2026-09-11 19:56:50 +00:00
1 changed files with 60 additions and 0 deletions
@@ -0,0 +1,60 @@
 ---
 status: open
 opened: 2026-09-10
 located-in: []
 fixed-by:
 amended-design:
 ---
 # 039 — The lab's registry was pinning what the catalogue left unpinned
 ## Symptom
 Nine container images across seven modules name their image by **tag** — the shape
 `<registry>/<org>/<name>:latest` — rather than by digest. They are the operator's own application
 images, the ones built from their own source.
 [ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md) requires a digest, and
 the host refuses a tag by name: *"image %q is not pinned. Write it as name@sha256:… — a tag moves,
 and a bundle that pinned a tag would not be pinned."*
 **Every bed passed anyway, for as long as the lab has existed.** The lab raised a registry of its
 own, pushed every image into it, and rewrote every reference in every manifest to the digest **that
 registry had just assigned**. So a manifest naming a tag arrived at a machine naming a digest. The
 rewriting was doing the pinning.
 It surfaced only when the lab's registry was deleted — the modules now carry their tags all the way
 to the machine, and fail there, which is the correct behaviour finally being reachable.
 ## Why this matters
 **A rule enforced by scenery is not enforced.** The host's refusal is right and has never once
 fired in a bed, because nothing unpinned could reach it. The check exists, the tests are green, and
 the property they appear to defend was being supplied by the test harness — which is the same shape
 as [003](../003-firewall-scope-is-read-by-no-code/00-report.md), one layer further out: there the
 rule was read by no code, here it is read by code that never saw a violation.
 **And these are the worst images for it to be true of.** A tag republished on every build is the
 one reference that genuinely moves. A machine reconciling against an unchanged declaration can
 change what it runs, with nothing in the declaration or the mesh's records saying anything did —
 which is precisely the failure pinning exists to prevent, aimed at the images that change most
 often.
 **The general form is the part worth keeping.** Any invariant the lab happens to satisfy
 incidentally is an invariant no bed tests. The harness was not merely serving images; it was
 quietly supplying a property of the system under test, and nothing said so.
 ## Open questions
 - What should a manifest name for an image the operator builds themselves? A digest changes on
  every build, so a manifest carrying one is wrong the moment anybody commits — which is the
  argument [`12-a-module-repository`](../../03-DESIGN/01-to-be/12-a-module-repository.md) already
  makes for *two* documents, the repository's naming artifacts and the mesh's naming digests. Is
  this simply the build pipeline's absence showing, rather than seven mistakes?
 - Until that pipeline exists, what names these images — and is a tag with a loud warning better or
  worse than a digest that is stale by construction?
 - How is *"nothing reaches a machine unpinned"* checked anywhere other than on the machine that
  refuses it? A check that only ever runs at the last possible moment, on the one path a harness
  was rewriting, is a check nobody can see failing.
 - Which other invariants is the lab supplying rather than testing? This one was found by deleting
  the thing that supplied it. That is not a repeatable technique.