tmk241/apsuflow-skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(skill): cover registry pulls and Void proof

Browse Source
This commit is contained in:
tmk241
2026-08-10 18:15:53 +02:00
parent bb8bc5cdf6
commit 2e1debaba0
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/apsuflow/SKILL.md
+10 -1
View File
@@ -48,7 +48,9 @@ in the same change when applicable requirements or CLI behavior change.
must prove its unprivileged effective UID and create/remove a child beneath a must prove its unprivileged effective UID and create/remove a child beneath a
writable delegated cgroup v2 path exposing `cpu`, `memory`, and `pids`. writable delegated cgroup v2 path exposing `cpu`, `memory`, and `pids`.
`doctor` reports the same kernel-observed parent-process and cgroup facts. `doctor` reports the same kernel-observed parent-process and cgroup facts.
Failure is closed: there is no root or service-manager-specific fallback. Failure is closed: there is no root or service-manager-specific fallback. The
current runit profile also passed its complete acceptance path on Void Linux
musl; that is evidence for the capability contract, not a distro special case.
- `.apsu` contains desired workloads and infrastructure, never secret values or - `.apsu` contains desired workloads and infrastructure, never secret values or
mutable runtime state. mutable runtime state.
- Services are continuously reconciled. Jobs are finite run-to-completion work. - Services are continuously reconciled. Jobs are finite run-to-completion work.
@@ -77,6 +79,13 @@ Use only the exact stable tag and artifact named by `docs/getting-started.md`.
Verify `SHA256SUMS` and its SSH signature before installing; never use a mutable Verify `SHA256SUMS` and its SSH signature before installing; never use a mutable
`latest` URL. Keep the previous executable and state backup until the new one `latest` URL. Keep the previous executable and state backup until the new one
passes `version`, `doctor`, workload diagnosis, and each operator-facing route. passes `version`, `doctor`, workload diagnosis, and each operator-facing route.
For a private image registry, pipe the credential into `apsuflow registry login
<host> --username <user> --password-stdin`; do not put it in `.apsu` or shell
history. Login stores sealed `_registry/{host}` state, and joined agents receive
only their per-node-resealed pull credential during assignment. Confirm the next
pull succeeds; `unauthorized` means the registry host or credential is wrong, not
that the workload should be stopped first.
For host-network workloads, confirm the old container released its host ports and For host-network workloads, confirm the old container released its host ports and
the successor is the sole running generation; repeated replacement failures are the successor is the sole running generation; repeated replacement failures are
a rollback signal, not a reason to mutate runtime state directly. The first a rollback signal, not a reason to mutate runtime state directly. The first