInput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{52}
+	return file_github_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *GraphQLInput) GetData() *structpb.Struct {
@@ -3804,7 +3158,7 @@ type GraphQLOutput struct {
 
 func (x *GraphQLOutput) Reset() {
 	*x = GraphQLOutput{}
-	mi := &file_github_proto_msgTypes[53]
+	mi := &file_github_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3816,7 +3170,7 @@ func (x *GraphQLOutput) String() string {
 func (*GraphQLOutput) ProtoMessage() {}
 
 func (x *GraphQLOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_github_proto_msgTypes[53]
+	mi := &file_github_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3829,7 +3183,7 @@ func (x *GraphQLOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GraphQLOutput.ProtoReflect.Descriptor instead.
 func (*GraphQLOutput) Descriptor() ([]byte, []int) {
-	return file_github_proto_rawDescGZIP(), []int{53}
+	return file_github_proto_rawDescGZIP(), []int{47}
 }
 
 func (x *GraphQLOutput) GetData() *structpb.Struct {
@@ -3900,83 +3254,7 @@ const file_github_proto_rawDesc = "" +
 	"\n" +
 	"conclusion\x18\x03 \x01(\tR\n" +
 	"conclusion\x12\x10\n" +
-	"\x03url\x18\x04 \x01(\tR\x03url\"\x95\b\n" +
-	"\x14ComputeGatewayConfig\x12\x1d\n" +
-	"\n" +
-	"server_url\x18\x01 \x01(\tR\tserverUrl\x12\x14\n" +
-	"\x05token\x18\x02 \x01(\tR\x05token\x12\x1e\n" +
-	"\n" +
-	"repository\x18\x03 \x01(\tR\n" +
-	"repository\x12\x1d\n" +
-	"\n" +
-	"oidc_token\x18\x04 \x01(\tR\toidcToken\x12&\n" +
-	"\x0fworkflow_run_id\x18\x05 \x01(\tR\rworkflowRunId\x120\n" +
-	"\x14workflow_run_attempt\x18\x06 \x01(\tR\x12workflowRunAttempt\x12&\n" +
-	"\x0fworkflow_job_id\x18\a \x01(\tR\rworkflowJobId\x12*\n" +
-	"\x11workflow_job_name\x18\b \x01(\tR\x0fworkflowJobName\x12\x10\n" +
-	"\x03ref\x18\t \x01(\tR\x03ref\x12\x10\n" +
-	"\x03sha\x18\n" +
-	" \x01(\tR\x03sha\x12\x15\n" +
-	"\x06org_id\x18\v \x01(\tR\x05orgId\x12\x17\n" +
-	"\apool_id\x18\f \x01(\tR\x06poolId\x12\x1b\n" +
-	"\tpolicy_id\x18\r \x01(\tR\bpolicyId\x12!\n" +
-	"\fcommand_args\x18\x0e \x03(\tR\vcommandArgs\x12+\n" +
-	"\x11working_directory\x18\x0f \x01(\tR\x10workingDirectory\x12-\n" +
-	"\x12artifact_allowlist\x18\x10 \x03(\tR\x11artifactAllowlist\x12/\n" +
-	"\x06labels\x18\x11 \x01(\v2\x17.google.protobuf.StructR\x06labels\x12+\n" +
-	"\x11executor_provider\x18\x12 \x01(\tR\x10executorProvider\x126\n" +
-	"\x17execution_security_tier\x18\x13 \x01(\tR\x15executionSecurityTier\x12\x1d\n" +
-	"\n" +
-	"proof_tier\x18\x14 \x01(\tR\tproofTier\x12%\n" +
-	"\x0ehardware_class\x18\x15 \x01(\tR\rhardwareClass\x12\x12\n" +
-	"\x04wait\x18\x16 \x01(\bR\x04wait\x12#\n" +
-	"\rpoll_interval\x18\x17 \x01(\tR\fpollInterval\x12\x18\n" +
-	"\atimeout\x18\x18 \x01(\tR\atimeout\x12\x1f\n" +
-	"\vwrite_check\x18\x19 \x01(\bR\n" +
-	"writeCheck\x12\x1f\n" +
-	"\vcheck_owner\x18\x1a \x01(\tR\n" +
-	"checkOwner\x12\x1d\n" +
-	"\n" +
-	"check_repo\x18\x1b \x01(\tR\tcheckRepo\x12\x1b\n" +
-	"\tcheck_sha\x18\x1c \x01(\tR\bcheckSha\x12\x1d\n" +
-	"\n" +
-	"check_name\x18\x1d \x01(\tR\tcheckName\x12\x1f\n" +
-	"\vcheck_token\x18\x1e \x01(\tR\n" +
-	"checkToken\"B\n" +
-	"\x13ComputeGatewayInput\x12+\n" +
-	"\x04data\x18\x01 \x01(\v2\x17.google.protobuf.StructR\x04data\"\xac\x02\n" +
-	"\x14ComputeGatewayOutput\x12\x17\n" +
-	"\atask_id\x18\x01 \x01(\tR\x06taskId\x12\x16\n" +
-	"\x06status\x18\x02 \x01(\tR\x06status\x12\x1e\n" +
-	"\n" +
-	"conclusion\x18\x03 \x01(\tR\n" +
-	"conclusion\x12\x19\n" +
-	"\bproof_id\x18\x04 \x01(\tR\aproofId\x12#\n" +
-	"\rartifact_hash\x18\x05 \x01(\tR\fartifactHash\x12'\n" +
-	"\x0fcontribution_id\x18\x06 \x01(\tR\x0econtributionId\x12\x1b\n" +
-	"\tworker_id\x18\a \x01(\tR\bworkerId\x12 \n" +
-	"\fcheck_run_id\x18\b \x01(\x03R\n" +
-	"checkRunId\x12\x1b\n" +
-	"\tcheck_url\x18\t \x01(\tR\bcheckUrl\"\xe1\x01\n" +
-	"\x11CreateCheckConfig\x12\x14\n" +
-	"\x05owner\x18\x01 \x01(\tR\x05owner\x12\x12\n" +
-	"\x04repo\x18\x02 \x01(\tR\x04repo\x12\x10\n" +
-	"\x03sha\x18\x03 \x01(\tR\x03sha\x12\x12\n" +
-	"\x04name\x18\x04 \x01(\tR\x04name\x12\x16\n" +
-	"\x06status\x18\x05 \x01(\tR\x06status\x12\x1e\n" +
-	"\n" +
-	"conclusion\x18\x06 \x01(\tR\n" +
-	"conclusion\x12\x14\n" +
-	"\x05title\x18\a \x01(\tR\x05title\x12\x18\n" +
-	"\asummary\x18\b \x01(\tR\asummary\x12\x14\n" +
-	"\x05token\x18\t \x01(\tR\x05token\"?\n" +
-	"\x10CreateCheckInput\x12+\n" +
-	"\x04data\x18\x01 \x01(\v2\x17.google.protobuf.StructR\x04data\"_\n" +
-	"\x11CreateCheckOutput\x12 \n" +
-	"\fcheck_run_id\x18\x01 \x01(\x03R\n" +
-	"checkRunId\x12\x16\n" +
-	"\x06status\x18\x02 \x01(\tR\x06status\x12\x10\n" +
-	"\x03url\x18\x03 \x01(\tR\x03url\"\xb8\x01\n" +
+	"\x03url\x18\x04 \x01(\tR\x03url\"\xb8\x01\n" +
 	"\x0ePRCreateConfig\x12\x14\n" +
 	"\x05owner\x18\x01 \x01(\tR\x05owner\x12\x12\n" +
 	"\x04repo\x18\x02 \x01(\tR\x04repo\x12\x12\n" +
@@ -4178,7 +3456,7 @@ func file_github_proto_rawDescGZIP() []byte {
 	return file_github_proto_rawDescData
 }
 
-var file_github_proto_msgTypes = make([]protoimpl.MessageInfo, 54)
+var file_github_proto_msgTypes = make([]protoimpl.MessageInfo, 48)
 var file_github_proto_goTypes = []any{
 	(*WebhookModuleConfig)(nil),        // 0: workflow.plugin.github.v1.WebhookModuleConfig
 	(*GitHubAppModuleConfig)(nil),      // 1: workflow.plugin.github.v1.GitHubAppModuleConfig
@@ -4189,81 +3467,72 @@ var file_github_proto_goTypes = []any{
 	(*ActionStatusConfig)(nil),         // 6: workflow.plugin.github.v1.ActionStatusConfig
 	(*ActionStatusInput)(nil),          // 7: workflow.plugin.github.v1.ActionStatusInput
 	(*ActionStatusOutput)(nil),         // 8: workflow.plugin.github.v1.ActionStatusOutput
-	(*ComputeGatewayConfig)(nil),       // 9: workflow.plugin.github.v1.ComputeGatewayConfig
-	(*ComputeGatewayInput)(nil),        // 10: workflow.plugin.github.v1.ComputeGatewayInput
-	(*ComputeGatewayOutput)(nil),       // 11: workflow.plugin.github.v1.ComputeGatewayOutput
-	(*CreateCheckConfig)(nil),          // 12: workflow.plugin.github.v1.CreateCheckConfig
-	(*CreateCheckInput)(nil),           // 13: workflow.plugin.github.v1.CreateCheckInput
-	(*CreateCheckOutput)(nil),          // 14: workflow.plugin.github.v1.CreateCheckOutput
-	(*PRCreateConfig)(nil),             // 15: workflow.plugin.github.v1.PRCreateConfig
-	(*PRCreateInput)(nil),              // 16: workflow.plugin.github.v1.PRCreateInput
-	(*PRCreateOutput)(nil),             // 17: workflow.plugin.github.v1.PRCreateOutput
-	(*PRMergeConfig)(nil),              // 18: workflow.plugin.github.v1.PRMergeConfig
-	(*PRMergeInput)(nil),               // 19: workflow.plugin.github.v1.PRMergeInput
-	(*PRMergeOutput)(nil),              // 20: workflow.plugin.github.v1.PRMergeOutput
-	(*PRCommentConfig)(nil),            // 21: workflow.plugin.github.v1.PRCommentConfig
-	(*PRCommentInput)(nil),             // 22: workflow.plugin.github.v1.PRCommentInput
-	(*PRCommentOutput)(nil),            // 23: workflow.plugin.github.v1.PRCommentOutput
-	(*PRReviewConfig)(nil),             // 24: workflow.plugin.github.v1.PRReviewConfig
-	(*PRReviewInput)(nil),              // 25: workflow.plugin.github.v1.PRReviewInput
-	(*PRReviewOutput)(nil),             // 26: workflow.plugin.github.v1.PRReviewOutput
-	(*IssueCreateConfig)(nil),          // 27: workflow.plugin.github.v1.IssueCreateConfig
-	(*IssueCreateInput)(nil),           // 28: workflow.plugin.github.v1.IssueCreateInput
-	(*IssueCreateOutput)(nil),          // 29: workflow.plugin.github.v1.IssueCreateOutput
-	(*IssueCloseConfig)(nil),           // 30: workflow.plugin.github.v1.IssueCloseConfig
-	(*IssueCloseInput)(nil),            // 31: workflow.plugin.github.v1.IssueCloseInput
-	(*IssueCloseOutput)(nil),           // 32: workflow.plugin.github.v1.IssueCloseOutput
-	(*IssueLabelConfig)(nil),           // 33: workflow.plugin.github.v1.IssueLabelConfig
-	(*IssueLabelInput)(nil),            // 34: workflow.plugin.github.v1.IssueLabelInput
-	(*IssueLabelOutput)(nil),           // 35: workflow.plugin.github.v1.IssueLabelOutput
-	(*ReleaseCreateConfig)(nil),        // 36: workflow.plugin.github.v1.ReleaseCreateConfig
-	(*ReleaseCreateInput)(nil),         // 37: workflow.plugin.github.v1.ReleaseCreateInput
-	(*ReleaseCreateOutput)(nil),        // 38: workflow.plugin.github.v1.ReleaseCreateOutput
-	(*ReleaseUploadConfig)(nil),        // 39: workflow.plugin.github.v1.ReleaseUploadConfig
-	(*ReleaseUploadInput)(nil),         // 40: workflow.plugin.github.v1.ReleaseUploadInput
-	(*ReleaseUploadOutput)(nil),        // 41: workflow.plugin.github.v1.ReleaseUploadOutput
-	(*RepoDispatchConfig)(nil),         // 42: workflow.plugin.github.v1.RepoDispatchConfig
-	(*RepoDispatchInput)(nil),          // 43: workflow.plugin.github.v1.RepoDispatchInput
-	(*RepoDispatchOutput)(nil),         // 44: workflow.plugin.github.v1.RepoDispatchOutput
-	(*DeploymentCreateConfig)(nil),     // 45: workflow.plugin.github.v1.DeploymentCreateConfig
-	(*DeploymentCreateInput)(nil),      // 46: workflow.plugin.github.v1.DeploymentCreateInput
-	(*DeploymentCreateOutput)(nil),     // 47: workflow.plugin.github.v1.DeploymentCreateOutput
-	(*SecretSetConfig)(nil),            // 48: workflow.plugin.github.v1.SecretSetConfig
-	(*SecretSetInput)(nil),             // 49: workflow.plugin.github.v1.SecretSetInput
-	(*SecretSetOutput)(nil),            // 50: workflow.plugin.github.v1.SecretSetOutput
-	(*GraphQLConfig)(nil),              // 51: workflow.plugin.github.v1.GraphQLConfig
-	(*GraphQLInput)(nil),               // 52: workflow.plugin.github.v1.GraphQLInput
-	(*GraphQLOutput)(nil),              // 53: workflow.plugin.github.v1.GraphQLOutput
-	(*structpb.Struct)(nil),            // 54: google.protobuf.Struct
+	(*PRCreateConfig)(nil),             // 9: workflow.plugin.github.v1.PRCreateConfig
+	(*PRCreateInput)(nil),              // 10: workflow.plugin.github.v1.PRCreateInput
+	(*PRCreateOutput)(nil),             // 11: workflow.plugin.github.v1.PRCreateOutput
+	(*PRMergeConfig)(nil),              // 12: workflow.plugin.github.v1.PRMergeConfig
+	(*PRMergeInput)(nil),               // 13: workflow.plugin.github.v1.PRMergeInput
+	(*PRMergeOutput)(nil),              // 14: workflow.plugin.github.v1.PRMergeOutput
+	(*PRCommentConfig)(nil),            // 15: workflow.plugin.github.v1.PRCommentConfig
+	(*PRCommentInput)(nil),             // 16: workflow.plugin.github.v1.PRCommentInput
+	(*PRCommentOutput)(nil),            // 17: workflow.plugin.github.v1.PRCommentOutput
+	(*PRReviewConfig)(nil),             // 18: workflow.plugin.github.v1.PRReviewConfig
+	(*PRReviewInput)(nil),              // 19: workflow.plugin.github.v1.PRReviewInput
+	(*PRReviewOutput)(nil),             // 20: workflow.plugin.github.v1.PRReviewOutput
+	(*IssueCreateConfig)(nil),          // 21: workflow.plugin.github.v1.IssueCreateConfig
+	(*IssueCreateInput)(nil),           // 22: workflow.plugin.github.v1.IssueCreateInput
+	(*IssueCreateOutput)(nil),          // 23: workflow.plugin.github.v1.IssueCreateOutput
+	(*IssueCloseConfig)(nil),           // 24: workflow.plugin.github.v1.IssueCloseConfig
+	(*IssueCloseInput)(nil),            // 25: workflow.plugin.github.v1.IssueCloseInput
+	(*IssueCloseOutput)(nil),           // 26: workflow.plugin.github.v1.IssueCloseOutput
+	(*IssueLabelConfig)(nil),           // 27: workflow.plugin.github.v1.IssueLabelConfig
+	(*IssueLabelInput)(nil),            // 28: workflow.plugin.github.v1.IssueLabelInput
+	(*IssueLabelOutput)(nil),           // 29: workflow.plugin.github.v1.IssueLabelOutput
+	(*ReleaseCreateConfig)(nil),        // 30: workflow.plugin.github.v1.ReleaseCreateConfig
+	(*ReleaseCreateInput)(nil),         // 31: workflow.plugin.github.v1.ReleaseCreateInput
+	(*ReleaseCreateOutput)(nil),        // 32: workflow.plugin.github.v1.ReleaseCreateOutput
+	(*ReleaseUploadConfig)(nil),        // 33: workflow.plugin.github.v1.ReleaseUploadConfig
+	(*ReleaseUploadInput)(nil),         // 34: workflow.plugin.github.v1.ReleaseUploadInput
+	(*ReleaseUploadOutput)(nil),        // 35: workflow.plugin.github.v1.ReleaseUploadOutput
+	(*RepoDispatchConfig)(nil),         // 36: workflow.plugin.github.v1.RepoDispatchConfig
+	(*RepoDispatchInput)(nil),          // 37: workflow.plugin.github.v1.RepoDispatchInput
+	(*RepoDispatchOutput)(nil),         // 38: workflow.plugin.github.v1.RepoDispatchOutput
+	(*DeploymentCreateConfig)(nil),     // 39: workflow.plugin.github.v1.DeploymentCreateConfig
+	(*DeploymentCreateInput)(nil),      // 40: workflow.plugin.github.v1.DeploymentCreateInput
+	(*DeploymentCreateOutput)(nil),     // 41: workflow.plugin.github.v1.DeploymentCreateOutput
+	(*SecretSetConfig)(nil),            // 42: workflow.plugin.github.v1.SecretSetConfig
+	(*SecretSetInput)(nil),             // 43: workflow.plugin.github.v1.SecretSetInput
+	(*SecretSetOutput)(nil),            // 44: workflow.plugin.github.v1.SecretSetOutput
+	(*GraphQLConfig)(nil),              // 45: workflow.plugin.github.v1.GraphQLConfig
+	(*GraphQLInput)(nil),               // 46: workflow.plugin.github.v1.GraphQLInput
+	(*GraphQLOutput)(nil),              // 47: workflow.plugin.github.v1.GraphQLOutput
+	(*structpb.Struct)(nil),            // 48: google.protobuf.Struct
 }
 var file_github_proto_depIdxs = []int32{
-	54, // 0: workflow.plugin.github.v1.ActionTriggerConfig.inputs:type_name -> google.protobuf.Struct
-	54, // 1: workflow.plugin.github.v1.ActionTriggerInput.data:type_name -> google.protobuf.Struct
-	54, // 2: workflow.plugin.github.v1.ActionStatusInput.data:type_name -> google.protobuf.Struct
-	54, // 3: workflow.plugin.github.v1.ComputeGatewayConfig.labels:type_name -> google.protobuf.Struct
-	54, // 4: workflow.plugin.github.v1.ComputeGatewayInput.data:type_name -> google.protobuf.Struct
-	54, // 5: workflow.plugin.github.v1.CreateCheckInput.data:type_name -> google.protobuf.Struct
-	54, // 6: workflow.plugin.github.v1.PRCreateInput.data:type_name -> google.protobuf.Struct
-	54, // 7: workflow.plugin.github.v1.PRMergeInput.data:type_name -> google.protobuf.Struct
-	54, // 8: workflow.plugin.github.v1.PRCommentInput.data:type_name -> google.protobuf.Struct
-	54, // 9: workflow.plugin.github.v1.PRReviewInput.data:type_name -> google.protobuf.Struct
-	54, // 10: workflow.plugin.github.v1.IssueCreateInput.data:type_name -> google.protobuf.Struct
-	54, // 11: workflow.plugin.github.v1.IssueCloseInput.data:type_name -> google.protobuf.Struct
-	54, // 12: workflow.plugin.github.v1.IssueLabelInput.data:type_name -> google.protobuf.Struct
-	54, // 13: workflow.plugin.github.v1.ReleaseCreateInput.data:type_name -> google.protobuf.Struct
-	54, // 14: workflow.plugin.github.v1.ReleaseUploadInput.data:type_name -> google.protobuf.Struct
-	54, // 15: workflow.plugin.github.v1.RepoDispatchConfig.payload:type_name -> google.protobuf.Struct
-	54, // 16: workflow.plugin.github.v1.RepoDispatchInput.data:type_name -> google.protobuf.Struct
-	54, // 17: workflow.plugin.github.v1.DeploymentCreateInput.data:type_name -> google.protobuf.Struct
-	54, // 18: workflow.plugin.github.v1.SecretSetInput.data:type_name -> google.protobuf.Struct
-	54, // 19: workflow.plugin.github.v1.GraphQLConfig.variables:type_name -> google.protobuf.Struct
-	54, // 20: workflow.plugin.github.v1.GraphQLInput.data:type_name -> google.protobuf.Struct
-	54, // 21: workflow.plugin.github.v1.GraphQLOutput.data:type_name -> google.protobuf.Struct
-	22, // [22:22] is the sub-list for method output_type
-	22, // [22:22] is the sub-list for method input_type
-	22, // [22:22] is the sub-list for extension type_name
-	22, // [22:22] is the sub-list for extension extendee
-	0,  // [0:22] is the sub-list for field type_name
+	48, // 0: workflow.plugin.github.v1.ActionTriggerConfig.inputs:type_name -> google.protobuf.Struct
+	48, // 1: workflow.plugin.github.v1.ActionTriggerInput.data:type_name -> google.protobuf.Struct
+	48, // 2: workflow.plugin.github.v1.ActionStatusInput.data:type_name -> google.protobuf.Struct
+	48, // 3: workflow.plugin.github.v1.PRCreateInput.data:type_name -> google.protobuf.Struct
+	48, // 4: workflow.plugin.github.v1.PRMergeInput.data:type_name -> google.protobuf.Struct
+	48, // 5: workflow.plugin.github.v1.PRCommentInput.data:type_name -> google.protobuf.Struct
+	48, // 6: workflow.plugin.github.v1.PRReviewInput.data:type_name -> google.protobuf.Struct
+	48, // 7: workflow.plugin.github.v1.IssueCreateInput.data:type_name -> google.protobuf.Struct
+	48, // 8: workflow.plugin.github.v1.IssueCloseInput.data:type_name -> google.protobuf.Struct
+	48, // 9: workflow.plugin.github.v1.IssueLabelInput.data:type_name -> google.protobuf.Struct
+	48, // 10: workflow.plugin.github.v1.ReleaseCreateInput.data:type_name -> google.protobuf.Struct
+	48, // 11: workflow.plugin.github.v1.ReleaseUploadInput.data:type_name -> google.protobuf.Struct
+	48, // 12: workflow.plugin.github.v1.RepoDispatchConfig.payload:type_name -> google.protobuf.Struct
+	48, // 13: workflow.plugin.github.v1.RepoDispatchInput.data:type_name -> google.protobuf.Struct
+	48, // 14: workflow.plugin.github.v1.DeploymentCreateInput.data:type_name -> google.protobuf.Struct
+	48, // 15: workflow.plugin.github.v1.SecretSetInput.data:type_name -> google.protobuf.Struct
+	48, // 16: workflow.plugin.github.v1.GraphQLConfig.variables:type_name -> google.protobuf.Struct
+	48, // 17: workflow.plugin.github.v1.GraphQLInput.data:type_name -> google.protobuf.Struct
+	48, // 18: workflow.plugin.github.v1.GraphQLOutput.data:type_name -> google.protobuf.Struct
+	19, // [19:19] is the sub-list for method output_type
+	19, // [19:19] is the sub-list for method input_type
+	19, // [19:19] is the sub-list for extension type_name
+	19, // [19:19] is the sub-list for extension extendee
+	0,  // [0:19] is the sub-list for field type_name
 }
 
 func init() { file_github_proto_init() }
@@ -4277,7 +3546,7 @@ func file_github_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_github_proto_rawDesc), len(file_github_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   54,
+			NumMessages:   48,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/internal/contracts.go b/internal/contracts.go
index a738358..fa91cc9 100644
--- a/internal/contracts.go
+++ b/internal/contracts.go
@@ -64,22 +64,6 @@ var githubContractRegistry = &pb.ContractRegistry{
 			OutputMessage: githubProtoPkg + "ActionStatusOutput",
 			Mode:          pb.ContractMode_CONTRACT_MODE_STRICT_PROTO,
 		},
-		{
-			Kind:          pb.ContractKind_CONTRACT_KIND_STEP,
-			StepType:      "step.gh_compute_gateway",
-			ConfigMessage: githubProtoPkg + "ComputeGatewayConfig",
-			InputMessage:  githubProtoPkg + "ComputeGatewayInput",
-			OutputMessage: githubProtoPkg + "ComputeGatewayOutput",
-			Mode:          pb.ContractMode_CONTRACT_MODE_STRICT_PROTO,
-		},
-		{
-			Kind:          pb.ContractKind_CONTRACT_KIND_STEP,
-			StepType:      "step.gh_create_check",
-			ConfigMessage: githubProtoPkg + "CreateCheckConfig",
-			InputMessage:  githubProtoPkg + "CreateCheckInput",
-			OutputMessage: githubProtoPkg + "CreateCheckOutput",
-			Mode:          pb.ContractMode_CONTRACT_MODE_STRICT_PROTO,
-		},
 		{
 			Kind:          pb.ContractKind_CONTRACT_KIND_STEP,
 			StepType:      "step.gh_pr_create",
diff --git a/internal/contracts_test.go b/internal/contracts_test.go
index 38054d6..c4497cc 100644
--- a/internal/contracts_test.go
+++ b/internal/contracts_test.go
@@ -54,8 +54,6 @@ func TestContractRegistry_CoversAllStepTypes(t *testing.T) {
 	wantSteps := []string{
 		"step.gh_action_trigger",
 		"step.gh_action_status",
-		"step.gh_compute_gateway",
-		"step.gh_create_check",
 		"step.gh_pr_create",
 		"step.gh_pr_merge",
 		"step.gh_pr_comment",
@@ -96,11 +94,29 @@ func TestContractRegistry_CoversAllStepTypes(t *testing.T) {
 	}
 }
 
+func TestT916_GitHubPluginDoesNotExposeComputeGatewayOrSyntheticCheckSteps(t *testing.T) {
+	p := &githubPlugin{}
+	for _, stepType := range p.StepTypes() {
+		switch stepType {
+		case "step.gh_compute_gateway", "step.gh_create_check":
+			t.Fatalf("github plugin must not expose %s; compute submission/check ownership belongs outside this plugin", stepType)
+		}
+	}
+
+	reg := p.ContractRegistry()
+	for _, contract := range reg.Contracts {
+		switch contract.StepType {
+		case "step.gh_compute_gateway", "step.gh_create_check":
+			t.Fatalf("github plugin contract registry must not expose %s", contract.StepType)
+		}
+	}
+}
+
 func TestContractRegistry_ContractCount(t *testing.T) {
 	p := &githubPlugin{}
 	reg := p.ContractRegistry()
-	// 3 modules + 17 steps = 20 total
-	if len(reg.Contracts) != 20 {
-		t.Errorf("expected 20 contracts (3 modules + 17 steps), got %d", len(reg.Contracts))
+	// 3 modules + 15 steps = 18 total
+	if len(reg.Contracts) != 18 {
+		t.Errorf("expected 18 contracts (3 modules + 15 steps), got %d", len(reg.Contracts))
 	}
 }
diff --git a/internal/ephemeral_runner_job.go b/internal/ephemeral_runner_job.go
index 45dbe2b..026bf9c 100644
--- a/internal/ephemeral_runner_job.go
+++ b/internal/ephemeral_runner_job.go
@@ -46,16 +46,17 @@ type EphemeralRunnerJobSpec struct {
 }
 
 type EphemeralRunnerJobResult struct {
-	RunnerID      int64    `json:"runner_id"`
-	RunnerName    string   `json:"runner_name"`
-	Labels        []string `json:"labels"`
-	WorkflowRunID int64    `json:"workflow_run_id"`
-	WorkflowJobID int64    `json:"workflow_job_id"`
-	WorkerID      string   `json:"worker_id"`
-	TaskID        string   `json:"task_id"`
-	ArtifactRefs  []string `json:"artifact_refs"`
-	CleanupStatus string   `json:"cleanup_status"`
-	RedactedError string   `json:"redacted_error,omitempty"`
+	RunnerID          int64    `json:"runner_id"`
+	RunnerName        string   `json:"runner_name"`
+	Labels            []string `json:"labels"`
+	WorkflowRunID     int64    `json:"workflow_run_id"`
+	WorkflowJobID     int64    `json:"workflow_job_id"`
+	WorkflowJobStatus string   `json:"workflow_job_status,omitempty"`
+	WorkerID          string   `json:"worker_id"`
+	TaskID            string   `json:"task_id"`
+	ArtifactRefs      []string `json:"artifact_refs"`
+	CleanupStatus     string   `json:"cleanup_status"`
+	RedactedError     string   `json:"redacted_error,omitempty"`
 }
 
 type EphemeralRunnerJobDriver interface {
diff --git a/internal/github_client.go b/internal/github_client.go
index cc270ef..c37ce04 100644
--- a/internal/github_client.go
+++ b/internal/github_client.go
@@ -17,7 +17,6 @@ import (
 type GitHubClient interface {
 	TriggerWorkflow(ctx context.Context, owner, repo, workflow, ref string, inputs map[string]string, token string) error
 	GetWorkflowRun(ctx context.Context, owner, repo string, runID int64, token string) (*WorkflowRun, error)
-	CreateCheckRun(ctx context.Context, owner, repo string, req *CreateCheckRunRequest, token string) (*CheckRun, error)
 }
 
 // WorkflowRun represents a GitHub Actions workflow run.
@@ -28,28 +27,6 @@ type WorkflowRun struct {
 	HTMLURL    string `json:"html_url"`
 }
 
-// CreateCheckRunRequest holds parameters for creating a GitHub Check Run.
-type CreateCheckRunRequest struct {
-	Name       string          `json:"name"`
-	HeadSHA    string          `json:"head_sha"`
-	Status     string          `json:"status"`
-	Conclusion string          `json:"conclusion,omitempty"`
-	Output     *CheckRunOutput `json:"output,omitempty"`
-}
-
-// CheckRunOutput holds the title and summary for a check run.
-type CheckRunOutput struct {
-	Title   string `json:"title"`
-	Summary string `json:"summary"`
-}
-
-// CheckRun represents a GitHub Check Run response.
-type CheckRun struct {
-	ID      int64  `json:"id"`
-	HTMLURL string `json:"html_url"`
-	Status  string `json:"status"`
-}
-
 // httpGitHubClient implements GitHubClient using net/http.
 type httpGitHubClient struct {
 	baseURL    string
@@ -142,22 +119,3 @@ func (c *httpGitHubClient) GetWorkflowRun(ctx context.Context, owner, repo strin
 	}
 	return &run, nil
 }
-
-// CreateCheckRun creates a GitHub Check Run on a commit.
-func (c *httpGitHubClient) CreateCheckRun(ctx context.Context, owner, repo string, req *CreateCheckRunRequest, token string) (*CheckRun, error) {
-	url := fmt.Sprintf("%s/repos/%s/%s/check-runs", c.baseURL, owner, repo)
-
-	body, status, err := c.doRequest(ctx, http.MethodPost, url, req, token)
-	if err != nil {
-		return nil, fmt.Errorf("create check run: %w", err)
-	}
-	if status != http.StatusCreated {
-		return nil, fmt.Errorf("create check run: unexpected status %d", status)
-	}
-
-	var check CheckRun
-	if err := json.Unmarshal(body, &check); err != nil {
-		return nil, fmt.Errorf("parse check run: %w", err)
-	}
-	return &check, nil
-}
diff --git a/internal/integration_test.go b/internal/integration_test.go
index ea27146..586e0c0 100644
--- a/internal/integration_test.go
+++ b/internal/integration_test.go
@@ -89,54 +89,3 @@ pipelines:
 		t.Errorf("expected status.conclusion=success, got %v", statusOut["conclusion"])
 	}
 }
-
-// TestIntegration_CreateCheck verifies that step.gh_create_check can be mocked
-// and records its invocation via a Recorder.
-func TestIntegration_CreateCheck(t *testing.T) {
-	rec := wftest.RecordStep("step.gh_create_check")
-	rec.WithOutput(map[string]any{
-		"check_run_id": int64(99),
-		"status":       "completed",
-		"url":          "https://github.com/GoCodeAlone/workflow/runs/99",
-	})
-
-	h := wftest.New(t, wftest.WithYAML(`
-pipelines:
-  check-pipeline:
-    steps:
-      - name: create_check
-        type: step.gh_create_check
-        config:
-          owner: "GoCodeAlone"
-          repo: "workflow"
-          sha: "abc123"
-          name: "workflow-ci"
-          status: "completed"
-          conclusion: "success"
-          title: "CI Pipeline"
-          summary: "All tests passed"
-          token: "fake-token"
-      - name: done
-        type: step.set
-        config:
-          values:
-            reported: true
-`),
-		rec,
-	)
-
-	result := h.ExecutePipeline("check-pipeline", nil)
-	if result.Error != nil {
-		t.Fatalf("unexpected error: %v", result.Error)
-	}
-	if result.Output["reported"] != true {
-		t.Errorf("expected reported=true, got %v", result.Output["reported"])
-	}
-	if rec.CallCount() != 1 {
-		t.Errorf("expected step.gh_create_check to be called once, got %d", rec.CallCount())
-	}
-	checkOut := result.StepResults["create_check"]
-	if checkOut["check_run_id"] != int64(99) {
-		t.Errorf("expected check_run_id=99, got %v", checkOut["check_run_id"])
-	}
-}
diff --git a/internal/plugin.go b/internal/plugin.go
index 44d5451..e3cee4c 100644
--- a/internal/plugin.go
+++ b/internal/plugin.go
@@ -71,8 +71,6 @@ func (p *githubPlugin) StepTypes() []string {
 		// Existing steps
 		"step.gh_action_trigger",
 		"step.gh_action_status",
-		"step.gh_compute_gateway",
-		"step.gh_create_check",
 		// Pull request steps
 		"step.gh_pr_create",
 		"step.gh_pr_merge",
@@ -101,10 +99,6 @@ func (p *githubPlugin) CreateStep(typeName, name string, config map[string]any)
 		return newActionTriggerStep(name, config, nil)
 	case "step.gh_action_status":
 		return newActionStatusStep(name, config, nil)
-	case "step.gh_compute_gateway":
-		return newComputeGatewayStep(name, config, nil)
-	case "step.gh_create_check":
-		return newCreateCheckStep(name, config, nil)
 	case "step.gh_pr_create":
 		return newPRCreateStep(name, config)
 	case "step.gh_pr_merge":
diff --git a/internal/step_action_trigger_test.go b/internal/step_action_trigger_test.go
index b3af1ed..06de937 100644
--- a/internal/step_action_trigger_test.go
+++ b/internal/step_action_trigger_test.go
@@ -9,9 +9,8 @@ import (
 // --- mock GitHub client ---
 
 type mockGitHubClient struct {
-	triggerWorkflowFunc  func(ctx context.Context, owner, repo, workflow, ref string, inputs map[string]string, token string) error
-	getWorkflowRunFunc   func(ctx context.Context, owner, repo string, runID int64, token string) (*WorkflowRun, error)
-	createCheckRunFunc   func(ctx context.Context, owner, repo string, req *CreateCheckRunRequest, token string) (*CheckRun, error)
+	triggerWorkflowFunc func(ctx context.Context, owner, repo, workflow, ref string, inputs map[string]string, token string) error
+	getWorkflowRunFunc  func(ctx context.Context, owner, repo string, runID int64, token string) (*WorkflowRun, error)
 }
 
 func (m *mockGitHubClient) TriggerWorkflow(ctx context.Context, owner, repo, workflow, ref string, inputs map[string]string, token string) error {
@@ -28,13 +27,6 @@ func (m *mockGitHubClient) GetWorkflowRun(ctx context.Context, owner, repo strin
 	return &WorkflowRun{ID: runID, Status: "completed", Conclusion: "success"}, nil
 }
 
-func (m *mockGitHubClient) CreateCheckRun(ctx context.Context, owner, repo string, req *CreateCheckRunRequest, token string) (*CheckRun, error) {
-	if m.createCheckRunFunc != nil {
-		return m.createCheckRunFunc(ctx, owner, repo, req, token)
-	}
-	return &CheckRun{ID: 42, Status: "completed"}, nil
-}
-
 // --- step.gh_action_trigger tests ---
 
 func TestActionTriggerStep_Success(t *testing.T) {
diff --git a/internal/step_compute_gateway.go b/internal/step_compute_gateway.go
deleted file mode 100644
index 060a800..0000000
--- a/internal/step_compute_gateway.go
+++ /dev/null
@@ -1,777 +0,0 @@
-package internal
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-
-	sdk "github.com/GoCodeAlone/workflow/plugin/external/sdk"
-)
-
-const computeGatewayHTTPTimeout = 30 * time.Second
-
-type computeGatewayStep struct {
-	name   string
-	config computeGatewayConfig
-	client computeGatewayClient
-	github GitHubClient
-}
-
-type computeGatewayConfig struct {
-	ServerURL             string
-	Token                 string
-	Repository            string
-	OIDCToken             string
-	WorkflowRunID         string
-	WorkflowRunAttempt    string
-	WorkflowJobID         string
-	WorkflowJobName       string
-	Ref                   string
-	SHA                   string
-	OrgID                 string
-	PoolID                string
-	PolicyID              string
-	TimeoutSeconds        int
-	CommandArgs           []string
-	WorkingDirectory      string
-	ArtifactAllowlist     []string
-	Labels                map[string]string
-	ExecutionSecurityTier string
-	ProofTier             string
-	ExecutorProvider      string
-	HardwareClass         string
-	Wait                  bool
-	PollInterval          time.Duration
-	Timeout               time.Duration
-	WriteCheck            bool
-	CheckOwner            string
-	CheckRepo             string
-	CheckSHA              string
-	CheckName             string
-	CheckToken            string
-}
-
-type computeGatewayPlacementRequirements struct {
-	ExecutorProvider      string `json:"executor_provider,omitempty"`
-	ExecutionSecurityTier string `json:"execution_security_tier,omitempty"`
-	ProofTier             string `json:"proof_tier,omitempty"`
-	HardwareClass         string `json:"hardware_class,omitempty"`
-}
-
-type computeGatewayWorkloadRequest struct {
-	Repository         string                              `json:"repository"`
-	OIDCToken          string                              `json:"oidc_token,omitempty"`
-	WorkflowRunID      int64                               `json:"workflow_run_id"`
-	WorkflowRunAttempt int64                               `json:"workflow_run_attempt,omitempty"`
-	WorkflowJobID      int64                               `json:"workflow_job_id"`
-	WorkflowJobName    string                              `json:"workflow_job_name"`
-	Ref                string                              `json:"ref,omitempty"`
-	SHA                string                              `json:"sha,omitempty"`
-	OrgID              string                              `json:"org_id"`
-	PoolID             string                              `json:"pool_id"`
-	PolicyID           string                              `json:"policy_id"`
-	TimeoutSeconds     int                                 `json:"timeout_seconds,omitempty"`
-	CommandArgs        []string                            `json:"command_args"`
-	WorkingDirectory   string                              `json:"working_directory,omitempty"`
-	ArtifactAllowlist  []string                            `json:"artifact_allowlist,omitempty"`
-	Requirements       computeGatewayPlacementRequirements `json:"requirements,omitempty"`
-	Labels             map[string]string                   `json:"labels,omitempty"`
-}
-
-type computeGatewayTask struct {
-	ID     string            `json:"id"`
-	Status string            `json:"status,omitempty"`
-	Labels map[string]string `json:"labels,omitempty"`
-}
-
-type computeGatewayWorkloadResponse struct {
-	Task computeGatewayTask `json:"task"`
-}
-
-type computeGatewayWorkloadStatus struct {
-	TaskID         string            `json:"task_id"`
-	Status         string            `json:"status"`
-	Conclusion     string            `json:"conclusion,omitempty"`
-	ProofID        string            `json:"proof_id,omitempty"`
-	ArtifactHash   string            `json:"artifact_hash,omitempty"`
-	ContributionID string            `json:"contribution_id,omitempty"`
-	WorkerID       string            `json:"worker_id,omitempty"`
-	Labels         map[string]string `json:"labels,omitempty"`
-}
-
-type computeGatewayStatusResponse struct {
-	Status computeGatewayWorkloadStatus `json:"status"`
-}
-
-type computeGatewayClient interface {
-	SubmitWorkload(context.Context, string, string, computeGatewayWorkloadRequest) (computeGatewayWorkloadResponse, error)
-	WorkloadStatus(context.Context, string, string, string) (computeGatewayStatusResponse, error)
-}
-
-type httpComputeGatewayClient struct {
-	http *http.Client
-}
-
-func newComputeGatewayStep(name string, config map[string]any, client computeGatewayClient) (*computeGatewayStep, error) {
-	cfg, err := parseComputeGatewayConfig(config)
-	if err != nil {
-		return nil, fmt.Errorf("step.gh_compute_gateway %q: %w", name, err)
-	}
-	if client == nil {
-		client = httpComputeGatewayClient{http: &http.Client{Timeout: computeGatewayHTTPTimeout}}
-	}
-	return &computeGatewayStep{name: name, config: cfg, client: client, github: newHTTPGitHubClient()}, nil
-}
-
-func parseComputeGatewayConfig(raw map[string]any) (computeGatewayConfig, error) {
-	var cfg computeGatewayConfig
-	cfg.ServerURL, _ = raw["server_url"].(string)
-	cfg.ServerURL = os.ExpandEnv(cfg.ServerURL)
-	if cfg.ServerURL == "" {
-		return cfg, errors.New("config.server_url is required")
-	}
-	if err := validateComputeGatewayServerURL(cfg.ServerURL); err != nil {
-		return cfg, err
-	}
-	cfg.Token, _ = raw["token"].(string)
-	cfg.Token = os.ExpandEnv(cfg.Token)
-	if cfg.Token == "" {
-		return cfg, errors.New("config.token is required")
-	}
-	cfg.Repository, _ = raw["repository"].(string)
-	if cfg.Repository == "" {
-		return cfg, errors.New("config.repository is required")
-	}
-	cfg.OIDCToken, _ = raw["oidc_token"].(string)
-	cfg.OIDCToken = os.ExpandEnv(cfg.OIDCToken)
-	if cfg.OIDCToken == "" {
-		return cfg, errors.New("config.oidc_token is required")
-	}
-	cfg.WorkflowRunID = requiredString(raw, "workflow_run_id")
-	if cfg.WorkflowRunID == "" {
-		return cfg, errors.New("config.workflow_run_id is required")
-	}
-	cfg.WorkflowRunAttempt = optionalString(raw, "workflow_run_attempt")
-	cfg.WorkflowJobID = requiredString(raw, "workflow_job_id")
-	if cfg.WorkflowJobID == "" {
-		return cfg, errors.New("config.workflow_job_id is required")
-	}
-	cfg.WorkflowJobName, _ = raw["workflow_job_name"].(string)
-	if cfg.WorkflowJobName == "" {
-		return cfg, errors.New("config.workflow_job_name is required")
-	}
-	cfg.Ref, _ = raw["ref"].(string)
-	cfg.SHA, _ = raw["sha"].(string)
-	cfg.OrgID, _ = raw["org_id"].(string)
-	if cfg.OrgID == "" {
-		return cfg, errors.New("config.org_id is required")
-	}
-	cfg.PoolID, _ = raw["pool_id"].(string)
-	if cfg.PoolID == "" {
-		return cfg, errors.New("config.pool_id is required")
-	}
-	cfg.PolicyID, _ = raw["policy_id"].(string)
-	if cfg.PolicyID == "" {
-		return cfg, errors.New("config.policy_id is required")
-	}
-	if timeout, ok, err := optionalInt(raw, "timeout_seconds"); err != nil {
-		return cfg, err
-	} else if ok {
-		if timeout < 0 {
-			return cfg, errors.New("config.timeout_seconds cannot be negative")
-		}
-		cfg.TimeoutSeconds = timeout
-	}
-	args, err := stringSlice(raw["command_args"])
-	if err != nil {
-		return cfg, fmt.Errorf("config.command_args: %w", err)
-	}
-	if len(args) == 0 {
-		return cfg, errors.New("config.command_args is required")
-	}
-	cfg.CommandArgs = args
-	cfg.WorkingDirectory, _ = raw["working_directory"].(string)
-	if values, err := stringSlice(raw["artifact_allowlist"]); err != nil {
-		return cfg, fmt.Errorf("config.artifact_allowlist: %w", err)
-	} else {
-		cfg.ArtifactAllowlist = values
-	}
-	if labels, err := stringMap(raw["labels"]); err != nil {
-		return cfg, fmt.Errorf("config.labels: %w", err)
-	} else {
-		cfg.Labels = labels
-	}
-	cfg.ExecutionSecurityTier, _ = raw["execution_security_tier"].(string)
-	if cfg.ExecutionSecurityTier == "" {
-		cfg.ExecutionSecurityTier = "sandboxed-container"
-	}
-	cfg.ProofTier, _ = raw["proof_tier"].(string)
-	if cfg.ProofTier == "" {
-		cfg.ProofTier = "artifact-hash"
-	}
-	if !protectedComputeGatewayExecutionTier(cfg.ExecutionSecurityTier) {
-		return cfg, fmt.Errorf("config.execution_security_tier %q is not protected for compute gateway workloads", cfg.ExecutionSecurityTier)
-	}
-	if !proofBackedComputeGatewayTier(cfg.ProofTier) {
-		return cfg, fmt.Errorf("config.proof_tier %q is not proof-backed for compute gateway workloads", cfg.ProofTier)
-	}
-	cfg.ExecutorProvider, _ = raw["executor_provider"].(string)
-	cfg.HardwareClass, _ = raw["hardware_class"].(string)
-	if rawWait, ok := raw["wait"]; ok {
-		wait, ok := rawWait.(bool)
-		if !ok {
-			return cfg, errors.New("config.wait must be a boolean")
-		}
-		cfg.Wait = wait
-	} else {
-		cfg.Wait = true
-	}
-	if !cfg.Wait {
-		return cfg, errors.New("config.wait must be true for proof-backed compute gateway workloads")
-	}
-	cfg.WriteCheck, _ = raw["write_check"].(bool)
-	cfg.CheckOwner, _ = raw["check_owner"].(string)
-	cfg.CheckRepo, _ = raw["check_repo"].(string)
-	cfg.CheckSHA, _ = raw["check_sha"].(string)
-	cfg.CheckName, _ = raw["check_name"].(string)
-	cfg.CheckToken, _ = raw["check_token"].(string)
-	cfg.CheckToken = os.ExpandEnv(cfg.CheckToken)
-	if cfg.CheckOwner != "" || cfg.CheckRepo != "" || cfg.CheckSHA != "" || cfg.CheckName != "" || cfg.CheckToken != "" {
-		cfg.WriteCheck = true
-	}
-	if cfg.WriteCheck {
-		if !cfg.Wait {
-			return cfg, errors.New("config.write_check requires wait=true")
-		}
-		if cfg.CheckOwner == "" || cfg.CheckRepo == "" || cfg.CheckSHA == "" || cfg.CheckName == "" || cfg.CheckToken == "" {
-			return cfg, errors.New("config.write_check requires check_owner, check_repo, check_sha, check_name, and check_token")
-		}
-	}
-	pollInterval, err := durationField(raw, "poll_interval", "10s")
-	if err != nil {
-		return cfg, err
-	}
-	if pollInterval <= 0 {
-		return cfg, errors.New("config.poll_interval must be greater than zero")
-	}
-	cfg.PollInterval = pollInterval
-	timeout, err := durationField(raw, "timeout", "30m")
-	if err != nil {
-		return cfg, err
-	}
-	if timeout <= 0 {
-		return cfg, errors.New("config.timeout must be greater than zero")
-	}
-	cfg.Timeout = timeout
-	return cfg, nil
-}
-
-func (s *computeGatewayStep) Execute(
-	ctx context.Context,
-	triggerData map[string]any,
-	stepOutputs map[string]map[string]any,
-	current map[string]any,
-	_ map[string]any,
-	_ map[string]any,
-) (*sdk.StepResult, error) {
-	req, err := s.workloadRequest(triggerData, stepOutputs, current)
-	if err != nil {
-		return errorResult(err.Error()), nil
-	}
-	submitted, err := s.client.SubmitWorkload(ctx, s.config.ServerURL, s.config.Token, req)
-	if err != nil {
-		return errorResult(fmt.Sprintf("failed to submit compute gateway workload: %v", err)), nil
-	}
-	output := map[string]any{
-		"task_id": submitted.Task.ID,
-		"status":  submitted.Task.Status,
-	}
-	status, err := s.waitForStatus(ctx, submitted.Task.ID)
-	if err != nil {
-		return errorResult(err.Error()), nil
-	}
-	if err := computeGatewayTerminalError(status); err != nil {
-		checkOutput, checkErr := s.writeTerminalCheck(ctx, status, triggerData, stepOutputs, current)
-		_ = checkOutput
-		if checkErr != nil {
-			return errorResult(errors.Join(err, checkErr).Error()), nil
-		}
-		return errorResult(err.Error()), nil
-	}
-	checkOutput, checkErr := s.writeTerminalCheck(ctx, status, triggerData, stepOutputs, current)
-	if checkErr != nil {
-		return errorResult(checkErr.Error()), nil
-	}
-	for key, value := range computeGatewayStatusOutput(status) {
-		output[key] = value
-	}
-	for key, value := range checkOutput {
-		output[key] = value
-	}
-	return &sdk.StepResult{Output: output}, nil
-}
-
-func (s *computeGatewayStep) workloadRequest(triggerData map[string]any, stepOutputs map[string]map[string]any, current map[string]any) (computeGatewayWorkloadRequest, error) {
-	runID, err := resolveInt64(s.config.WorkflowRunID, "workflow_run_id", triggerData, stepOutputs, current)
-	if err != nil {
-		return computeGatewayWorkloadRequest{}, err
-	}
-	var attempt int64
-	if s.config.WorkflowRunAttempt != "" {
-		attempt, err = resolveInt64(s.config.WorkflowRunAttempt, "workflow_run_attempt", triggerData, stepOutputs, current)
-		if err != nil {
-			return computeGatewayWorkloadRequest{}, err
-		}
-	}
-	jobID, err := resolveInt64(s.config.WorkflowJobID, "workflow_job_id", triggerData, stepOutputs, current)
-	if err != nil {
-		return computeGatewayWorkloadRequest{}, err
-	}
-	return computeGatewayWorkloadRequest{
-		Repository:         resolveField(s.config.Repository, triggerData, stepOutputs, current),
-		OIDCToken:          resolveField(s.config.OIDCToken, triggerData, stepOutputs, current),
-		WorkflowRunID:      runID,
-		WorkflowRunAttempt: attempt,
-		WorkflowJobID:      jobID,
-		WorkflowJobName:    resolveField(s.config.WorkflowJobName, triggerData, stepOutputs, current),
-		Ref:                resolveField(s.config.Ref, triggerData, stepOutputs, current),
-		SHA:                resolveField(s.config.SHA, triggerData, stepOutputs, current),
-		OrgID:              resolveField(s.config.OrgID, triggerData, stepOutputs, current),
-		PoolID:             resolveField(s.config.PoolID, triggerData, stepOutputs, current),
-		PolicyID:           resolveField(s.config.PolicyID, triggerData, stepOutputs, current),
-		TimeoutSeconds:     s.config.TimeoutSeconds,
-		CommandArgs:        resolveStringSlice(s.config.CommandArgs, triggerData, stepOutputs, current),
-		WorkingDirectory:   resolveField(s.config.WorkingDirectory, triggerData, stepOutputs, current),
-		ArtifactAllowlist:  resolveStringSlice(s.config.ArtifactAllowlist, triggerData, stepOutputs, current),
-		Labels:             resolveStringMap(s.config.Labels, triggerData, stepOutputs, current),
-		Requirements: computeGatewayPlacementRequirements{
-			ExecutorProvider:      resolveField(s.config.ExecutorProvider, triggerData, stepOutputs, current),
-			ExecutionSecurityTier: s.config.ExecutionSecurityTier,
-			ProofTier:             s.config.ProofTier,
-			HardwareClass:         resolveField(s.config.HardwareClass, triggerData, stepOutputs, current),
-		},
-	}, nil
-}
-
-func (s *computeGatewayStep) waitForStatus(ctx context.Context, taskID string) (computeGatewayWorkloadStatus, error) {
-	deadline := time.Now().Add(s.config.Timeout)
-	for {
-		resp, err := s.client.WorkloadStatus(ctx, s.config.ServerURL, s.config.Token, taskID)
-		if err != nil {
-			return computeGatewayWorkloadStatus{}, fmt.Errorf("failed to read compute gateway status: %w", err)
-		}
-		if computeGatewayTerminal(resp.Status) {
-			return resp.Status, nil
-		}
-		if time.Now().After(deadline) {
-			return computeGatewayWorkloadStatus{}, fmt.Errorf("timeout waiting for compute gateway task %s after %s", taskID, s.config.Timeout)
-		}
-		select {
-		case <-ctx.Done():
-			return computeGatewayWorkloadStatus{}, errors.New("context cancelled while waiting for compute gateway workload")
-		case <-time.After(s.config.PollInterval):
-		}
-	}
-}
-
-func (s *computeGatewayStep) writeTerminalCheck(
-	ctx context.Context,
-	status computeGatewayWorkloadStatus,
-	triggerData map[string]any,
-	stepOutputs map[string]map[string]any,
-	current map[string]any,
-) (map[string]any, error) {
-	if !s.config.WriteCheck {
-		return nil, nil
-	}
-	owner, err := resolveRequiredCheckField("check_owner", s.config.CheckOwner, triggerData, stepOutputs, current)
-	if err != nil {
-		return nil, err
-	}
-	repo, err := resolveRequiredCheckField("check_repo", s.config.CheckRepo, triggerData, stepOutputs, current)
-	if err != nil {
-		return nil, err
-	}
-	sha, err := resolveRequiredCheckField("check_sha", s.config.CheckSHA, triggerData, stepOutputs, current)
-	if err != nil {
-		return nil, err
-	}
-	if err := validateComputeGatewayCheckTarget(status, owner, repo, sha); err != nil {
-		return nil, err
-	}
-	name, err := resolveRequiredCheckField("check_name", s.config.CheckName, triggerData, stepOutputs, current)
-	if err != nil {
-		return nil, err
-	}
-	token, err := resolveRequiredCheckField("check_token", s.config.CheckToken, triggerData, stepOutputs, current)
-	if err != nil {
-		return nil, err
-	}
-	req := &CreateCheckRunRequest{
-		Name:       name,
-		HeadSHA:    sha,
-		Status:     "completed",
-		Conclusion: githubConclusionForComputeStatus(status),
-		Output: &CheckRunOutput{
-			Title:   "workflow-compute " + status.Status,
-			Summary: computeGatewayCheckSummary(status),
-		},
-	}
-	check, err := s.github.CreateCheckRun(ctx, owner, repo, req, token)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create compute gateway check: %w", err)
-	}
-	return map[string]any{
-		"check_run_id": check.ID,
-		"check_url":    check.HTMLURL,
-	}, nil
-}
-
-func validateComputeGatewayCheckTarget(status computeGatewayWorkloadStatus, owner, repo, sha string) error {
-	verifiedRepository := status.Labels["github.provenance.repository"]
-	verifiedSHA := status.Labels["github.provenance.sha"]
-	if verifiedRepository == "" || verifiedSHA == "" {
-		return fmt.Errorf("compute gateway status missing verified github repository/sha labels for check binding")
-	}
-	if !strings.EqualFold(owner+"/"+repo, verifiedRepository) {
-		return fmt.Errorf("compute gateway check target %s/%s does not match verified repository %s", owner, repo, verifiedRepository)
-	}
-	if !strings.EqualFold(sha, verifiedSHA) {
-		return fmt.Errorf("compute gateway check sha %s does not match verified sha %s", sha, verifiedSHA)
-	}
-	return nil
-}
-
-func resolveRequiredCheckField(name, value string, triggerData map[string]any, stepOutputs map[string]map[string]any, current map[string]any) (string, error) {
-	resolved := resolveField(value, triggerData, stepOutputs, current)
-	if resolved == "" || strings.Contains(resolved, "{{") {
-		return "", fmt.Errorf("config.%s resolved to empty or unresolved value", name)
-	}
-	return resolved, nil
-}
-
-func (c httpComputeGatewayClient) SubmitWorkload(ctx context.Context, serverURL, token string, req computeGatewayWorkloadRequest) (computeGatewayWorkloadResponse, error) {
-	var out computeGatewayWorkloadResponse
-	err := c.do(ctx, http.MethodPost, serverURL, token, "/v1/adapters/github/actions/workloads", req, http.StatusCreated, &out)
-	return out, err
-}
-
-func (c httpComputeGatewayClient) WorkloadStatus(ctx context.Context, serverURL, token, taskID string) (computeGatewayStatusResponse, error) {
-	var out computeGatewayStatusResponse
-	err := c.do(ctx, http.MethodGet, serverURL, token, "/v1/adapters/github/actions/workloads/"+url.PathEscape(taskID), nil, http.StatusOK, &out)
-	return out, err
-}
-
-func (c httpComputeGatewayClient) do(ctx context.Context, method, serverURL, token, path string, body any, want int, out any) error {
-	base, err := url.Parse(serverURL)
-	if err != nil {
-		return fmt.Errorf("parse server_url: %w", err)
-	}
-	var reader io.Reader
-	if body != nil {
-		data, err := json.Marshal(body)
-		if err != nil {
-			return fmt.Errorf("marshal request: %w", err)
-		}
-		reader = bytes.NewReader(data)
-	}
-	req, err := http.NewRequestWithContext(ctx, method, base.JoinPath(path).String(), reader)
-	if err != nil {
-		return fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("Accept", "application/json")
-	if body != nil {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != want {
-		data, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
-		return fmt.Errorf("%s %s: got HTTP %d want %d: %s", method, path, resp.StatusCode, want, strings.TrimSpace(string(data)))
-	}
-	if out != nil {
-		if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
-			return fmt.Errorf("decode response: %w", err)
-		}
-	}
-	return nil
-}
-
-func validateComputeGatewayServerURL(raw string) error {
-	u, err := url.Parse(raw)
-	if err != nil {
-		return fmt.Errorf("parse config.server_url: %w", err)
-	}
-	if u.Scheme != "http" && u.Scheme != "https" {
-		return errors.New("config.server_url must use http or https")
-	}
-	if u.Host == "" {
-		return errors.New("config.server_url must include host")
-	}
-	if u.Scheme == "http" && !computeGatewayLoopback(u.Hostname()) {
-		return fmt.Errorf("config.server_url refuses bearer token over cleartext non-loopback host %q", raw)
-	}
-	return nil
-}
-
-func computeGatewayLoopback(host string) bool {
-	if host == "localhost" {
-		return true
-	}
-	ip := net.ParseIP(host)
-	return ip != nil && ip.IsLoopback()
-}
-
-func requiredString(raw map[string]any, key string) string {
-	value, ok := raw[key]
-	if !ok || value == nil {
-		return ""
-	}
-	return fmt.Sprint(value)
-}
-
-func optionalString(raw map[string]any, key string) string {
-	value, ok := raw[key]
-	if !ok || value == nil {
-		return ""
-	}
-	return fmt.Sprint(value)
-}
-
-func optionalInt(raw map[string]any, key string) (int, bool, error) {
-	value, ok := raw[key]
-	if !ok || value == nil {
-		return 0, false, nil
-	}
-	switch v := value.(type) {
-	case int:
-		return v, true, nil
-	case int64:
-		if v > int64(int(^uint(0)>>1)) || v < -int64(int(^uint(0)>>1))-1 {
-			return 0, true, fmt.Errorf("config.%s is outside int range", key)
-		}
-		return int(v), true, nil
-	case float64:
-		if v != float64(int64(v)) {
-			return 0, true, fmt.Errorf("config.%s must be an integer", key)
-		}
-		if v > float64(int(^uint(0)>>1)) || v < -float64(int(^uint(0)>>1))-1 {
-			return 0, true, fmt.Errorf("config.%s is outside int range", key)
-		}
-		return int(v), true, nil
-	case string:
-		n, err := strconv.Atoi(v)
-		if err != nil {
-			return 0, true, fmt.Errorf("config.%s is not a valid integer: %w", key, err)
-		}
-		return n, true, nil
-	default:
-		return 0, true, fmt.Errorf("config.%s must be an integer", key)
-	}
-}
-
-func durationField(raw map[string]any, key, fallback string) (time.Duration, error) {
-	rawValue, ok := raw[key]
-	if ok && rawValue != nil {
-		value, ok := rawValue.(string)
-		if !ok {
-			return 0, fmt.Errorf("config.%s must be a duration string", key)
-		}
-		return parseDurationField(key, value)
-	}
-	value := fallback
-	return parseDurationField(key, value)
-}
-
-func parseDurationField(key, value string) (time.Duration, error) {
-	if value == "" {
-		return 0, fmt.Errorf("config.%s is required", key)
-	}
-	d, err := time.ParseDuration(value)
-	if err != nil {
-		return 0, fmt.Errorf("config.%s is invalid: %w", key, err)
-	}
-	return d, nil
-}
-
-func stringSlice(value any) ([]string, error) {
-	switch v := value.(type) {
-	case nil:
-		return nil, nil
-	case []string:
-		return append([]string(nil), v...), nil
-	case []any:
-		out := make([]string, 0, len(v))
-		for _, item := range v {
-			s, ok := item.(string)
-			if !ok {
-				return nil, errors.New("all values must be strings")
-			}
-			out = append(out, s)
-		}
-		return out, nil
-	default:
-		return nil, errors.New("must be a string array")
-	}
-}
-
-func stringMap(value any) (map[string]string, error) {
-	switch v := value.(type) {
-	case nil:
-		return nil, nil
-	case map[string]string:
-		out := make(map[string]string, len(v))
-		for key, item := range v {
-			out[key] = item
-		}
-		return out, nil
-	case map[string]any:
-		out := make(map[string]string, len(v))
-		for key, item := range v {
-			s, ok := item.(string)
-			if !ok {
-				return nil, fmt.Errorf("%s must be a string", key)
-			}
-			out[key] = s
-		}
-		return out, nil
-	default:
-		return nil, errors.New("must be a string map")
-	}
-}
-
-func resolveInt64(value, name string, triggerData map[string]any, stepOutputs map[string]map[string]any, current map[string]any) (int64, error) {
-	resolved := resolveField(value, triggerData, stepOutputs, current)
-	n, err := strconv.ParseInt(resolved, 10, 64)
-	if err != nil {
-		return 0, fmt.Errorf("%s resolved to non-integer value %q: %w", name, resolved, err)
-	}
-	return n, nil
-}
-
-func resolveStringSlice(values []string, triggerData map[string]any, stepOutputs map[string]map[string]any, current map[string]any) []string {
-	out := make([]string, 0, len(values))
-	for _, value := range values {
-		out = append(out, resolveField(value, triggerData, stepOutputs, current))
-	}
-	return out
-}
-
-func resolveStringMap(values map[string]string, triggerData map[string]any, stepOutputs map[string]map[string]any, current map[string]any) map[string]string {
-	if len(values) == 0 {
-		return nil
-	}
-	out := make(map[string]string, len(values))
-	for key, value := range values {
-		out[key] = resolveField(value, triggerData, stepOutputs, current)
-	}
-	return out
-}
-
-func protectedComputeGatewayExecutionTier(tier string) bool {
-	switch tier {
-	case "sandboxed-container", "microvm", "confidential-cpu", "confidential-gpu", "wasm-capability":
-		return true
-	default:
-		return false
-	}
-}
-
-func proofBackedComputeGatewayTier(tier string) bool {
-	switch tier {
-	case "artifact-hash", "replicated-quorum", "attested-receipt", "attested-quorum", "zk-replay":
-		return true
-	default:
-		return false
-	}
-}
-
-func computeGatewayTerminal(status computeGatewayWorkloadStatus) bool {
-	if status.Conclusion != "" {
-		return true
-	}
-	switch status.Status {
-	case "failed", "stalled", "cancelled":
-		return true
-	default:
-		return false
-	}
-}
-
-func computeGatewayTerminalError(status computeGatewayWorkloadStatus) error {
-	if status.Conclusion == "success" && (status.ProofID == "" || status.ContributionID == "") {
-		return fmt.Errorf("compute gateway task %s reported success without proof-backed status", status.TaskID)
-	}
-	if status.Conclusion != "" && status.Conclusion != "success" {
-		return fmt.Errorf("compute gateway task %s concluded %s", status.TaskID, status.Conclusion)
-	}
-	switch status.Status {
-	case "failed", "stalled", "cancelled":
-		return fmt.Errorf("compute gateway task %s ended with status %s", status.TaskID, status.Status)
-	default:
-		return nil
-	}
-}
-
-func githubConclusionForComputeStatus(status computeGatewayWorkloadStatus) string {
-	if status.Conclusion == "success" && (status.ProofID == "" || status.ContributionID == "") {
-		return "action_required"
-	}
-	if status.Conclusion == "success" {
-		return "success"
-	}
-	switch status.Status {
-	case "cancelled":
-		return "cancelled"
-	case "stalled":
-		return "timed_out"
-	default:
-		return "failure"
-	}
-}
-
-func computeGatewayCheckSummary(status computeGatewayWorkloadStatus) string {
-	parts := []string{
-		"task_id=" + status.TaskID,
-		"status=" + status.Status,
-	}
-	if status.Conclusion != "" {
-		parts = append(parts, "conclusion="+status.Conclusion)
-	}
-	if status.ProofID != "" {
-		parts = append(parts, "proof_id="+status.ProofID)
-	}
-	if status.ContributionID != "" {
-		parts = append(parts, "contribution_id="+status.ContributionID)
-	}
-	if status.ArtifactHash != "" {
-		parts = append(parts, "artifact_hash="+status.ArtifactHash)
-	}
-	return strings.Join(parts, "\n")
-}
-
-func computeGatewayStatusOutput(status computeGatewayWorkloadStatus) map[string]any {
-	return map[string]any{
-		"task_id":         status.TaskID,
-		"status":          status.Status,
-		"conclusion":      status.Conclusion,
-		"proof_id":        status.ProofID,
-		"artifact_hash":   status.ArtifactHash,
-		"contribution_id": status.ContributionID,
-		"worker_id":       status.WorkerID,
-	}
-}
diff --git a/internal/step_compute_gateway_test.go b/internal/step_compute_gateway_test.go
deleted file mode 100644
index 18ac8bb..0000000
--- a/internal/step_compute_gateway_test.go
+++ /dev/null
@@ -1,510 +0,0 @@
-package internal
-
-import (
-	"context"
-	"testing"
-)
-
-type fakeComputeGatewayClient struct {
-	submitted []computeGatewayWorkloadRequest
-	statuses  []computeGatewayWorkloadStatus
-}
-
-func (c *fakeComputeGatewayClient) SubmitWorkload(_ context.Context, serverURL, token string, req computeGatewayWorkloadRequest) (computeGatewayWorkloadResponse, error) {
-	c.submitted = append(c.submitted, req)
-	return computeGatewayWorkloadResponse{
-		Task: computeGatewayTask{
-			ID:     "github-gateway-task-1",
-			Status: "queued",
-			Labels: map[string]string{
-				"adapter": "github-gateway",
-			},
-		},
-	}, nil
-}
-
-func (c *fakeComputeGatewayClient) WorkloadStatus(_ context.Context, serverURL, token, taskID string) (computeGatewayStatusResponse, error) {
-	if len(c.statuses) == 0 {
-		return computeGatewayStatusResponse{Status: computeGatewayWorkloadStatus{TaskID: taskID, Status: "queued"}}, nil
-	}
-	status := c.statuses[0]
-	c.statuses = c.statuses[1:]
-	return computeGatewayStatusResponse{Status: status}, nil
-}
-
-func TestComputeGatewayStepSubmitsProtectedWorkload(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			proofBackedComputeGatewayStatus(),
-		},
-	}
-	step, err := newComputeGatewayStep("compute", map[string]any{
-		"server_url":        "https://compute.example.test",
-		"token":             "compute-token",
-		"repository":        "GoCodeAlone/workflow-compute",
-		"oidc_token":        "oidc",
-		"workflow_run_id":   "42",
-		"workflow_job_id":   "99",
-		"workflow_job_name": "build",
-		"ref":               "refs/heads/main",
-		"sha":               "abc123",
-		"org_id":            "org-1",
-		"pool_id":           "pool-1",
-		"policy_id":         "policy-1",
-		"command_args":      []any{"go", "test", "./..."},
-		"wait":              true,
-		"poll_interval":     "1ms",
-		"timeout":           "100ms",
-	}, client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if result.StopPipeline {
-		t.Fatalf("unexpected stop: %+v", result.Output)
-	}
-	if len(client.submitted) != 1 {
-		t.Fatalf("submissions: got %d want 1", len(client.submitted))
-	}
-	got := client.submitted[0]
-	if got.Requirements.ExecutionSecurityTier != "sandboxed-container" || got.Requirements.ProofTier != "artifact-hash" {
-		t.Fatalf("gateway placement defaults: %+v", got.Requirements)
-	}
-	if got.Repository != "GoCodeAlone/workflow-compute" || got.WorkflowRunID != 42 || got.WorkflowJobID != 99 {
-		t.Fatalf("gateway request: %+v", got)
-	}
-	if result.StopPipeline {
-		t.Fatalf("unexpected stop: %+v", result.Output)
-	}
-	if taskID, _ := result.Output["task_id"].(string); taskID != "github-gateway-task-1" {
-		t.Fatalf("task_id output: got %q", taskID)
-	}
-}
-
-func TestComputeGatewayStepWaitsForProofBackedStatus(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			{TaskID: "github-gateway-task-1", Status: "queued"},
-			proofBackedComputeGatewayStatus(),
-		},
-	}
-	step, err := newComputeGatewayStep("compute", map[string]any{
-		"server_url":        "https://compute.example.test",
-		"token":             "compute-token",
-		"repository":        "GoCodeAlone/workflow-compute",
-		"oidc_token":        "oidc",
-		"workflow_run_id":   int64(42),
-		"workflow_job_id":   int64(99),
-		"workflow_job_name": "build",
-		"ref":               "refs/heads/main",
-		"sha":               "abc123",
-		"org_id":            "org-1",
-		"pool_id":           "pool-1",
-		"policy_id":         "policy-1",
-		"command_args":      []string{"true"},
-		"wait":              true,
-		"poll_interval":     "1ms",
-		"timeout":           "100ms",
-	}, client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if result.StopPipeline {
-		t.Fatalf("unexpected stop: %+v", result.Output)
-	}
-	if result.Output["conclusion"] != "success" || result.Output["proof_id"] != "proof-1" || result.Output["contribution_id"] != "contrib-1" {
-		t.Fatalf("proof-backed output: %+v", result.Output)
-	}
-}
-
-func TestComputeGatewayStepRejectsSuccessWithoutProofBacking(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			{TaskID: "github-gateway-task-1", Status: "succeeded", Conclusion: "success", Labels: verifiedGitHubLabels()},
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"poll_interval": "1ms",
-		"timeout":       "100ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if !result.StopPipeline {
-		t.Fatalf("unbacked success must stop pipeline: %+v", result.Output)
-	}
-}
-
-func TestComputeGatewayStepWritesFailureCheckForUnbackedSuccess(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			{TaskID: "github-gateway-task-1", Status: "succeeded", Conclusion: "success", Labels: verifiedGitHubLabels()},
-		},
-	}
-	var capturedConclusion string
-	gh := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, req *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			capturedConclusion = req.Conclusion
-			return &CheckRun{ID: 79, HTMLURL: "https://github.example/check/79", Status: "completed"}, nil
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"write_check":   true,
-		"check_owner":   "GoCodeAlone",
-		"check_repo":    "workflow-compute",
-		"check_sha":     "abc123",
-		"check_name":    "workflow-compute",
-		"check_token":   "gh-token",
-		"poll_interval": "1ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-	step.github = gh
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if !result.StopPipeline || capturedConclusion == "success" {
-		t.Fatalf("unbacked success check/stop: conclusion=%q output=%+v", capturedConclusion, result.Output)
-	}
-}
-
-func TestComputeGatewayStepWritesGitHubCheckForProofBackedStatus(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			proofBackedComputeGatewayStatus(),
-		},
-	}
-	var capturedReq *CreateCheckRunRequest
-	gh := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, owner, repo string, req *CreateCheckRunRequest, token string) (*CheckRun, error) {
-			if owner != "GoCodeAlone" || repo != "workflow-compute" || token != "gh-token-from-trigger" {
-				t.Fatalf("check target: owner=%s repo=%s token=%s", owner, repo, token)
-			}
-			capturedReq = req
-			return &CheckRun{ID: 77, HTMLURL: "https://github.example/check/77", Status: "completed"}, nil
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"write_check":   true,
-		"check_owner":   "GoCodeAlone",
-		"check_repo":    "workflow-compute",
-		"check_sha":     "abc123",
-		"check_name":    "workflow-compute",
-		"check_token":   "{{.github_token}}",
-		"poll_interval": "1ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-	step.github = gh
-
-	result, err := step.Execute(context.Background(), map[string]any{"github_token": "gh-token-from-trigger"}, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if result.StopPipeline {
-		t.Fatalf("unexpected stop: %+v", result.Output)
-	}
-	if capturedReq == nil || capturedReq.Conclusion != "success" || capturedReq.HeadSHA != "abc123" {
-		t.Fatalf("check request: %+v", capturedReq)
-	}
-	if result.Output["check_run_id"] != int64(77) {
-		t.Fatalf("check output: %+v", result.Output)
-	}
-}
-
-func TestComputeGatewayStepCheckTargetBindingIsCaseInsensitive(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			proofBackedComputeGatewayStatus(),
-		},
-	}
-	var called bool
-	gh := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, _ *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			called = true
-			return &CheckRun{ID: 80, HTMLURL: "https://github.example/check/80", Status: "completed"}, nil
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"write_check":   true,
-		"check_owner":   "gocodealone",
-		"check_repo":    "Workflow-Compute",
-		"check_sha":     "ABC123",
-		"check_name":    "workflow-compute",
-		"check_token":   "gh-token",
-		"poll_interval": "1ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-	step.github = gh
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if result.StopPipeline || !called {
-		t.Fatalf("case-insensitive target should write check: called=%v output=%+v", called, result.Output)
-	}
-}
-
-func TestComputeGatewayStepRejectsCheckTargetMismatch(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			proofBackedComputeGatewayStatus(),
-		},
-	}
-	gh := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, _ *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			t.Fatal("mismatched check target must not call GitHub")
-			return nil, nil
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"write_check":   true,
-		"check_owner":   "GoCodeAlone",
-		"check_repo":    "other",
-		"check_sha":     "abc123",
-		"check_name":    "workflow-compute",
-		"check_token":   "gh-token",
-		"poll_interval": "1ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-	step.github = gh
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if !result.StopPipeline {
-		t.Fatalf("mismatched check target must stop pipeline: %+v", result.Output)
-	}
-}
-
-func TestComputeGatewayStepStopsOnFailedTerminalStatus(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			{TaskID: "github-gateway-task-1", Status: "failed", Labels: verifiedGitHubLabels()},
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"poll_interval": "1ms",
-		"timeout":       "100ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if !result.StopPipeline {
-		t.Fatalf("failed compute status must stop pipeline: %+v", result.Output)
-	}
-}
-
-func TestComputeGatewayStepWritesFailureCheckBeforeStopping(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			{TaskID: "github-gateway-task-1", Status: "failed", Labels: verifiedGitHubLabels()},
-		},
-	}
-	var capturedConclusion string
-	gh := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, req *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			capturedConclusion = req.Conclusion
-			return &CheckRun{ID: 78, HTMLURL: "https://github.example/check/78", Status: "completed"}, nil
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"write_check":   true,
-		"check_owner":   "GoCodeAlone",
-		"check_repo":    "workflow-compute",
-		"check_sha":     "abc123",
-		"check_name":    "workflow-compute",
-		"check_token":   "gh-token",
-		"poll_interval": "1ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-	step.github = gh
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if !result.StopPipeline || capturedConclusion != "failure" {
-		t.Fatalf("failure check/stop: conclusion=%q output=%+v", capturedConclusion, result.Output)
-	}
-}
-
-func TestComputeGatewayStepRejectsUnresolvedCheckToken(t *testing.T) {
-	client := &fakeComputeGatewayClient{
-		statuses: []computeGatewayWorkloadStatus{
-			proofBackedComputeGatewayStatus(),
-		},
-	}
-	gh := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, _ *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			t.Fatal("unresolved check token must not call GitHub")
-			return nil, nil
-		},
-	}
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait":          true,
-		"write_check":   true,
-		"check_owner":   "GoCodeAlone",
-		"check_repo":    "workflow-compute",
-		"check_sha":     "abc123",
-		"check_name":    "workflow-compute",
-		"check_token":   "{{.missing_github_token}}",
-		"poll_interval": "1ms",
-	}), client)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-	step.github = gh
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if !result.StopPipeline {
-		t.Fatalf("unresolved check token must stop pipeline: %+v", result.Output)
-	}
-}
-
-func TestComputeGatewayStepRejectsDowngradedPlacement(t *testing.T) {
-	_, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"execution_security_tier": "trusted-native",
-		"proof_tier":              "receipt-only",
-	}), &fakeComputeGatewayClient{})
-	if err == nil {
-		t.Fatal("downgraded compute gateway placement must fail")
-	}
-}
-
-func TestComputeGatewayStepRequiresOIDCProvenanceToken(t *testing.T) {
-	_, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"oidc_token": "",
-	}), &fakeComputeGatewayClient{})
-	if err == nil {
-		t.Fatal("compute gateway step must require oidc_token")
-	}
-}
-
-func TestComputeGatewayStepRequiresWaitForProofBackedStatus(t *testing.T) {
-	_, err := newComputeGatewayStep("compute", validComputeGatewayConfig(map[string]any{
-		"wait": false,
-	}), &fakeComputeGatewayClient{})
-	if err == nil {
-		t.Fatal("compute gateway step must require wait=true")
-	}
-}
-
-func TestComputeGatewayStepDefaultsWaitToTrue(t *testing.T) {
-	_, err := newComputeGatewayStep("compute", validComputeGatewayConfig(nil), &fakeComputeGatewayClient{})
-	if err != nil {
-		t.Fatalf("default wait should be true: %v", err)
-	}
-}
-
-func TestComputeGatewayStepDefaultHTTPClientHasTimeout(t *testing.T) {
-	step, err := newComputeGatewayStep("compute", validComputeGatewayConfig(nil), nil)
-	if err != nil {
-		t.Fatalf("newComputeGatewayStep: %v", err)
-	}
-	client, ok := step.client.(httpComputeGatewayClient)
-	if !ok {
-		t.Fatalf("client type: got %T", step.client)
-	}
-	if client.http == nil || client.http.Timeout != computeGatewayHTTPTimeout {
-		t.Fatalf("http timeout: got %+v want %s", client.http, computeGatewayHTTPTimeout)
-	}
-}
-
-func TestComputeGatewayStepRejectsUnsafeNumericConfig(t *testing.T) {
-	cases := map[string]map[string]any{
-		"fractional timeout": {"timeout_seconds": 1.9},
-		"negative timeout":   {"timeout_seconds": -1},
-		"zero poll interval": {"poll_interval": "0s"},
-		"negative wait":      {"timeout": "-1s"},
-		"numeric duration":   {"poll_interval": 1000},
-		"string wait":        {"wait": "true"},
-	}
-	for name, override := range cases {
-		t.Run(name, func(t *testing.T) {
-			_, err := newComputeGatewayStep("compute", validComputeGatewayConfig(override), &fakeComputeGatewayClient{})
-			if err == nil {
-				t.Fatal("unsafe numeric config must fail")
-			}
-		})
-	}
-}
-
-func validComputeGatewayConfig(overrides map[string]any) map[string]any {
-	cfg := map[string]any{
-		"server_url":        "https://compute.example.test",
-		"token":             "compute-token",
-		"repository":        "GoCodeAlone/workflow-compute",
-		"oidc_token":        "oidc",
-		"workflow_run_id":   "42",
-		"workflow_job_id":   "99",
-		"workflow_job_name": "build",
-		"org_id":            "org-1",
-		"pool_id":           "pool-1",
-		"policy_id":         "policy-1",
-		"command_args":      []any{"true"},
-	}
-	for key, value := range overrides {
-		cfg[key] = value
-	}
-	return cfg
-}
-
-func proofBackedComputeGatewayStatus() computeGatewayWorkloadStatus {
-	return computeGatewayWorkloadStatus{
-		TaskID:         "github-gateway-task-1",
-		Status:         "succeeded",
-		Conclusion:     "success",
-		ProofID:        "proof-1",
-		ContributionID: "contrib-1",
-		Labels:         verifiedGitHubLabels(),
-	}
-}
-
-func verifiedGitHubLabels() map[string]string {
-	return map[string]string{
-		"github.provenance.repository": "GoCodeAlone/workflow-compute",
-		"github.provenance.sha":        "abc123",
-	}
-}
diff --git a/internal/step_create_check.go b/internal/step_create_check.go
deleted file mode 100644
index 5c62c67..0000000
--- a/internal/step_create_check.go
+++ /dev/null
@@ -1,174 +0,0 @@
-package internal
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	sdk "github.com/GoCodeAlone/workflow/plugin/external/sdk"
-)
-
-// createCheckStep implements sdk.StepInstance.
-// It creates a GitHub Check Run (status check) on a specific commit.
-//
-// Config:
-//
-//	owner:      "GoCodeAlone"
-//	repo:       "workflow"
-//	sha:        "{{.commit}}"
-//	name:       "workflow-ci"
-//	status:     "completed"     # queued, in_progress, completed
-//	conclusion: "success"       # success, failure, neutral, cancelled, skipped
-//	title:      "CI Pipeline"
-//	summary:    "All tests passed"
-//	token:      "${GITHUB_TOKEN}"
-type createCheckStep struct {
-	name     string
-	config   createCheckConfig
-	ghClient GitHubClient
-}
-
-// createCheckConfig holds the parsed configuration for step.gh_create_check.
-type createCheckConfig struct {
-	Owner      string `yaml:"owner"`
-	Repo       string `yaml:"repo"`
-	SHA        string `yaml:"sha"`
-	Name       string `yaml:"name"`
-	Status     string `yaml:"status"`
-	Conclusion string `yaml:"conclusion"`
-	Title      string `yaml:"title"`
-	Summary    string `yaml:"summary"`
-	Token      string `yaml:"token"`
-}
-
-// validStatuses lists the valid values for the status field.
-var validStatuses = map[string]bool{
-	"queued":      true,
-	"in_progress": true,
-	"completed":   true,
-}
-
-// validConclusions lists the valid values for the conclusion field.
-var validConclusions = map[string]bool{
-	"success":         true,
-	"failure":         true,
-	"neutral":         true,
-	"cancelled":       true,
-	"skipped":         true,
-	"timed_out":       true,
-	"action_required": true,
-}
-
-// newCreateCheckStep parses config and returns a createCheckStep.
-func newCreateCheckStep(name string, config map[string]any, client GitHubClient) (*createCheckStep, error) {
-	cfg, err := parseCreateCheckConfig(config)
-	if err != nil {
-		return nil, fmt.Errorf("step.gh_create_check %q: %w", name, err)
-	}
-	if client == nil {
-		client = newHTTPGitHubClient()
-	}
-	return &createCheckStep{
-		name:     name,
-		config:   cfg,
-		ghClient: client,
-	}, nil
-}
-
-// parseCreateCheckConfig converts a raw config map to createCheckConfig.
-func parseCreateCheckConfig(raw map[string]any) (createCheckConfig, error) {
-	var cfg createCheckConfig
-
-	cfg.Owner, _ = raw["owner"].(string)
-	if cfg.Owner == "" {
-		return cfg, fmt.Errorf("config.owner is required")
-	}
-
-	cfg.Repo, _ = raw["repo"].(string)
-	if cfg.Repo == "" {
-		return cfg, fmt.Errorf("config.repo is required")
-	}
-
-	cfg.SHA, _ = raw["sha"].(string)
-	// sha may be a dynamic template reference (e.g. {{.commit}}) resolved at Execute time.
-	if cfg.SHA == "" {
-		return cfg, fmt.Errorf("config.sha is required")
-	}
-
-	cfg.Name, _ = raw["name"].(string)
-	if cfg.Name == "" {
-		return cfg, fmt.Errorf("config.name is required")
-	}
-
-	cfg.Status, _ = raw["status"].(string)
-	if cfg.Status == "" {
-		cfg.Status = "queued"
-	}
-	if !validStatuses[cfg.Status] {
-		return cfg, fmt.Errorf("config.status %q is invalid; must be one of: queued, in_progress, completed", cfg.Status)
-	}
-
-	cfg.Conclusion, _ = raw["conclusion"].(string)
-	if cfg.Status == "completed" && cfg.Conclusion == "" {
-		return cfg, fmt.Errorf("config.conclusion is required when status=completed")
-	}
-	if cfg.Conclusion != "" && !validConclusions[cfg.Conclusion] {
-		return cfg, fmt.Errorf("config.conclusion %q is invalid", cfg.Conclusion)
-	}
-
-	cfg.Title, _ = raw["title"].(string)
-	cfg.Summary, _ = raw["summary"].(string)
-
-	cfg.Token, _ = raw["token"].(string)
-	cfg.Token = os.ExpandEnv(cfg.Token)
-
-	return cfg, nil
-}
-
-// Execute creates the GitHub Check Run.
-// triggerData, stepOutputs, and current are used to resolve dynamic field
-// references (e.g. {{.commit}}, {{.steps.prev.sha}}) in owner, repo, and sha.
-func (s *createCheckStep) Execute(
-	ctx context.Context,
-	triggerData map[string]any,
-	stepOutputs map[string]map[string]any,
-	current map[string]any,
-	_ map[string]any,
-	_ map[string]any,
-) (*sdk.StepResult, error) {
-	token := s.config.Token
-	if token == "" {
-		return errorResult("GITHUB_TOKEN is not configured"), nil
-	}
-
-	owner := resolveField(s.config.Owner, triggerData, stepOutputs, current)
-	repo := resolveField(s.config.Repo, triggerData, stepOutputs, current)
-	sha := resolveField(s.config.SHA, triggerData, stepOutputs, current)
-
-	req := &CreateCheckRunRequest{
-		Name:       s.config.Name,
-		HeadSHA:    sha,
-		Status:     s.config.Status,
-		Conclusion: s.config.Conclusion,
-	}
-
-	if s.config.Title != "" || s.config.Summary != "" {
-		req.Output = &CheckRunOutput{
-			Title:   s.config.Title,
-			Summary: s.config.Summary,
-		}
-	}
-
-	check, err := s.ghClient.CreateCheckRun(ctx, owner, repo, req, token)
-	if err != nil {
-		return errorResult(fmt.Sprintf("failed to create check run: %v", err)), nil
-	}
-
-	return &sdk.StepResult{
-		Output: map[string]any{
-			"check_run_id": check.ID,
-			"status":       check.Status,
-			"url":          check.HTMLURL,
-		},
-	}, nil
-}
diff --git a/internal/step_create_check_test.go b/internal/step_create_check_test.go
deleted file mode 100644
index 9a0c6f5..0000000
--- a/internal/step_create_check_test.go
+++ /dev/null
@@ -1,288 +0,0 @@
-package internal
-
-import (
-	"context"
-	"errors"
-	"testing"
-)
-
-// --- step.gh_create_check tests ---
-
-func TestCreateCheckStep_Success(t *testing.T) {
-	var capturedReq *CreateCheckRunRequest
-
-	client := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, req *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			capturedReq = req
-			return &CheckRun{
-				ID:      42,
-				Status:  "completed",
-				HTMLURL: "https://github.com/owner/repo/runs/42",
-			}, nil
-		},
-	}
-
-	step, err := newCreateCheckStep("test", map[string]any{
-		"owner":      "GoCodeAlone",
-		"repo":       "workflow",
-		"sha":        "abc123",
-		"name":       "workflow-ci",
-		"status":     "completed",
-		"conclusion": "success",
-		"title":      "CI Pipeline",
-		"summary":    "All tests passed",
-		"token":      "gh-token",
-	}, client)
-	if err != nil {
-		t.Fatalf("newCreateCheckStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if result.StopPipeline {
-		t.Error("expected StopPipeline=false on success")
-	}
-
-	if capturedReq.Name != "workflow-ci" {
-		t.Errorf("expected name=workflow-ci, got %q", capturedReq.Name)
-	}
-	if capturedReq.HeadSHA != "abc123" {
-		t.Errorf("expected sha=abc123, got %q", capturedReq.HeadSHA)
-	}
-	if capturedReq.Status != "completed" {
-		t.Errorf("expected status=completed, got %q", capturedReq.Status)
-	}
-	if capturedReq.Conclusion != "success" {
-		t.Errorf("expected conclusion=success, got %q", capturedReq.Conclusion)
-	}
-	if capturedReq.Output == nil || capturedReq.Output.Title != "CI Pipeline" {
-		t.Errorf("expected output.title=CI Pipeline, got %v", capturedReq.Output)
-	}
-	if capturedReq.Output.Summary != "All tests passed" {
-		t.Errorf("expected output.summary='All tests passed', got %q", capturedReq.Output.Summary)
-	}
-
-	if checkID, _ := result.Output["check_run_id"].(int64); checkID != 42 {
-		t.Errorf("expected check_run_id=42, got %v", result.Output["check_run_id"])
-	}
-}
-
-func TestCreateCheckStep_InProgress(t *testing.T) {
-	client := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, req *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			return &CheckRun{ID: 1, Status: req.Status}, nil
-		},
-	}
-
-	step, err := newCreateCheckStep("test", map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"sha":    "abc123",
-		"name":   "workflow-ci",
-		"status": "in_progress",
-		"token":  "gh-token",
-	}, client)
-	if err != nil {
-		t.Fatalf("newCreateCheckStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if result.StopPipeline {
-		t.Error("expected StopPipeline=false")
-	}
-}
-
-func TestCreateCheckStep_APIError(t *testing.T) {
-	client := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, _ *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			return nil, errors.New("check run creation failed")
-		},
-	}
-
-	step, err := newCreateCheckStep("test", map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"sha":    "abc123",
-		"name":   "workflow-ci",
-		"status": "queued",
-		"token":  "gh-token",
-	}, client)
-	if err != nil {
-		t.Fatalf("newCreateCheckStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute returned unexpected error: %v", err)
-	}
-	if !result.StopPipeline {
-		t.Error("expected StopPipeline=true on API error")
-	}
-}
-
-func TestCreateCheckStep_MissingToken(t *testing.T) {
-	client := &mockGitHubClient{}
-
-	step, err := newCreateCheckStep("test", map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"sha":    "abc123",
-		"name":   "workflow-ci",
-		"status": "queued",
-		"token":  "",
-	}, client)
-	if err != nil {
-		t.Fatalf("newCreateCheckStep: %v", err)
-	}
-
-	result, err := step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if !result.StopPipeline {
-		t.Error("expected StopPipeline=true when token is missing")
-	}
-}
-
-func TestCreateCheckStep_NoOutputWhenTitleAndSummaryEmpty(t *testing.T) {
-	var capturedReq *CreateCheckRunRequest
-	client := &mockGitHubClient{
-		createCheckRunFunc: func(_ context.Context, _, _ string, req *CreateCheckRunRequest, _ string) (*CheckRun, error) {
-			capturedReq = req
-			return &CheckRun{ID: 1, Status: "queued"}, nil
-		},
-	}
-
-	step, err := newCreateCheckStep("test", map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"sha":    "abc123",
-		"name":   "workflow-ci",
-		"status": "queued",
-		"token":  "gh-token",
-		// No title or summary.
-	}, client)
-	if err != nil {
-		t.Fatalf("newCreateCheckStep: %v", err)
-	}
-
-	_, err = step.Execute(context.Background(), nil, nil, nil, nil, nil)
-	if err != nil {
-		t.Fatalf("Execute: %v", err)
-	}
-	if capturedReq.Output != nil {
-		t.Error("expected nil output when title and summary are empty")
-	}
-}
-
-// --- config validation tests ---
-
-func TestParseCreateCheckConfig_MissingOwner(t *testing.T) {
-	_, err := parseCreateCheckConfig(map[string]any{
-		"repo":   "workflow",
-		"sha":    "abc",
-		"name":   "ci",
-		"status": "queued",
-	})
-	if err == nil {
-		t.Error("expected error for missing owner")
-	}
-}
-
-func TestParseCreateCheckConfig_MissingRepo(t *testing.T) {
-	_, err := parseCreateCheckConfig(map[string]any{
-		"owner":  "GoCodeAlone",
-		"sha":    "abc",
-		"name":   "ci",
-		"status": "queued",
-	})
-	if err == nil {
-		t.Error("expected error for missing repo")
-	}
-}
-
-func TestParseCreateCheckConfig_MissingSHA(t *testing.T) {
-	_, err := parseCreateCheckConfig(map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"name":   "ci",
-		"status": "queued",
-	})
-	if err == nil {
-		t.Error("expected error for missing sha")
-	}
-}
-
-func TestParseCreateCheckConfig_MissingName(t *testing.T) {
-	_, err := parseCreateCheckConfig(map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"sha":    "abc",
-		"status": "queued",
-	})
-	if err == nil {
-		t.Error("expected error for missing name")
-	}
-}
-
-func TestParseCreateCheckConfig_InvalidStatus(t *testing.T) {
-	_, err := parseCreateCheckConfig(map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"sha":    "abc",
-		"name":   "ci",
-		"status": "unknown-status",
-	})
-	if err == nil {
-		t.Error("expected error for invalid status")
-	}
-}
-
-func TestParseCreateCheckConfig_CompletedRequiresConclusion(t *testing.T) {
-	_, err := parseCreateCheckConfig(map[string]any{
-		"owner":  "GoCodeAlone",
-		"repo":   "workflow",
-		"sha":    "abc",
-		"name":   "ci",
-		"status": "completed",
-		// No conclusion.
-	})
-	if err == nil {
-		t.Error("expected error when status=completed but conclusion is missing")
-	}
-}
-
-func TestParseCreateCheckConfig_InvalidConclusion(t *testing.T) {
-	_, err := parseCreateCheckConfig(map[string]any{
-		"owner":      "GoCodeAlone",
-		"repo":       "workflow",
-		"sha":        "abc",
-		"name":       "ci",
-		"status":     "completed",
-		"conclusion": "bad-conclusion",
-	})
-	if err == nil {
-		t.Error("expected error for invalid conclusion")
-	}
-}
-
-func TestParseCreateCheckConfig_DefaultStatus(t *testing.T) {
-	cfg, err := parseCreateCheckConfig(map[string]any{
-		"owner": "GoCodeAlone",
-		"repo":  "workflow",
-		"sha":   "abc",
-		"name":  "ci",
-		// No status — should default to "queued".
-	})
-	if err != nil {
-		t.Fatalf("parseCreateCheckConfig: %v", err)
-	}
-	if cfg.Status != "queued" {
-		t.Errorf("expected default status=queued, got %q", cfg.Status)
-	}
-}
diff --git a/plugin.contracts.json b/plugin.contracts.json
index cbb7bbd..849da23 100644
--- a/plugin.contracts.json
+++ b/plugin.contracts.json
@@ -35,22 +35,6 @@
       "input": "workflow.plugin.github.v1.ActionStatusInput",
       "output": "workflow.plugin.github.v1.ActionStatusOutput"
     },
-    {
-      "kind": "step",
-      "type": "step.gh_compute_gateway",
-      "mode": "strict_proto",
-      "config": "workflow.plugin.github.v1.ComputeGatewayConfig",
-      "input": "workflow.plugin.github.v1.ComputeGatewayInput",
-      "output": "workflow.plugin.github.v1.ComputeGatewayOutput"
-    },
-    {
-      "kind": "step",
-      "type": "step.gh_create_check",
-      "mode": "strict_proto",
-      "config": "workflow.plugin.github.v1.CreateCheckConfig",
-      "input": "workflow.plugin.github.v1.CreateCheckInput",
-      "output": "workflow.plugin.github.v1.CreateCheckOutput"
-    },
     {
       "kind": "step",
       "type": "step.gh_pr_create",
diff --git a/plugin.json b/plugin.json
index 2ee3d78..d9ca3f4 100644
--- a/plugin.json
+++ b/plugin.json
@@ -49,8 +49,6 @@
     "stepTypes": [
         "step.gh_action_trigger",
         "step.gh_action_status",
-        "step.gh_compute_gateway",
-        "step.gh_create_check",
         "step.gh_pr_create",
         "step.gh_pr_merge",
         "step.gh_pr_comment",
@@ -72,8 +70,6 @@
         "stepTypes": [
             "step.gh_action_trigger",
             "step.gh_action_status",
-            "step.gh_compute_gateway",
-            "step.gh_create_check",
             "step.gh_pr_create",
             "step.gh_pr_merge",
             "step.gh_pr_comment",
@@ -125,22 +121,6 @@
             "input": "workflow.plugin.github.v1.ActionStatusInput",
             "output": "workflow.plugin.github.v1.ActionStatusOutput"
         },
-        {
-            "kind": "step",
-            "type": "step.gh_compute_gateway",
-            "mode": "strict_proto",
-            "config": "workflow.plugin.github.v1.ComputeGatewayConfig",
-            "input": "workflow.plugin.github.v1.ComputeGatewayInput",
-            "output": "workflow.plugin.github.v1.ComputeGatewayOutput"
-        },
-        {
-            "kind": "step",
-            "type": "step.gh_create_check",
-            "mode": "strict_proto",
-            "config": "workflow.plugin.github.v1.CreateCheckConfig",
-            "input": "workflow.plugin.github.v1.CreateCheckInput",
-            "output": "workflow.plugin.github.v1.CreateCheckOutput"
-        },
         {
             "kind": "step",
             "type": "step.gh_pr_create",
@@ -287,75 +267,6 @@
                 {"key": "url", "type": "string", "description": "URL to the workflow run"}
             ]
         },
-        {
-            "type": "step.gh_compute_gateway",
-            "plugin": "workflow-plugin-github",
-            "description": "Submits a GitHub-origin workload to workflow-compute's protected GitHub gateway and waits for proof-backed completion.",
-            "configFields": [
-                {"key": "server_url", "type": "string", "description": "workflow-compute control plane URL", "required": true},
-                {"key": "token", "type": "string", "description": "workflow-compute credential with github gateway scopes", "required": true, "sensitive": true},
-                {"key": "repository", "type": "string", "description": "GitHub repository in owner/name form", "required": true},
-                {"key": "oidc_token", "type": "string", "description": "GitHub Actions OIDC token proving workflow job provenance", "required": true, "sensitive": true},
-                {"key": "workflow_run_id", "type": "string", "description": "Workflow run ID (numeric literal or template expression)", "required": true},
-                {"key": "workflow_run_attempt", "type": "string", "description": "Workflow run attempt (numeric literal or template expression)"},
-                {"key": "workflow_job_id", "type": "string", "description": "Workflow job ID (numeric literal or template expression)", "required": true},
-                {"key": "workflow_job_name", "type": "string", "description": "Workflow job name", "required": true},
-                {"key": "ref", "type": "string", "description": "Git ref associated with the workload"},
-                {"key": "sha", "type": "string", "description": "Commit SHA associated with the workload"},
-                {"key": "org_id", "type": "string", "description": "workflow-compute organization ID", "required": true},
-                {"key": "pool_id", "type": "string", "description": "workflow-compute pool ID", "required": true},
-                {"key": "policy_id", "type": "string", "description": "workflow-compute policy ID", "required": true},
-                {"key": "command_args", "type": "array", "description": "Command argv to execute inside the protected compute provider", "required": true},
-                {"key": "working_directory", "type": "string", "description": "Optional working directory for command workloads"},
-                {"key": "artifact_allowlist", "type": "array", "description": "Output artifact paths the agent may return"},
-                {"key": "labels", "type": "map", "description": "Additional non-github workload labels"},
-                {"key": "executor_provider", "type": "string", "description": "Optional executor provider selector"},
-                {"key": "execution_security_tier", "type": "string", "description": "Protected execution tier", "defaultValue": "sandboxed-container"},
-                {"key": "proof_tier", "type": "string", "description": "Proof tier required for success", "defaultValue": "artifact-hash"},
-                {"key": "hardware_class", "type": "string", "description": "Optional hardware security class selector"},
-                {"key": "wait", "type": "boolean", "description": "Poll workflow-compute until proof-backed completion; must be true for this provider", "required": true, "defaultValue": true},
-                {"key": "poll_interval", "type": "duration", "description": "Interval between status polls when wait=true", "defaultValue": "10s"},
-                {"key": "timeout", "type": "duration", "description": "Maximum time to wait when wait=true", "defaultValue": "30m"},
-                {"key": "write_check", "type": "boolean", "description": "Create a GitHub Check Run when the compute workload reaches a terminal status", "defaultValue": false},
-                {"key": "check_owner", "type": "string", "description": "Owner for the GitHub Check Run target"},
-                {"key": "check_repo", "type": "string", "description": "Repository for the GitHub Check Run target"},
-                {"key": "check_sha", "type": "string", "description": "Commit SHA for the GitHub Check Run target"},
-                {"key": "check_name", "type": "string", "description": "GitHub Check Run name"},
-                {"key": "check_token", "type": "string", "description": "GitHub token for creating the Check Run", "sensitive": true}
-            ],
-            "outputs": [
-                {"key": "task_id", "type": "string", "description": "workflow-compute task ID"},
-                {"key": "status", "type": "string", "description": "workflow-compute task status"},
-                {"key": "conclusion", "type": "string", "description": "Proof-backed conclusion"},
-                {"key": "proof_id", "type": "string", "description": "Accepted proof receipt ID"},
-                {"key": "artifact_hash", "type": "string", "description": "Returned artifact hash"},
-                {"key": "contribution_id", "type": "string", "description": "Contribution ledger event ID"},
-                {"key": "worker_id", "type": "string", "description": "Worker that completed the accepted proof"},
-                {"key": "check_run_id", "type": "number", "description": "GitHub Check Run ID when write_check=true"},
-                {"key": "check_url", "type": "string", "description": "GitHub Check Run URL when write_check=true"}
-            ]
-        },
-        {
-            "type": "step.gh_create_check",
-            "plugin": "workflow-plugin-github",
-            "description": "Creates a GitHub Check Run (status check) on a specific commit.",
-            "configFields": [
-                {"key": "owner", "type": "string", "description": "GitHub repository owner", "required": true},
-                {"key": "repo", "type": "string", "description": "GitHub repository name", "required": true},
-                {"key": "sha", "type": "string", "description": "Commit SHA to associate the check with", "required": true},
-                {"key": "name", "type": "string", "description": "Name of the check run", "required": true},
-                {"key": "status", "type": "select", "description": "Check run status", "options": ["queued", "in_progress", "completed"], "defaultValue": "queued"},
-                {"key": "conclusion", "type": "select", "description": "Check run conclusion (required when status=completed)", "options": ["success", "failure", "neutral", "cancelled", "skipped", "timed_out", "action_required"]},
-                {"key": "title", "type": "string", "description": "Check output title"},
-                {"key": "summary", "type": "string", "description": "Check output summary"},
-                {"key": "token", "type": "string", "description": "GitHub personal access token", "required": true, "sensitive": true}
-            ],
-            "outputs": [
-                {"key": "check_run_id", "type": "number", "description": "Check run ID"},
-                {"key": "status", "type": "string", "description": "Check run status"},
-                {"key": "url", "type": "string", "description": "URL to the check run"}
-            ]
-        },
         {
             "type": "step.gh_pr_create",
             "plugin": "workflow-plugin-github",
diff --git a/proto/github/v1/github.proto b/proto/github/v1/github.proto
index 3dd6cc5..ab5059e 100644
--- a/proto/github/v1/github.proto
+++ b/proto/github/v1/github.proto
@@ -96,83 +96,6 @@ message ActionStatusOutput {
   string url = 4;
 }
 
-// ComputeGatewayConfig is the typed config for step.gh_compute_gateway.
-message ComputeGatewayConfig {
-  string server_url = 1;
-  string token = 2;
-  string repository = 3;
-  string oidc_token = 4;
-  string workflow_run_id = 5;
-  string workflow_run_attempt = 6;
-  string workflow_job_id = 7;
-  string workflow_job_name = 8;
-  string ref = 9;
-  string sha = 10;
-  string org_id = 11;
-  string pool_id = 12;
-  string policy_id = 13;
-  repeated string command_args = 14;
-  string working_directory = 15;
-  repeated string artifact_allowlist = 16;
-  google.protobuf.Struct labels = 17;
-  string executor_provider = 18;
-  string execution_security_tier = 19;
-  string proof_tier = 20;
-  string hardware_class = 21;
-  bool wait = 22;
-  string poll_interval = 23;
-  string timeout = 24;
-  bool write_check = 25;
-  string check_owner = 26;
-  string check_repo = 27;
-  string check_sha = 28;
-  string check_name = 29;
-  string check_token = 30;
-}
-
-// ComputeGatewayInput carries runtime inputs for step.gh_compute_gateway.
-message ComputeGatewayInput {
-  google.protobuf.Struct data = 1;
-}
-
-// ComputeGatewayOutput holds the result of step.gh_compute_gateway.
-message ComputeGatewayOutput {
-  string task_id = 1;
-  string status = 2;
-  string conclusion = 3;
-  string proof_id = 4;
-  string artifact_hash = 5;
-  string contribution_id = 6;
-  string worker_id = 7;
-  int64 check_run_id = 8;
-  string check_url = 9;
-}
-
-// CreateCheckConfig is the typed config for step.gh_create_check.
-message CreateCheckConfig {
-  string owner = 1;
-  string repo = 2;
-  string sha = 3;
-  string name = 4;
-  string status = 5;
-  string conclusion = 6;
-  string title = 7;
-  string summary = 8;
-  string token = 9;
-}
-
-// CreateCheckInput carries runtime inputs for step.gh_create_check.
-message CreateCheckInput {
-  google.protobuf.Struct data = 1;
-}
-
-// CreateCheckOutput holds the result of step.gh_create_check.
-message CreateCheckOutput {
-  int64 check_run_id = 1;
-  string status = 2;
-  string url = 3;
-}
-
 // PRCreateConfig is the typed config for step.gh_pr_create.
 message PRCreateConfig {
   string owner = 1;