fix(#6257): remove credential mode model, make inference secrets unconditional

[fullsend-ai-coder]

Summary

Removes the credential mode model (wif/oidc/token) introduced in PR #6224 and makes inference WIF secrets unconditional. The core bug: needsWIF was gated on credMode == CredModeWIF, so GitHub repos using the default OIDC mode silently skipped writing FULLSEND_GCP_PROJECT_ID and FULLSEND_GCP_WIF_PROVIDER secrets — breaking Vertex AI inference for default-mode repos.

Changes

• manifest.go: Remove CredModeWIF/CredModeOIDC/CredModeToken constants, CredentialMode fields from GitHubForgeInfra, GitLabForgeInfra, RepoEntry, and ResolvedConfig; remove validation functions (IsValidCredentialMode, ValidCredentialModesFor)
• install.go: Remove resolveCredentialMode(), make inference secrets unconditional (written when InferenceProject is set), remove FULLSEND_CREDENTIAL_MODE variable from installs, simplify requiredSecretsForForge() to always return secrets
• batch_install.go: Remove credential mode gating on inference flag validation — repos without pre-existing secrets now always require --inference-project
• status.go: Remove credential mode drift detection, always check for inference secrets
• uninstall.go: Remove credential mode from cleanup variable list, always delete inference secrets
• migrate.go: Default region to "global" when not discovered (instead of warning with no value)
• Scaffold templates: Remove WIF/token branching from fullsend-agent.yml and fullsend-poll.yml; bot PAT always from FULLSEND_FORGE_TOKEN CI/CD variable; inference WIF setup unconditional when FULLSEND_GCP_WIF_PROVIDER is set
• repos_gitlab.go: Simplify setupGitLabBotToken to always store as CI/CD variable (remove Secret Manager path)
• Docs: Remove credential mode terminology from operations.md and infrastructure-reference.md

Testing

• All internal/repos/ tests pass (169 tests)
• All internal/scaffold/ tests pass
• Full build passes (go build ./...)
• Secret scan passes
• Gitlint passes
• Pre-existing CLI test failure verified as unrelated (TestPostScriptEnv_NoSchemaAppendedWhenNoValidationLoop — missing openshell binary in sandbox)

---

Closes #6257

Post-script verification

• Branch is not main/master (agent/6257-remove-credential-mode)
• Secret scan passed (gitleaks — 53456d472dcba81bcea79f8d715e9d6159cefa5c..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:57 PM UTC · Completed 1:13 PM UTC

Commit: af21633 · View workflow run →

[github-actions]

Site preview

Preview: https://792f110d-site.fullsend-ai.workers.dev

Commit: df491ae2a1dba3175a1d35e20c4c1e98bcd6fc53

[fullsend-ai-review]

Review

Findings

High

• [logic-error] internal/repos/manifest.go:41 — DefaultPublicMintURL is set to "https://mint.fullsend.sh" while DefaultPerRepoMintURL (in internal/config/defaults.go) and DefaultMintURL (in internal/cli/admin.go) are set to the Cloud Run URL "https://fullsend-mint-gljhbkcloq-uc.a.run.app". These three constants represent the default hosted mint URL but now diverge. repos install via manifest in public mode will write FULLSEND_MINT_URL=https://mint.fullsend.sh, while github setup and admin install will write FULLSEND_MINT_URL=https://fullsend-mint-gljhbkcloq-uc.a.run.app. This causes repos status to report FULLSEND_MINT_URL drift between repos installed by different commands.
  Remediation: Unify all three constants to the same value. Either keep them all at "https://mint.fullsend.sh" or change them all to the Cloud Run URL.

• [scaffold-contract-breaking] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml — GitLab scaffold template no longer retrieves bot token from Secret Manager via OIDC/WIF. Existing WIF-mode GitLab repos will fail when scaffold is updated without first migrating the bot token to FULLSEND_FORGE_TOKEN CI/CD variable. The scaffold now unconditionally expects FULLSEND_FORGE_TOKEN as a protected CI/CD variable.
  Remediation: Document a migration path in release notes: (1) read bot token from Secret Manager, (2) store as protected+masked CI/CD variable FULLSEND_FORGE_TOKEN, (3) delete FULLSEND_CREDENTIAL_MODE, FULLSEND_BOT_TOKEN_SECRET, FULLSEND_SA, FULLSEND_WIF_PROVIDER variables, (4) upgrade scaffold. Alternatively, provide a migration command.

Medium

• [backward-compatibility] internal/repos/manifest.go — Existing repos.yaml manifests containing credential_mode at the forge level (GitHubForgeInfra/GitLabForgeInfra) or per-repo level will fail to parse with a hard error. At the forge level, KnownFields(true) rejects the removed field. At the per-repo level, the custom UnmarshalYAML returns an error for the unknown field. Users must remove credential_mode from their manifests before upgrading.
  Remediation: Add a migration path — silently ignore the removed field via a YAML tag or explicit handling in UnmarshalYAML that logs a deprecation warning and continues. Alternatively, document this as a breaking change requiring manifest editing before upgrade.

• [variable-contract] internal/repos/install.go — Inference secrets (FULLSEND_GCP_PROJECT_ID, FULLSEND_GCP_WIF_PROVIDER) are now required for all repos unconditionally. The prior contract allowed GitLab repos in token mode to omit these secrets. Existing token-mode GitLab repos without inference secrets will be flagged as incomplete installations during repos status checks.

Low

• [exported-type-field-removal] internal/repos/status.go — RepoStatus struct dropped CredentialMode and ExpectedCredentialMode fields, changing the JSON serialization shape of repos status output. Automation consuming these JSON keys will silently lose the data.

• [naming-consistency] internal/cli/admin.go:629 — The DefaultMintURL constant was changed to the Cloud Run URL but the comment still refers to "hosted public mint" without clarifying the URL type.

• [security-posture-degradation] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml:41 — Removing the WIF-mode bot token retrieval path eliminates defense-in-depth protection against CI_DEBUG_TRACE-based PAT exposure. The script-level guard is now the sole defense. ADR-0067's security table is updated to acknowledge this tradeoff.

• [incomplete-cleanup] internal/repos/uninstall.go — FULLSEND_CREDENTIAL_MODE was removed from the uninstall variable list. Repos previously installed with that variable will retain it as an orphaned CI/CD variable. Additionally, the Secret Manager cleanup path for WIF-mode bot tokens was removed — old WIF-mode GitLab repos will leave orphaned secrets in Secret Manager after uninstall.

• [scope-clarification] docs/cli/repos.md — Documentation implies inference is optional for GitLab but the code makes inference secrets unconditional in batch_install.go.

• [scaffold-contract-breaking] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-poll.yml — The id_tokens declaration (FULLSEND_ID_TOKEN with aud: fullsend) was removed. This was needed for WIF credential retrieval in existing WIF-mode installations. Covered by the migration path in the agent.yml finding above.

---

Labels: PR modifies repos install/manifest subsystem and scaffold templates with mint mode changes

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

Medium

• [exported-type-field-removal] internal/repos/status.go — The RepoStatus struct had CredentialMode and ExpectedCredentialMode fields removed, changing its JSON serialization shape (the credential_mode and expected_credential_mode JSON keys are dropped from repos status output). Automation consuming this JSON output that references these fields will silently lose the data.
  Remediation: If repos status JSON output is consumed by automation scripts or dashboards that reference credential_mode or expected_credential_mode, update them to stop expecting these fields.

• [manifest-schema-change] internal/repos/manifest.go — The YAML manifest schema changed: credential_mode at forge and per-repo levels is now silently ignored on read and dropped on write (not round-tripped). Existing manifests with credential_mode will parse without error but lose that field on re-serialization. A new mint_mode field was added controlling the default mint URL (public defaults to https://mint.fullsend.sh; private requires an explicit mint_url).
  Remediation: Document in release notes that credential_mode is ignored on read and dropped on write; existing manifests should be updated to remove credential_mode entries.

Low

• [yaml-manifest-compat] internal/repos/manifest.go:83 — Re-marshaling drops credential_mode at the RepoEntry level (not emitted by MarshalYAML), but at the forge level (GitHubForgeInfra, GitLabForgeInfra), the field is preserved via the struct's omitempty tag if non-empty, creating an inconsistency: forge-level credential_mode survives round-trip but per-repo credential_mode does not.
  Remediation: Document in migration guide that credential_mode is ignored on read and dropped on write; manifests should be updated to remove credential_mode.

• [security-posture-degradation] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml:41 — Removing the WIF-mode bot token retrieval path eliminates the defense-in-depth protection against CI_DEBUG_TRACE-based PAT exposure. The PAT is now always a CI/CD variable, meaning the CI_DEBUG_TRACE guard is the sole defense. ADR-0067's security table is updated to acknowledge this tradeoff.

• [scaffold-contract] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml — Existing WIF-mode GitLab repos will fail when scaffold is updated without first migrating the bot token to a FULLSEND_FORGE_TOKEN CI/CD variable. The scaffold now expects FULLSEND_FORGE_TOKEN and no longer retrieves the PAT from Secret Manager.
  Remediation: Document migration path in release notes: existing WIF-mode repos need bot PAT migrated from Secret Manager to FULLSEND_FORGE_TOKEN CI/CD variable before scaffold upgrade.

• [scaffold-contract] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-poll.yml — The poll template removed id_tokens declaration (FULLSEND_ID_TOKEN with aud: fullsend). This was previously needed for WIF credential retrieval. The agent template retains its id_tokens block for inference credential setup. This is correct for the new model.

• [incomplete-authorization] internal/repos/migrate.go — Issue fix: remove credential mode model, separate mint mode from inference requirements #6257 requires defaulting region to "global" when not discovered, but the production code still leaves inferenceRegion empty with a warning. The test comment in migrate_test.go was changed from "missing region" to "global region", which is misleading since the production behavior was not changed.
  Remediation: Either implement the "global" default or revert the test comment change to avoid implying the behavior changed.

• [scope-note] internal/repos/install.go — Inference secrets are now unconditional: repos without pre-existing secrets always require --inference-project. Previously, OIDC and token mode repos could install without it. This is authorized by the issue but is a breaking change for existing workflows.

• [exported-type-field-removal] internal/repos/manifest.go, internal/repos/install.go — Exported Go types (ResolvedConfig, RepoEntry, InstallConfig) had CredentialMode fields removed/replaced with MintMode. Exported constants (CredModeWIF, CredModeOIDC, CredModeToken) and functions (IsValidCredentialMode, ValidCredentialModesFor) were removed. All types live under internal/ — no external Go consumer can import them; all in-tree callers are updated.

Previous run (2)

Review

Findings

Low

• [security-posture-degradation] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml:41 — Removing the WIF-mode bot token retrieval path eliminates the defense-in-depth protection against CI_DEBUG_TRACE-based PAT exposure. Previously, WIF-mode repos stored the bot PAT in GCP Secret Manager (outside GitLab), so the PAT was not logged at job init even if CI_DEBUG_TRACE was enabled. Now the PAT is always a CI/CD variable, meaning the CI_DEBUG_TRACE guard is the sole defense. ADR-0067's security table is updated to acknowledge this tradeoff.

• [scaffold-contract] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml — Existing WIF-mode GitLab repos will fail when scaffold is updated without first migrating the bot token to a FULLSEND_FORGE_TOKEN CI/CD variable. The scaffold now expects FULLSEND_FORGE_TOKEN and no longer retrieves the PAT from Secret Manager.
  Remediation: Document migration path in release notes: existing WIF-mode repos need bot PAT migrated from Secret Manager to FULLSEND_FORGE_TOKEN CI/CD variable before scaffold upgrade.

• [yaml-manifest-compat] internal/repos/manifest.go — YAML manifests with credential_mode field are silently accepted but the value is ignored. Re-marshaling drops the field, causing round-trip data loss for tools that read and re-write manifests.
  Remediation: Document in migration guide that credential_mode is ignored on read and dropped on write; manifests should be updated to use mint_mode.

Previous run (3)

Review

Findings

Low

• [stale-comment] internal/repos/manifest.go:478 — The Validate function's doc comment says "mint_url is required when at least one repo resolves to forge: github" but the implementation now defaults mint_url to DefaultPublicMintURL for public mode (the default). mint_url is only required when mint_mode is "private".
  Remediation: Update the comment to reflect the new defaulting behavior.

• [scaffold-contract] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml — Existing repos installed with WIF mode retrieve bot PAT from Secret Manager; if scaffold is updated without first populating FULLSEND_FORGE_TOKEN as CI/CD variable, jobs will fail.
  Remediation: Document migration path in release notes: existing WIF-mode repos need bot PAT migrated from Secret Manager to FULLSEND_FORGE_TOKEN CI/CD variable before scaffold upgrade.

• [stale-doc] docs/guides/getting-started/operations.md:1721 — Stale uninstall instruction references "WIF-mode repos" and bot token Secret Manager secret cleanup. The credential mode model was removed in this PR.
  Remediation: Remove step 5 from the GitLab uninstall procedure.

---

Labels: PR modifies repos install/manifest subsystem, updates documentation, and fixes a bug in inference secret provisioning

Previous run (4)

Review

Findings

Critical

• [stale-reference] internal/cli/repos_gitlab_test.go:687 — TestSetupGitLabBotToken_WIFMode (6 subtests, lines 687–931) tests WIF behavior removed from setupGitLabBotToken. The production code now ignores the wifCfg parameter and always stores the bot PAT as a CI/CD variable via CreateRepoSecret. These tests pass non-nil wifCfg and assert Secret Manager calls (CreateSecret, AddSecretVersion, ReplaceSecretIAMBinding) and FULLSEND_BOT_TOKEN_SECRET creation — none of which execute anymore. Tests will fail.
  Remediation: Delete TestSetupGitLabBotToken_WIFMode and its subtests, or rewrite them to test the new unconditional CI/CD variable storage path.

Medium

• [breaking-change] internal/repos/manifest.go:66 — GitHubForgeInfra and GitLabForgeInfra structs had CredentialMode field removed, but parseManifestBytes uses KnownFields(true) at line 363. Existing manifests with credential_mode under forge.github or forge.gitlab will fail to parse as an unknown field. The per-repo level handles it via custom UnmarshalYAML (silently ignoring it), but forge-level structs are decoded by the standard YAML decoder.
  Remediation: Add CredentialMode back to GitHubForgeInfra and GitLabForgeInfra as an ignored field with yaml tag, matching the per-repo backward-compat handling.

• [logic-error] internal/repos/migrate.go:363 — "global" is not a valid Vertex AI region (valid examples: us-central1, europe-west4). Migration with missing region discovery will silently write "global" as FULLSEND_GCP_REGION, causing Vertex AI inference failures at runtime. Note: issue fix: remove credential mode model, separate mint mode from inference requirements #6257 explicitly specifies this default, so the finding may be dismissed if "global" has special meaning in this infrastructure.
  Remediation: Either keep the warning (original behavior) and skip setting InferenceRegion, or default to "global" but also emit a warning so the operator is aware.

• [stale-doc] docs/cli/repos.md:94 — Documentation about removed credential_mode concept: lines 94–113 describe modes (wif, oidc, token) with a table; line 146 describes FULLSEND_BOT_TOKEN_SECRET for WIF mode. All references are stale.
  Remediation: Remove credential mode documentation section and update GitLab bot token section.

• [stale-doc] docs/guides/getting-started/repo-management.md — Getting started guide documents credential_mode as a user-facing config option with YAML examples and describes "Partial secret state (WIF mode)". All stale.
  Remediation: Remove credential modes section and update prerequisites.

Low

• [stale-doc] docs/ADRs/0067-gitlab-cron-polling-event-dispatch.md — ADR references FULLSEND_CREDENTIAL_MODE and describes WIF/token mode retrieval paths. ADRs are historical documents; a note at the top may be more appropriate than rewriting.

• [fail-open] internal/repos/install.go:203 — Install proceeds without error when InferenceProject is empty and ReuseSecrets is false, writing no inference secrets. Upstream callers enforce this, but Install itself is not fail-closed despite the comment saying secrets are "always required."

• [dead-code] internal/cli/repos_gitlab.go:70 — setupGitLabBotToken still accepts wifCfg parameter. botTokenWIFConfig, botTokenSecretID(), legacyBotTokenSecretID(), storeSecretManagerToken() are retained but never called.

• [stale-comment] internal/repos/install.go:243 — Step 6 comment says "GitLab writes secrets only when inference is configured (WIF mode)" — the "(WIF mode)" parenthetical references the removed model.

• [scaffold-contract] internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml — Existing repos installed with WIF mode retrieve bot PAT from Secret Manager; if scaffold is updated without first populating FULLSEND_FORGE_TOKEN as CI/CD variable, jobs will fail. Document migration path in release notes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[ggallen]

All review findings have been addressed in the squashed commit:

Critical

• repos_gitlab_test.go:687 — stale-reference: Deleted TestSetupGitLabBotToken_WIFMode (6 subtests) and TestStoreSecretManagerToken (5 subtests) — both tested removed WIF behavior.

Medium

• manifest.go:66 — breaking-change: Added CredentialMode string field with yaml:"credential_mode,omitempty" tag to both GitHubForgeInfra and GitLabForgeInfra structs, matching the per-repo backward-compat handling.
• migrate.go:363 — logic-error: Added a warning via progress() when defaulting to "global" — "'global' is not a standard Vertex AI region; consider setting --inference-region explicitly". Default kept for consistency with admin.go:596.
• Docs — stale credential mode content: Removed credential mode documentation from docs/cli/repos.md (lines 94–113, line 146) and docs/guides/getting-started/repo-management.md (lines 22, 99–133, 172–176, 377–382). Simplified ADR-0067 credential model section.

Low

• repos_gitlab.go:70 — dead-code: Removed botTokenWIFConfig struct, storeSecretManagerToken(), and wifCfg *botTokenWIFConfig parameter from setupGitLabBotToken. Updated caller in repos.go:767 and all test callers to remove the nil argument. Kept botTokenSecretID(), legacyBotTokenSecretID(), and cleanupGitLabBotTokenSecret() — these are still called from repos.go:1156 during uninstall for cleanup of pre-existing Secret Manager secrets.
• install.go:243 — stale-comment: Removed "(WIF mode)" from the Step 6 comment.
• install.go:203 — fail-open: Acknowledged — upstream callers validate, no change needed.

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 2:38 PM UTC · Ended 2:57 PM UTC

Commit: a666a40 · View workflow run →

[codecov]

Codecov Report

❌ Patch coverage is 93.13725% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/repos/manifest.go	90.24%	2 Missing and 2 partials ⚠️
internal/repos/install.go	75.00%	1 Missing and 1 partial ⚠️
internal/cli/repos.go	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:38 PM UTC · Completed 2:57 PM UTC

Commit: a666a40 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:06 PM UTC · Completed 3:21 PM UTC

Commit: cc5c97d · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:29 PM UTC · Completed 8:50 PM UTC

Commit: 1a687ab · View workflow run →

[ggallen]

Response to review findings on 1a687ab

Context: no breaking changes

The repos command suite is unreleased — there are no external consumers, no deployed manifests, and no automation consuming the JSON output. All exported types live under internal/ and cannot be imported by third-party Go code.

Medium findings

• [exported-type-field-removal] status.go — RepoStatus dropped CredentialMode/ExpectedCredentialMode. Acknowledged. No automation consumes this JSON since repos is unreleased.
• [manifest-schema-change] manifest.go — credential_mode silently ignored, mint_mode added. Acknowledged. No production manifests exist. Will document in release notes when repos ships.

Low findings

• [yaml-manifest-compat] — Forge-level credential_mode survives round-trip but per-repo doesn't. Will fix for consistency (clear forge-level after parsing).
• [security-posture-degradation] — No WIF-mode installs have ever been deployed. This is dead code removal, not a security regression.
• [scaffold-contract] (agent.yml) — No WIF-mode repos exist. No migration path needed.
• [scaffold-contract] (poll.yml) — Informational, id_tokens removal is correct for the new model.
• [incomplete-authorization] migrate.go — Test comment says "global region" but production warns about missing region. Will fix the misleading comment.
• [scope-note] — Inference secrets unconditional by design. Repos is unreleased, no existing workflows to break.
• [exported-type-field-removal] (manifest.go, install.go) — All under internal/, no external consumers.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:26 PM UTC · Completed 10:45 PM UTC

Commit: 842d15e · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

---

Note: The following inline comments could not be posted on the diff (GitHub returned 422) and are included here instead:

• internal/repos/manifest.go:41: [high] logic-error

DefaultPublicMintURL is set to "https://mint.fullsend.sh" while DefaultPerRepoMintURL (in internal/config/defaults.go) and DefaultMintURL (in internal/cli/admin.go) are set to the Cloud Run URL "https://fullsend-mint-gljhbkcloq-uc.a.run.app". These three constants represent the default hosted mint URL but now diverge. repos install via manifest in public mode will write FULLSEND_MINT_URL=https://mint.fullsend.sh, while github setup and admin install will write FULLSEND_MINT_URL=https://fullsend-mint-gljhbkcloq-uc.a.run.app. This causes repos status to report FULLSEND_MINT_URL drift between repos installed by different commands.

Suggested fix: Unify all three constants to the same value. Either keep them all at "https://mint.fullsend.sh" or change them all to the Cloud Run URL.

• internal/cli/admin.go (file-level): Line 629 · [low] naming-consistency

DefaultMintURL constant changed to Cloud Run URL but comment still refers to hosted public mint without clarifying the URL type.

• internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml:41: [low] security-posture-degradation

Removing WIF-mode bot token retrieval eliminates defense-in-depth against CI_DEBUG_TRACE PAT exposure. Script-level guard is now the sole defense. ADR-0067 updated to acknowledge tradeoff.

[ggallen]

Review findings evaluation — 842d15e

Not actionable (repos is UNRELEASED — no breaking changes, no deployed installs):

Severity	Finding	Reason
HIGH	DefaultPublicMintURL vs DefaultPerRepoMintURL divergence	Intentional architecture. Three constants serve different subsystems: DefaultPublicMintURL (repos manifest public mode → mint.fullsend.sh), DefaultPerRepoMintURL (per-repo config system → Cloud Run), DefaultMintURL (admin CLI → Cloud Run). Already discussed in prior review round.
HIGH	GitLab scaffold contract break	No existing WIF-mode GitLab installs exist — repos is unreleased.
MEDIUM	credential_mode backward compatibility	No existing manifests contain credential_mode — repos is unreleased.
MEDIUM	Inference secrets unconditional	No existing token-mode GitLab installs — repos is unreleased.
LOW	RepoStatus field removal	Internal type, no external consumers — repos is unreleased.
LOW	WIF security posture degradation	Acknowledged design decision per ADR-0067 security table update.
LOW	Orphaned FULLSEND_CREDENTIAL_MODE variable	No installs ever created this variable — repos is unreleased.
LOW	poll.yml id_tokens removal	Same as scaffold contract — no existing installs.
LOW	docs/cli/repos.md scope clarification	Checked — docs do not imply inference is optional for GitLab. False positive.

Fixed:

Severity	Finding	Fix
LOW	DefaultMintURL comment says "hosted public mint" but value is Cloud Run URL	Updated comment and flag description to say "hosted Cloud Run mint".

All findings evaluated — not actionable. repos is unreleased (no backward compatibility concerns, no deployed installs, no token-mode GitLab repos). DefaultPublicMintURL vs DefaultPerRepoMintURL divergence is intentional architecture. See evaluation: #6258 (comment)

[fullsend-ai-review]

🤖 Review · Started 10:54 PM UTC

Commit: df491ae · View workflow run →