10000app
10000app #0108 · PMF pre-judgment 86/100 · $15 one-time evidence pack under strong GitHub, cloud IAM and IaC substitutes

The repository moved.
Will cloud trust still match?

Map sanitized trust aliases before a repository is created, opted in, renamed or transferred. Tie the expected subject format to audience, scope, cloud condition, minimum workflow permission, a non-production test and rollback—without pasting a JWT, repository ID, role or policy.

Map 3 trust records locally核对依据
Free · browser-only

OIDC trust migration map

Migration gateADD SANITIZED RECORDS
Valid / invalid / duplicate0 / 0 / 0
Recorded / review / cannot tell0 / 0 / 0
Subject / audience gaps0 / 0
Scope / trust gaps0 / 0
Permission / test / rollback gaps0 / 0 / 0
Boundary fixtures0 / 10
Trust aliasLifecycle / subjectAudience / scopeCloud conditionPermission / test / rollbackEvidence / ownerDecision / result

Trust change, test and rollback queue

    “Evidence recorded” proves only coherent abstract metadata. This page did not read a JWT, repository, workflow, cloud role or policy; calculate effective permissions; generate deployable IAM; run a login; change trust; deploy; certify access; or guarantee a migration.

    Zero-credential boundary: all free analysis stays in this browser. Enter only fictional aliases, enumerated states and safe evidence references. Never paste a real organization or repository name, owner/repository ID, GitHub URL, JWT, OIDC response, workflow, role ARN, trust policy, account, tenant/project, token, credential, cloud log or personal data. This page does not parse claims, discover effective access, generate IAM, connect to GitHub or a cloud, deploy a change or certify security. Authorized GitHub, cloud-security and platform owners control every real policy, test, rollback and release decision.

    Source ledger

    Current GitHub OIDC behavior and native control planes

    PMF pre-judgment 86/100 · $15 one-time evidence pack under strong GitHub, cloud IAM and IaC substitutes

    GitHub Actions · OpenID Connect referenceGitHub documents aud/sub claims and the July 15, 2026 immutable default subject for new repositories and later rename/transfer events; actual claim and cloud policy remain authoritative.GitHub Actions · OIDC security conceptOIDC exchanges short-lived cloud access and requires the cloud trust relationship to validate claims; this tool only maps a human review.GitHub Actions · OIDC in cloud providersGitHub and each provider's IAM/IaC are the strong native execution systems; this page neither replaces nor configures them.