From 2e1debaba0b79c0dd0c01ec3142b1e877c72775b Mon Sep 17 00:00:00 2001 From: tmk241 Date: Mon, 10 Aug 2026 18:15:53 +0200 Subject: [PATCH] docs(skill): cover registry pulls and Void proof --- skills/apsuflow/SKILL.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/skills/apsuflow/SKILL.md b/skills/apsuflow/SKILL.md index 3e5cb87..461b8de 100644 --- a/skills/apsuflow/SKILL.md +++ b/skills/apsuflow/SKILL.md @@ -48,7 +48,9 @@ in the same change when applicable requirements or CLI behavior change. must prove its unprivileged effective UID and create/remove a child beneath a writable delegated cgroup v2 path exposing `cpu`, `memory`, and `pids`. `doctor` reports the same kernel-observed parent-process and cgroup facts. - Failure is closed: there is no root or service-manager-specific fallback. + Failure is closed: there is no root or service-manager-specific fallback. The + current runit profile also passed its complete acceptance path on Void Linux + musl; that is evidence for the capability contract, not a distro special case. - `.apsu` contains desired workloads and infrastructure, never secret values or mutable runtime state. - Services are continuously reconciled. Jobs are finite run-to-completion work. @@ -77,6 +79,13 @@ Use only the exact stable tag and artifact named by `docs/getting-started.md`. Verify `SHA256SUMS` and its SSH signature before installing; never use a mutable `latest` URL. Keep the previous executable and state backup until the new one passes `version`, `doctor`, workload diagnosis, and each operator-facing route. +For a private image registry, pipe the credential into `apsuflow registry login + --username --password-stdin`; do not put it in `.apsu` or shell +history. Login stores sealed `_registry/{host}` state, and joined agents receive +only their per-node-resealed pull credential during assignment. Confirm the next +pull succeeds; `unauthorized` means the registry host or credential is wrong, not +that the workload should be stopped first. + For host-network workloads, confirm the old container released its host ports and the successor is the sole running generation; repeated replacement failures are a rollback signal, not a reason to mutate runtime state directly. The first