From c684ffbac4871c43589c90b457f4f35f2b8f8007 Mon Sep 17 00:00:00 2001 From: itswl Date: Mon, 19 Oct 2026 12:15:47 +0800 Subject: [PATCH] =?UTF-8?q?release:=200.7.0=20=E2=80=94=20the=20quickstart?= =?UTF-8?q?=20points=20at=20images=20whose=20investigator=20measures=20its?= =?UTF-8?q?=20posture,=20and=20the=20stranger's=20run=20starts=20from=20an?= =?UTF-8?q?=20empty=20directory?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The six image lines move from 0.6.0 to 0.7.0, pinned by the OCI index digests GHCR serves for the tags, read back after the release workflow for the tag finished green on every job. The file's own comment says why it cannot point at an older tag: 0.7.0 is the first whose bridge refuses to start without its secret (this file sets one), whose pipe answers a replayed request as a duplicate, and whose investigator measures its posture with the tools its image carries. Run the way a stranger does before this commit: from an empty directory holding only the compose file and scripts/demo.sh, the compose pulled by digest, the three boards answered, demo.sh ran all nine steps on the rehearsal adapter (approve pressed through the pipe's own door, two observations executed as argv, the recovery verified the work), and down -v removed it. docs/releasing.md now says 'from an empty directory, not the checkout': compose reads ./.env for interpolation, and the checkout's .env is a deployment's. Run from the repository root, the quickstart's investigator took the work stack's HOOKPROBE_TOKEN and every demo.sh lookup answered 401 — a release that was fine, failing a check that was not testing it. --- docker-compose.quickstart.yml | 18 ++++++++++-------- docs/releasing.md | 5 +++++ 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/docker-compose.quickstart.yml b/docker-compose.quickstart.yml index 76bc01e6..057ffdac 100644 --- a/docker-compose.quickstart.yml +++ b/docker-compose.quickstart.yml @@ -37,14 +37,16 @@ # first whose images carry the boards the pictures show — one attention entry # per alert, the relay inbox, dark and light, two languages; 0.6.0 is the first # whose boards fit the phone the pictures now show, and whose approve press -# names the version it read. This file needs all of it, so it cannot point at -# an older tag. +# names the version it read; 0.7.0 is the first whose bridge refuses to start +# without its secret (set below), whose pipe answers a replayed request as a +# duplicate, and whose investigator measures its posture with the tools its +# image carries. This file needs all of it, so it cannot point at an older tag. name: hookstack services: hookrelay: - image: ghcr.io/itswl/hookrelay:0.6.0@sha256:2489b6e89626cfe85b26db49d96221b0be481a4bb1510d18755744be2fba6ed1 + image: ghcr.io/itswl/hookrelay:0.7.0@sha256:6b303cb074f5ac9ba1c82be94b6fda5ae2754a88690e1ca90f8f38b1083886a0 container_name: hs-hookrelay restart: unless-stopped environment: @@ -86,7 +88,7 @@ services: - sink hookjudge: - image: ghcr.io/itswl/hookjudge:0.6.0@sha256:9b6c537c82e8b4ead1f8d68029889caca642f653a8fbb419b7f5173707204e30 + image: ghcr.io/itswl/hookjudge:0.7.0@sha256:4024f9910b9025e5522edff857e599aefc32794da202ffbdf58eea3d1591c8fc container_name: hs-hookjudge restart: unless-stopped environment: @@ -116,7 +118,7 @@ services: # operator would actually have received. It runs from the pipe's own image # because that image now carries it — one fewer thing to pull, and no mount. sink: - image: ghcr.io/itswl/hookrelay:0.6.0@sha256:2489b6e89626cfe85b26db49d96221b0be481a4bb1510d18755744be2fba6ed1 + image: ghcr.io/itswl/hookrelay:0.7.0@sha256:6b303cb074f5ac9ba1c82be94b6fda5ae2754a88690e1ca90f8f38b1083886a0 container_name: hs-sink restart: unless-stopped command: ["python", "-u", "/app/examples/sink.py"] @@ -129,7 +131,7 @@ services: # exactly the hop a real deployment makes to a custom bot's incoming URL. # `ops-feishu` in the baked config is `type: bridge` and points here. lark-bridge: - image: ghcr.io/itswl/lark-bridge:0.6.0@sha256:781fcd8166a266903e266ed11e0990f6235c7c4ef71b46ce66450561c2159afa + image: ghcr.io/itswl/lark-bridge:0.7.0@sha256:9cec031adcf6ba71190f5a0687eed286729dae158cd1f1d6262abeb58cb2e4ee container_name: hs-lark-bridge restart: unless-stopped environment: @@ -147,7 +149,7 @@ services: # not a model: it reports itself as `stub-4o-mini`. Point the judge's AI vars # at a real provider and this stops being used. stub-ai: - image: ghcr.io/itswl/hookjudge:0.6.0@sha256:9b6c537c82e8b4ead1f8d68029889caca642f653a8fbb419b7f5173707204e30 + image: ghcr.io/itswl/hookjudge:0.7.0@sha256:4024f9910b9025e5522edff857e599aefc32794da202ffbdf58eea3d1591c8fc container_name: hs-stub-ai restart: unless-stopped command: ["python", "-u", "/app/examples/stub_ai.py"] @@ -159,7 +161,7 @@ services: # pipe to the same channels; the disk alert in demo.sh also proposes a # two-step procedure the approve button runs against the allowlist below. hookprobe: - image: ghcr.io/itswl/hookprobe:0.6.0@sha256:019b5a3ff36bee4c857badf912e24b476b4fde8ff9b93259e3140c3583354223 + image: ghcr.io/itswl/hookprobe:0.7.0@sha256:cbf1fcb12b765cd4881381a6ba4196124aa65cb7a0a3e35d62f89ec1fd3214d9 container_name: hs-hookprobe restart: unless-stopped # The agent executes arbitrary bash, so the container is bounded even in a diff --git a/docs/releasing.md b/docs/releasing.md index cd5ab6ed..6479942c 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -41,6 +41,11 @@ tag's own message is the note, which is how 0.5.0 and 0.6.0 shipped. 4. **Re-run the quickstart the way a stranger does** — `curl` the published compose, `docker compose up`, `bash scripts/demo.sh`. The file's own comment records three releases that were wrong until somebody actually ran it. + **From an empty directory, not the checkout.** Compose reads `./.env` for + interpolation, and the checkout's `.env` is a deployment's: run from the + repository root on 2026-10-19, the quickstart's investigator took the work + stack's `HOOKPROBE_TOKEN` and every `demo.sh` lookup answered 401 — a + release that was fine, failing a check that was not testing it. ## A note on tags vs. digests