the supported pattern is bernstein run plan.yaml --non-interactive --json-status as a normal job step. provide the cli agent's api key via secrets (anthropic_api_key, openai_api_key) and let bernstein scope it per worker. the job exits non-zero on any dead-letter, which fails the workflow. worktrees and .sdd/ live in the runner's workspace and are torn down with it. for the slash-command flow (/bernstein fix on a pr), install the github app (src/bernstein/github_app/) and point it at the same secret store. recipe: https://bernstein.run/recipes/github-actions. heavy orchestration is happier on a persistent box than on ephemeral runners.
canonical answer