Provider I/O is Buzz

A CI or VCS provider (GitHub, GitLab, ...) is reached only by a Buzz op magus invokes (a provider spell, the queue's own provider script, a hack/ driver script, or a workflow action step), which names the act and reports host and elapsed on the line. Go opens no provider socket of its own; it calls the Buzz op through bindings and reads the record back, the shape review_spell.go and the queue's own Buzz host module already take. The console reaches nothing but its own daemon, which its CSP enforces at runtime.

The failure this prevents is environment sniffing's shape from the other side: a "quick fetch" landing in Go, or in a Buzz file nobody meant to carry one, stays invisible until the day the credential it silently depended on is missing or wrong, by which point it is load-bearing.

Enforced by

• providerio in libs/conventions fails a net/http client or a provider SDK import outside a reasoned allowlist.
• provider-io-is-buzz in hack/lint/run.buzz fails a real gh, curl or http call at a provider host from a Buzz file outside the ones named above.
• The console's CSP allows only its own daemon.

Good

The provider call lives in a Buzz op that names the act, and Go reads the record it returns.

provider spell op -> host and elapsed on the line -> typed record back to Go

Bad

resp, err := http.Get("https://api.github.com/repos/" + repo + "/pulls")

A fetch in Go depends on a token nobody declared, reports nothing on the line, and fails far from the change that added it.

See also

• Told, never guessed
• Providers
• ADR 0011