status(bsky): bootstrap phase — root cause proven (:0.4 moving tag now ships 0.5.1/node24/index.ts; recipe entrypoint execs index.js), fix = exact-pin 0.4.219; decisions + upstream registry

STATUS-bsky.md

@@ -0,0 +1,46 @@
+# STATUS — phase bsky (fix bluesky-pds recipe + screenshot)
+
+Phase SSOT: /srv/cc-ci/cc-ci-plan/plan-phase-bsky-fix.md
+Gate: none claimed yet — working M1 (root cause + green fix PR).
+
+## Root cause (established 2026-06-11, evidence below)
+
+bluesky-pds pins the MOVING image tag `ghcr.io/bluesky-social/pds:0.4` and overrides the
+image entrypoint with a config script that ends `exec node --enable-source-maps index.js`
+(relative to image WORKDIR `/app`). Upstream now publishes main-branch builds to `:0.4`
+(== `latest`): the current manifest (digest `sha256:871194d2…`, created 2026-05-30) is
+`@atproto/pds` 0.5.1 on Node v24.15.0 with the service restructured to `/app/index.ts`
+(no `index.js`) and CMD `node --enable-source-maps index.ts`. The recipe's hardcoded
+`index.js` therefore crash-loops `Cannot find module '/app/index.js'` (MODULE_NOT_FOUND).
+
+Newest EXACT tag `0.4.219` keeps the layout the recipe assumes: Node v20.20.2,
+`/app/index.js` present, dumb-init present, CMD `node --enable-source-maps index.js`,
+`@atproto/pds: 0.4.219` (verified by running the image on cc-ci).
+
+## How to verify the root cause (from any host with docker + ssh cc-ci)
+
+- `ssh cc-ci 'docker image inspect ghcr.io/bluesky-social/pds:0.4 --format "{{.Created}} {{.Config.Cmd}}"'`
+  → EXPECTED: created 2026-05-30…, cmd `[node --enable-source-maps index.ts]`
+- `ssh cc-ci 'docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4 -c "node --version; ls /app; grep @atproto/pds /app/package.json"'`
+  → EXPECTED: v24.15.0; index.ts (NO index.js); `"@atproto/pds": "0.5.1"`
+- `ssh cc-ci 'docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4.219 -c "node --version; ls /app; grep @atproto/pds /app/package.json"'`
+  → EXPECTED: v20.20.2; index.js present; `"@atproto/pds": "0.4.219"`
+- Recipe entrypoint: mirror `recipe-maintainers/bluesky-pds` @ b2d86ef,
+  `entrypoint.sh.tmpl` last line `exec node --enable-source-maps index.js`;
+  compose.yml `image: ghcr.io/bluesky-social/pds:0.4`.
+- Upstream refs: Dockerfile@main (node:24.15-alpine3.23, CMD index.ts) vs
+  Dockerfile@v0.4.219 (node:20.20-alpine3.23, CMD index.js);
+  ghcr tags list (exact tags end at 0.4.219; `:0.4` digest == `latest` digest
+  `sha256:871194d2…` ≠ `0.4.219` digest `sha256:e0b756701c92…`).
+  Research persisted: cc-ci-plan/upstream/bluesky-pds.md (plan repo f395247).
+
+## Fix in flight (M1)
+
+Re-pin to exact tag `0.4.219` + version label bump `0.2.0+v0.4` → `0.3.0+v0.4.219` on a
+mirror PR branch `upgrade-0.3.0+v0.4.219` (precedent: immich PR#2 naming). Entrypoint
+script unchanged — it matches 0.4.219's layout exactly. Then `!testme` to green, then
+screenshot verification.
+
+## Operator summary
+
+(to be completed at M2)