rapp-playwright/docs/evidence/2026-10-13-publication.md

Forgejo image publication fixed — 2026-10-13

Release 0.1.0 is published and pullable on railiance01. Its immutable reference:

forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441

The fetched OCI index bytes hash to exactly that digest, matching the image previously tested by the independent agent. The linux/amd64 manifest is sha256:20d8310d44cd807579aca06df01090a7bb27892ce387519f9957e4dd67f64cc7; cluster pull resolved the expected config sha256:5bda1139fda091648b1e984f6be8119291ad5616263b206d62ac7986ba2762b3. This publication did not rebuild or alter the browser image and did not deploy the browser workload.

Cause and fix

The previous HTTP 499/500 responses were caused by the shared Traefik ingress cutting off large request bodies at its default 60-second read deadline. Forgejo reported unexpected EOF; retries of those interrupted sessions could report offset mismatch between file and model. Authentication and smaller blobs succeeded. Forgejo had no restarts and approximately 130GiB disk available.

The approved fix declares a bounded 600-second read timeout on the shared websecure entry point through a k3s HelmChartConfig. This setting covers HTTPS request bodies for all services on that entry point. Other timeouts, TLS and registry authentication remain unchanged. Source is owned by railiance-cluster: install/traefik/railiance01-helmchartconfig.yaml, initial published commit bad08fd712bded4aefe011d2cdad1f50ade8c43e, workplan RCLUSTER-WP-0016. The estate close-down checklist row 23 tracks review of the longer shared budget.

Rendering the installed chart with its actual base values produced exactly one additional argument. Server dry-run and diff passed, capacity was checked, and the k3s Helm controller rolled Traefik to generation 2, Ready, on the same 3.6.7 image. Forgejo version and reuse health returned HTTP 200; registry /v2/ still returned HTTP 401 without authentication. Rollback is a reviewed source change back to 60s and reapplication through the same controller.

References: Traefik entry-point timeout and k3s managed customization.

Executed verification

• docker push forgejo.coulomb.social/coulomb/rapp-playwright:0.1.0 succeeded. Five large layers completed with HTTP 201 in 85.5, 106.9, 111.4, 172.7 and 182.6 seconds. Manifests published at 2026-10-13T18:15:17Z.
• docker buildx imagetools inspect ...:0.1.0 returned the exact expected index. The raw fetched index's SHA-256 was independently computed and matched.
• ssh railiance01 'sudo k3s crictl pull <immutable-reference>' succeeded, and crictl inspecti confirmed the expected image config identity.

Retained diagnosis, rollout and HTTPS checks, successful upload timings, remote index, cluster pull, and release record.

WP-0003-T01 is now done and WP-0003 is finished. Managed workload admission, consumer binding, deployment and live browser recovery/rollback remain in WP-0004-T01. The publication fix does not claim those outcomes or close discovery and consumer-acceptance work.

The State Hub audit reconciled WP-0003 and its publication task to finished/done with zero failures. The ingress owner's RCLUSTER-WP-0016 was also reconciled to finished/done. Its deep audit still reports pre-existing archived task identifier warnings; those records are outside this publication fix.