Six countable criteria, the first of which is that images.txt stops existing and
is not replaced by another maintained file. Coverage of the running estate has
to reach 100 percent, measured as a set difference over normalised names, and
stay visible as a metric so the gap cannot return quietly.
The open question is how far "everything from the registry" reaches. Six repos
hold 36 tags; seven are CI artefacts and 25 of the remaining version tags run
nowhere. Scanning all of them triples the workload and puts findings about
v0.1.0 into the security room — the exact noise this work removes. Three
readings are laid out with a recommendation, not a decision.
The ledger records the rungs: nothing needed building for the sources. Both
image sets already live in the same Prometheus the scanner can reach, and the
registry answers an anonymous token. It also records two wrong turns of my own,
including reading a registry 401 as "needs credentials".
Thore Cimbal
e10cd5dee3