Aether Actions

Hosted execution, GitHub automation, and Predator Security are now live. Repositories can run Build & Test and Predator Security against exact GitHub revisions, return results through GitHub Checks, and execute on Aether-hosted infrastructure under bounded UVT authorization.

By Brandon Barrante, Aether AI · Published August 2026 · Part of the Aether research and technical papers

Aether Hosted Build & Test

Run project-defined build and test workflows on Aether-hosted infrastructure.

Actions binds execution to the requested repository and Git revision, creates a durable run, reserves the authorized compute budget, leases execution to an Aether worker, and returns the resulting state and artifacts through Aether.

Invalid or incomplete project configuration fails before execution rather than being treated as a failed test. A repository without the required .aether-ci.yml is returned as:

Predator Security

Predator Security is now available as a first-class Aether Action.

Unlike a configurable repository scanner, Predator executes a locked, server-owned security operation against the exact repository revision. The production release verifies five behavioral security boundaries:

• Authorization boundaries — one user cannot reach another user's protected resources, including prefix-confusion and missing-identity cases.
• Filesystem containment — requested paths cannot escape approved roots through traversal, absolute paths, sibling prefixes, or platform-specific path behavior.
• Command execution — untrusted input cannot reach dangerous command dispatch; shell and path-lookup bypasses are rejected before execution.
• Outbound URL / SSRF protection — unsafe schemes, hosts, credentials, redirects, local addresses, and parser-confusion inputs are rejected before a request is made.
• Cloud execution and usage authorization — identity, entitlement, pricing preflight, and provider dispatch occur in the required order; unauthorized calls reach neither billing nor the provider.

The repository cannot replace Predator's route set, executor, commands, environment, or verdict mechanism. Predator runs inside a qualified immutable executor, receives a read-only source projection, produces a sealed report, and projects the final result back to GitHub.

A successful production run appears directly as:

GitHub-native automation

Aether Actions supports real GitHub-triggered execution. Repository owners choose which automation is enabled:

• Build & Test on pull requests
• Predator Security on pull requests
• supported push automation
• maximum UVT authorized per run

GitHub repository access alone does not authorize compute spending. A repository must explicitly enable Aether Actions and establish its execution ceiling before premium automation can run. This separates:

Bounded UVT execution

Hosted Actions use an explicit reserve → execute → settle model. Before execution, Aether establishes the maximum authorized UVT for the run. After execution, actual verified usage is captured and everything unused is released. The reservation is never treated as the final charge.

This applies across successful runs, failures, and cancellations.

Production proof

The release was qualified through the real production control plane, GitHub integration, billing layer, and worker fleet — not a staging copy of any of them.

Across 7 billed production canary runs:

The qualification set included successful execution, an unavailable execution slot, cancellation mid-run, and a worker interrupted mid-run. There were 0 orphan worker leases and no observed double settlement in the completed production set. Re-delivering the same GitHub event created no duplicate run, no duplicate reservation, and no second charge.

One real Predator execution

A production GitHub delivery for commit 326dea331fc561d194f2307b8ddc7b70bbfff0b3 completed the full path:

Final billing for that run:

The 51,300 UVT charge represents the verified execution the worker actually performed — not the original maximum reservation.

Durable execution

Actions runs are not transient CI requests. A hosted execution has durable state across ActionRun creation, worker leasing, execution attempts, events, source projection, artifacts, billing state, cancellation, terminal settlement, and GitHub synchronization.

This lets Aether distinguish between execution failure, project configuration failure, infrastructure failure, security findings, cancellation, and billing refusal — instead of collapsing them into one generic red state. An execution slot that never becomes available reports itself as infrastructure, releases the entire reservation, and charges nothing. A cancelled run reads canceled, not failed. A missing config reads configuration, not a broken build.

Verified artifacts

Predator's result is bound to the qualified production executor and the exact run that produced it. The release uses:

• exact Git repository revision
• qualified immutable executor image
• fixed Predator route catalog
• read-only source projection
• trusted verdict generation
• digest-bound report artifacts
• server-owned settlement
• GitHub Check projection

A repository process cannot write its own successful Predator verdict.

Release state

• Aether Actions hosted execution is live.
• Predator Security production execution is live.
• GitHub-triggered Actions are live for repositories that explicitly enable automation and authorize their per-run UVT ceiling.

Production qualification covers the execution, GitHub delivery, worker, Predator, artifact, and UVT reserve/capture/release paths.

Aether Actions

Build. Test. Verify. Ship.

One execution plane from repository event to verified result.