release handoff
bind published descriptor
ApplicationRelease/v1 bind published descriptor Published handoff operands
A published application release binds its source identity, one target and its lock, its qualification and output manifest, an authenticated root, a runtime image and its receipts into the handoff operands.
Canonical payload and post-publication descriptor digests are distinct, so no release contains its own digest.
Whitepaper, page 10
bind application + policy
OverlayBundle/v1 bind application + policy Published handoff operands
A published reusable OverlayBundle binds separate source identity, target/graph/lock/evidence/output manifest, a bounded authenticated tar root, an exact regular 0755 activation-adapter member, and policy.
Whitepaper, page 10
trusted identity / policy
ReleaseAuthority trusted identity / policy OwnerOverlayDecision
Release authority, verified source commit/tree, payload/descriptor cryptography, and independently checked referenced-content observations are verifier-owned inputs, separate from artifact payloads.
Whitepaper, page 10
independent byte verification
ReleaseVerification independent byte verification OwnerOverlayDecision
Payload and descriptor bytes are verified independently against the trusted producer identity.
Whitepaper, page 10
exact immutable operands
Published handoff operands exact immutable operands OwnerOverlayDecision
The typed decision accepts only authority-matched application and reusable overlay releases whose complete references are bound by a separately signed selection.
Whitepaper, page 10
Accept(handoff) only
OwnerOverlayDecision Accept(handoff) only Owner-overlay consumer
Missing selection, signature, the selected arm's independent authority verification, or independently supplied subject refuses; two independently signed release artifacts alone do not authorize their pairing.
Only an accepted handoff reaches the consumer; deployment plan, apply and provider state stay outside the product.
Whitepaper, page 10
CandidateEvidence/v1
- cannot satisfy a published handoff
CandidateEvidence is structurally nondeployable.
ApplicationRelease/v1
- target + authenticated outputs + build evidence
OverlayBundle/v1
- target + authenticated root + policy
Published handoff operands
ReleaseAuthority
- trusted producers + policy
ReleaseVerification
- payload + descriptor + references
OwnerOverlayDecision
Verifier-owned source identity, payload/descriptor cryptography, publication evidence, archive observations, and exact referenced-content observations drive deterministic accepted/refused decisions.
Owner-overlay consumer
Architecture Axioms
Attach once.
Local development, CI through the adopter thin dispatch edge, and REAPI workers resolve the same logical tenant, cache, and toolchain contract.
Capabilities, not repositories.
Placement is selected by architecture, runtime, privilege, accelerator, and bounded resource capability; project identity is not a runner class.
Content identity is verified.
A served object MUST match its digest, and every output-affecting input, command, environment, platform, and toolchain fact MUST participate in the corresponding Nix or REAPI identity.
Trusted work deposits automatically.
Successful trusted work MUST publish its reusable closure or action result before the lane reports success.
A manual seed is bootstrap or repair, never steady-state acceptance.
Every attached path withdraws from shared authority.
A warm result MUST be reusable by another authorized caller with the same tenant, digest, platform, and policy identity.
Remote misses execute remotely or fail explicitly.
A remote-required cache miss MUST either be admitted to a compatible worker pool or receive a typed admission/availability failure.
The control-plane cell is not a compatible worker and MUST NOT execute actions.
Once admitted, work MUST never execute locally: successful execution is validated and deposited; cancellation, deadline, execution failure, worker loss, or absent capacity terminates with a typed failure.
Rollback selects a prior worker release/route snapshot or leaves execution unavailable; it never restores control-plane execution.
No silent fallback or disguised outage.
Remote-required work MUST fail closed when remote execution is unavailable.
Backend unavailability, corruption, denial, and a genuine cache miss are distinct observable states.
Tenancy is server-side.
Writes, leases, and quota charges bind an authenticated tenant and subject.
Every audit event records either that identity, an explicitly anonymous public reader, or a denied unauthenticated principal.
Public-read Nix closures require explicit policy plus signature/content verification.
Physical deduplication MUST NOT grant logical visibility.
Evidence is external to the claim.
Product status comes from protocol responses, build-event data, service metrics, failure injection, and restore tests.
A producer cannot be the sole verifier of its own summary.
Implementations are replaceable.
REAPI Protobuf and these behavioral laws are authoritative.
Go, Rust, storage providers, schedulers, and control-plane applications are replaceable components.
Core contains no installation facts.
GF core defines capability classes, interfaces, and laws.
Consumer installations bind one organization, its App installation, and all-repository selection; overlays bind organization-wide admitted subjects, trusted workflows, write policy, and abstract capability/concurrency demand.
Repository and ActionPlan facts enter only with a fresh invocation.
Provider supply binds the instance authority, routes, endpoints, workers, and capacity; the controller derives tenant and logical instance identity from verified ownership under that authority.
Cluster substrate binds physical nodes, taints, labels, and provider StorageClasses.
A hostname or provider class is not a core placement primitive.
The action is the unit of compute; throughput lives in the pooled scheduler, not runner count.
Product throughput is a property of the shared exec-cache pool and GF's own scheduler (cache hit-rate, deposited and withdrawn results, admitted actions, worker slots), never of runner count.
The adopter thin dispatch edge (an ARC-hosted scale set today) is a thin, dispatch-only GitHub admission shell;
GitHub's ARC/JIT scheduler is not GF's scheduler.
Runner-count, lane-tiering, and quota tuning are a maintenance floor, never the product story, and a runner-count delta is never a product win (R243, 2026-08-21).
Capacity and capability remain evidence-gated: ARC job capacity and REAPI worker capacity scale independently from queue demand within declared bounds, and a language, platform, privilege, or resource capability is admitted only after positive, negative, failure-isolation, and rollback evidence.
Supply is measured, not remembered.
Live provisioned capacity is read from the running system, never inferred from a declared or last-known number.
A declared cap is an admission bound, not a measurement; any capacity claim cites a measured reading with its timestamp, never a remembered value.
Verified operands are constructor-protected.
An artifact reference, verification observation, canonical payload bytes, and decoded semantics MUST NOT enter a controller as independent caller inputs.
An independent verifier fetches the exact subject, verifies its external signature/bundle and producer policy, bounds and canonical-decodes those same payload bytes, and returns one opaque accepted value whose constructor is unavailable to callers.
Whitepaper, page 7
Whitepaper, page 8
Versioned Interface Authorities
Attachment
A consumer-owned OwnerInstallation/v1, TenantOverlay/v1, consumer RevocationSet/v1, and bounded all-repositories GitHub App observation resolve to canonical VerifiedOwnerDemandContribution/v1 bytes.
A projected pod-bound Kubernetes ServiceAccount identity authenticates the exact adopter verifier at provider intake; the provider reads no consumer secret or raw operand, and adding an owner requires no GF source edit.
Identity and admission
An explicit closed identity distinguishes genuine Actions OIDC from a Developer authenticated through the adopter's Product App.
Common exact repository, committed source, ActionPlan, lock and Bazel identities join the atomic ResolvedOwnerSupplyCatalog/v1; missing identity never implies Actions.
Developer App/user identity is stable, while verified write/admin permission observations renew within 60 seconds without extending the original action/session deadline.
Developer identity grants neither direct AC write nor publication/deployment authority.
The short-lived ResolvedActionBinding/v1 supplies tenant, route, platform, policy and scopes; no profile or direct endpoint is authority.
Nix shared data
The Nix binary-cache NAR/.narinfo protocol, store-path identity, signatures, and the complete recursive closure reported by nix path-info -r.
Attic is an adapter, not the protocol authority.
Bazel shared data
REAPI v2 ContentAddressableStorage, ActionCache, and ByteStream, tenant-routed by instance_name.
One provider-selected ExternalInputClosureBinding/v1 may join only a fresh exact action invocation: it addresses a complete target-scoped Bazel vendor tree in CAS; binds the repository/source/plan/action/module-lock/Bazel-binary tuple and exact signed ProviderActionRoute.routeIdentity; contains every repository Bazel 8.2.1 actually vendors for the bound action/configuration, each paired marker, all vendored generated/module-extension repositories, registry content Bazel emitted, and the inert generated VENDOR.bazel (_registries may be absent); excludes the refreshed bazel-external; and admits no catalog, repository roster, distdir, repository-cache, network, or fallback authority.
Because Bazel always excludes local/configure repository rules from vendor mode, v1 refuses an action needing one until a separate exact runtime-environment authority exists.
The independently verified ProviderCapability covers that policy; neither its digest nor a declared policy proves authenticated generation.
The closure and invocation must use the policy's exact binary.
Any accepted provider producer and the materializer enforce fixed tree/blob/node/depth ceilings; --nofetch, download refusal, and network isolation fail closed.
The resolved action uses the same logical CAS/AC authority for cache access and execution.
Remote execution
WorkerRouteSnapshot/v1 binds a monotonic generation to the exact ready/draining workers, capability, address, TLS server identity, closure identity, physical maxSlots, per-cell-replica dispatch slots, and pool; multiple slots on one leaf are concurrent leases of that same physical identity, never invented workers.
WorkerRouteActivation/v1 binds that snapshot, the exact raw route body and its SHA-256, one selected Ready worker, separate image and closure fields, exact cell/worker workload identities and positive replicas, and distinct route/client-TLS/server-TLS Secret identities.
It proves each slots * cellReplicas <= maxSlots; the independent verifier must additionally join aggregate route demand to verified ProviderCapability capacity and lifecycle.
Image and closure may carry the same digest; the raw route-body SHA-256 may not reuse either.
Heartbeats may report liveness only; they cannot introduce address or trust.
Runner capacity
Selection is by capability, never repository identity.
Qualified action output
The exact canonical ActionPlan digest and its ResolvedActionBinding/v1 join a bounded, CAS-present, non-authoritative ActionOutputSet/v1 to an independent ActionCacheObservation/v1.
Only a remote cache hit or remote-execution deposit qualifies; local execution is representable only so the law can refuse it.
The original binding-bound deposit qualifier retains its independent schema-4 protocol/build-event evidence.
The separate cell-origin-remote-actions qualifier joins authenticated per-action hit/deposit receipts and CellExecuteOrigin/v1, including mixed actions, without historical schema-4 evidence.
Operations
OpenMetrics/Prometheus exposition for deposit, substitution, CAS/AC, queue, worker, quota, corruption, failure, and restore state.
A protected read API is planned but is not yet a versioned replacement boundary.
Owner-overlay handoff
CandidateEvidence is structurally nondeployable.
A published reusable OverlayBundle binds separate source identity, target/graph/lock/evidence/output manifest, a bounded authenticated tar root, an exact regular 0755 activation-adapter member, and policy.
The closed selection authorization binds both complete artifact references and the installation image to independently supplied pre-evidence request-binding/request-identity digests.
Its ActionsSource arm retains OwnerOverlaySelection, the same overlay repository/producer authority, and its own source revision independent of the reused overlay.
Its OwnerDelegatedRuntime arm separately verifies protected owner intent, released-software provenance and custody assignment without fabricating workflow-source identity.
Verifier-owned source identity, payload/descriptor cryptography, publication evidence, archive observations, and exact referenced-content observations drive deterministic accepted/refused decisions.
Binding/v4 separately binds the immutable release to consumer-owned PRE policy and verifier-owned forge lifecycle.
Nix remote build
Nix retains evaluation, dependency and output semantics; derivation-granular execution uses the shared REAPI fabric.
Builder registration binds endpoint and credential authority, platform, capacity, health, exposure, drain, and per-derivation REAPI execution; a whole-flake wrapper or local build is not an admitted execution mode.
After remote execution or a qualified remote cache hit, success requires qualified output custody, recursive publication of the complete closure and independent substitution.
Publication failure is failure, not a cached build side effect.
Execution scheduling
The scheduler is GF's, not GitHub's ARC/JIT scheduler; the ARC runner is a thin admission shell and is never the base unit of compute.
Whitepaper, page 9
Whitepaper, page 10
Product SLOs
The minimum product dashboard is metrics and a protected API.
It MUST report:
- trusted-deposit coverage and deposit lag;
- Nix substitutions and byte avoidance;
- Bazel CAS and action-cache hit rates;
- local executions avoided and remote-action count;
- queue p50/p95 and available worker slots by capability;
- worker failures, sandbox failures, and no-fallback violations;
- tenant quota usage and admission rejection;
- corruption, digest mismatch, and quarantined objects;
- durable-store restore RPO/RTO and last successful restore drill;
- credential freshness and rollback completion time;
Objectives
GloriousFlywheel guarantees and reports three operative product objectives.
Exact-head request accepted to routable PRE ready: p95 at most 600 seconds.
Protected-main merge to exact merged digest served: p95 at most 600 seconds.
Admit 110 simultaneous valid action submissions without using GitHub Actions jobs or ARC pods as the execution unit.
Remote ActionCache hits and active cold misses are reported separately, and attribution covers tenant, action, queue, cache, worker lease, latency, refusal, and error class.