Why this is a conversation
An assurance profile is not a config file you fill in. It names the routes that get replayed, the catalog each one references, the source surface that must be present, and the evidence a clean run produces. Aether authors that, because it is the security boundary: if a repository could define its own routes, a passing result would mean whatever the repository wanted it to mean.
The production profile — 5 routes, 54 checks against the AetherCloud backend surface — took real work to qualify. Yours would too. That is the honest reason there is no button here.
What we would need from you
- The repository, and who owns it
- The exact repository, and confirmation you are authorised to have it verified. Predator runs only against code its owner asked us to run against.
- The surface that matters
- Which part of the codebase carries the security boundary — the request handlers, the auth layer, the file and command paths. A profile verifies a defined surface, not a whole repository.
- What a violation would mean to you
- The guarantees you actually rely on. A route is only worth registering if its failure would be a real incident for you, not a lint finding.
- How the code is reached
- Runtime shape and entry points — enough to build probes that exercise the real guard rather than a mock of it.
None of this needs credentials, a token, or production access. If a conversation ever seems to be heading toward you handing over a secret, stop — that is not how this works.
What we are not promising
- We will not give you a date. Profiles are authored and qualified by hand, and inventing a timeline to be polite helps nobody.
- Some repositories cannot get a profile at all. Certain surfaces cannot be probed safely or meaningfully, and we would rather say so than ship one that verifies nothing.
- There is no self-serve onboarding. No form ends in a working profile today.
- A profile does not make your code secure. It verifies specific registered routes at one exact commit — the same limit that applies to the AetherCloud profile applies to yours.
A separate path while you wait
Aether Hosted Build & Test is a separate product and needs no assurance profile. It runs your project's own configured checks against an exact commit, with the same quote and the same explicit spend ceiling when hosted execution is available for that repository. Availability is controlled by the deployment, so Aether Actions shows whether the path is available rather than assuming every repository is open.