Skip to main content
The pull-request job should prove the file is clean, inspect the authority and spend shape, then rehearse the graph with the mock provider.

Admission script

Authority ladder

CI ADMISSION ยท SECRETS ARRIVE LAST
The review job needs no provider key. Protected execution receives only the authority its environment and workflow declare.

Pin and print both versions

Keep the engine and SDK release train visible in logs. Do not debug skew from an implicit global binary.

Continue

GitHub Actions

Use the Nika action for PR comments and receipts.

Check and plan

Read every admission field.

Security

Keep authority explicit.

Testing

Design deterministic mock goldens.