I had it wrong: `cloudron builder build` uploads the build context and the
registry app's BuildKit builds it — the caller needs no docker, only a registry
login. The guard now checks for that login and prints both bootstrap routes
(narrow app password scoped to the registry app, or the CLI device flow) instead
of blaming a missing docker binary.
Three drifts between this repo and reality, found while moving the per-member key
seed into the app:
- The 'verify after every image deploy' block asserted the CREAM palette
(rgb(250,248,245)). The deployed palette has been the green wash
(rgb(234,243,234) with white text areas) for some time, so a correct deploy
would have read as a failure — and invited someone to 'fix' the CSS back.
- The block still verified against librechat-test.inference.coop; the swap to
chat.inference.coop happened 2026-10-21 and that alias is not provisioned.
- Nothing checked that the scheduler task's script exists in the running image,
which is exactly the failure mode a manifest repoint can introduce.
release.sh encodes the documented release flow (dirty-tree guard, always
--no-cache, pin-before-deploy) and its verify subcommand runs checks 1-5 plus the
seed task's log lines. sync-keys.js now prints its own md5 prefix on every run,
so a stale volume copy can never hide again — the repo copy's md5 is the
authority.
Verified: ./release.sh verify passes all six checks against the live app;
./release.sh volume sync-keys.js confirms md5 parity.
- CloudronManifest.json: byte-identical copy of the OFFICIAL appstore manifest
(the hand-edited one stripped addons and crash-looped the app on 2026-10-18)
- Dockerfile: pinned base (202610150224320000), brand assets only + title sed
- librechat.yaml: schema 1.3.17; chat models only in picker (qwen-image moved
to the agent image tool); speech via gateway with capped key refs; SearXNG
web search; inference-docs MCP server; forward-compatible interface.theme
- mcp/server.py: docs MCP server (stdio, stdlib-only, tool search_docs)
- assets/: co-op logo + favicons/PWA icons
inference-admin
Nathan Schneider