pdurlej/platform

Fork 0

chore(deps): pin Meerkat image defaults #683

Merged

pdurlej merged 1 commit from codex/669-pin-floating-images into main

2026-06-02 10:18:08 +02:00

codex commented

2026-06-02 10:10:44 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

Pins the repo-visible Meerkat image defaults by digest and records why the rest of #669 still needs runtime reconciliation instead of paper-pinning invented compose entries.

Canary Context Pack

Product story

M10 image maintenance should move the platform away from floating container tags, but only where the repository actually owns the image reference. This keeps future updates reviewable without pretending that runtime-only legacy containers are already under repo control.

What changed

Pinned MEERKAT_BACKEND_IMAGE and MEERKAT_FRONTEND_IMAGE compose defaults to sha256 digests.
Updated the Meerkat module manifests to mark compose image pinning as true.
Added a focused regression test for the Meerkat compose defaults.
Added sanitized evidence showing the five remaining live floating images that need a separate runtime/env or retirement decision.

Why it changed

Issue #669 identified seven live floating images. Read-only inspection showed only two of those are repo-visible service image defaults in the current compose surface. The other five are active/parked/sunset runtime-only findings and should be handled by reconcile/retire work, not by adding invented compose definitions in this PR.

Files touched

compose/apps/compose.yaml
modules/np-meerkat-backend/module.yaml
modules/np-meerkat-frontend/module.yaml
control-plane/platformctl/tests/test_compose_image_pins.py
state/reports/floating-image-pin-evidence-2026-06-02.md

Relevant context

#669 M10 image-pinning issue
compose/apps/compose.yaml Meerkat service definitions
Meerkat module manifests

Runtime evidence

Read-only RS2000 inspection was used only to classify live floating-image findings. No runtime container, env file, Infisical value, or production host state was mutated.

Known constraints

This PR intentionally does not change canonical runtime env files and does not apply compose changes live.

Explicit out-of-scope

No live deployment.
No runtime env edits.
No Infisical writes.
No parked/sunset service retirement.
No invented compose entries for runtime-only containers.
Does not close #669.

Requested decision

Approve this repo-visible slice, then leave #669 open for the runtime-only reconcile/retirement follow-up.

Merge blockers

Regression test or platformctl validate all --json failing.
Evidence that the remaining five floating images are already repo-visible and should have been pinned in this same PR.

Spec sources read

compose/apps/compose.yaml — locate repo-visible image references.
modules/np-meerkat-backend/module.yaml — update image pin metadata.
modules/np-meerkat-frontend/module.yaml — update image pin metadata.
state/reports/rs2000-live-data-config-inventory-2026-05-24/legacy-mounts.json — compare historical live floating-image evidence without exposing private data.

Validation

uv run pytest platformctl/tests/test_compose_image_pins.py — passed.
PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json — passed with exitCode: 0.
git diff --check — passed.

Refs #669

Canary status: missing — fire canary 3+3 manually before merge ## Summary Pins the repo-visible Meerkat image defaults by digest and records why the rest of #669 still needs runtime reconciliation instead of paper-pinning invented compose entries. ## Canary Context Pack ### Product story M10 image maintenance should move the platform away from floating container tags, but only where the repository actually owns the image reference. This keeps future updates reviewable without pretending that runtime-only legacy containers are already under repo control. ### What changed - Pinned `MEERKAT_BACKEND_IMAGE` and `MEERKAT_FRONTEND_IMAGE` compose defaults to sha256 digests. - Updated the Meerkat module manifests to mark compose image pinning as true. - Added a focused regression test for the Meerkat compose defaults. - Added sanitized evidence showing the five remaining live floating images that need a separate runtime/env or retirement decision. ### Why it changed Issue #669 identified seven live floating images. Read-only inspection showed only two of those are repo-visible service image defaults in the current compose surface. The other five are active/parked/sunset runtime-only findings and should be handled by reconcile/retire work, not by adding invented compose definitions in this PR. ### Files touched - `compose/apps/compose.yaml` - `modules/np-meerkat-backend/module.yaml` - `modules/np-meerkat-frontend/module.yaml` - `control-plane/platformctl/tests/test_compose_image_pins.py` - `state/reports/floating-image-pin-evidence-2026-06-02.md` ### Relevant context - #669 M10 image-pinning issue - `compose/apps/compose.yaml` Meerkat service definitions - Meerkat module manifests ### Runtime evidence Read-only RS2000 inspection was used only to classify live floating-image findings. No runtime container, env file, Infisical value, or production host state was mutated. ### Known constraints This PR intentionally does not change canonical runtime env files and does not apply compose changes live. ### Explicit out-of-scope - No live deployment. - No runtime env edits. - No Infisical writes. - No parked/sunset service retirement. - No invented compose entries for runtime-only containers. - Does not close #669. ### Requested decision Approve this repo-visible slice, then leave #669 open for the runtime-only reconcile/retirement follow-up. ### Merge blockers - Regression test or `platformctl validate all --json` failing. - Evidence that the remaining five floating images are already repo-visible and should have been pinned in this same PR. ## Spec sources read - `compose/apps/compose.yaml` — locate repo-visible image references. - `modules/np-meerkat-backend/module.yaml` — update image pin metadata. - `modules/np-meerkat-frontend/module.yaml` — update image pin metadata. - `state/reports/rs2000-live-data-config-inventory-2026-05-24/legacy-mounts.json` — compare historical live floating-image evidence without exposing private data. ## Validation - `uv run pytest platformctl/tests/test_compose_image_pins.py` — passed. - `PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` — passed with `exitCode: 0`. - `git diff --check` — passed. Refs #669

codex added 1 commit

2026-06-02 10:10:44 +02:00

chore(deps): pin Meerkat image defaults

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 38s

Details

python-ci / Python 3.12 (pull_request) Successful in 40s

Details

python-ci / Python 3.13 (pull_request) Successful in 39s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

canary-required / canary (pull_request) Successful in 11s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m11s

Details

d086834dc4

codex added this to the 10 - Improvements milestone

2026-06-02 10:11:39 +02:00

codex added the

safety:no-prod-mutation

labels

2026-06-02 10:11:39 +02:00

codex commented

2026-06-02 10:16:06 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 683
Commit: d086834dc4319bc6e7fe0559bb8b360f5c23638d
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
low Digest hardcoded in three locations creates update synchronization burden
- Evidence: Same digest sha256:e719effced8dab81d302dc1460d62945d005ad606a61c7098d85536ec5dad876 appears in compose/apps/compose.yaml line 1093, modules/np-meerkat-backend/module.yaml line 31, and control-plane/platformctl/tests/test_compose_image_pins.
- Next: Consider extracting digest constants to a single source-of-truth file that compose, manifests, and tests all reference, reducing drift risk on future image updates

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `683` - Commit: `d086834dc4319bc6e7fe0559bb8b360f5c23638d` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`low`** Digest hardcoded in three locations creates update synchronization burden - Evidence: `Same digest sha256:e719effced8dab81d302dc1460d62945d005ad606a61c7098d85536ec5dad876 appears in compose/apps/compose.yaml line 1093, modules/np-meerkat-backend/module.yaml line 31, and control-plane/platformctl/tests/test_compose_image_pins.` - Next: Consider extracting digest constants to a single source-of-truth file that compose, manifests, and tests all reference, reducing drift risk on future image updates ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.