fix(supply-chain): fail a release whose version tag is not this run's index

`latest` is allowed to lag — the monotonic guard holds it back when the branch
has moved on, and it then belongs to an older run that already attested it. A
version tag has no such carve-out: this run published it, so a mismatch now
fails rather than skipping, and a release can no longer ship a version image
nothing has attested.

The device-plugin mirror path was ambiguous. `sim.image` prepends the registry
to the repository verbatim, so the plugin lands at
`<registry>/nvcr.io/nvidia/k8s-device-plugin` — an operator who mirrored it
without the embedded host would get ImagePullBackOff. The inventory now states
the destination rule and offers the direct repository override for registries
that cannot nest that path.

Docs:

- doctor needs no root .env from a source checkout; that guidance was
  Compose-specific.
- The LM Studio commands hardcoded the production Compose file after the last
  round, which breaks an install started from the Ollama stack. They now take
  the file as a variable.
- NODE_EXTRA_CA_CERTS does fix an incomplete chain by supplying the missing
  intermediate; only expiry and clock drift are beyond it. The section had
  ruled it out for all three.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt

Author: waleedlatif1

.github/workflows/ci.yml

@@ -744,8 +744,17 @@ jobs:
             for alias in $alias_groups; do
               alias_index="$(digest_of "${image}:${alias}")"
               if [ "$alias_index" != "$sha_index" ]; then
-                echo "Skipping ${alias}* for ${image}: it does not point at this run's index."
-                continue
+                # `latest` is legitimately allowed to lag: the monotonic guard in
+                # create-ghcr-manifests holds it back when the branch has moved
+                # on, and it then belongs to an older run that attested it.
+                if [ "$alias" = "latest" ]; then
+                  echo "Skipping latest* for ${image}: it does not point at this run's index."
+                  continue
+                fi
+                # A version tag has no such carve-out. This run published it, so
+                # a release must not ship a version image nothing has attested.
+                echo "::error::${image}:${alias} does not resolve to this run's index (${sha_index:-none}); refusing to publish an unattested release image"
+                exit 1
               fi
               for tag in "${alias}" "${alias}-amd64" "${alias}-arm64"; do
                 digest="$(digest_of "${image}:${tag}")"

apps/docs/content/docs/platform/self-hosting/troubleshooting.mdx

@@ -13,7 +13,7 @@ npx sim-setup doctor --fix     # repair what it safely can
 npx sim-setup doctor --json    # machine-readable, for CI
 ```
 
-Run it from the directory holding your `.env` and Compose file. It exits `1` if anything failed, so it drops straight into a script. See [Verify Your Install](/platform/self-hosting/verify#sim-setup-doctor) for what each group of checks covers.
+On a standalone Compose install, run it from the directory holding your `.env` and Compose file. From a source checkout, run it there — it resolves the per-application env files itself and needs no root `.env`. It exits `1` if anything failed, so it drops straight into a script. See [Verify Your Install](/platform/self-hosting/verify#sim-setup-doctor) for what each group of checks covers.
 
 ## Database connection failed
 
@@ -61,11 +61,12 @@ Sim identifies dynamically discovered LM Studio and vLLM models by their `vllm/`
 
 1. Set `VLLM_BASE_URL`, and `VLLM_API_KEY` too if you enabled LM Studio's API authentication — without the key, discovery requests omit the bearer token and fail. No Compose file sets either for you — `docker-compose.ollama.yml` only sets `OLLAMA_URL` — so add them to the `simstudio` service's `environment:` block (or to `.env` and interpolate them), then recreate the service and confirm it landed:
 
-   Use the Compose file that started your installation — `docker-compose.prod.yml` for the documented production setup:
+   Use the Compose file that started your installation — `docker-compose.prod.yml` for the documented production setup, or `docker-compose.ollama.yml` if you started from the Ollama stack:
 
    ```bash
-   docker compose -f docker-compose.prod.yml up -d --force-recreate simstudio
-   docker compose -f docker-compose.prod.yml exec simstudio printenv VLLM_BASE_URL
+   COMPOSE_FILE=docker-compose.prod.yml   # or docker-compose.ollama.yml
+   docker compose -f "$COMPOSE_FILE" up -d --force-recreate simstudio
+   docker compose -f "$COMPOSE_FILE" exec simstudio printenv VLLM_BASE_URL
    ```
 
    An empty result means the variable never reached the container, and model discovery cannot run.
@@ -118,9 +119,11 @@ image: pgvector/pgvector:pg17  # NOT postgres:17
 
 ## Certificate errors (CERT_HAS_EXPIRED)
 
-Rule out the ordinary causes first: the endpoint's certificate really has expired, its chain is incomplete, or the host's clock has drifted far enough to put a valid certificate outside its window. Check the certificate and the host date before changing any trust configuration — `NODE_EXTRA_CA_CERTS` does not fix any of them.
+Rule out expiry and clock drift first: the endpoint's certificate may genuinely have expired, or the host's clock may have drifted far enough to put a valid certificate outside its window. Check the certificate dates and the host date before changing any trust configuration — no CA bundle fixes either.
 
-If the certificate is valid and current, the endpoint is presenting one signed by a private CA — a corporate TLS-inspecting proxy, or an internal service. The image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. Mount your CA bundle and point Node at it:
+That leaves two cases a bundle does address: the endpoint is signed by a private CA — a corporate TLS-inspecting proxy, or an internal service — or it serves an incomplete chain, omitting an intermediate. Adding the private root, or the missing intermediate, to `NODE_EXTRA_CA_CERTS` resolves both, though repairing the server's chain is the better fix when it is yours to repair.
+
+In either case, the image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. Mount your CA bundle and point Node at it:
 
 ```yaml
 # docker-compose.prod.yml

helm/sim/images.yaml

@@ -9,6 +9,13 @@
 # rewrites the `simstudioai/*` images, leaving the third-party ones pointing at
 # their public registries. Pin each image's `digest` to what your mirror
 # resolved.
+#
+# Mirror to `<your-registry>/<reference exactly as listed below>`. The chart
+# prepends your registry to the repository verbatim, so the device plugin lands
+# at `<your-registry>/nvcr.io/nvidia/k8s-device-plugin` — the `nvcr.io/`
+# segment is part of the path, not a source host to strip. If your registry
+# cannot nest that path, override the one image directly instead:
+# `ollama.gpu.devicePlugin.image.repository=<your-registry>/nvidia/k8s-device-plugin`.
 appVersion: v0.8.18
 images:
   - busybox:1.36

scripts/generate-image-manifest.ts

@@ -101,6 +101,13 @@ export function renderManifest(input: { appVersion: string; images: readonly str
 # rewrites the \`simstudioai/*\` images, leaving the third-party ones pointing at
 # their public registries. Pin each image's \`digest\` to what your mirror
 # resolved.
+#
+# Mirror to \`<your-registry>/<reference exactly as listed below>\`. The chart
+# prepends your registry to the repository verbatim, so the device plugin lands
+# at \`<your-registry>/nvcr.io/nvidia/k8s-device-plugin\` — the \`nvcr.io/\`
+# segment is part of the path, not a source host to strip. If your registry
+# cannot nest that path, override the one image directly instead:
+# \`ollama.gpu.devicePlugin.image.repository=<your-registry>/nvidia/k8s-device-plugin\`.
 appVersion: ${input.appVersion}
 images:
 ${entries}