diff --git a/.agents/skills/manage-ci/references/current-inventory.md b/.agents/skills/manage-ci/references/current-inventory.md
index 2b791b0127..404cb69cd6 100644
--- a/.agents/skills/manage-ci/references/current-inventory.md
+++ b/.agents/skills/manage-ci/references/current-inventory.md
@@ -418,8 +418,18 @@ permission.
 ## Providers and variables
 
 GitHub-hosted labels are `ubuntu-24.04`, `ubuntu-24.04-arm`, `macos-15`, and
-`windows-2022`. Depot labels are selected only by `select-ci-runners`; no
-workflow accepts a raw provider label. Trusted main Linux requires
+`windows-2022`. Central policy also exposes the GitHub-hosted `xcode-27`
+label as `runner_macos_apple` for the follow-on Apple-provider platform row;
+this prerequisite does not route an existing row to it. That image is an
+Xcode 27 toolchain lane: today it runs a macOS 26.5 host with the macOS 27
+SDK (actions/runner-images#14404), so the output names the Xcode capability,
+not a macOS 27 host OS. Rows that need an actual macOS 27 host must wait for
+a host image (GitHub or Depot) that provides one — Depot's current
+`depot-macos-26` tops out at macOS 26/Xcode 26.6. #1444 must assert
+`sw_vers`, `xcodebuild -version`, and the selected SDK before doing work, and
+decide compile-only vs test accordingly. Depot labels are
+selected only by `select-ci-runners`; no workflow accepts a raw provider label.
+Trusted main Linux requires
 `DEPOT_RUNNERS_ENABLED=true`. An exact same-repository PR revision may use the
 time-bounded exception only when `DEPOT_PR_RUNNERS_ENABLED=true` and both
 `DEPOT_PR_APPROVED_REF` and `DEPOT_PR_APPROVED_SHA` match; it expires on
diff --git a/.github/actions/select-ci-runners/action.yml b/.github/actions/select-ci-runners/action.yml
index e27caf3b88..bee0d701a5 100644
--- a/.github/actions/select-ci-runners/action.yml
+++ b/.github/actions/select-ci-runners/action.yml
@@ -90,6 +90,9 @@ outputs:
   runner_macos:
     description: macOS runner label selected by the centralized provider policy.
     value: ${{ steps.select.outputs.runner_macos }}
+  runner_macos_apple:
+    description: Apple Foundation Models-capable macOS runner label selected by the centralized provider policy.
+    value: ${{ steps.select.outputs.runner_macos_apple }}
   runner_windows:
     description: Windows runner label selected by the centralized provider policy.
     value: ${{ steps.select.outputs.runner_windows }}
@@ -288,6 +291,7 @@ runs:
           runner_macos=macos-15
           runner_windows=windows-2022
         fi
+        runner_macos_apple=xcode-27
 
         {
           echo "depot_enabled=$depot_enabled"
@@ -303,5 +307,6 @@ runs:
           echo "runner_arm_8=$runner_arm_8"
           echo "runner_arm_16=$runner_arm_16"
           echo "runner_macos=$runner_macos"
+          echo "runner_macos_apple=$runner_macos_apple"
           echo "runner_windows=$runner_windows"
         } >> "$GITHUB_OUTPUT"
diff --git a/scripts/tests/test_ci_artifact_actions.py b/scripts/tests/test_ci_artifact_actions.py
index 97b7fb8877..9d47341b4d 100644
--- a/scripts/tests/test_ci_artifact_actions.py
+++ b/scripts/tests/test_ci_artifact_actions.py
@@ -2257,6 +2257,7 @@ def test_runner_selection_uses_event_repository_and_ref_policy(self) -> None:
                     else "windows-2022"
                 )
                 self.assertEqual(outputs["runner_macos"], expected_macos)
+                self.assertEqual(outputs["runner_macos_apple"], "xcode-27")
                 self.assertEqual(outputs["runner_windows"], expected_windows)
 
         untrusted_repository = self.run_runner_selector(