Repository navigation
bug: DEPLOY.md, docker-compose.example.yml and Makefile tell users to run UPSTREAM's image #167
Description
Our own deployment instructions tell users to pull upstream's container image. Anyone following DEPLOY.md deploys Kpa-clawbot's build of CoreScope, not ours.
Found while writing #163's upstream policy, by running the grep that policy tells reviewers to run.
Live, user-facing [repo: master @ adbfa0a]
| file:line | content | effect |
|---|---|---|
DEPLOY.md:14 |
ghcr.io/kpa-clawbot/corescope:latest |
the documented pull is upstream's image |
DEPLOY.md:22 |
curl -sL https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/docker-compose.example.yml |
fetches upstream's compose file at their current master, not ours |
docker-compose.example.yml:19 |
image: ghcr.io/kpa-clawbot/corescope:latest |
our committed example runs upstream's image |
Makefile:58 |
DOCKER_IMAGE ?= ghcr.io/kpa-clawbot/corescope |
the default image target for local builds and pushes |
We publish to ghcr.io/oki-mesh/corescope and have since #60 (2026-07-26). These four were never repointed.
Consequences, in order of seriousness:
- A user following our public
DEPLOY.mdruns upstream's code, including any change upstream makes, with none of our fixes — fix(server): resolve byTxID under snapshot RLock in observer analytics (#134) #141's race fix, the goose migration work, the deploy hardening. They then report bugs against behaviour we do not ship. DEPLOY.md:22pulls a live file from upstream's master, so what a user gets changes whenever upstream changes it. That is a supply-chain dependency on a repository we deliberately detached from.Makefile:58means a carelessmaketarget could push to, or attempt to push to, upstream's registry. Same class as bug(ci): release-fast-path verifies and deletes against ghcr.io/kpa-clawbot, not our registry #164, which had the same root cause in CI.
Runtime, lower severity but still wrong
| file:line | content | why it matters |
|---|---|---|
cmd/server/known_channels_cache.go:177 |
User-Agent: CoreScope-KnownChannels/1.0 (+https://github.com/Kpa-clawbot/CoreScope) |
an outbound header we send to third parties identifies us as upstream |
cmd/ingestor/db.go:765 |
error text cites Kpa-clawbot/CoreScope/issues/919 |
sends an operator reading our logs to an issue tracker that is not ours |
cmd/server/openapi_known_gaps.json:3 |
"_issue": ".../issues/1670" |
same, in published API metadata |
package-lock.json:2 |
"name": "meshcore-analyzer" |
the pre-handover project name, two renames out of date |
AGENTS.md:139 |
main clone given as C:\Projects\meshcore-analyzer\ |
wrong path and wrong project name; agents read this file first |
cmd/decrypt/README.md:27,31 |
release download URLs point at upstream's releases page | a user downloads upstream's binary |
Relationship to #147
#147 was scoped to the imported agent surface — 11 files referencing the pre-handover repo, of which #151 removed the worst (a release runbook aimed at upstream's Actions).
The files above are a different set and were not in that scope. When #147 was triaged the remainder was characterised as "historical logs" that could stay. That characterisation was wrong, and it was made without reading the files — DEPLOY.md and the Makefile are neither historical nor logs.
Not counted here: .squad/, .github/agents/, .github/instructions/ and docs/agents/ also carry the old name, but those paths are being deleted wholesale under #144 and need no repointing.
Fix
Mechanical, and the same lesson as #164: define the registry once rather than repeating it.
DEPLOY.md— repoint the image and fetch our owndocker-compose.example.ymlby relative path or our raw URL.docker-compose.example.yml—ghcr.io/oki-mesh/corescope:latest.Makefile:58—ghcr.io/oki-mesh/corescope.known_channels_cache.go:177— our URL in the User-Agent.package-lock.json— rename the package.AGENTS.md:139— correct path and name (coordinate with Decide the single source of truth for agent guardrails (AGENTS.md vs docs/agents vs .github/agents) #149, which rewrites that file).- Error text and README download URLs — our issue tracker and our releases.
Then add the check to CI so it cannot regress; #157 is the natural home, or a standalone grep gate:
grep -rniE "kpa-clawbot|meshcore-analyzer" \
--exclude-dir=.git --exclude-dir=.squad --exclude-dir=docs --exclude=UPSTREAM.md .That currently returns the set above. Once cleared it should return nothing outside the #144 paths, which makes it usable as a gate.
Done when
No file outside the #144 deletion set names kpa-clawbot or meshcore-analyzer in a way that affects what a user downloads, what a build pushes, what we send over the wire, or where we send people for support — and CI fails a PR that reintroduces one.
Activity