Free Provider Access Work Package
Goal: prove that an agent can reach each candidate service with read-only or low-impact calls before JobCache architecture depends on it.
Rules
- Read credentials only from
~/.agent/secrets/*.ymlwithsops. - Never print secrets, write them to repo files, commit them, or include them in logs.
- Prefer read-only profile/list endpoints.
- Do not build, deploy, create paid resources, or connect a payment method during access checks.
- Do not put Cockroach, B2, R2, S3, Browserbase, Firecrawl, or other provider
credentials into hosted worker environments. Hosted Devices receive only
JOBCACHE_API_URLandJOBCACHE_CONTROL_TOKEN.
Access matrix
| Provider | Local credential | Local CLI | First access check | Status |
|---|---|---|---|---|
| GitHub | keyring via gh |
gh |
gh auth status --hostname github.com |
proven: authenticated as julian-corbet |
| Back4App Containers/BaaS | ~/.agent/secrets/back4app.yml |
none found | Confirm dashboard/API access, list BaaS apps and container apps if API endpoint is available | pending; strict permanent-free candidate |
| Hugging Face | ~/.agent/secrets/huggingface.yml |
hf, huggingface-cli |
Call whoami-v2, then list Spaces owned by the account |
pending |
| Render | ~/.agent/secrets/render.yml |
none found | GET /v1/services?limit=1 with bearer token |
pending |
| Koyeb | ~/.agent/secrets/koyeb.yml |
none found | Optional read-only app/service list only | not candidate capacity; free slot belongs to Typst |
| Google Cloud Run | ~/.agent/secrets/google-cloud.yml, gcloud login |
gcloud |
No worker deployment; read-only budget/project check only | discipline-required, not default pool |
| Azure Container Apps | ~/.agent/secrets/azure.yml |
az |
No worker deployment; read-only account/budget check only | discipline-required, not default pool |
| IBM Code Engine | missing | none found | No access check until credential exists | discipline-required, not default pool |
| Northflank | missing | none found | No access check until no-bill account is proven | discipline-required, not default pool |
| Zeabur | missing | none found | No access check until no-bill account is proven | discipline-required, not default pool |
Deliverables
- Access evidence table with timestamp, endpoint/command, and result class
(
ok,auth-missing,quota-risk,manual-login-needed,not-candidate). - No secret values in command output or docs.
- Provider shortlist for architecture:
- baseline hosted Device
- planner tick host
- burst/manual worker
Architecture gate
Do not start architecture work until the access package answers:
- Which providers can the agent operate without manual browser steps?
- Which providers can run Docker from GitHub or GHCR?
- Which providers are unpaid-free without usage overage?
- Which providers can run one-shot jobs versus long-running services?
- Which providers expose enough logs/metrics for a Device runbook?
Strict permanent-free candidates to prove first:
- Back4App Containers
- Back4App BaaS Cloud Code Job
- Hugging Face Spaces
- CircleCI
jobcache_planner/ bounded runner jobs oncorbet/unraid - Existing Render free service, only as last resort
Discipline-required providers are a second work package. Do not deploy workers there until the access package proves budget alarms, scale-to-zero, a kill switch, and no accidental paid side resources.