The folder-cleanup automation has been migrated off the Cowork-scheduled task and onto a cloud-orchestrated GitHub Actions workflow that executes on a self-hosted Windows runner registered to Sam's box. Side-by-side rollout starts now and ends 2026-05-18. After cutover the Cowork task is paused (not deleted) so it can be revived as a fallback.

Why this matters

The Cowork scheduler is opaque, runs on Anthropic's internal infrastructure, and gives Sam zero visibility into success or failure outside of completion notifications. The new architecture is fully introspectable: every run leaves a workflow log in GitHub Actions, every quarantine action leaves a SHA-256-anchored row in QUARANTINE-REGISTRY.md, and every run ends with a Notion entry tagged completion-log on this database. This also unlocks Codex Cloud and any other agent that can target a GitHub Actions workflow, which was the stated goal.

Repo

samaguiar1982-cpu/sail-automation @ main, commit 88a8a0b

Files shipped (all verified on remote)

• .github/workflows/folder-cleanup.yml (2319 bytes, SHA be785911ad790040e019b9709490c7648bf63908) — daily cron at 13:00 UTC (09:00 ET) plus workflow_dispatch with dry_run and pass inputs. Self-hosted labels: Windows, sail-cleanup. Uploads SUMMARY-*.md and QUARANTINE-REGISTRY.md as 14-day artifacts.
• automations/folder-cleanup/run.ps1 (12005 bytes, SHA 10f78cf73546d7c2d10d2982c3302692f9d708ae) — deterministic Pass 1 / Pass 2 entry point. SHA-256 hashing, idempotent registry append, NEVER-TOUCH and SKIP-PROTECTED guards, Notion REST POST at end of run.
• automations/folder-cleanup/install-runner.ps1 (6537 bytes, SHA 2b7836bed30e68851f4e4fadafd3e0f726393518) — one-shot self-hosted runner installer.
• automations/folder-cleanup/README.md (6370 bytes, SHA 469fadff536cb8f9f07a06adab48cb00adef34a0) — architecture diagram, install steps, 7-day rollout plan.

What to paste, in order

1. Get a runner registration token

Open https://github.com/samaguiar1982-cpu/sail-automation/settings/actions/runners/new?arch=x64&os=win and copy the token shown next to --token. It expires in 60 minutes.

2. Install the runner (PowerShell as Administrator)

cd 'C:\Users\SAguiar\Documents\Codex\folder-cleanup-migration-2026-05-11\.repo-clone\automations\folder-cleanup'
.\install-runner.ps1 -Token 'PASTE_REGISTRATION_TOKEN_HERE'

The script runs admin pre-flight, downloads the latest actions-runner-win-x64-*.zip from the official GitHub releases endpoint, extracts to C:\actions-runner-sail, runs config.cmd --runasservice --unattended --replace, and starts the service. When it returns, Get-Service actions.runner.* should show one Running entry.

3. Add the NOTION_TOKEN secret

If gh CLI is installed:

$env:NOTION_TOKEN = (Get-Content 'C:\Users\SAguiar\Documents\Projects\.credentials\vault.env' | Where-Object { $_ -match '^NOTION_TOKEN=' } | ForEach-Object { ($_ -split '=', 2)[1].Trim('"') })
gh secret set NOTION_TOKEN --repo samaguiar1982-cpu/sail-automation --body $env:NOTION_TOKEN

If gh CLI is not installed, the manual path is: open https://github.com/samaguiar1982-cpu/sail-automation/settings/secrets/actions, click New repository secret, name NOTION_TOKEN, paste the value from vault.env.