Scaffold fullsend-vertex-ai profile allows uninspected credentials on api.anthropic.com; the fleet profile does not

[waynesun09]

What happened

While building the reference example for #6966 (fullsend-ai/agents#1167), the example's profiles/fullsend-vertex-ai.yaml — copied verbatim by fullsend agent new from the embedded scaffold — was compared byte-for-byte against the fleet's profiles/fullsend-vertex-ai.yaml in fullsend-ai/agents. They differ:

Endpoint / field	fullsend scaffold (internal/scaffold/fullsend-repo/profiles/fullsend-vertex-ai.yaml)	fleet (fullsend-ai/agents profiles/fullsend-vertex-ai.yaml)
api.anthropic.com	enforce, allow_uninspected_credentials: true	enforce, no allow_uninspected_credentials
*.googleapis.com	enforce, allow_uninspected_credentials: true	same (with the rationale comment citing NVIDIA/OpenShell#2904, #6716, #6695 / ADR 0092)
binaries	claude, node	claude, claude.exe, pi, node

So the scaffold copy is wider on api.anthropic.com (uninspected credentials allowed where the fleet decided they were not needed) and narrower on binaries (no pi, so a runtime: pi agent using the scaffold profile fails at egress). The per-repo install does not vendor profiles/ (see #6834 for the sibling policies/ gap), so this copy reaches users through fullsend agent new and through the CI workspace-preparation layer.

What should happen

One source of truth for the built-in profiles. Either the scaffold copy is updated to the fleet version (and the rationale comment travels with it), or the fleet profile is derived from the scaffold at release time. In the meantime the agent new reference example deliberately keeps the scaffold's bytes so the drift stays visible rather than being hand-patched in one place.

Found in review of fullsend-ai/agents#1167 (Qodo thread; note that thread's description has the direction inverted). Related: #6834, #6966.

[waynesun09]

Note from the comparison: the binaries half of the drift is probably the more consequential one. The scaffold profile allows only claude and node; the fleet profile also allows claude.exe and pi. A repo that opts into runtime: pi and gets its Vertex profile from the scaffold (which is what fullsend agent new copies and what the CI workspace-preparation layer ships) will fail at egress on the pi binary before the credentials flag ever matters.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 5:31 PM UTC · Completed 5:35 PM UTC

Commit: 48eac1a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.58

[fullsend-ai-triage]

This issue describes the same scaffold-vs-fleet profile drift tracked in #6978, which covers both the Vertex AI allow_uninspected_credentials scope difference and the package-registries drift, and proposes a lint check to prevent future drift. The binaries gap (missing claude.exe and pi) is separately tracked in #6971, with PR #6975 open to fix it.

Closing as duplicate of #6978 — the detail in the comparison table here is valuable context and will be referenced from there.

---

Labels: Scaffold profile drift is a sandbox maintenance concern matching the canonical issue's labels.

[waynesun09]

Scope narrowed: the binaries half of this drift (claude.exe, pi missing from the scaffold profile) is already tracked in #6971 and fixed by #6975. What remains here is the credentials half: the scaffold copy sets allow_uninspected_credentials: true on api.anthropic.com while the fleet profile in fullsend-ai/agents does not, and the *.googleapis.com rationale comment does not travel with the scaffold copy. Once #6975 lands, a follow-up should reconcile that flag (and decide which file is the source of truth) so fullsend agent new and the CI workspace layer ship the same profile the fleet runs.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 5:49 PM UTC · Completed 5:52 PM UTC

Commit: 48eac1a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.58