[ksteffe]

Description

Contribute the PADE Coder module to the community after-certainty Registry namespace, now synchronized with the source module's PADE v0.4.1 default, verified installer behavior, and trusted downstream bindings support.

PADE is a portable development-session capability intent/Consumer model. A Coder workspace gets the released PADE CLI and a local provider: broker binding, and PADE uses runtime workload identity (not the Coder agent token) to request broker-authorized, scoped capabilities.

• Default CLI: PADE v0.4.1, installed from the published release with SHA256SUMS verification. Templates explicitly pinning an older version retain their choice.
• Static mode: broker_capabilities binds only the named broker capabilities, without provider secrets in the workspace or Terraform module configuration.
• Optional dynamic mode: omitting broker_capabilities produces an empty, fail-closed bindings map until a separate trusted downstream integration validates inputs and writes a complete authorized mapping. The installer clears stale dynamic bindings even when a later installation step fails. This is configuration, not an authorization grant.
• Coder lifecycle: uses the existing coder-utils module v0.0.2 for install script orchestration; exports scripts for dependency sync. Does not deploy or change the PADE broker, its policy, or the Runtime Conditions adapter.
• Supported platforms: Linux amd64/arm64; GCE or Cursor identity adapters where supported by PADE, with explicit limits on what was actually dogfooded.

Compatibility and evidence

The historical GCE-backed Coder dogfood used PADE v0.3.0, Linux amd64, the GCE metadata identity provider, and broker-authorized github.repo.read. These historical observations are not represented as v0.4.1 results.

The PADE v0.4.1 installation, version handling, bindings, failure boundaries and checksums have automated coverage; live GCE/broker v0.4.1 validation is still pending.

Security boundaries: RC demand is not a broker grant; Coder credentials are not substituted for PADE workload identity. A child that receives temporary material may still copy it; PADE's output redaction does not form a security boundary. Keep the broker authorization and downstream IAM restricted.

Type of Change

• New module (namespace after-certainty)

Path: registry/after-certainty/modules/pade
Proposed module version: v1.0.0
Breaking change: No (new contribution)

Validation (current Registry base)

The fork was fast-forwarded to the latest upstream coder/registry:main (2026-10-27; validated 2026-10-28), and the contribution branch now includes that upstream base without a force push.

• CI: Terraform validation/tests and Bun installer tests; formatting, shell and typo checks (fork CI run).
• golangci-lint: passed (fork Go lint run).
• README/frontmatter/namespace validator: passed on latest fork CI (including Registry's one-Terraform-example-per-h1 rule).
• Module scorecard: unavailable in the fork because SCORECARD_CODER_TOKEN is not present (fork scorecard run). No score is claimed; Coder maintainers can run it with upstream credentials.

A temporary fork-only validation PR was opened solely to exercise the unmodified Registry workflows; no upstream CI/quality gate has been disabled.

Related Issues

None.

---

AI-assisted with OpenAI Codex / ChatGPT.

[ksteffe]

Hi Coder Registry maintainers! I wanted to follow up on this PADE module contribution and see whether someone would be available to review it.

I’ve updated the branch against the latest upstream main, brought the module to PADE v0.4.1, and verified that the Registry’s CI, Terraform tests, installer tests, linting, and README validation all pass.

The only outstanding check is the module scorecard, which requires a Coder-owned token unavailable in my fork.

Happy to address any feedback or changes needed to get this ready for inclusion. Thanks!