Keep hosted public image verification reliable under shared API quotas

🤖 Generated by the Agentic Engineer

Problem

Hosted platform validation can fail before its application trial because anonymous public CI evidence reads share an exhausted API quota. Bounded retries correctly refuse long delays, but do not establish a separate read identity.

Intended outcome

Add an explicit, default-off hosted-CI read mode to the shared prebuilt image verifier. The platform's native proof in devantler-tech/platform#5550 confirms its existing job identity can read a fixed public run, its exact attempt and a final recheck. Normal publication must remain credential-free.

Acceptance

Require explicit CI opt-in and a supplied opaque job token; no ambient-credential or anonymous fallback.
Confine credentials to fixed HTTPS GitHub API requests, a private temporary config and the public evidence operation; never pass them to signing, registry or build commands.
Require both repository identities to be public at all three observations, preserving exact source, run, attempt, success, signature, provenance and bounded retry checks.
Exercise default and opt-in paths, changed/private/malformed evidence, long stateless credentials, redirects, header injection and credential isolation.
Deliver the shared source through protected review and merge, verify main, and record its immutable helper revision and checksum.

Platform adoption and native default-branch acceptance remain separate delivery gates owned by devantler-tech/platform#5334. Closing this shared-source issue does not clear those gates.

Part of #287; fixes the shared source for devantler-tech/platform#5334.

🔗 Related PRs

#766 - fix(publish): recover bounded public CI quota refusals [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

chore: agent-claim #797 nonce=5d770dd593a2679989979cb45f2a201a

🤖 Generated by the Agentic Engineer

Shared-source delivery verified: PR #798 merged through normal protection as signed commit d3c754ceb9f1588e9ed016a9d9a7bd59a5c845c8; tag v15.0.1 resolves to that exact commit. Release 40803094484, CD 40803149606 and post-merge main CI 40803094228 all succeeded. The merged tree matches the reviewed/tested tree, and the helper's independently verified SHA-256 is 4e0db6ad6c8a5620a2b676be0ca28dbe5e5cb855e15cc649368499f3ddcb4bb3.

The actual hosted integration passed in platform job 123212434720. Final consumer adoption and default-branch acceptance continue in platform#5550 and platform#5334; this receipt clears only the shared-source delivery.

Navigation Menu

Keep hosted public image verification reliable under shared API quotas #797

Problem

Intended outcome

Acceptance

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Keep hosted public image verification reliable under shared API quotas #797

Description

Problem

Intended outcome

Acceptance

Activity

coderabbitai commented on Oct 29, 2026

devantler commented on Oct 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions