@@ -99,6 +99,17 @@ jobs:
           datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
           datadog-site: ${{ vars.DATADOG_SITE || vars.DD_SITE }}
 
+      - name: Set up private source authentication
+        if: >-
+          github.actor != 'dependabot[bot]' &&
+          (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+          inputs.runtime-source == 'checkout' &&
+          steps.cache.outputs.cache-hit != 'true'
+        uses: ./.github/actions/setup-private-source-auth
+        with:
+          client-id: ${{ vars.RUNTIME_ACCESSOR_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RUNTIME_ACCESSOR_APP_PRIVATE_KEY }}
+
       - name: Install the ARM64 strip tool
         if: inputs.runtime-source == 'checkout' && steps.cache.outputs.cache-hit != 'true' && runner.os == 'Linux' && endsWith(inputs.target, '-arm64')
         run: script/linux/apt-install.sh binutils-aarch64-linux-gnu
 
@@ -78,14 +78,16 @@ jobs:
         env:
           RUSTDOCFLAGS: "-D warnings"
         run: cargo doc --no-deps --no-default-features --features local-runtime,derive
+      - name: External-stream-only SDK
+        run: cargo test --no-default-features --features test-support --test protocol_version_test
       - run: npm ci --ignore-scripts
         working-directory: ${{ inputs.sdk-home }}/test/harness
       - if: runner.os == 'Windows'
         run: pwsh.exe -Command "Write-Host 'PowerShell ready'"
       - env:
           COPILOT_HMAC_KEY: ${{ secrets.COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY }}
           RUST_E2E_CONCURRENCY: 4
-        run: cargo test --no-default-features --features test-support,derive -- --test-threads=4 --nocapture
+        run: cargo test --no-default-features --features runtime,test-support,derive -- --test-threads=4 --nocapture
 
   rust-inprocess:
     name: "Rust (${{ matrix.os }}, inprocess)"
@@ -189,6 +191,9 @@ jobs:
             esac
 
             export CARGO_TARGET_DIR=/tmp/copilot-sdk-rust-target
+            # Keep every integration test without filling the runner with build artifacts.
+            export CARGO_INCREMENTAL=0
+            export CARGO_PROFILE_TEST_DEBUG=0
             cd "$COPILOT_SDK_ROOT/rust"
             if [ "$COPILOT_SDK_TEST_TRANSPORT" = "inprocess" ]; then
               unset RUST_E2E_CONCURRENCY
@@ -200,5 +205,5 @@ jobs:
                 -- --exact --test-threads=1 --nocapture
             else
               export RUST_E2E_CONCURRENCY=4
-              cargo test --no-default-features --features test-support,derive -- --test-threads=4 --nocapture
+              cargo test --no-default-features --features runtime,test-support,derive -- --test-threads=4 --nocapture
             fi
@@ -100,6 +100,13 @@ jobs:
           datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
           datadog-site: ${{ vars.DATADOG_SITE || vars.DD_SITE }}
 
+      - name: Set up private source authentication
+        if: steps.cache.outputs.cache-hit != 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: ./.github/actions/setup-private-source-auth
+        with:
+          client-id: ${{ vars.RUNTIME_ACCESSOR_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RUNTIME_ACCESSOR_APP_PRIVATE_KEY }}
+
       - name: Cache xwin downloads
         if: steps.cache.outputs.cache-hit != 'true'
         uses: actions/cache@v6
 
@@ -3,6 +3,9 @@
 docs/.validation/
 .DS_Store
 
+# Local runtime-host integration homes, caches, and candidate packages.
+/.runtime-host-test-work/
+
 # Generated by `npm run auth:refresh` for local Azure Artifacts routing.
 /java/scripts/codegen/.npmrc
 
 
@@ -71,7 +71,7 @@ are not necessarily sufficient to build the repository.
 | --- | --- |
 | Node.js and shared tooling | [Node.js](https://nodejs.org/en/download) satisfying [the SDK engines](nodejs/package.json): `^20.19.0 \|\| >=22.12.0`; SDK CI uses Node 22. Nested runtime builds require **Node >=24** and the parent repository's pinned pnpm. Use npm for SDK-local projects and their lockfiles. |
 | Python | [Python >=3.11](python/pyproject.toml) and [uv](https://docs.astral.sh/uv/getting-started/installation/). `uv sync` installs the project, development tools, and pinned Ruff; do not install those globally. CI tests on 3.11 and validates docs on 3.12. |
-| Go | [Install Go](https://go.dev/doc/install) at the version selected by [go.mod](go/go.mod), currently 1.24, also required by [samples](go/samples/go.mod). Go includes `gofmt`. Checks additionally need [golangci-lint](https://golangci-lint.run/docs/welcome/install/); [CI](.github/workflows/sdk-go.yml) currently uses `latest`, not an exact repository pin. |
+| Go | [Install Go](https://go.dev/doc/install) at the version selected by [go.mod](go/go.mod), currently 1.24, also required by [samples](go/samples/go.mod). Go includes `gofmt`; generation fails if `go fmt` cannot run rather than emitting unformatted projections. Checks additionally need [golangci-lint](https://golangci-lint.run/docs/welcome/install/); [CI](.github/workflows/sdk-go.yml) currently uses `latest`, not an exact repository pin. |
 | .NET | [.NET SDK](https://dotnet.microsoft.com/download/dotnet) selected by [global.json](dotnet/global.json): 10.0.100 with major roll-forward. Also install the **[.NET 8 runtime](https://dotnet.microsoft.com/download/dotnet/8.0)** for the `net8.0` [tests](dotnet/test/GitHub.Copilot.SDK.Test.csproj). SDK 10 alone does not supply that runtime. Windows additionally runs `net472` tests and needs a compatible .NET Framework runtime. |
 | Java | [Install a JDK](https://learn.microsoft.com/java/openjdk/download) meeting the [build requirement](java/sdk/pom.xml), currently >=25. The artifact targets Java 17; a second JDK 17 is needed only to reproduce that compatibility test. From `java/`, use `./mvnw` (`.\mvnw.cmd` on Windows): the [wrapper](java/.mvn/wrapper/maven-wrapper.properties) downloads pinned Maven. Normal builds/tests do not require a global Maven install. |
 | Rust | [rustup](https://rustup.rs/) with the SDK's [pinned toolchain and components](rust/rust-toolchain.toml), currently 1.94.0. Formatting/check tasks also need rustfmt from the toolchain selected in [run-tasks.mjs](scripts/run-tasks.mjs). This is separate from the parent runtime's Rust toolchain. |