fix(supply-chain): fail on an unresolvable tag instead of silently skipping it

`digest_of` treated every inspect failure as "tag absent", so a transient
registry error would drop a published digest from the matrix while both jobs
still went green — an unsigned image that verification would later reject, with
nothing in the run to show for it. It now retries, reports absent only when the
registry says the manifest is unknown, and fails the step otherwise. The three
sha tags are required outright, and an alias group that is current must resolve
all three of its tags.

SBOMs no longer attach to index subjects. Syft resolves an index to a single
platform, so the SBOM described amd64 while the index also serves arm64. The
per-arch subjects each carry an accurate SBOM; the index keeps its signature and
provenance.

Docs:

- The member-directory restriction does not apply to organization owners and
  admins — the roster routes exempt those roles.
- Python's execution does not hinge on NEXT_PUBLIC_SANDBOXES_ENABLED; that flag
  gates the controls, the server-side provider and image decide whether it runs.
- The security checklist demanded sslMode: require on a Compose database that
  ships without TLS, so it could not be satisfied as written.
- CERT_HAS_EXPIRED is usually an expired certificate, an incomplete chain, or a
  drifted clock. Sending operators straight to NODE_EXTRA_CA_CERTS fixes none of
  those, and the section also said the same thing twice.
- Four endpoints, not "both".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt

Author: waleedlatif1

.github/workflows/ci.yml

@@ -665,29 +665,63 @@ jobs:
 
           IMAGES="simstudio migrations realtime pii cron"
 
-          # Prints the digest, or nothing when the tag is not published. The
-          # explicit `if !` matters: under `set -e` a failing inspect inside a
-          # command substitution aborts the step before the caller can treat an
-          # absent tag as "skip".
+          # Prints the digest, or nothing when the tag is genuinely absent.
+          #
+          # An absent tag and a registry hiccup both make `inspect` fail, and
+          # treating them alike is how a published image silently ends up
+          # unsigned while this job still goes green. So: retry, and only report
+          # "absent" when the registry actually says the manifest is unknown.
+          # Anything else fails the step.
           digest_of() {
-            local raw
-            if ! raw="$(docker buildx imagetools inspect "$1" --format '{{json .Manifest}}' 2>/dev/null)"; then
-              return 0
-            fi
-            printf '%s' "$raw" | jq -r '.digest // empty'
+            local ref="$1" attempt raw err
+            for attempt in 1 2 3; do
+              if raw="$(docker buildx imagetools inspect "$ref" --format '{{json .Manifest}}' 2>/tmp/inspect.err)"; then
+                printf '%s' "$raw" | jq -r '.digest // empty'
+                return 0
+              fi
+              err="$(cat /tmp/inspect.err)"
+              case "$err" in
+                *"not found"*|*MANIFEST_UNKNOWN*|*"no such manifest"*|*"NAME_UNKNOWN"*)
+                  return 0
+                  ;;
+              esac
+              sleep "$((attempt * 3))"
+            done
+            echo "::error::Could not inspect ${ref} after 3 attempts: ${err}" >&2
+            return 1
+          }
+
+          # Records a subject. `platform` tells the attestation job whether this
+          # digest is a single-architecture image, which is the only case where
+          # a Syft SBOM describes what the puller actually gets.
+          emit() {
+            jq -nc --arg image "$1" --arg digest "$2" --arg platform "$3" \
+              '{image: $image, digest: $digest, platform: $platform}' >> /tmp/subjects.jsonl
           }
 
           : > /tmp/subjects.jsonl
           for name in $IMAGES; do
             image="ghcr.io/simstudioai/${name}"
 
-            # The sha tags are this run's own output and always exist.
-            sha_index="$(digest_of "${image}:${SHA}")"
-            if [ -z "$sha_index" ]; then
-              echo "::error::No index published for ${image}:${SHA}"
-              exit 1
-            fi
-            tags="${SHA} ${SHA}-amd64 ${SHA}-arm64"
+            # The sha tags are this run's own output. All three must resolve —
+            # a missing one means the publish did not complete, not that the tag
+            # is optional.
+            seen=""
+            sha_index=""
+            for tag in "${SHA}" "${SHA}-amd64" "${SHA}-arm64"; do
+              digest="$(digest_of "${image}:${tag}")"
+              if [ -z "$digest" ]; then
+                echo "::error::${image}:${tag} was not published by this run"
+                exit 1
+              fi
+              case "$tag" in
+                *-amd64) platform=amd64 ;;
+                *-arm64) platform=arm64 ;;
+                *) platform=index; sha_index="$digest" ;;
+              esac
+              seen="$seen $digest"
+              emit "$image" "$digest" "$platform"
+            done
 
             # A moving alias is only ours if it resolves to the index this run
             # published. create-ghcr-manifests holds the latest tags back when
@@ -696,24 +730,31 @@ jobs:
             # and provenance on an image it did not produce. The per-arch
             # aliases are published in the same guarded block as `latest`, so
             # that one comparison gates all three.
-            if [ "$(digest_of "${image}:latest")" = "$sha_index" ]; then
-              tags="${tags} latest latest-amd64 latest-arm64"
-            else
-              echo "Skipping latest tags for ${image}: they do not point at this run's index."
-            fi
-
-            if [ "${IS_RELEASE}" = "true" ] && [ "$(digest_of "${image}:${VERSION}")" = "$sha_index" ]; then
-              tags="${tags} ${VERSION} ${VERSION}-amd64 ${VERSION}-arm64"
+            alias_groups="latest"
+            if [ "${IS_RELEASE}" = "true" ]; then
+              alias_groups="${alias_groups} ${VERSION}"
             fi
 
-            seen=""
-            for tag in $tags; do
-              digest="$(digest_of "${image}:${tag}")"
-              [ -n "$digest" ] || continue
-              case " $seen " in *" $digest "*) continue ;; esac
-              seen="$seen $digest"
-              jq -nc --arg image "$image" --arg digest "$digest" \
-                '{image: $image, digest: $digest}' >> /tmp/subjects.jsonl
+            for alias in $alias_groups; do
+              alias_index="$(digest_of "${image}:${alias}")"
+              if [ "$alias_index" != "$sha_index" ]; then
+                echo "Skipping ${alias}* for ${image}: it does not point at this run's index."
+                continue
+              fi
+              for tag in "${alias}" "${alias}-amd64" "${alias}-arm64"; do
+                digest="$(digest_of "${image}:${tag}")"
+                if [ -z "$digest" ]; then
+                  echo "::error::${image}:${tag} is missing though ${image}:${alias} is current"
+                  exit 1
+                fi
+                case " $seen " in *" $digest "*) continue ;; esac
+                seen="$seen $digest"
+                case "$tag" in
+                  *-amd64) emit "$image" "$digest" amd64 ;;
+                  *-arm64) emit "$image" "$digest" arm64 ;;
+                  *) emit "$image" "$digest" index ;;
+                esac
+              done
             done
           done
 
@@ -756,7 +797,12 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Skipped for index subjects: Syft resolves an index to one platform, so
+      # the SBOM it produces would describe amd64 while the index also serves
+      # arm64. The per-arch subjects below carry an accurate SBOM each, and the
+      # index still gets a signature and provenance.
       - name: Generate SBOM
+        if: matrix.platform != 'index'
         uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ matrix.image }}@${{ matrix.digest }}
@@ -768,6 +814,7 @@ jobs:
           upload-release-assets: false
 
       - name: Attest SBOM
+        if: matrix.platform != 'index'
         uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
         with:
           subject-name: ${{ matrix.image }}

apps/docs/content/docs/platform/enterprise/access-control.mdx

@@ -161,7 +161,7 @@ The **Chat Deployment** row also carries an **auth-mode allowlist** — *Auth mo
 |---------|---------------------------|
 | Invitations | Prevents inviting anyone to a workspace or to the organization. |
 | Workspace Creation | Prevents creating new workspaces. A new one is not covered by any workspace-scoped group until you add it, though the organization's default group still governs it. |
-| Member Directory | Withholds the member directory. Members cannot see the names or email addresses of other members. |
+| Member Directory | Withholds the member directory. Members cannot see the names or email addresses of other members. Organization owners and admins keep access — the roster routes exempt those roles. |
 
 **Credentials & Access**
 

apps/docs/content/docs/platform/enterprise/self-hosted.mdx

@@ -69,7 +69,7 @@ See [Sandboxes](/platform/self-hosting/sandboxes) for the provider credentials,
 
 ## Schedule the background jobs
 
-Two enterprise features do their work from a cron-driven HTTP endpoint rather than from the app process. All four endpoints authenticate with a bearer token equal to `CRON_SECRET`, and both return `401` when `CRON_SECRET` is unset:
+Two enterprise features do their work from a cron-driven HTTP endpoint rather than from the app process. All four endpoints authenticate with a bearer token equal to `CRON_SECRET`, and all four return `401` when it is unset:
 
 ```bash
 openssl rand -hex 32

apps/docs/content/docs/platform/self-hosting/security.mdx

@@ -151,7 +151,7 @@ Two browser-side variables project server state into the UI, and neither is deri
 
 | Variable | Effect when unset |
 |---|---|
-| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Shell language, its Sandbox picker, and **Settings → Sandboxes** stay hidden, even with a working provider. Python stays selectable and fails at execution |
+| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Shell language, its Sandbox picker, and **Settings → Sandboxes** stay hidden, even with a working provider. Python stays selectable; whether it runs depends on the server-side provider and Function image, not on this flag |
 | `NEXT_PUBLIC_E2B_ENABLED` | The E2B-backed Pi block modes stay hidden; `sim-setup doctor` reports it as a mismatch against `E2B_ENABLED`. Revealing them is not enough to make them run — Pi executes on its own image, pinned with `E2B_PI_TEMPLATE_ID` or `DAYTONA_PI_SNAPSHOT_ID`, and fails closed without it |
 
 Set the public values only **after** the server-side configuration above is complete — they are assertions about readiness, not switches, and the server-side check has its own conditions beyond them. See [Sandboxes](/platform/self-hosting/sandboxes) for the base-image build and promotion procedure. `npx sim-setup doctor` reports a mismatch in either direction.
@@ -276,7 +276,8 @@ The service bundles ~2.2 GB of spaCy models, so first start takes around three m
 - [ ] NetworkPolicy enabled and `ingressFrom` scoped to the ingress controller
 - [ ] Namespace labelled `pod-security.kubernetes.io/enforce=restricted`
 - [ ] Object storage buckets private, with CORS limited to your Sim origin
-- [ ] Database reachable only from the deployment — on Compose, the `db` service's host `ports:` mapping removed or bound to `127.0.0.1` — with a generated `POSTGRES_PASSWORD` and TLS enforced (`sslMode: require`)
+- [ ] Database reachable only from the deployment — on Compose, the `db` service's host `ports:` mapping removed or bound to `127.0.0.1` — with a generated `POSTGRES_PASSWORD`
+- [ ] TLS enforced (`sslMode: require`) on an externally managed database, or on the bundled one once you have configured it for TLS — the shipped Compose database does not enable it
 - [ ] Backups configured **and a restore rehearsed**
 - [ ] Sandbox strategy decided for user code
 

apps/docs/content/docs/platform/self-hosting/troubleshooting.mdx

@@ -116,11 +116,9 @@ image: pgvector/pgvector:pg17  # NOT postgres:17
 
 ## Certificate errors (CERT_HAS_EXPIRED)
 
-SSL certificate errors when calling external APIs almost always mean the endpoint presents a certificate signed by a private CA — a TLS-inspecting proxy, or an internal service.
+Rule out the ordinary causes first: the endpoint's certificate really has expired, its chain is incomplete, or the host's clock has drifted far enough to put a valid certificate outside its window. Check the certificate and the host date before changing any trust configuration — `NODE_EXTRA_CA_CERTS` does not fix any of them.
 
-The image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. This almost always means the endpoint presents a certificate signed by a private CA — a corporate TLS-inspecting proxy, or an internal service.
-
-Mount your CA bundle and point Node at it:
+If the certificate is valid and current, the endpoint is presenting one signed by a private CA — a corporate TLS-inspecting proxy, or an internal service. The image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. Mount your CA bundle and point Node at it:
 
 ```yaml
 # docker-compose.prod.yml