real development verification, 2026-10-28
main: c677d5fc45 (github/main)
pr: ad56e4719f9ae47c5458eff50b98fcb68fb26026

playwright + /usr/bin/google-chrome; no intercepted responses or mocked services.
empty isolated development databases; projects and codex gpt-6.1-sol turns created through web ui.

browser session -> POST /api/auth/websocket-ticket -> /ws?orchestrationProtocol=2 -> assets.createUrl -> GET signed /api/assets/...

existing private release asset (ordinary tag)
main: AssetGitHubMediaUrlValidationError
pr: http 200, image/gif, 2554314 bytes, sha256 baf693ab54fe4e0cc2603b213e7f56f48c1ced3320fdf968e0df105e2426565f

existing private release asset (encoded slash and # tag)
main: AssetGitHubMediaUrlValidationError
pr: http 200, image/gif, 17563 bytes, sha256 8f16b4815863f2a113d39212881e60173a0664c049642274fa251c13a3bebe0b

existing private raw repository image
main: http 200, image/png, 3421 bytes, sha256 7f9bc7a63536a2af1e7a481364de95c072aae7bc411dd7080dcbe99bc99075fa
pr: http 200, image/png, 3421 bytes, sha256 7f9bc7a63536a2af1e7a481364de95c072aae7bc411dd7080dcbe99bc99075fa

both private release images decode at 480x480 through the real server.
release byte counts and sha256 match live github release asset metadata.
private raw image bytes remain identical on both heads.

public pr description #19703: main fetches release images directly; pr fetches via /api/assets.
pr public release image decodes at 3090x1876; adjacent github user-attachment image at 2560px wide.
image gallery open, next image, escape exercised in real web ui.
codex gpt-6.1-sol on both heads executed pwd and git rev-parse --is-inside-work-tree successfully.

blacksmith: vp test run packages/source-control-github/src/server/gitHubMediaFetch.test.ts packages/source-control-github/src/shared/definition.test.ts
14 tests passed, 2 files passed.

unverified: private release image embedded in a live private pr description; native desktop/mobile; remote relay/tunnel; live anonymous fallback without github credentials.
private contents, signed URLs, and credentials omitted.