@@ -665,29 +665,63 @@ jobs:
 
           IMAGES="simstudio migrations realtime pii cron"
 
-          # Prints the digest, or nothing when the tag is not published. The
-          # explicit `if !` matters: under `set -e` a failing inspect inside a
-          # command substitution aborts the step before the caller can treat an
-          # absent tag as "skip".
+          # Prints the digest, or nothing when the tag is genuinely absent.
+          #
+          # An absent tag and a registry hiccup both make `inspect` fail, and
+          # treating them alike is how a published image silently ends up
+          # unsigned while this job still goes green. So: retry, and only report
+          # "absent" when the registry actually says the manifest is unknown.
+          # Anything else fails the step.
           digest_of() {
-            local raw
-            if ! raw="$(docker buildx imagetools inspect "$1" --format '{{json .Manifest}}' 2>/dev/null)"; then
-              return 0
-            fi
-            printf '%s' "$raw" | jq -r '.digest // empty'
+            local ref="$1" attempt raw err
+            for attempt in 1 2 3; do
+              if raw="$(docker buildx imagetools inspect "$ref" --format '{{json .Manifest}}' 2>/tmp/inspect.err)"; then
+                printf '%s' "$raw" | jq -r '.digest // empty'
+                return 0
+              fi
+              err="$(cat /tmp/inspect.err)"
+              case "$err" in
+                *"not found"*|*MANIFEST_UNKNOWN*|*"no such manifest"*|*"NAME_UNKNOWN"*)
+                  return 0
+                  ;;
+              esac
+              sleep "$((attempt * 3))"
+            done
+            echo "::error::Could not inspect ${ref} after 3 attempts: ${err}" >&2
+            return 1
+          }
+
+          # Records a subject. `platform` tells the attestation job whether this
+          # digest is a single-architecture image, which is the only case where
+          # a Syft SBOM describes what the puller actually gets.
+          emit() {
+            jq -nc --arg image "$1" --arg digest "$2" --arg platform "$3" \
+              '{image: $image, digest: $digest, platform: $platform}' >> /tmp/subjects.jsonl
           }
 
           : > /tmp/subjects.jsonl
           for name in $IMAGES; do
             image="ghcr.io/simstudioai/${name}"
 
-            # The sha tags are this run's own output and always exist.
-            sha_index="$(digest_of "${image}:${SHA}")"
-            if [ -z "$sha_index" ]; then
-              echo "::error::No index published for ${image}:${SHA}"
-              exit 1
-            fi
-            tags="${SHA} ${SHA}-amd64 ${SHA}-arm64"
+            # The sha tags are this run's own output. All three must resolve —
+            # a missing one means the publish did not complete, not that the tag
+            # is optional.
+            seen=""
+            sha_index=""
+            for tag in "${SHA}" "${SHA}-amd64" "${SHA}-arm64"; do
+              digest="$(digest_of "${image}:${tag}")"
+              if [ -z "$digest" ]; then
+                echo "::error::${image}:${tag} was not published by this run"
+                exit 1
+              fi
+              case "$tag" in
+                *-amd64) platform=amd64 ;;
+                *-arm64) platform=arm64 ;;
+                *) platform=index; sha_index="$digest" ;;
+              esac
+              seen="$seen $digest"
+              emit "$image" "$digest" "$platform"
+            done
 
             # A moving alias is only ours if it resolves to the index this run
             # published. create-ghcr-manifests holds the latest tags back when
@@ -696,24 +730,31 @@ jobs:
             # and provenance on an image it did not produce. The per-arch
             # aliases are published in the same guarded block as `latest`, so
             # that one comparison gates all three.
-            if [ "$(digest_of "${image}:latest")" = "$sha_index" ]; then
-              tags="${tags} latest latest-amd64 latest-arm64"
-            else
-              echo "Skipping latest tags for ${image}: they do not point at this run's index."
-            fi
-
-            if [ "${IS_RELEASE}" = "true" ] && [ "$(digest_of "${image}:${VERSION}")" = "$sha_index" ]; then
-              tags="${tags} ${VERSION} ${VERSION}-amd64 ${VERSION}-arm64"
+            alias_groups="latest"
+            if [ "${IS_RELEASE}" = "true" ]; then
+              alias_groups="${alias_groups} ${VERSION}"
             fi
 
-            seen=""
-            for tag in $tags; do
-              digest="$(digest_of "${image}:${tag}")"
-              [ -n "$digest" ] || continue
-              case " $seen " in *" $digest "*) continue ;; esac
-              seen="$seen $digest"
-              jq -nc --arg image "$image" --arg digest "$digest" \
-                '{image: $image, digest: $digest}' >> /tmp/subjects.jsonl
+            for alias in $alias_groups; do
+              alias_index="$(digest_of "${image}:${alias}")"
+              if [ "$alias_index" != "$sha_index" ]; then
+                echo "Skipping ${alias}* for ${image}: it does not point at this run's index."
+                continue
+              fi
+              for tag in "${alias}" "${alias}-amd64" "${alias}-arm64"; do
+                digest="$(digest_of "${image}:${tag}")"
+                if [ -z "$digest" ]; then
+                  echo "::error::${image}:${tag} is missing though ${image}:${alias} is current"
+                  exit 1
+                fi
+                case " $seen " in *" $digest "*) continue ;; esac
+                seen="$seen $digest"
+                case "$tag" in
+                  *-amd64) emit "$image" "$digest" amd64 ;;
+                  *-arm64) emit "$image" "$digest" arm64 ;;
+                  *) emit "$image" "$digest" index ;;
+                esac
+              done
             done
           done
 
@@ -756,7 +797,12 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Skipped for index subjects: Syft resolves an index to one platform, so
+      # the SBOM it produces would describe amd64 while the index also serves
+      # arm64. The per-arch subjects below carry an accurate SBOM each, and the
+      # index still gets a signature and provenance.
       - name: Generate SBOM
+        if: matrix.platform != 'index'
         uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ matrix.image }}@${{ matrix.digest }}
@@ -768,6 +814,7 @@ jobs:
           upload-release-assets: false
 
       - name: Attest SBOM
+        if: matrix.platform != 'index'
         uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
         with:
           subject-name: ${{ matrix.image }}
 
@@ -161,7 +161,7 @@ The **Chat Deployment** row also carries an **auth-mode allowlist** — *Auth mo
 |---------|---------------------------|
 | Invitations | Prevents inviting anyone to a workspace or to the organization. |
 | Workspace Creation | Prevents creating new workspaces. A new one is not covered by any workspace-scoped group until you add it, though the organization's default group still governs it. |
-| Member Directory | Withholds the member directory. Members cannot see the names or email addresses of other members. |
+| Member Directory | Withholds the member directory. Members cannot see the names or email addresses of other members. Organization owners and admins keep access — the roster routes exempt those roles. |
 
 **Credentials & Access**
 
 
@@ -69,7 +69,7 @@ See [Sandboxes](/platform/self-hosting/sandboxes) for the provider credentials,
 
 ## Schedule the background jobs
 
-Two enterprise features do their work from a cron-driven HTTP endpoint rather than from the app process. All four endpoints authenticate with a bearer token equal to `CRON_SECRET`, and both return `401` when `CRON_SECRET` is unset:
+Two enterprise features do their work from a cron-driven HTTP endpoint rather than from the app process. All four endpoints authenticate with a bearer token equal to `CRON_SECRET`, and all four return `401` when it is unset:
 
 ```bash
 openssl rand -hex 32
 
@@ -151,7 +151,7 @@ Two browser-side variables project server state into the UI, and neither is deri
 
 | Variable | Effect when unset |
 |---|---|
-| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Shell language, its Sandbox picker, and **Settings → Sandboxes** stay hidden, even with a working provider. Python stays selectable and fails at execution |
+| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Shell language, its Sandbox picker, and **Settings → Sandboxes** stay hidden, even with a working provider. Python stays selectable; whether it runs depends on the server-side provider and Function image, not on this flag |
 | `NEXT_PUBLIC_E2B_ENABLED` | The E2B-backed Pi block modes stay hidden; `sim-setup doctor` reports it as a mismatch against `E2B_ENABLED`. Revealing them is not enough to make them run — Pi executes on its own image, pinned with `E2B_PI_TEMPLATE_ID` or `DAYTONA_PI_SNAPSHOT_ID`, and fails closed without it |
 
 Set the public values only **after** the server-side configuration above is complete — they are assertions about readiness, not switches, and the server-side check has its own conditions beyond them. See [Sandboxes](/platform/self-hosting/sandboxes) for the base-image build and promotion procedure. `npx sim-setup doctor` reports a mismatch in either direction.
@@ -276,7 +276,8 @@ The service bundles ~2.2 GB of spaCy models, so first start takes around three m
 - [ ] NetworkPolicy enabled and `ingressFrom` scoped to the ingress controller
 - [ ] Namespace labelled `pod-security.kubernetes.io/enforce=restricted`
 - [ ] Object storage buckets private, with CORS limited to your Sim origin
-- [ ] Database reachable only from the deployment — on Compose, the `db` service's host `ports:` mapping removed or bound to `127.0.0.1` — with a generated `POSTGRES_PASSWORD` and TLS enforced (`sslMode: require`)
+- [ ] Database reachable only from the deployment — on Compose, the `db` service's host `ports:` mapping removed or bound to `127.0.0.1` — with a generated `POSTGRES_PASSWORD`
+- [ ] TLS enforced (`sslMode: require`) on an externally managed database, or on the bundled one once you have configured it for TLS — the shipped Compose database does not enable it
 - [ ] Backups configured **and a restore rehearsed**
 - [ ] Sandbox strategy decided for user code
 
 
@@ -116,11 +116,9 @@ image: pgvector/pgvector:pg17  # NOT postgres:17
 
 ## Certificate errors (CERT_HAS_EXPIRED)
 
-SSL certificate errors when calling external APIs almost always mean the endpoint presents a certificate signed by a private CA — a TLS-inspecting proxy, or an internal service.
+Rule out the ordinary causes first: the endpoint's certificate really has expired, its chain is incomplete, or the host's clock has drifted far enough to put a valid certificate outside its window. Check the certificate and the host date before changing any trust configuration — `NODE_EXTRA_CA_CERTS` does not fix any of them.
 
-The image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. This almost always means the endpoint presents a certificate signed by a private CA — a corporate TLS-inspecting proxy, or an internal service.
-
-Mount your CA bundle and point Node at it:
+If the certificate is valid and current, the endpoint is presenting one signed by a private CA — a corporate TLS-inspecting proxy, or an internal service. The image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. Mount your CA bundle and point Node at it:
 
 ```yaml
 # docker-compose.prod.yml