stale-docker-compose-images
Done. The verified solution is written to ~/solution-stale-docker-compose-images.md.
Root cause: docker compose up -d builds an image only if the tag doesn't already exist locally. On an existing checkout with a fixed image tag (e.g. api:latest), pulling the board-closed fix doesn't trigger a rebuild — compose reuses the cached pre-fix image, so /v1/open still credits fabricated hashes (200 SHADOW_QUALIFIED_OPEN shadow_credit:1) while HEAD correctly says 404 hash_not_found. CI passes because it builds fresh; only the local stack is stale.
The fix (in the document):
1. Immediate: docker compose up -d --build (forces rebuild + container recreation; pull-based variant: docker compose pull && up -d)
2. Permanent: Quick Start changed to document --build, with a staleness warning callout
3. Hardening: commit-SHA image tags, /v1/version build marker, CI-driven rebuild
Verification (all in the doc):
- Freshness: docker inspect <api-container> --format '{{.Created}}' (epoch-compared) ≥ fix commit time
- Negative path: forged hash → 404 hash_not_found, credits unmoved
- Positive path: real corpus hash → 200 SHADOW_QUALIFIED_OPEN, credit +1
- A copy-paste set -euo pipefail script (section 4.5) that runs all of it
Validation performed (no docker daemon available here, so I mocked the toolchain):
- The 4.5 script passes bash -n
- End-to-end mock run with fake git/docker/curl/jq:
| Scenario | Result |
|---|---|
| Fixed stack (container after fix commit) | ALL CHECKS PASSED, exit 0 |
Stale container ({{.Created}} < fix commit) |
Freshness check correctly FAILs, exit 1 |
| Old image still crediting forged hashes | Negative-path check correctly FAILs, exit 1 |
The reference table (section 5) maps each endpoint probe to its fixed vs. stale response so the ticket closure is unambiguous.
# Evidence - Problem class: stale-docker-compose-images - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-08-18T11:51:49.042Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Live stack serves old images after board-closed fixes; docker compose up -d reuses cached images on existing checkouts. Symptom: fabricated-hash POST /v1/open returns 200 SHADOW_QUALIFIED_OPEN shadow_credit:1 while HEAD returns 404 hash_not_found. Fix: docker compose up -d --build; verify with docker inspect <api-container> --format {{.Created}} >= fix commit time, then re-run the forged-hash open expecting 404 + credits unmoved, and positive-path real search hash -> 200 credit accrual. Quick Start should document --build. Proven: asce tick #351 (GAP-022).", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "stale-docker-compose-images", "provider": "openrouter", "solved_at": "2026-08-18T11:51:49.042Z", "version": ""}Done. The verified solution is written to ~/solution-stale-docker-compose-images.md.
Root cause: docker compose up -d builds an image only if the tag doesn't already exist locally. On an existing checkout with a fixed image tag (e.g. api:latest), pulling the board-closed fix doesn't trigger a rebuild — compose reuses the cached pre-fix image, so /v1/open still credits fabricated hashes (200 SHADOW_QUALIFIED_OPEN shadow_credit:1) while HEAD correctly says 404 hash_not_found. CI passes because it builds fresh; only the local stack is stale.
The fix (in the document):
1. Immediate: docker compose up -d --build (forces rebuild + container recreation; pull-based variant: docker compose pull && up -d)
2. Permanent: Quick Start changed to document --build, with a staleness warning callout
3. Hardening: commit-SHA image tags, /v1/version build marker, CI-driven rebuild
Verification (all in the doc):
- Freshness: docker inspect <api-container> --format '{{.Created}}' (epoch-compared) ≥ fix commit time
- Negative path: forged hash → 404 hash_not_found, credits unmoved
- Positive path: real corpus hash → 200 SHADOW_QUALIFIED_OPEN, credit +1
- A copy-paste set -euo pipefail script (section 4.5) that runs all of it
Validation performed (no docker daemon available here, so I mocked the toolchain):
- The 4.5 script passes bash -n
- End-to-end mock run with fake git/docker/curl/jq:
| Scenario | Result |
|---|---|
| Fixed stack (container after fix commit) | ALL CHECKS PASSED, exit 0 |
Stale container ({{.Created}} < fix commit) |
Freshness check correctly FAILs, exit 1 |
| Old image still crediting forged hashes | Negative-path check correctly FAILs, exit 1 |
The reference table (section 5) maps each endpoint probe to its fixed vs. stale response so the ticket closure is unambiguous.
# Evidence - Problem class: stale-docker-compose-images - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-08-18T11:51:49.042Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Live stack serves old images after board-closed fixes; docker compose up -d reuses cached images on existing checkouts. Symptom: fabricated-hash POST /v1/open returns 200 SHADOW_QUALIFIED_OPEN shadow_credit:1 while HEAD returns 404 hash_not_found. Fix: docker compose up -d --build; verify with docker inspect <api-container> --format {{.Created}} >= fix commit time, then re-run the forged-hash open expecting 404 + credits unmoved, and positive-path real search hash -> 200 credit accrual. Quick Start should document --build. Proven: asce tick #351 (GAP-022).", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "stale-docker-compose-images", "provider": "openrouter", "solved_at": "2026-08-18T11:51:49.042Z", "version": ""}