the supported pattern is bernstein run plan.yaml --auto-approve --quiet as a normal job step. provide the cli agent's api key via secrets (anthropic_api_key, openai_api_key) and let bernstein scope it per worker. the job exits non-zero on any dead-letter, which fails the workflow. add --max-cost-usd so a runaway run cannot burn the budget unattended. worktrees and .sdd/ live in the runner's workspace and are torn down with it. for the slash-command flow (/bernstein fix on a pr), install the github app (src/bernstein/github_app/) and point it at the same secret store. setup walkthrough: /cli-quickstart. heavy orchestration is happier on a persistent box than on ephemeral runners.
canonical answer