Revert "feat(ci): download macOS preview DMGs without signing in" by rynfar · Pull Request #113 · pylon-code/pylon

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

rynfar · 2026-08-27T07:19:30Z

Reverts #111 and records the decision as DEF-7 in .agents/upstream-review.md, so a later session can pick it back up rather than rediscovering it.

Nothing was wrong with the port. It cherry-picked cleanly, the runner adaptation was right, and the four silent-failure paths the pre-merge review found were all fixed in 9d112329e. The feature just does not earn its cost for Pylon.

The premise does not hold here. Upstream's motivation was that Actions artifacts require a signed-in account, which "breaks testing on headless devices." Three things undercut that for us:

Fork PRs cannot trigger it. Both the build and cleanup jobs require head.repo.full_name == github.repository. External contributors — the people a login-free download most helps — are excluded by design.
gh run download <run-id> already does this. The gate is a browser login gate; an authenticated gh CLI retrieves artifacts on a headless box without one.
Pylon Nightly already publishes public builds every three hours for anything merged.

That leaves one beneficiary: a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient.

Against that sat: 210 lines of concurrency-sensitive YAML whose four review findings were all silent failures; a new contents: write token on a PR-triggered workflow; an unsigned binary hosted publicly under the org's name; and a Releases widget advertising it as this repository's only release, while real builds live in pylon-code/pylon-releases.

Leaving it merged but inert behind an unapplied label was the alternative. Unexercised machinery carrying a write token rots — the next person to touch it inherits four races they have no reason to know about — so removing it is the more honest state.

The workflow file is byte-identical to its state before #111 merged; actionlint reports 0 findings. The preview:mac label created earlier today is being deleted alongside this.

DEF-7's revisit condition is concrete: Pylon deciding to distribute unsigned previews publicly, or upstream lifting the same-repo restriction / dropping the contents: write publish job, checkable with a path-filtered git log over the workflow. Earliest revisit 2026-11-01, so it is not re-litigated every review. If it is ever revived, the note says to start from #111 plus 9d112329e rather than from upstream.

Model: Claude Opus 5. Harness: Claude Code.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Reverts the #111 merge and records the decision as DEF-7 in the upstream ledger, so a later session can pick it back up if the premise changes. Nothing was wrong with the port and its four review findings were fixed. The feature just does not earn its cost here. Fork PRs are excluded by head.repo.full_name == github.repository on both the build and cleanup jobs, so external contributors cannot trigger it at all. `gh run download <run-id>` already retrieves artifacts headlessly with an authenticated CLI, which covers upstream's stated motivation, and Pylon Nightly already publishes builds every three hours for anything merged. That leaves a maintainer testing an unmerged same-repo branch on a machine where a browser login is inconvenient. Against that: 210 lines of concurrency-sensitive YAML the pre-merge review found four silent-failure paths in, a new contents: write token on a PR-triggered workflow, an unsigned binary hosted publicly under the org's name, and a Releases widget advertising it as this repository's only release. Unexercised machinery carrying a write token rots, so it is removed rather than left inert behind an unapplied label. The workflow is byte-identical to its state before #111 merged.

github-actions · 2026-08-27T07:25:02Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+50 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+10 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 59a9c46 · PR result: 9491b73 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 109.4 KiB
Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

github-actionsBot added size:L vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. labels Aug 27, 2026

rynfar merged commit 0b3e147 into pylonAug 27, 2026
14 checks passed

rynfar deleted the revert/2026-08-27-preview-dmg-downloads branch August 27, 2026 07:25