archy/releases/registry-trust-floor.json

{
  "_comment": [
    "Registry hosts that binaries ALREADY DEPLOYED to nodes are known to trust.",
    "",
    "This is the floor the signed app catalog must stay within. It is NOT the",
    "same as TRUSTED_REGISTRIES in the working tree: that list describes what a",
    "binary being built today accepts, while nodes in the field run whatever was",
    "shipped to them. Publishing a catalog that names a host the fleet's binaries",
    "do not trust makes every install fail with 'not from a trusted registry'.",
    "",
    "To migrate to a new registry host, in this order:",
    "  1. Add the host to TRUSTED_REGISTRIES and ship a binary OTA.",
    "  2. Confirm the fleet is running that binary or newer.",
    "  3. Add the host here, in the same commit as the confirmation.",
    "  4. Only then regenerate and re-sign the catalog against the new host.",
    "",
    "Removing a host is the mirror image: take it out of the catalog first, let",
    "that catalog reach every node, and only then drop it from here."
  ],
  "hosts": [
    "docker.io",
    "ghcr.io",
    "localhost",
    "146.59.87.168:3000",
    "source.archipelago-foundation.org"
  ],
  "pending": {},
  "promotions": {
    "source.archipelago-foundation.org": {
      "trusted_from_binary": "1.8.0-alpha",
      "confirmed": "2026-08-13",
      "note": "Fleet confirmed on 1.8.0-alpha (TRUSTED_REGISTRIES includes this host since 2026-08-07): archi-dev-box, zaza-optiplex, archipelago-1, shorty-s, austin-sapien all report current_version 1.8.0-alpha via update_state.json on 2026-08-13. Exception: archy-x250-beta is stranded pre-v1.7.122 (old release-root pin, cannot OTA at all) and needs a full re-image — it cannot install catalog apps from ANY host today, so it does not hold the floor down."
    }
  },
  "updated": "2026-08-13"
}