2c91aea01d
The webui release handoff verified org.opencontainers.image.revision on the Harbor artifact's own extra_attrs.config.Labels. That works for a single-arch image, but a multi-arch manifest list has no top-level config, so Harbor reports the label on each per-arch child. build-38 built + published the index fine, then failed post-publish with 'Harbor artifact omitted OCI image labels'. verify_registry_digest now checks the top-level config labels when present (single-arch, unchanged) and otherwise walks the index references, fetching each child artifact by digest and asserting its revision label. Mirrors how the agent image lane already tolerates a multi-arch index, without dropping the supply-chain label check. Adds multi-arch pass/reject tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
titan-iac
Flux-managed Kubernetes desired-state config for bstein.dev.
Canonical source URL:
ssh://git@scm.bstein.dev:2242/atlas/titan-iac.git
Scope
This repo contains cluster configuration consumed by Flux:
- platform/infrastructure manifests
- service manifests and kustomizations
- operational scripts for render/reconcile workflows
Apply model
I use Git + Flux as the source of truth and avoid manual in-cluster edits for durable changes.