[objectstack-fleet]

Requested by Steedos · project thread
Fixes #356
Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:安全参考页「Supply chain」一节改写:Community 镜像 ghcr.io/objectstack-ai/objectstack 由开源仓 objectstack-ai/objectstack 在每次发版时构建发布,标签跟随 CLI 版本;Enterprise 镜像只写部署页已有的说法(私有仓库、随许可证给凭据),并链到 Docker 页的校验一节;删去无出处的「可复现构建溯源」;固定镜像的建议改为「Community 用精确版本 X.Y.Z,Enterprise 用发布说明里的 digest」。页尾加固清单的同一处 sha-SHORT 说法一并改正。
• 为什么改:原文说镜像从本文档仓库发布,并建议使用从未发布过的 sha-SHORT 标签,与部署页矛盾;发布 workflow 也没有配置任何溯源证明。
• 风险与回滚:仅改一页英文文案,不动代码;该页没有译文文件,无需删除。回滚即 revert 本 PR。
• 先看:content/docs/reference/security.mdx 的 Supply chain 一节(第 305–322 行)和第 336 行。
• 两分钟验证:打开 /docs/reference/security#supply-chain,四条要点里不再出现 objectos 仓库链接和 sha- 标签,三个站内链接都落到对应小节。
• 需要你做的:无,席位落地。

What changes

File

Change

content/docs/reference/security.mdx

§ Supply chain: the image bullet now names the Community image, the repository it is built from, and its version tags; a new Enterprise bullet says only what the Deployment page says and links the Docker verification section; the unsourced "reproducible build provenance" is removed; the pinning bullet matches the Deployment and Docker pages (exact X.Y.Z on Community, the release-notes digest on Enterprise). § Suggested hardening checklist: the "pinned to sha-SHORT or semver tag" item becomes "an exact version tag (X.Y.Z) or a digest, never a rolling tag".

Every fact is read from a file and line:

• Community image name, public: this site's content/docs/deploy/index.mdx:22 and content/docs/deploy/docker.mdx:12.
• Published on every ObjectStack release, tags mirror the CLI version (X.Y.Z, with latest, X.Y, X rolling): content/docs/deploy/docker.mdx:17-21; in objectstack at aa00362f, .github/workflows/docker-publish.yml:3-4 (built from docker/Dockerfile, pushed to ghcr), :16, :143-154 (the docker/metadata-action tag list has semver patterns and latest only, no type=sha), called from .github/workflows/release.yml:2093 after changeset publish.
• Provenance: docker-publish.yml has no attest-build-provenance step, no id-token: write permission (:44-46), and no provenance: or sbom: input on docker/build-push-action (:156-165). So the page drops the claim.
• Enterprise image from a private registry with the license's credentials, pinned by the release-notes digest: content/docs/deploy/index.mdx:22-23.
• A rolling tag can be re-pointed: content/docs/deploy/index.mdx:38.

Tests

Content-only diff; no test files change. Gates are under Verification.

Acceptance notes

• AGENTS.md rule 3: the provenance claim is removed, but reference/security.mdx has no locale siblings (git ls-files 'content/docs/reference/security*' lists only the English file), so there is nothing to delete.
• Hardening checklist item (line 336) is in scope: it is the same sha-SHORT claim in the same file, fixed the same way.
• Enterprise: only the Deployment page's wording plus a link to deploy/docker#verify-the-image-before-production. Nothing about signing, SBOM or provenance is restated here.
• Serial with docs: the Chinese terms page says ObjectOS Community is open source; links follow the repository rename #355: that PR changes the old image bullet's link. This PR rewrites the bullet from main; whichever lands second merges main and keeps this wording.
• Provenance, measured but not written: the published latest index on ghcr (index digest sha256:3d14ddf5…) carries one attestation manifest per platform with predicate https://slsa.dev/provenance/v1. It is BuildKit's default from docker/build-push-action, unsigned, and nothing in the workflow asks for it; the GitHub attestations API answers 404 for the index and the amd64 digest. A default the workflow does not declare can change without notice, so the page does not cite it.

Verification

At head a94c0c6, all exit codes captured before any pipe:

Gate	Exit
pnpm install --frozen-lockfile	0
node apps/docs/scripts/gen-zh-hant.mjs --check	0
node .github/scripts/check-doc-samples.mjs	0
pnpm turbo run type-check --continue	0
pnpm turbo run build --force (NEXT_PRIVATE_STANDALONE=true, under the verify lock)	0
check-locale-surface.mjs / check-positioning.mjs / check-search-locales.mjs	0 / 0 / 0
check-translations.mjs	0
check-translation-ownership.mjs --files (1 file, 0 translation artifacts)	0
pnpm turbo run test	0
smoke-docs.mjs --base http://localhost:3356 on next start of the build	0 ("4 page(s) rendered … negative control demonstrated red, search answered in 8 locale(s)")

Playwright, desktop 1440×900 and phone 390×844: the four Supply chain links resolve to https://github.com/objectstack-ai/objectstack, /docs/deploy#the-two-images, /docs/deploy/docker#verify-the-image-before-production and /docs/deploy/docker#pin-the-image, and each target page has the anchor element (count 1). The section wraps cleanly on the phone width.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QsR2jSu4EKmL1qLQgAxPaS

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-27T23:03Z · session_01QsR2jTaZ2GeyfjANMwstiw · seat repo:docs.objectos.ai#1

1. Shape. Draft PR against main (based on 88f98bd), head a94c0c6, 1 file (content/docs/reference/security.mdx) +15/−5. First line Fixes #356. Clause-②: no and Metadata-protocol: none match claim 6455554230. Tier none.
2. Facts, seat-verified. objectstack .github/workflows/docker-publish.yml (on origin/main): lines 3-4 build and push ghcr.io/objectstack-ai/objectstack; the workflow_call entry from release.yml runs on every release; the metadata step tags {{version}}, {{major}}.{{minor}}, {{major}} and latest from the CLI version. grep -iE "attest|provenance|sbom" finds nothing (exit 1), so removing the provenance claim is right. The Enterprise wording and the pinning advice match deploy/index.mdx:22-23 word for word, and the three anchors exist (deploy#the-two-images, deploy/docker#pin-the-image, #verify-the-image-before-production at docker.mdx:15,301).
3. Gates, check-runs at head a94c0c6. build success (type-check, build, bundle budget, local workerd render smoke) · Ownership & freshness success · Node floor success. Dev-local: the full ci.yml list exits 0, plus smoke-docs on next start. No security.<locale>.mdx sibling exists, so rule 3 deletes nothing.
4. Accepted scope. The hardening checklist's sha-<short> item in the same file got the same correction.
5. Open questions and finding. (1) BuildKit's default provenance on ghcr is undeclared, so the site says nothing about it. (2) Enterprise signing and SBOM are with the cloud lane. The dev's finding is filed: workflow_dispatch re-pushes an existing X.Y.Z (docker-publish.yml:12-14), so an exact version tag is not immutable. That reaches deploy/docker.mdx:19-20, deploy/index.mdx:38 and the new pinning bullet here. This PR stays consistent with the deploy pages, and the new card corrects all three together.
6. Landing. Tier none. The seat lands it through the merge queue under the maintainer's standing go-ahead, after docs(i18n): zh-Hans for the root pages, Start and Editions; sync locale sidebars #357's main deploy smoke-checks green. PR docs: the Chinese terms page says ObjectOS Community is open source; links follow the repository rename #355 also edits this file's Supply chain link, and docs: the Chinese terms page says ObjectOS Community is open source; links follow the repository rename #355 merges main when it lands.