The public URL (legalpoc.eroomai.com) sits behind a Google OAuth proxy, so CI requests get 302-redirected to the login page. Point api_base at the internal backend (http://localhost:8800, served at root without /api prefix) which the act_runner reaches on the same host. Documents host.docker.internal and Tailscale fallbacks for containerized runners. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>