From b51d17450035f12e70dced164ff9d8cc858ac8ba Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 6 Sep 2026 23:32:19 +0200 Subject: [PATCH] Pin published approval-engine release candidate Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- deploy/approval-engine.yaml | 4 ++-- docs/image-scan-2026-09-06.md | 15 +++++++++++++++ ...-production-readiness-and-consumer-adoption.md | 15 +++++++++++++++ 3 files changed, 32 insertions(+), 2 deletions(-) diff --git a/deploy/approval-engine.yaml b/deploy/approval-engine.yaml index 3a549ae..839e976 100644 --- a/deploy/approval-engine.yaml +++ b/deploy/approval-engine.yaml @@ -42,7 +42,7 @@ spec: seccompProfile: {type: RuntimeDefault} initContainers: - name: migrate - image: forgejo.coulomb.social/coulomb/approval-engine@sha256:REPLACE_WITH_RELEASE_DIGEST + image: forgejo.coulomb.social/coulomb/approval-engine@sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d args: ["migrate", "--db", "/data/approvals.sqlite"] securityContext: allowPrivilegeEscalation: false @@ -53,7 +53,7 @@ spec: - {name: tmp, mountPath: /tmp} containers: - name: approval-engine - image: forgejo.coulomb.social/coulomb/approval-engine@sha256:REPLACE_WITH_RELEASE_DIGEST + image: forgejo.coulomb.social/coulomb/approval-engine@sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d args: - serve - --production diff --git a/docs/image-scan-2026-09-06.md b/docs/image-scan-2026-09-06.md index 38a26b3..2919e9f 100644 --- a/docs/image-scan-2026-09-06.md +++ b/docs/image-scan-2026-09-06.md @@ -172,3 +172,18 @@ docker inspect --format '{{index .RepoDigests 0}}' \ Then pin both `image:` references in `deploy/approval-engine.yaml` to that digest. Rollout, restart and restore evidence remain gated on the KeyCape registrations and the audit sender credential, which are still unmaterialized. + + +## Registry publication — 2026-09-06, Glas deployment session + +The previously blocked push succeeded under the operator's standing production +deployment authorization. Registry tag `0.1.0` resolves to OCI index digest +`sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d`. +The linux/amd64 image manifest is +`sha256:2064d5378e01801ecf9966ccec9c93aadd16d6b404ef4890983d89fa738c164c`. +Both deployment images now pin the registry index digest, verified remotely +following publication. Its equality to the earlier local image identifier is +not the evidence of publication; the successful push and remote index lookup are. + +No StatefulSet rollout yet: live KeyCape registrations and audit sender/token +admission remain outstanding. APPROVAL-WP-0002-T03 stays wait for those gates. diff --git a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md index becfcfa..0ee849d 100644 --- a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md +++ b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md @@ -419,3 +419,18 @@ claim/store comparison requires an owner-consistent choice before activation. Do not substitute guessed values or start production without audit delivery. The secrets-engine PDP was independently deployed by FLEX-WP-0021-T04; this does not satisfy approval service readiness. + + +## Registry publication — 2026-09-06, Glas deployment session + +The previously blocked push succeeded under the operator's standing production +deployment authorization. Registry tag `0.1.0` resolves to OCI index digest +`sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d`. +The linux/amd64 image manifest is +`sha256:2064d5378e01801ecf9966ccec9c93aadd16d6b404ef4890983d89fa738c164c`. +Both deployment images now pin the registry index digest, verified remotely +following publication. Its equality to the earlier local image identifier is +not the evidence of publication; the successful push and remote index lookup are. + +No StatefulSet rollout yet: live KeyCape registrations and audit sender/token +admission remain outstanding. APPROVAL-WP-0002-T03 stays wait for those gates.