Only ghcr.io/uug-ai images are trusted, so Admin now defaults to the
signed GHCR release with the hardened runtime production already uses
(8080, 65532 non-root, read-only root, memory /tmp, /healthz probes).
A legacy image can be restored with the documented opt-out values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hub-frontend v1.19.35 is a hardened release with the signed
image-hardening attestation (v1.19.34 was hardened before attestations
existed). With it, every chart default with a hardening policy is an
attested hardened release. Frontend runtime check and README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
check-frontend-runtime.sh asserted the old default hub-frontend tag
(v1.19.28); README parameter table defaults were stale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Coordinate frontend v1.19.28, port 8080, non-root/read-only security defaults and writable scratch for primary and demo. Preserve Service port 80, Admin legacy defaults, and explicit legacy rollback settings. Validate real image startup, health and generated configuration in Kind.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
