Pin the package registry to the version the machine it replaces is running #44

2026-09-23T00:24:15Z

jschoubben commented

2026-09-23 00:24:15 +00:00

The module pinned a digest for 6.10.1. The machine whose service it takes over runs
6.10.3. Taking it would have been a downgrade, which is what the forge's first cutover cost an
outage to learn — so the runbook now checks version parity before anything else, and this is that
check applied to the next module in line.

Pinned to sha256:7b067a47…, which is exactly verdaccio/verdaccio:6.10.3 and exactly the image
digest the running container resolves to.

6.10.4 is published. Moving to it is an upgrade, deliberate and separate from a cutover; a cutover
changes who owns a service, not which version of it runs.

Note for whoever schedules that cutover: this module is not ready to take. Its declared
config.yaml drops a rule the machine's has — one private scope kept local and never proxied —
and there is no mechanism to carry it across. Written up as
hq issue 098.

The module pinned a digest for **6.10.1**. The machine whose service it takes over runs **6.10.3**. Taking it would have been a downgrade, which is what the forge's first cutover cost an outage to learn — so the runbook now checks version parity before anything else, and this is that check applied to the next module in line. Pinned to `sha256:7b067a47…`, which is exactly `verdaccio/verdaccio:6.10.3` and exactly the image digest the running container resolves to. 6.10.4 is published. Moving to it is an upgrade, deliberate and separate from a cutover; a cutover changes who owns a service, not which version of it runs. Note for whoever schedules that cutover: this module is **not** ready to take. Its declared `config.yaml` drops a rule the machine's has — one private scope kept local and never proxied — and there is no mechanism to carry it across. Written up as [hq issue 098](https://git.novox.be/novox/hq/src/branch/main/04-ISSUES/098-taking-a-module-replaces-a-configuration-nobody-compared/00-report.md).

jschoubben added 1 commit 2026-09-23 00:24:16 +00:00

Pin the package registry to the version the machine it replaces is running: 6.10.3, not 6.10.1 a3eca8f4e6

The rule the forge's cutover taught: a module that takes over a running service must not
carry an older image than the one running, or the cutover is a downgrade nobody asked for.
6.10.4 exists; moving to it is an upgrade and its own act.

jschoubben merged commit b0d48d5c54 into main

2026-09-23 00:37:31 +00:00

jschoubben deleted branch fix/verdaccio-matches-production

2026-09-23 00:37:31 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#44