From 9de55986dc261708790fec5f7322c106d5e121ae Mon Sep 17 00:00:00 2001
From: zzstoatzz <thrast36@gmail.com>
Date: Sat, 8 Aug 2026 14:04:31 -0500
Subject: [PATCH] receipt: fd9fe7f admitted and deployed; admit push handles
 attestation manifests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fd9fe7f serving since 2026-08-08 18:57Z: cursor-resume hot-tail fix +
header-skip rebuild, compaction on at 2 rewrite workers. restart-to-
firehose measured 3m56s (was ~3.5h); 6,568 below-watermark segments
skipped at header read. cursor-resume verified smooth (250-600/s, zero
silent seconds); coral steady, degraded banner clear.

publish leg: docker 29 buildkit attaches an attestation manifest that
docker save exports with a dangling blob ref — load-then-push 404s.
admit now pushes the amd64 manifest alone; this deploy's image was
pushed from the box under an ephemeral DOCKER_CONFIG (one-time
deviation from creds-never-on-box, noted in ops changelog).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 receipts/fd9fe7f.json | 47 +++++++++++++++++++++++++++++++++++++++++++
 scripts/admit         |  5 ++++-
 2 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 receipts/fd9fe7f.json

diff --git a/receipts/fd9fe7f.json b/receipts/fd9fe7f.json
new file mode 100644
index 0000000..9283c90
--- /dev/null
+++ b/receipts/fd9fe7f.json
@@ -0,0 +1,47 @@
+{
+  "created_utc": "20260808T182701Z",
+  "image": {
+    "local_id": "sha256:20570110075a9b81513d2a8a984db285e7510dd4b41ac1331ac9d6d1981d07bb",
+    "registry_digest": "sha256:20570110075a9b81513d2a8a984db285e7510dd4b41ac1331ac9d6d1981d07bb",
+    "tag": "atcr.io/zat.dev/stream:fd9fe7f"
+  },
+  "revisions": {
+    "dashboard_sha256": "ef6033c182d8c3f9d88af7d91e61126724efbe72e6b940984c9de12e9530cd91",
+    "dependencies": {
+      "otel": "git+https://github.com/zzstoatzz/otel-zig.git#158b32d87762be4f6b65a7d723d08b20d74d1294",
+      "rocksdb": "https://github.com/zzstoatzz/rocksdb-zig/archive/9d2ebd8.tar.gz",
+      "websocket": "https://github.com/zzstoatzz/websocket.zig/archive/73429df.tar.gz",
+      "xxhash": "https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.3.tar.gz",
+      "zat": "https://tangled.org/zat.dev/zat/archive/409711c0ff5465211f3ff3eb8a5332332da09b3b.tar.gz",
+      "zstd": "https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-1.5.7.tar.gz"
+    },
+    "stream": "fd9fe7f6888e66c7f23641d51c06b8fe121256c0",
+    "stream_describe": "fd9fe7f",
+    "upstream_jetstream": "f29815c391fc2644f8a3dd36b899fb3697dd1ea6",
+    "upstream_jetstream_dirty": false,
+    "zig": "0.16.0"
+  },
+  "schema": "stream-admission/1",
+  "suites": {
+    "archive-contract": "pass",
+    "compaction-config-contract": "pass",
+    "cursor-lookback-contract": "pass",
+    "dashboard-test": "pass",
+    "differential-oracle": "pass",
+    "environment-contract": "pass",
+    "http-metrics-contract": "pass",
+    "lifecycle-oracle": "pass",
+    "listener-contract": "pass",
+    "logging-contract": "pass",
+    "plan-config-contract": "pass",
+    "powerloss-oracle": "pass",
+    "process-metrics-contract": "pass",
+    "retry-config-contract": "pass",
+    "shutdown-contract": "pass",
+    "status-contract": "pass",
+    "subscribe-config-contract": "pass",
+    "subscribe-read-batch-contract": "pass",
+    "unit-debug": "pass",
+    "unit-releasesafe": "pass"
+  }
+}
diff --git a/scripts/admit b/scripts/admit
index 39d943f..75a1fcc 100755
--- a/scripts/admit
+++ b/scripts/admit
@@ -268,7 +268,10 @@ cmd_publish() {
     die "local image $tag is $current but the receipt covers $recorded; rerun 'admit run'"
 
   note "pushing $tag"
-  ATCR_AUTO_AUTH=1 docker push "$tag" >&2
+  # --platform: the remote BuildKit attaches a provenance attestation to the
+  # manifest list, and docker save/load drops its blobs — a bare push then
+  # 404s on the missing attestation digest. Push the amd64 manifest alone.
+  ATCR_AUTO_AUTH=1 docker push --platform linux/amd64 "$tag" >&2
   digest=$(docker image inspect --format '{{index .RepoDigests 0}}' "$tag" | cut -d@ -f2)
   [ -n "$digest" ] || die "could not read the pushed digest"
 
-- 
2.51.2