archipelagoandClaude Opus 5
44b50a39d4
Fixes 4 test failures introduced by8e814ca0, which I pushed after running only the container-crate tests while the full suite was still compiling. Both failures were real defects, not stale assertions. 1. Catalog-driven installs would have failed fleet-wide.8e814ca0dropped the old registry address from TRUSTED_REGISTRIES, but the signed catalog still advertises image refs on it — deliberately, since rewriting a signed artifact invalidates its signature. Nodes resolve apps through the catalog, so every install would have been refused with "not from a trusted registry". Reinstated as LEGACY_REGISTRY_HOST, documented as transitional and removable only once the catalog is re-signed. 2. The update fallback lost the property it exists for. update.rs keeps two mirrors on purpose: the domain as primary, and the old IP over plain HTTP as a fallback, because a node whose DNS or clock is wrong (both break TLS) must still be able to update itself — the signature, not the transport, is what makes either source safe. The bulk rewrite pointed both constants at the domain, leaving the escape hatch dependent on exactly what it exists to survive. Restored to its original value. Separately, validate-app-manifest.sh is ported from ruby to python3+PyYAML. It shelled out to ruby with stderr discarded, so on any machine without ruby a missing interpreter was reported as "Valid YAML with top-level app block: FAIL" and every manifest came back REJECTED. This is the first tool an app developer runs, and it sent them to fix YAML that was never broken. Ruby was also the odd dependency out — the repo already ships three python scripts. It now checks for python3 and PyYAML up front and names what is missing, then parses with PyYAML. Missing keys resolve to an absent-value object that indexes to itself and prints empty, so call sites lost their per-hop guards: (((app["container"] || {})["build"] || {})["context"]) becomes app["container"]["build"]["context"]. Booleans still print as true/false rather than Python's True/False — call sites compare == "true", so Python's capitalisation would have silently inverted the readonly_root and no_new_privileges security checks. Verified: full rust suite 1148/1148, 0 failed. All 56 app manifests validate (0 rejected, 0 errored) where previously every one was rejected. No signed artifact modified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Archipelago
Self-sovereign Bitcoin node OS and manifest-driven app platform.
Archipelago is a bootable personal server OS for Bitcoin infrastructure,
self-hosted apps, mesh communication, decentralized identity, and federation.
Apps are packaged as declarative manifest.yml files and run as rootless
Podman containers managed by the Rust backend.
What is here
core/- Rust workspace: backend API, container runtime, security, OpenWrt helpers, and performance/resource management.neode-ui/- Vue 3 + TypeScript frontend.apps/- app manifests and custom app container sources.docker/- supporting container build contexts for UI companion surfaces.image-recipe/- bootable image/ISO build inputs.Android/- Android companion app.scripts/- development, release, deployment, and validation tooling.docs/- architecture, app packaging, operations, API, and roadmap docs.
Platform model
Archipelago is built as a developer-ready app platform, not a fixed appliance:
- Apps are declared in
apps/<app-id>/manifest.yml. - The Rust parser in
core/container/src/manifest.rsis the canonical schema. - The orchestrator compiles manifests to rootless Podman/Quadlet runtime state.
- App data lives under
/var/lib/archipelago/<app-id>/. - Secrets are generated or read from
/var/lib/archipelago/secrets/and injected through Podman secrets rather than static environment values. - Release and app catalogs are signed and verified against a pinned trust anchor.
Start with:
- Architecture
- Developer Guide
- App Developer Guide
- App Manifest Spec
- Nostr Git Source Hosting Plan
- Troubleshooting
Quick start
Frontend
cd neode-ui
npm install
npm start
The dev UI runs at http://localhost:8100 with a mock backend on :5959.
Backend
cd core
cargo build
cargo test --all-features
Linux is the supported backend runtime and release-build target. macOS is fine for frontend work and many Rust compile/test loops, but host integration tests that touch Podman, systemd, networking, or image build paths require Linux.
App manifests
./scripts/validate-app-manifest.sh apps/filebrowser/manifest.yml
python3 scripts/generate-app-catalog.py
python3 scripts/check-app-catalog-drift.py --release --strict
scripts/generate-app-catalog.py requires Python with PyYAML installed.
Documentation map
| Doc | Purpose |
|---|---|
| Architecture | System layers, crates, data paths, security model |
| Developer Guide | Local setup, code workflow, testing |
| API Reference | JSON-RPC API overview |
| App Developer Guide | How to package and test apps |
| App Manifest Spec | Manifest schema and validation rules |
| Nostr Git Source Hosting Plan | ngit/NIP-34 contribution workflow and maintainer model |
| Apps README | Packaged app catalog overview |
| Image Recipe | Bootable image build flow |
| Roadmap | Shipped, in-progress, and planned work |
| Archive | Historical plans, audits, and handoffs |
Contributing
Read CONTRIBUTING.md before opening a pull request. For security issues, follow SECURITY.md and do not open a public issue.
License
Archipelago is licensed under the MIT License. Third-party notices are listed in NOTICE and generated license inventories in component release artifacts.