DL-547
Every Compass image (agent, runner, server, guest image, gateway) is public, renderers emit no imagePullSecrets, every registry read in the publish, index and release tooling is anonymous and credentials are used only for the write destination, except the pre-push probe of the tag a push is about to write, which is part of the write and uses the login file because GHCR answers an anonymous probe of a package that does not exist yet with 403, and each publish job fails when its package is not public, because no GitHub API sets package visibility.
Status: Active (Matt, 2026-10-17)