@caelo-cms/provisioning 0.10.65 → 0.10.66

package/src/upgrade/release-images.ts

@@ -167,6 +167,55 @@ export async function resolveRegistryDigest(
   }
 }
 
+/** What {@link fetchRegistryManifest} read. */
+export type RegistryManifestResult =
+  | { readonly ok: true; readonly bytes: Uint8Array<ArrayBuffer> }
+  | {
+      readonly ok: false;
+      /**
+       * True when a retry may cure it: the registry could not be reached,
+       * timed out, rate-limited (429/408), failed (5xx) or would not hand
+       * out a pull token. False when it answered that the manifest does not
+       * exist (404 and other 4xx).
+       */
+      readonly transient: boolean;
+      readonly reason: string;
+    };
+
+/**
+ * GET the manifest (or index) `<registryHost>/<repository>@<reference>`
+ * anonymously, through the same Bearer-challenge handling as
+ * {@link resolveRegistryDigest}. Returns the raw bytes: a caller that asked
+ * by digest checks them against it (content addressing is the trust here).
+ *
+ * @example fetchRegistryManifest("europe-west1-docker.pkg.dev", "caelo-website/caelo-cms-images/admin", "sha256:…")
+ */
+export async function fetchRegistryManifest(
+  registryHost: string,
+  repository: string,
+  reference: string,
+  fetchImpl: typeof fetch = fetch,
+): Promise<RegistryManifestResult> {
+  const url = `https://${registryHost}/v2/${repository}/manifests/${reference}`;
+  try {
+    let res = await fetchImpl(url, { headers: { Accept: MANIFEST_ACCEPT } });
+    if (res.status === 401) {
+      const token = await anonymousPullToken(res.headers.get("www-authenticate"), fetchImpl);
+      if (!token.ok) return { ok: false, transient: true, reason: token.reason };
+      res = await fetchImpl(url, {
+        headers: { Accept: MANIFEST_ACCEPT, Authorization: `Bearer ${token.token}` },
+      });
+    }
+    if (!res.ok) {
+      const transient = res.status >= 500 || res.status === 429 || res.status === 408;
+      return { ok: false, transient, reason: `${url}: HTTP ${res.status} ${res.statusText}` };
+    }
+    return { ok: true, bytes: new Uint8Array(await res.arrayBuffer()) };
+  } catch (e) {
+    return { ok: false, transient: true, reason: e instanceof Error ? e.message : String(e) };
+  }
+}
+
 /** Follow a registry's Bearer challenge to an anonymous pull token. */
 async function anonymousPullToken(
   challenge: string | null,

package/src/upgrader-gcp.ts

@@ -28,6 +28,7 @@ import { acquireBucketStateLock, GcsStateStore, realSyncGcloud } from "./state-s
 import type { AppRollPlan } from "./upgrade/app-roll.js";
 import { findServiceUrl } from "./upgrade/gcp-lookup.js";
 import { createIapHealthProbe } from "./upgrade/health.js";
+import { createReleaseImageForms } from "./upgrade/image-forms.js";
 import { type IamTester, restIamTester } from "./upgrader-iam-preflight.js";
 import type { UpdateQueue, UpgraderJobDeps } from "./upgrader-job.js";
 import type { JobLog } from "./upgrader-reporter.js";
@@ -134,6 +135,8 @@ export function gcpUpgraderDeps(
     iam: gcloudIamTester(run, http),
     // The default deps: the fixed registry and signer, never overridden.
     fetchManifest: (version) => fetchVerifiedReleaseManifest(version),
+    // #1025 — the fixed public mirror, read by digest and content-checked.
+    imageForms: createReleaseImageForms(),
     // #815 — the lock names this execution, so a later run can break it
     // once Cloud Run says this one has ended (killed at its task timeout,
     // OOM). Outside Cloud Run there is no execution to vouch for it.

package/src/upgrader-job.test.ts

@@ -15,7 +15,19 @@ import type { GcloudRunner } from "./gcloud-retry.js";
 import type { InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
 import { StateLockHeldError } from "./state-store.js";
+import {
+  ADMIN_AMD64,
+  ADMIN_INDEX,
+  fakeRegistryFetch,
+  GATEWAY_AMD64,
+  GATEWAY_INDEX,
+} from "./upgrade/__tests__/live-indexes.js";
 import type { HealthOutcome, HealthProbe } from "./upgrade/health.js";
+import {
+  createReleaseImageForms,
+  type ImageFormsResult,
+  type ReleaseImageForms,
+} from "./upgrade/image-forms.js";
 import { type IamTester, resourceName } from "./upgrader-iam-preflight.js";
 import {
   type ClaimedUpdate,
@@ -212,6 +224,11 @@ function setup(
     lockDenied?: boolean;
     /** The lock broke a dead run's lock on the way, with this message. */
     brokeStaleLock?: string;
+    /**
+     * The release mirror (#1025): by default index `D(c)` lists platform
+     * manifest `P(c)`; `down` makes every index read fail as an outage.
+     */
+    imageForms?: ReleaseImageForms | "down";
     /** IAM's answer: permissions withheld per resource name. */
     iamWithheld?: Record<string, readonly string[]>;
     /** A resource IAM cannot be asked about. */
@@ -246,6 +263,10 @@ function setup(
       }
       return opts.manifest ?? { ok: true, manifest: MANIFEST };
     },
+    imageForms:
+      typeof opts.imageForms === "object"
+        ? opts.imageForms
+        : fakeImageForms(order, opts.imageForms === "down"),
     lockState: (onBreak) => {
       order.push("lock");
       if (opts.locked) throw new StateLockHeldError("held by caelo installer");
@@ -271,6 +292,28 @@ function setup(
   return { deps, order, q, written };
 }
 
+/**
+ * The release mirror's indexes as {@link ReleaseImageForms}: index `D(c)`
+ * lists platform manifest `P(c)` (#1025). Signed platform digests win, as
+ * in createReleaseImageForms.
+ */
+function fakeImageForms(order: string[], down: boolean): ReleaseImageForms {
+  const ofIndex = async (slug: string, index: string): Promise<ImageFormsResult> => {
+    order.push(`index ${slug}@${index}`);
+    if (down) return { ok: false, transient: true, message: "the mirror answered HTTP 503" };
+    const platform = P(index.slice(-1));
+    return { ok: true, digests: [index, platform], amd64: platform };
+  };
+  return {
+    ofIndex,
+    of: async (m, slug) => {
+      const signed = m.platformDigests?.[slug];
+      if (signed) return { ok: true, digests: [m.digests[slug], signed], amd64: signed };
+      return ofIndex(slug, m.digests[slug]);
+    },
+  };
+}
+
 /** IAM granting everything asked except `withheld` per resource; `error` names a resource it cannot be asked about. */
 function fakeIam(
   order: string[],
@@ -765,6 +808,116 @@ describe("runUpgraderJob", () => {
     expect(order).not.toContain("manifest 0.11.0");
   });
 
+  describe("regression #1025: Cloud Run's revision spec names the platform manifest", () => {
+    /** Serving revisions whose spec AND status name only the platform digests (the live shape). */
+    const servingPlatform = (admin: string, gateway: string): [RegExp, Answer] => [
+      /^run revisions describe (\S+)/,
+      (l) => {
+        const d = l.includes("-admin-") ? admin : gateway;
+        return ok(revisionJson(d, d));
+      },
+    ];
+
+    it("the live v0.10.64 shapes: identified by the signed indexes, records both forms, installs", async () => {
+      const calls: string[] = [];
+      const v064 = {
+        ...MANIFEST,
+        version: "0.10.64",
+        digests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX, ops: D("c") },
+      };
+      const { deps, q, written } = setup({
+        meta: {
+          ...META,
+          imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX },
+          releaseVersion: "0.10.64",
+        },
+        manifests: { "0.10.64": { ok: true, manifest: v064 } },
+        gcloud: [servingPlatform(ADMIN_AMD64, GATEWAY_AMD64)],
+        imageForms: createReleaseImageForms(fakeRegistryFetch(calls)),
+      });
+      expect((await runUpgraderJob(deps)).status).toBe("succeeded");
+      expect(written[0]).toMatchObject({
+        releaseVersion: "0.10.64",
+        imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX },
+        platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 },
+      });
+      expect(q.events.some((e) => e.message.startsWith("0.10.64 → 0.11.0"))).toBe(true);
+      // Each index read once, by digest, from the fixed mirror.
+      expect(calls.filter((c) => c.endsWith(`/admin/manifests/${ADMIN_INDEX}`))).toHaveLength(1);
+      expect(calls.filter((c) => c.endsWith(`/gateway/manifests/${GATEWAY_INDEX}`))).toHaveLength(
+        1,
+      );
+    });
+
+    it("install.json with both forms matches directly: no drift, no lookup", async () => {
+      const { deps, order, q } = setup({
+        meta: { ...META, platformDigests: { admin: P("1"), gateway: P("2") } },
+        gcloud: [servingPlatform(P("1"), P("2"))],
+      });
+      expect((await runUpgraderJob(deps)).status).toBe("succeeded");
+      expect(order.filter((l) => l.startsWith("manifest"))).toEqual(["manifest 0.11.0"]);
+      // Only the target's index is read (to record its platform forms), never the serving one's.
+      expect(order.filter((l) => l.startsWith("index "))).toEqual([
+        `index admin@${D("a")}`,
+        `index gateway@${D("b")}`,
+      ]);
+      expect(q.events.some((e) => e.message.includes("refreshed its install records"))).toBe(false);
+    });
+
+    it("the roll records the new release's platform forms, signed ones first", async () => {
+      const signed = {
+        ...MANIFEST,
+        platformDigests: { admin: P("x"), gateway: P("y"), ops: P("z") },
+      };
+      const { deps, order, written } = setup({ manifest: { ok: true, manifest: signed } });
+      expect((await runUpgraderJob(deps)).status).toBe("succeeded");
+      expect(written.at(-1)).toMatchObject({
+        releaseVersion: "0.11.0",
+        imageDigests: { admin: D("a"), gateway: D("b") },
+        platformDigests: { admin: P("x"), gateway: P("y") },
+      });
+      expect(order.some((l) => l.startsWith("index "))).toBe(false);
+    });
+
+    it("a stale platform record is dropped when the platform forms cannot be read", async () => {
+      const { deps, q, written } = setup({
+        meta: { ...META, platformDigests: { admin: P("1"), gateway: P("2") } },
+        imageForms: "down",
+      });
+      expect((await runUpgraderJob(deps)).status).toBe("succeeded");
+      expect(written.at(-1)?.imageDigests).toEqual({ admin: D("a"), gateway: D("b") });
+      expect(written.at(-1)?.platformDigests).toBeUndefined();
+      expect(q.events.some((e) => e.level === "warn" && e.message.includes("linux/amd64"))).toBe(
+        true,
+      );
+    });
+
+    it("a platform digest in no signed index is still refused with the current message", async () => {
+      const { deps, q, written } = setup({
+        gcloud: [servingPlatform(P("7"), P("6"))],
+        manifests: { "0.10.45": manifestOf("0.10.45", D("1"), D("2")) },
+      });
+      expect((await runUpgraderJob(deps)).status).toBe("needs_cloud_shell");
+      const end = q.end();
+      expect(end?.codes).toEqual(["install-state-drift"]);
+      expect(end?.reason).toContain("do not belong to one signed Caelo release");
+      expect(end?.reason).toContain(`admin ${P("7")}`);
+      expect(written).toEqual([]);
+    });
+
+    it("an index the mirror cannot serve fails retryably, never as drift", async () => {
+      const { deps, q, written } = setup({
+        gcloud: [servingPlatform(P("1"), P("2"))],
+        manifests: { "0.10.45": manifestOf("0.10.45", D("1"), D("2")) },
+        imageForms: "down",
+      });
+      expect((await runUpgraderJob(deps)).status).toBe("failed");
+      expect(q.end()?.codes).toEqual(["registry"]);
+      expect(q.end()?.reason).toContain("HTTP 503");
+      expect(written).toEqual([]);
+    });
+  });
+
   it("regression #865: drift whose release manifest the registry cannot serve fails retryably, not install-state-drift", async () => {
     const { deps, order, q, written } = setup({
       meta: {

package/src/upgrader-job.ts

@@ -70,11 +70,13 @@ import {
 import { restoreCommand, takeSqlBackup } from "./upgrade/backup.js";
 import {
   findServingImage,
+  findTemplateImageDigest,
   lookupFailure,
   resolveGcpResourceName,
   servingImageDigests,
 } from "./upgrade/gcp-lookup.js";
 import type { HealthProbe } from "./upgrade/health.js";
+import { platformDigestsOf, type ReleaseImageForms } from "./upgrade/image-forms.js";
 import { releaseImageRef } from "./upgrade/release-images.js";
 import { assessUpgradeRequest, type RefusalCode } from "./upgrader-assess.js";
 import {
@@ -166,6 +168,13 @@ export interface UpgraderJobDeps {
   readonly iam: IamTester;
   /** fetchVerifiedReleaseManifest against the fixed registry. */
   readonly fetchManifest: (version: string) => Promise<ReleaseManifestResult>;
+  /**
+   * Every digest a release image is known by (#1025): the signed platform
+   * digests, else the content-checked index from the fixed mirror
+   * (createReleaseImageForms). One instance per run, so each index is read
+   * at most once.
+   */
+  readonly imageForms: ReleaseImageForms;
   /**
    * Take the install's state lock (the one `pulumi up`, `state migrate` and
    * the CLI `upgrade` hold) right before the run's first write; returns its
@@ -384,10 +393,16 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
     if (!serving.ok) {
       return stopWith("failed", ["lookup"], `Nothing was changed: ${serving.error}.`);
     }
-    if (!recordMatchesServing(meta.imageDigests, serving.digests)) {
+    if (!recordMatchesServing(meta, serving.digests)) {
       // #860 — re-record the serving release ourselves, but only one whose
-      // admin AND gateway images a signed release manifest names.
-      const found = await findServingRelease(meta, serving.digests, deps);
+      // admin AND gateway images a signed release manifest names, as its
+      // index or a platform manifest inside it (#1025).
+      const found = await findServingRelease(meta, serving.digests, {
+        run: deps.run,
+        fetchManifest: deps.fetchManifest,
+        imageForms: deps.imageForms,
+        hintDigests: () => templateDigests(deps, serving.services),
+      });
       if (!found.ok) {
         if (found.retryable) return stopWith("failed", ["registry"], found.reason);
         // #815 — the serving images were read without the lock: a run that
@@ -400,14 +415,17 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
         }
         return stopWith("needs_cloud_shell", ["install-state-drift"], found.reason);
       }
-      // The manifest's digests, not the serving ones: the signed form is the
-      // one every later comparison and deploy uses (gcp-lookup.ts ServingImage).
+      // The manifest's index digests, not the serving ones: the signed form
+      // is the one every deploy pins. The linux/amd64 forms go next to them
+      // (#1025), so the next run matches what Cloud Run records directly.
+      const { platformDigests: _stale, ...rest } = meta;
       meta = {
-        ...meta,
+        ...rest,
         imageDigests: {
           admin: found.manifest.digests.admin,
           gateway: found.manifest.digests.gateway,
         },
+        ...(found.platformDigests ? { platformDigests: found.platformDigests } : {}),
         releaseVersion: found.manifest.version,
       };
       // Judged against now, written under the lock once decided (#815).
@@ -562,9 +580,23 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
         // never "succeeded" while the records name the previous release).
         recordDigests: async (digests) => {
           r.phase("record");
+          // #1025 — both forms, so the next run recognises what Cloud Run
+          // records without a registry lookup. Not knowing the platform form
+          // is no failure: the next run then reads the index itself.
+          const platform = await platformDigestsOf(digests, deps.imageForms, m);
+          if (!platform.ok) {
+            r.warn(
+              `install.json records ${m.version} by its image indexes only; their linux/amd64 forms could not be read (${platform.message}). The next update reads them from the release registry.`,
+            );
+          }
           try {
-            const fresh = deps.readInstall() ?? meta;
-            deps.writeInstall({ ...fresh, imageDigests: digests, releaseVersion: m.version });
+            const { platformDigests: _previous, ...fresh } = deps.readInstall() ?? meta;
+            deps.writeInstall({
+              ...fresh,
+              imageDigests: digests,
+              ...(platform.ok ? { platformDigests: platform.platformDigests } : {}),
+              releaseVersion: m.version,
+            });
             r.info(`Recorded ${m.version} as this install's release.`);
           } catch (e) {
             recordError = errorText(e);
@@ -659,10 +691,17 @@ export async function recordUpdateEnd(
 }
 
 /** Every digest the revisions serving traffic are known by, per service. */
-async function servingDigests(
-  deps: UpgraderJobDeps,
-): Promise<{ ok: true; digests: ServingDigests } | { ok: false; error: string }> {
+async function servingDigests(deps: UpgraderJobDeps): Promise<
+  | {
+      ok: true;
+      digests: ServingDigests;
+      /** The services' deployed names, for the template hints. */
+      services: Readonly<Record<RollSlug, string>>;
+    }
+  | { ok: false; error: string }
+> {
   const digests: Partial<Record<RollSlug, readonly string[]>> = {};
+  const services: Partial<Record<RollSlug, string>> = {};
   for (const slug of ["admin", "gateway"] as const) {
     const prefix = `${gcpNamePrefix(deps.env)}-${slug}`;
     const service = await resolveGcpResourceName(
@@ -678,8 +717,30 @@ async function servingDigests(
     const image = await findServingImage(deps.run, deps.projectId, deps.region, service.name);
     if (!image) return { ok: false, error: `could not read which image the ${slug} serves` };
     digests[slug] = servingImageDigests(image);
+    services[slug] = service.name;
+  }
+  return {
+    ok: true,
+    digests: digests as ServingDigests,
+    services: services as Record<RollSlug, string>,
+  };
+}
+
+/**
+ * The index digests the services' templates pin (#1025): hints for which
+ * release to check when the serving revisions name only platform digests,
+ * which carry no release tag.
+ */
+async function templateDigests(
+  deps: UpgraderJobDeps,
+  services: Readonly<Record<RollSlug, string>>,
+): Promise<ServingDigests> {
+  const out: Partial<Record<RollSlug, readonly string[]>> = {};
+  for (const slug of ["admin", "gateway"] as const) {
+    const d = await findTemplateImageDigest(deps.run, deps.projectId, deps.region, services[slug]);
+    out[slug] = d ? [d] : [];
   }
-  return { ok: true, digests: digests as ServingDigests };
+  return out as ServingDigests;
 }
 
 async function recordFacts(

package/src/upgrader-records.test.ts

@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Which signed release serves (#860, #1025), with the shapes recorded on
+ * live installs: the serving revisions name the linux/amd64 platform
+ * manifests (`2e75…`, `d24f…`), the signed v0.10.64 manifest and
+ * install.json the indexes (`bcda…`, `fbb0…`) that list them next to one
+ * attestation manifest each.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import type { InstallMetadata } from "./install-state.js";
+import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
+import {
+  ADMIN_AMD64,
+  ADMIN_ATTESTATION,
+  ADMIN_INDEX,
+  fakeRegistryFetch,
+  GATEWAY_AMD64,
+  GATEWAY_INDEX,
+} from "./upgrade/__tests__/live-indexes.js";
+import { createReleaseImageForms } from "./upgrade/image-forms.js";
+import {
+  findServingRelease,
+  recordMatchesServing,
+  type ServingDigests,
+  type ServingReleaseDeps,
+} from "./upgrader-records.js";
+
+const D = (c: string) => `sha256:${c.repeat(64)}`;
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+
+const V064: ReleaseManifest = {
+  manifestVersion: 1,
+  version: "0.10.64",
+  channel: "stable",
+  digests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX, ops: D("c") },
+  minFromVersion: "0.10.0",
+  infraContractVersion: 13,
+  migrations: { contract: false, lastContractVersion: null, head: "0338_x" },
+  security: false,
+  advisories: [],
+};
+
+const META: InstallMetadata = {
+  installId: "gcp-firebase-acme",
+  provider: "gcp-firebase",
+  projectId: "acme",
+  domain: "acme.com",
+  ownerEmail: "owner@acme.com",
+  region: "europe-west1",
+  createdAt: "2026-01-01T00:00:00Z",
+  imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX },
+  releaseVersion: "0.10.64",
+  infraContractVersion: 13,
+};
+
+/** What the serving revisions read back as on searchviu-website (spec = status). */
+const LIVE_SERVING: ServingDigests = { admin: [ADMIN_AMD64], gateway: [GATEWAY_AMD64] };
+
+function deps(
+  opts: {
+    manifests?: Record<string, ReleaseManifest>;
+    calls?: string[];
+    registry?: Parameters<typeof fakeRegistryFetch>[1];
+    /** `gcloud artifacts docker tags list` answers: version → digest, per slug. */
+    tags?: Partial<Record<"admin" | "gateway", Record<string, string>>>;
+    hints?: ServingDigests;
+  } = {},
+): ServingReleaseDeps & { fetched: string[] } {
+  const fetched: string[] = [];
+  const manifests = opts.manifests ?? { "0.10.64": V064 };
+  return {
+    fetched,
+    run: async (args) => {
+      const line = args.join(" ");
+      const slug = /\/(admin|gateway) /.exec(`${line} `)?.[1] as "admin" | "gateway" | undefined;
+      if (line.startsWith("artifacts docker tags list") && slug) {
+        const tags = opts.tags?.[slug] ?? {};
+        return ok(
+          Object.entries(tags)
+            .map(
+              ([v, d]) => `projects/p/locations/l/repositories/r/packages/${slug}/tags/${v}\t${d}`,
+            )
+            .join("\n"),
+        );
+      }
+      return ok("");
+    },
+    fetchManifest: async (version): Promise<ReleaseManifestResult> => {
+      fetched.push(version);
+      const m = manifests[version];
+      return m
+        ? { ok: true, manifest: m }
+        : {
+            ok: false,
+            error: { code: "registry", message: `no release manifest for v${version}` },
+          };
+    },
+    imageForms: createReleaseImageForms(fakeRegistryFetch(opts.calls ?? [], opts.registry)),
+    ...(opts.hints ? { hintDigests: async () => opts.hints as ServingDigests } : {}),
+  };
+}
+
+describe("recordMatchesServing", () => {
+  it("regression #1025: the index alone does not match what Cloud Run reports", () => {
+    expect(recordMatchesServing(META, LIVE_SERVING)).toBe(false);
+  });
+
+  it("matches by the recorded platform forms", () => {
+    const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
+    expect(recordMatchesServing(both, LIVE_SERVING)).toBe(true);
+    // Still by the index when a revision names it.
+    expect(recordMatchesServing(META, { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] })).toBe(
+      true,
+    );
+  });
+
+  it("both services must match, and no record never matches", () => {
+    const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
+    expect(recordMatchesServing(both, { admin: [ADMIN_AMD64], gateway: [D("6")] })).toBe(false);
+    expect(recordMatchesServing({}, LIVE_SERVING)).toBe(false);
+  });
+});
+
+describe("findServingRelease", () => {
+  it("regression #1025: identifies v0.10.64 from the platform digests inside its signed indexes", async () => {
+    const calls: string[] = [];
+    const d = deps({ calls });
+    const r = await findServingRelease(META, LIVE_SERVING, d);
+    expect(r).toEqual({
+      ok: true,
+      manifest: V064,
+      platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 },
+    });
+    expect(d.fetched).toEqual(["0.10.64"]);
+    expect(calls).toHaveLength(2);
+  });
+
+  it("an attestation manifest of the index is not a serving image of the release", async () => {
+    const r = await findServingRelease(
+      META,
+      { admin: [ADMIN_ATTESTATION], gateway: [GATEWAY_AMD64] },
+      deps(),
+    );
+    expect(r.ok).toBe(false);
+    expect(r.ok ? "" : r.reason).toContain(
+      "The gateway serves v0.10.64's image, the admin does not.",
+    );
+  });
+
+  it("uses the signed platform digests without reading the index", async () => {
+    const calls: string[] = [];
+    const signed = {
+      ...V064,
+      platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64, ops: D("3") },
+    };
+    const r = await findServingRelease(
+      META,
+      LIVE_SERVING,
+      deps({ calls, manifests: { "0.10.64": signed } }),
+    );
+    expect(r.ok).toBe(true);
+    expect(calls).toEqual([]);
+  });
+
+  it("a digest in no signed index is still refused with the current message", async () => {
+    const r = await findServingRelease(META, { admin: [D("7")], gateway: [D("6")] }, deps());
+    expect(r).toMatchObject({ ok: false, retryable: false });
+    expect(r.ok ? "" : r.reason).toContain(
+      "are not the ones install.json names, and they do not belong to one signed Caelo release",
+    );
+    expect(r.ok ? "" : r.reason).toContain(`admin ${D("7")}`);
+  });
+
+  it("a registry outage reading the index is retryable, a tampered index is not", async () => {
+    const down = await findServingRelease(META, LIVE_SERVING, deps({ registry: { status: 503 } }));
+    expect(down).toMatchObject({ ok: false, retryable: true });
+    expect(down.ok ? "" : down.reason).toContain("could not be reached");
+
+    const tampered = await findServingRelease(
+      META,
+      LIVE_SERVING,
+      deps({ registry: { tampered: new TextEncoder().encode("{}") } }),
+    );
+    expect(tampered).toMatchObject({ ok: false, retryable: false });
+    expect(tampered.ok ? "" : tampered.reason).toContain("could not be verified");
+  });
+
+  it("finds the release by the template's index when install.json names none", async () => {
+    const { releaseVersion: _none, ...unversioned } = META;
+    const meta = { ...unversioned, imageDigests: { admin: D("9"), gateway: D("8") } };
+    const d = deps({
+      tags: { admin: { "0.10.64": ADMIN_INDEX } },
+      hints: { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] },
+    });
+    const r = await findServingRelease(meta, LIVE_SERVING, d);
+    expect(r.ok && r.manifest.version).toBe("0.10.64");
+    expect(d.fetched).toEqual(["0.10.64"]);
+  });
+});