gh-api-readonly and ruff-autofix are the default cloud-runnable ids within the disabled device-hooks path.
What
Instead of calling back to your machine, a matching hook can be uploaded and run inside the cloud session. When the caller names no list, the ids permitted to do that default to gh-api-readonly and ruff-autofix; anything else falls back to running on your machine with a notice.
Details
- A digest mismatch, a legacy copy, a matcher that does not match, or two consecutive "awaiting upload" results each demote a template back to local execution.
- Behind the same device-hooks gate that is off in this build.
Evidence
is not run in the cloud in this version; it runs on this machine instead.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.