Validate staging content without publication credentials

[adrianwebb]

Outcome

Make the shared content workflow usable on staging without external publication credentials while preserving production R2 publication on main.

Work authority

• Work item / Issue: Platform SDK-first cutover Gate 0; tracked by docs: record SDK standards cutover and agent boundary platform#10
• Proposal / decision: Approved SDK-first standards, GitHub, and cluster cutover plan
• Assignment / checkpoint: Cross-repository staging content-validation correction
• Actor: Codex task /root
• Human authority: @adrianwebb
• Agent / capacity provider: Codex Desktop / local Codex capacity provider
• Exact base ref: staging at a58aa53c9507e5af61a8c19dac51797a6abe6f6a
• Exact head ref: codex/staging-content-validation at ae2fe26223520185cff641d5ac77faf323248277

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

1. Default content execution to deterministic validation-only mode.
2. Permit external acceptance and R2 publication only for non-PR execution on main.
3. Prove the PR path needs no R2 credentials, then merge and prove the staging push path is also credential-free.

Current status: exact-head push/PR checks and independent review passed; ready for staging integration.

Changes and commits

• Initialize VALIDATE with --validate-only.
• Clear validation-only mode and run R2 acceptance only on main outside pull requests.
• Preserve exact source-commit checks, channel labeling, receipts, and production fail-closed behavior.
• Include the workflow path in its own trigger filter so pull-request and staging behavior are exercised when this contract changes.

The exact two-commit branch head is ae2fe26223520185cff641d5ac77faf323248277; both commits modify only the content workflow.

Verification

• git diff --check passed.
• Content runs 32208295303 and 32208297679 passed without R2 credentials.
• Package Verify runs 32208295268 and 32208297666 passed.
• The PR receipt is bound to the exact source head, records zero uploads, and has SHA-256 8189b9f26731fc08219a63e29aa6b61aa82c4514ab6e1d467489f01b1379cf75.
• Independent review found no correction-specific source or security issue.
• Human contribution affirmation run 32208434130 passed at the exact head.

Risk and rollback

Risk is accidentally suppressing production publication. The condition explicitly retains R2 acceptance/publication for non-PR main execution. Roll back by reverting these one-file commits; never provision production publication secrets merely to make staging validation pass.

Completion summary

The shared workflow contract is explicit and verified at the exact head: pull requests and staging validate locally; only main can publish externally. The next lifecycle step is staging merge, exact ref read-back, and a credential-free staging Content receipt.

Contribution grant (human action required)

The accountable human must review CONTRIBUTING.md and check the affirmation below. Agents must leave it unchecked for the human.

• I have read CONTRIBUTING.md, have the right to submit this contribution, and grant the rights described there, including the right to offer my contribution under the project's AGPL and alternative commercial licenses.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.