The allowlist gating which hosts the CI smoke test and gallery fetcher are allowed to execute a ref against exists independently in both scripts plus a prose list in references/live-fetch.md.
Since this list is a real security control and not just documentation, deriving it from code_libraries[] instead of hand-maintaining three copies would remove a class of "forgot to update one of them" gap.
The allowlist gating which hosts the CI smoke test and gallery fetcher are allowed to execute a
refagainst exists independently in both scripts plus a prose list in references/live-fetch.md.Since this list is a real security control and not just documentation, deriving it from
code_libraries[]instead of hand-maintaining three copies would remove a class of "forgot to update one of them" gap.