command-center/agent/managed-skills/fleet-image-pull-freshness-audit/SKILL.md

name, description

name	description
fleet-image-pull-freshness-audit	Answer "when was the last time we pulled/updated engine?" for digest-pinned dank-fleet images: git-history pin dating vs host podman state, pull-vs-restart distinction.

Answer "when was the last time we pulled/updated ?" for a digest-pinned fleet endpoint (radiance/halogen/llama.cpp images on dankserver/dankclaw).

Procedure

1. Locate the pin. grep the repo for the image digest prefix (e.g. 4c3f484564) — pins live in scripts/<svc>.env (FRANK_ARCHON_IMAGE etc.) and are restated in AGENTS.md / runbooks.
2. Date the pin in git. git log --all --format='%h %ad %s' --date=short -S '<digest-full-prefix>' — the OLDEST hit is the cutover that pulled it (renames and service-name sweeps produce later hits; ignore them).
3. Check the host state. ssh <host> 'sudo podman images --format "{{.Repository}}:{{.Tag}} {{.ID}} {{.Digest}} {{.CreatedTime}}"' Compare the on-disk digest to the pin. CreatedTime is the VENDOR build stamp, not the pull time — it proves which build is on disk; the git commit dates the pull.
4. Distinguish pull from restart. Digest pinning means the serve script NEVER auto-pulls; a fresh ActiveEnterTimestamp (systemctl show <svc> -p ActiveEnterTimestamp) is a restart, not an update.
5. Sweep side pulls. A newer engine version may have been pulled for a one-off (calibration, KLD, bench) and removed after. podman images census + git log -S for the second digest; note when the side image is gone from disk (answer: "pulled , no longer on disk").

Facts to carry (radiance example)

• frank-archon pin stilldeadcode/radiance@sha256:4c3f484564… (1.0.13) pulled 2026-10-05 (cutover commit); reused unchanged at the 2026-10-08 w4dn8 cutover.
• Engine 1.2.0 was pulled 2026-10-08 for calibration only; image absent from disk afterwards.
• Cross-pin compatibility (e.g. RADGRAM2 grams byte-identical across pins) is documented in the runbook — cite it when explaining a calibration/serving pin split.

Answer format

Table: pin-first-introduced commit+date (the pull), later cutovers reusing the same digest (no pull), side-image pulls, last container start (restart, explicitly labeled not-a-pull). Offer upstream freshness scout as next step; a digest change for an LLM endpoint requires the stop-and-mask bench-window law.