@rizom/ops 0.2.0-alpha.566 → 0.2.0-alpha.567

package/README.md

@@ -4,7 +4,7 @@ Operator CLI package for managing pilot brain fleet registry repos.
 
 ## Runtime images
 
-The fleet builds one immutable image per effective Brain version and site pin set. An instance without a site override runs `brain-${brainVersion}`; an instance with one runs `brain-${brainVersion}--<pins>`, the pins spelled out and sorted (`@rizom/site-x@1.2.3` → `rizom-site-x-1.2.3`), or a digest of them when spelling them out would exceed a registry's tag length. Every instance with the same version and pins shares one image. A site's pin change therefore builds that site's image and no other, and smoke-to-fleet promotion reuses the smoke-tested image unchanged, because its name already carries its pins. The generated `users/<handle>/.env` of an instance with site pins names its image (`IMAGE_TAG`), so a pin change is a changed config and deploys; a plain instance's env says only its version.
+The fleet builds one immutable image per effective Brain version and site pin set. An instance without a site override runs `brain-${brainVersion}`; an instance with one runs `brain-${brainVersion}--<pins>--s<digest>`, the pins spelled out and sorted (`@rizom/site-x@1.2.3` → `rizom-site-x-1.2.3`), with a digest of the exact version and normalized pin set even for short names. Long names omit the readable pins. Distinct requirements that collide are refused, never silently overwritten. Upgrading selects new immutable tags for pinned images; do not overwrite or retag existing registry images as a migration workaround. Every instance with the same version and pins shares one image. A site's pin change therefore builds that site's image and no other, and smoke-to-fleet promotion reuses the smoke-tested image unchanged, because its name already carries its pins. The generated `users/<handle>/.env` of an instance with site pins names its image (`IMAGE_TAG`), so a pin change is a changed config and deploys; a plain instance's env says only its version.
 
 Before reusing an existing image, Build verifies its actual installed Brain and package versions against what its name says it holds. Deploy independently verifies the selected instance's requirements before provisioning or replacing containers, including manual deploys. Verification runs only a manifest-reading command in a read-only, network-disabled container on the CI runner; it never starts the Brain or mounts fleet data. Missing packages, mismatched versions, and verification failures stop the workflow.