[pelikhan]

Why

Implement the OIDC admission contract introduced in #70286 so participating workflows can consult a centralized authority before agent execution. Validated admission supersedes daily-AIC validation and supplies component-specific runtime credit limits.

Implementation

• Emit a dedicated compiler-owned admission job, gated at job level by vars.GH_AW_DEFAULT_ADMISSION_URL. An absent endpoint skips its runner, setup and OIDC acquisition. Daily-AIC validation and its credentials remain in activation; daily-limit variables do not enable admission.
• Grant admission only contents: read and id-token: write. Admission does not run workflow hooks or mint workflow/telemetry App credentials. Reject all jobs.admission frontmatter customization, including setup-steps, pre-steps, steps, permissions and environment overrides. Activation receives no admission-only OIDC grant; independent workflow OIDC requirements remain supported.
• Make activation depend on admission and explicitly accept success or skip, reject failure/cancellation, and preserve its original prerequisite and eligibility conditions. Protect downstream jobs against GitHub Actions skipped-ancestor propagation without weakening required dependency results or overriding explicit status-function conditions.
• Authenticate using native Actions OIDC only. Preserve the ten-string-field POST contract, caller-owned W3C trace context, strict response validation, bounded retries and shared 60-second monotonic deadline. No service response trace identifiers are accepted.
• Relay validated primary, threat-detection and evals allowances through activation outputs into existing runtime enforcement. Supplied allowances replace the corresponding local caps; omitted optional allowances preserve independent component policy. Missing/invalid required admitted limits fail closed. Remove handoff environment variables before agent execution.
• Record status and validated numeric allowances in guardrail.admission unified-session events with admission provenance, and propagate the component values to detection/evals. Human-readable lifecycle logs and collapsed step-summary details withhold identities, credentials, endpoint configuration, allowance amounts, spend and service diagnostics.
• Update the service specification, ADR, release note, regression coverage and TLA+ model, including admission-job isolation and activation dependency invariants.

Validation

• All 345 repository workflows regenerated successfully. Build, formatting, changed-file publication gate and focused compiler regressions passed after integrating concurrent branch/main changes.
• JavaScript type checking and admission/unified-session suites passed: 292 tests.
• All four secure TLA+ profiles, 29 negative controls and 18 witnesses verified; checker harness tests passed.
• Regression coverage includes rejection of each frontmatter hook form, endpoint-only gating, daily-AIC placement/fallback, OIDC permission isolation, skipped-admission dependency conditions, independent runtime allowances, and unified-session propagation.
• No live workflow runs were triggered. Earlier macOS/platform/toolcache failures in broad package runs are not presented as full-suite success.

Operational scope

Admission is cooperative rather than an unbypassable organization spending cap. Authoritative enforcement still requires protected backend authorization/accounting. The independently implemented server contract is unchanged; its initial deployment profile supports GitHub.com, string audiences and non-reusable workflows, failing closed for unsupported reusable identities. No server or Actions rollout configuration is changed here.

Most of the diff is regenerated workflow lock files. Reusable caller permission envelopes must permit the callee's admission OIDC capability.

---

Changeset

• Type: patch
• Description: Add isolated OIDC admission with validated component-specific runtime credit allowances and redacted unified-session reporting.

Generated by 📋 Changeset Generator for #70429 · codex · gpt56 · 38 AIC · ⌖ 25.6 AIC · ⊞ 15.7K · ◷

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · sonnet50 · 14.1 AIC · ⌖ 15.1 AIC · ◇ 6.6 AIC · ⊞ 12.6K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · 14.4 AIC · ⌖ 5.37 AIC · ⊞ 14.7K · ◷

Generated by Ponytail Reviewer for #70429

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Commit pushed: 82b3ac3

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

Request changes

Two blocking issues found in the admission runtime:

• The control-character regex rejects ordinary uppercase characters, so valid configured endpoints and identities fail admission.
• id-token: write is granted unconditionally to every activation job, including workflows with admission disabled; the step condition cannot sandbox OIDC minting.

Inline comments explain the impact and surgical fixes. Static review only; no tests or repository code were executed.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · 6.46 AIC · ⌖ 0.553 AIC · ⊞ 1.6K
_{Comment /review to run again}

[github-actions]

🏗️ Design Decision Gate — ADR Required

This PR adds about 327 new lines of core business logic (more than the 100-line threshold) but does not link an Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/70429-activation-only-oidc-admission-service-runtime.md. Please review and complete it before merging.

The draft records these decisions:

• An OIDC-only admission step runs in the activation job only.
• A validated approval replaces the daily-AIC guardrail. Disabled admission and ignored outages fall back to the daily-AIC check.
• Every activation job gets id-token: write, including reusable caller envelopes.
• The shared withRetry helper gains per-attempt timeouts and an absolute deadline.

🔒 This PR cannot merge until an ADR is linked in the PR body.

📋 What to do next

1. Review the draft ADR committed to your branch. It was generated from the PR description and the file patches, because the full diff was too large to fetch.
2. Complete the missing sections. Check the alternatives against what you actually considered. In particular, check whether id-token: write should be granted unconditionally rather than at compile time, and whether admission should replace the daily-AIC check or run alongside it.
3. Commit the finalized ADR to docs/adr/ on your branch.
4. Reference the ADR in this PR body by adding a line such as:

   ADR: ADR-70429: Activation-Only OIDC Admission Service Runtime

Once an ADR is linked in the PR body, this gate will re-run and verify that the implementation matches the decision.

❓ Why ADRs Matter

"AI made me procrastinate on key design decisions. Because refactoring was cheap, I could always say 'I'll deal with this later.' Deferring decisions corroded my ability to think clearly."

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you.

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

• Context: What is the problem? What forces are at play?
• Decision: What did you decide? Why?
• Alternatives Considered: What else could have been done?
• Consequences: What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · opus55 · 35.4 AIC · ⌖ 40.8 AIC · ⊞ 1.9K · ◷
_{Comment /review to run again}

[github-actions]

Skills-Based Review 🧠

Applied /tdd, /codebase-design, and /grill-with-docs on the admission-runtime high-impact files (compiler_admission.go, check_admission.cjs, admission_protocol.cjs, compiler_activation_permissions.go, call_workflow_permissions.go, error_recovery.cjs, and the updated spec). Overall this is a well-scoped, defense-in-depth implementation with strong test coverage (128 JS tests, dedicated Go compiler tests, and a TLA+ model with 27 negative controls). Approving with a few minor, non-blocking suggestions.

📋 Key Themes & Highlights

Key Themes

• Strict protocol parsing: admission_protocol.cjs uses a hand-rolled regex grammar instead of trusting JSON.parse output directly, correctly handling duplicate-key and escaped-key attacks that a naive parse would miss — good defensive design for an untrusted external response.
• Deadline/signal plumbing: error_recovery.cjs's new runWithinRetryBudget plus AbortSignal wiring through withRetry is a clean, backward-compatible extension (existing non-timeout callers are unaffected since operation() and sleep() still work without a signal).
• Permission minimality trade-off documented: the PR body explicitly and correctly caveats that id-token: write on activation is not a sandbox boundary — good, since that is exactly the kind of assumption a reviewer would otherwise flag as a gap.
• Two inline comments note minor coverage/documentation gaps: IPv6-without-brackets URL validation test, and the non-overridable id-token: write behavior in extractPermissionsFromMDFile deserving an explicit code comment since it diverges from the otherwise-declarative frontmatter permissions: convention elsewhere in the compiler.
• One inline suggestion on runWithinRetryBudget's already-expired-deadline path is largely already covered by an equivalent withRetry-level test ("should not invoke operations after an expired deadline or zero timeout"), so treat it as a nice-to-have, not a gap.

Positive Highlights

• ✅ Spec, TLA+ model, and implementation were updated together and stay internally consistent (verified hash pattern, trace fields, and optional-allowance semantics all match across .tla, .md, and .cjs/.go).
• ✅ TestAdmissionRepositoryReusableCallerPermissions and TestAdmissionReusableCallerPermissionsWithStaleWorkerLock proactively guard the cross-cutting 344-lock-file regeneration against silent permission regressions.
• ✅ Bounded body reads (readBoundedBody), strict content-type checks, and redirect: "manual" on both OIDC and admission fetches are solid baseline hardening against response-smuggling/SSRF-adjacent issues.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 111.1 AIC · ⌖ 15.3 AIC · ⊞ 10.1K
_{Comment /matt to run again}

[Copilot]

🔵 Needs a closer look

Admission output and permission regressions, stale WASM fixtures, and missing caller-migration guidance block approval.

No open issues 🎉

What changed in this PR

Adds activation-only OIDC admission, intended to replace daily-AIC validation after approval without changing downstream execution or runtime budgets.

Changes:

• Generates endpoint-gated admission checks with workflow hashes.
• Expands activation and reusable-caller OIDC permissions.
• Updates generated workflows, tracing, tests, documentation, and formal checks.

Unresolved issues include overwritten admission output, Markdown-worker write-all permission downgrades, stale WASM golden fixtures, and missing breaking-change migration guidance. Optional findings concern sequential OTLP export delays, duplicated action-path handling, and undocumented constants.

File	Description
specs/​workflow-security/​check.py	Updates admission controls and reachability witnesses.
specs/​workflow-security/​ActivationAdmission.cfg	Selects revised admission invariants.
pkg/​workflow/​compilerenv/​manager.go	Defines managed admission variables.
pkg/​workflow/​compiler_admission.go	Generates the conditional admission step.
pkg/​workflow/​compiler_activation_permissions.go	Grants activation OIDC access unconditionally.
pkg/​workflow/​compiler_activation_job.go	Inserts admission before validation.
pkg/​workflow/​call_workflow_permissions.go	Extends reusable-caller permission inference.
pkg/​workflow/​call_workflow_permissions_test.go	Updates permission-import expectations.
pkg/​workflow/​agy_engine_test.go	Updates scoped OIDC permission assertions.
pkg/​cli/​env_admission_test.go	Tests admission defaults and validation.
docs/​src/​content/​docs/​reference/​enterprise-configuration.md	Documents centralized admission deployment.
docs/​src/​content/​docs/​reference/​cost-management.md	Explains admission precedence and daily-AIC fallback.
docs/​src/​content/​docs/​reference/​compiler-enterprise-environment-controls.md	Documents managed variables and permission boundaries.
actions/​setup/​js/​send_otlp_span.test.cjs	Tests rejection of zero trace identifiers.
actions/​setup/​js/​send_otlp_span.cjs	Adds validated W3C traceparent construction.
actions/​setup/​js/​error_codes.cjs	Defines the admission error category.
.github/​workflows/​windows.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​windows-grower.md	Grants reusable-caller OIDC access.
.github/​workflows/​unbloat-docs.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​tidy.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​test-quality-sentinel.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​squad.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​squad-plan.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-water.yml	Grants reusable-caller OIDC access.
.github/​workflows/​smoke-trigger.yml	Grants reusable-caller OIDC access.
.github/​workflows/​smoke-test-tools.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-temporary-id.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-service-ports.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-project.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-pi.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-pi-routed.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-opencode.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-multi-pr.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-multi-caller.yml	Grants reusable-caller OIDC access.
.github/​workflows/​smoke-kiro.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-goose.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-gemini.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-drive.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-cursor.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-crush.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-copilot.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-copilot-small.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-copilot-sdk.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-copilot-auto.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-copilot-arm.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-codex.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-claude.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-checkout-pr-dispatch.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-aider.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-agy.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-agent-public-none.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-agent-public-approved.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​smoke-agent-all-none.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​skillet.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​security-review.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​scout.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​refiner.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​q.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​purelock.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​pr-sous-chef.lock.yml	Adds activation admission and OIDC access.
.github/​workflows/​pr-nitpick-reviewer.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​pr-code-quality-reviewer.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​ponytail-reviewer.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​plan.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​pdf-summary.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​mergefest.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​grumpy-reviewer.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​design-decision-gate.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​dependabot-burner.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​deep-report.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​daily-max-ai-credits-test.lock.yml	Adds activation admission and OIDC access.
.github/​workflows/​daily-issues-report.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​daily-firewall-report.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​daily-doc-updater.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​daily-doc-healer.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​daily-community-attribution.lock.yml	Gates wiki-ledger preparation and daily validation.
.github/​workflows/​daily-code-metrics.lock.yml	Gates repository-ledger preparation and daily validation.
.github/​workflows/​daily-cli-performance.lock.yml	Gates repository-ledger preparation and daily validation.
.github/​workflows/​credentials-check.yml	Grants reusable-caller OIDC access.
.github/​workflows/​craft.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​code-simplifier.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​cloclo.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​ci-coach.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​changeset.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​avenger.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​artifacts-summary.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​archie.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​approach-validator.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​ai-moderator.lock.yml	Adds admission and daily-AIC gating.
.github/​workflows/​ace-editor.lock.yml	Adds admission after strict-policy enforcement.
.changeset/​admission-service-runtime.md	Announces admission runtime behavior and boundaries.

_{Review effort: Max}

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · sonnet50 · 14 AIC · ⌖ 16 AIC · ◇ 6.61 AIC · ⊞ 12.6K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · 6.65 AIC · ⌖ 5.31 AIC · ⊞ 14.7K · ◷

Generated by Ponytail Reviewer for #70429

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · opus55 · 11.2 AIC · ⌖ 31.9 AIC · ◇ 15.8 AIC · ⊞ 1.9K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ Smoke OTEL completed successfully!

Generated by Smoke OTEL

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

🔮 The oracle has spoken through Smoke Codex

[github-actions]

✨ Gemini awakens... Smoke Gemini begins its journey on this pull request...

[github-actions]

🥧 Pi initializing... Smoke Pi begins on this pull request...

[github-actions]

✅ Smoke Copilot Auto completed successfully!

Generated by Smoke Copilot Auto for #70429

[github-actions]

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

🔧 Tool validation by Agent Container Smoke Test

[github-actions]

Gate asks for a token,
Admission grants credit's share—
Agents run in trust.

Inspired by PR #70429's OIDC admission job and runtime credit allowances.

Generated by 🌸 Smoke Copilot Auto for #70429 · copilot · auto · 9.1 AIC · ⌖ 3.76 AIC · ⊞ 6.4K · ◷
_{Add label smoke to run again}

[github-actions]

Smoke Test: MAI-Code-1.1-Flash

• Repo activity was focused on docs, MCP/tooling, and workflow fixes.
• Overall status: PASS
• Bash command check: ✅

Generated by ⚡ Smoke Copilot MAI · copilot · mai11 · 0.753 AIC · ⌖ 0.249 AIC · ⊞ 18K · ◷
_{Comment /smoke-copilot-mai to run again
Add label smoke to run again}

[github-actions]

Comment Memory

Peek at saved memory (smoke-codex)

Quiet branches sway
Small checks cross the morning light
Green leaves greet the dawn

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔮 The oracle has spoken through Smoke Codex · codex · 10.5 AIC · ⌖ 0.626 AIC · ⊞ 21K · ◷
_{Comment /smoke-codex to run again}

[github-actions]

Commit pushed: 50b891d

Generated by Changeset Generator · codex · gpt56 · 38 AIC · ⌖ 25.6 AIC · ⊞ 15.7K

[github-actions]

Agent Container Tool Check

Tool	Status	Version
bash	✅	GNU bash, version 5.2.21
sh	✅	available
git	✅	git version 2.55.0
jq	✅	jq-1.7
yq	✅	yq v4.54.1
curl	✅	curl 8.5.0
gh	✅	gh version 2.102.0
node	✅	v24.21.0
python3	✅	Python 3.11.17
go	✅	go version go1.24.13
java	✅	openjdk 21.0.12.1
dotnet	✅	10.0.401

Result: 12/12 tools available ✅

Playwright title validation

• Expected title from file: playwright-o9xoRsSFZWbyPy5T8D8ya-MhQwsPe9Q9
• Actual title: unavailable; the Playwright browser could not launch in this container
• Error: /opt/google/chrome/chrome: /lib/x86_64-linux-gnu/libm.so.6: version GLIBC_2.43' not found (required by /run/awf-lib/browser-libs/usr/lib/x86_64-linux-gnu/libasound.so.2)`
• Result: FAIL — exact title equality could not be verified because the browser runtime is incompatible with the container

🔧 Tool validation by Agent Container Smoke Test · pi · mai11 · 1.77 AIC · ⌖ 0.395 AIC · ⊞ 7.7K · ◷
_{Comment /smoke-test-tools to run again}

[github-actions]

Smoke Copilot: FAIL (partial) — PR "Add isolated OIDC admission and runtime credit allowances" by @pelikhan (no assignees). ✅ gh query, discussion query; ⚠️ build unverified; ❌ remaining tests not run (permission denied).

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 32.3 AIC · ⌖ 0.35 AIC · ⊞ 14.2K · ◷
_{Comment /smoke-copilot to run again
Add label smoke to run again}