diff --git a/internal/cloud/code-agent-agentrun-profile.test.ts b/internal/cloud/code-agent-agentrun-profile.test.ts
index 21ef9e03..6212959c 100644
--- a/internal/cloud/code-agent-agentrun-profile.test.ts
+++ b/internal/cloud/code-agent-agentrun-profile.test.ts
@@ -3,19 +3,24 @@ import { test } from "node:test";
 
 import {
   DEFAULT_AGENTRUN_REPO_URL,
+  GITHUB_SSH_AGENTRUN_REPO_URL,
   GITEA_AGENTRUN_REPO_URL,
   resolveAgentRunRepoUrl
 } from "./code-agent-agentrun-profile.ts";
 
-test("resolveAgentRunRepoUrl allows approved internal mirrors", () => {
+test("resolveAgentRunRepoUrl allows approved HWLAB Git authorities", () => {
   assert.equal(resolveAgentRunRepoUrl({}), DEFAULT_AGENTRUN_REPO_URL);
+  assert.equal(
+    resolveAgentRunRepoUrl({ HWLAB_CODE_AGENT_AGENTRUN_REPO_URL: GITHUB_SSH_AGENTRUN_REPO_URL }),
+    GITHUB_SSH_AGENTRUN_REPO_URL
+  );
   assert.equal(
     resolveAgentRunRepoUrl({ HWLAB_CODE_AGENT_AGENTRUN_REPO_URL: `${GITEA_AGENTRUN_REPO_URL}/?token=ignored#fragment` }),
     GITEA_AGENTRUN_REPO_URL
   );
 });
 
-test("resolveAgentRunRepoUrl rejects unapproved internal repo URLs", () => {
+test("resolveAgentRunRepoUrl rejects unapproved repo URLs", () => {
   assert.throws(
     () => resolveAgentRunRepoUrl({ HWLAB_CODE_AGENT_AGENTRUN_REPO_URL: "http://gitea-http.devops-infra.svc.cluster.local:3000/other/HWLAB.git" }),
     (error) => error?.code === "agentrun_internal_repo_url_required"
diff --git a/internal/cloud/code-agent-agentrun-profile.ts b/internal/cloud/code-agent-agentrun-profile.ts
index c698bf71..02e97f81 100644
--- a/internal/cloud/code-agent-agentrun-profile.ts
+++ b/internal/cloud/code-agent-agentrun-profile.ts
@@ -1,10 +1,13 @@
 // SPEC: PJ2026-010205 HWLAB接入 draft-2026-06-17-r0; PJ2026-0104010803 Workbench唯一投影 draft-2026-06-19-p1-agentrun-incremental-cursor.
-// Responsibility: AgentRun backend profile, internal repo source authority, provider identity, and trace metadata.
+// SPEC: PJ2026-010306 嵌入式AgentBench
+// SPEC_VERSION: draft-2026-07-24-p2-l0-l1-arm2d
+// Responsibility: AgentRun backend profile, repo source authority, provider identity, and trace metadata.
 
 import { truthyFlag } from "./server-http-utils.ts";
 
 export const DEFAULT_AGENTRUN_REPO_URL = "http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB.git";
 export const GITEA_AGENTRUN_REPO_URL = "http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git";
+export const GITHUB_SSH_AGENTRUN_REPO_URL = "git@github.com:pikasTech/HWLAB.git";
 
 const ADAPTER_ID = "agentrun-v01";
 const AGENTRUN_BACKEND_PREFIX = ADAPTER_ID;
@@ -41,6 +44,7 @@ export function backendForBackendProfile(profile) {
 
 export function resolveAgentRunRepoUrl(env = process.env) {
   const raw = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_REPO_URL, env.HWLAB_BOOT_READ_URL, DEFAULT_AGENTRUN_REPO_URL);
+  if (raw === GITHUB_SSH_AGENTRUN_REPO_URL) return raw;
   const url = new URL(raw);
   const host = url.hostname.toLowerCase();
   const allowedByTest = truthyFlag(env.HWLAB_CODE_AGENT_AGENTRUN_ALLOW_NON_K3S_URL) && ["127.0.0.1", "localhost"].includes(host);
@@ -49,7 +53,7 @@ export function resolveAgentRunRepoUrl(env = process.env) {
   url.hash = "";
   const normalized = url.toString().replace(/\/+$/u, "");
   if (url.protocol !== "http:" || (!isAllowedAgentRunRepoUrl(normalized) && !allowedByTest)) {
-    throw Object.assign(new Error(`HWLAB_CODE_AGENT_AGENTRUN_REPO_URL must use an approved internal k3s git mirror (${DEFAULT_AGENTRUN_REPO_URL} or ${GITEA_AGENTRUN_REPO_URL}); got ${redactUrl(raw)}`), {
+    throw Object.assign(new Error(`HWLAB_CODE_AGENT_AGENTRUN_REPO_URL must use an approved HWLAB Git authority (${DEFAULT_AGENTRUN_REPO_URL}, ${GITEA_AGENTRUN_REPO_URL}, or ${GITHUB_SSH_AGENTRUN_REPO_URL}); got ${redactUrl(raw)}`), {
       code: "agentrun_internal_repo_url_required",
       statusCode: 500
     });