nexo/docs/runtime-image-validation.md

Nexo Runtime Image Validation

This document records the registry, tag, architecture, and verification digests for nexo-owned runtime images.

Published Images Summary

Service	Target Architecture	Immutable Tag	Latest Tag	Digest (Immutable Tag)	Digest (Latest)
Core (Mattermost)	linux/arm64	v11.4.2-arm64	latest	sha256:a811233f0625dd72a43c4b2315010ad67355fccc34be3e29d44e7aaab202b3ee	sha256:a811233f0625dd72a43c4b2315010ad67355fccc34be3e29d44e7aaab202b3ee
Push-Proxy	linux/arm64	v11.4.2-arm64	latest	sha256:73d104148e66bb24e901bd1787624cf9b46e41268955e20bdfe4c6fc70f10b0b	sha256:73d104148e66bb24e901bd1787624cf9b46e41268955e20bdfe4c6fc70f10b0b

Verification Evidence

Registry API Manifest Headers

This section displays registry manifest verification logs, ensuring the matching Docker-Content-Digest is resolved.

# Fetch Core (Mattermost) manifests from registry
$ curl -fsSI -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' https://toki-labs.com:5050/v2/nexo/mattermost/manifests/latest
HTTP/1.1 200 OK
Server: nginx/1.29.3
Content-Type: application/vnd.docker.distribution.manifest.v2+json
Content-Length: 6766
Docker-Content-Digest: sha256:a811233f0625dd72a43c4b2315010ad67355fccc34be3e29d44e7aaab202b3ee
Etag: "sha256:a811233f0625dd72a43c4b2315010ad67355fccc34be3e29d44e7aaab202b3ee"

# Fetch Push-Proxy manifests from registry
$ curl -fsSI -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' https://toki-labs.com:5050/v2/nexo/push-proxy/manifests/latest
HTTP/1.1 200 OK
Server: nginx/1.29.3
Content-Type: application/vnd.docker.distribution.manifest.v2+json
Content-Length: 1577
Docker-Content-Digest: sha256:73d104148e66bb24e901bd1787624cf9b46e41268955e20bdfe4c6fc70f10b0b
Etag: "sha256:73d104148e66bb24e901bd1787624cf9b46e41268955e20bdfe4c6fc70f10b0b"

Remote Host Image Inspect (Architecture Proof)

This section lists concrete inspection output executed directly on the remote Mac build host (toki@toki-labs.com).

$ ssh toki@toki-labs.com '/usr/local/bin/docker image inspect toki-labs.com:5050/nexo/mattermost:latest --format "{{.Os}}/{{.Architecture}} {{range .RepoDigests}}{{.}} {{end}}" && /usr/local/bin/docker image inspect toki-labs.com:5050/nexo/mattermost:v11.4.2-arm64 --format "{{.Os}}/{{.Architecture}} {{range .RepoDigests}}{{.}} {{end}}" && /usr/local/bin/docker image inspect toki-labs.com:5050/nexo/push-proxy:latest --format "{{.Os}}/{{.Architecture}} {{range .RepoDigests}}{{.}} {{end}}" && /usr/local/bin/docker image inspect toki-labs.com:5050/nexo/push-proxy:v11.4.2-arm64 --format "{{.Os}}/{{.Architecture}} {{range .RepoDigests}}{{.}} {{end}}"'

linux/arm64 toki-labs.com:5050/nexo/mattermost@sha256:a811233f0625dd72a43c4b2315010ad67355fccc34be3e29d44e7aaab202b3ee
linux/arm64 toki-labs.com:5050/nexo/mattermost@sha256:a811233f0625dd72a43c4b2315010ad67355fccc34be3e29d44e7aaab202b3ee
linux/arm64 toki-labs.com:5050/nexo/push-proxy@sha256:73d104148e66bb24e901bd1787624cf9b46e41268955e20bdfe4c6fc70f10b0b
linux/arm64 toki-labs.com:5050/nexo/push-proxy@sha256:73d104148e66bb24e901bd1787624cf9b46e41268955e20bdfe4c6fc70f10b0b

Remote Compose Smoke Evidence

This section contains the validation log of copying the local compose files to the remote development host, running a config check, pulling nexo-owned images, and performing service smoke tests.

# 1. Compare local and remote file hashes (Parity Verification)
$ sha256sum docker-compose.yml .env.example
c46bc291e42b1e87ca5e6b49d118bb59c67b0b2b1412a2751c6089e49d492563  docker-compose.yml
fa56a8dc7a8dddc7737d42ec048e4f29836252e277e2d270f0ad0e7cbb38d430  .env.example

$ ssh toki@toki-labs.com 'cd ~/docker/services/nexo/compose && sha256sum docker-compose.yml .env.example'
c46bc291e42b1e87ca5e6b49d118bb59c67b0b2b1412a2751c6089e49d492563  docker-compose.yml
fa56a8dc7a8dddc7737d42ec048e4f29836252e277e2d270f0ad0e7cbb38d430  .env.example

# 2. Check remote Docker Compose configuration
$ ssh toki@toki-labs.com 'cd ~/docker/services/nexo/compose && /usr/local/bin/docker compose --env-file .env.example config >/tmp/nexo-compose-config.yml && /usr/bin/grep -E "toki-labs.com:5050/nexo/(mattermost|push-proxy):latest|platform: linux/arm64" /tmp/nexo-compose-config.yml'
    image: toki-labs.com:5050/nexo/mattermost:latest
    platform: linux/arm64
    image: toki-labs.com:5050/nexo/push-proxy:latest

# 3. Pull and start services on the remote server
$ ssh toki@toki-labs.com 'export PATH=$PATH:/Applications/Docker.app/Contents/Resources/bin && cd ~/docker/services/nexo/compose && /usr/local/bin/docker compose pull && /usr/local/bin/docker compose up -d'
Container nexo-core-db  Running
Container nexo-core-push-proxy  Recreated
Container nexo-core  Recreated
Container nexo-core-push-proxy  Started
Container nexo-core-db  Healthy
Container nexo-core  Started

# 4. Remote Runtime Smoke Checks
$ ssh toki@toki-labs.com 'cd ~/docker/services/nexo/compose && curl -fsS "http://localhost:18065/api/v4/system/ping" && /usr/local/bin/docker compose exec -T db pg_isready -U mmuser -d mattermost && curl -fsSI "http://localhost:18065" && /usr/local/bin/docker compose ps push-proxy'
{"ActiveSearchBackend":"database","AndroidLatestVersion":"","AndroidMinVersion":"","IosLatestVersion":"","IosMinVersion":"","status":"OK"}
/var/run/postgresql:5432 - accepting connections
HTTP/1.1 200 OK
Cache-Control: no-cache, max-age=31556926, public
Content-Security-Policy: frame-ancestors 'self' ; script-src 'self'
Content-Type: text/html
Permissions-Policy:
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: 1z4r5bc67b89fd8x816dexgsse
X-Version-Id: 11.4.2.22416167438.bfd0f10f265c336e8b5a043b0dccdcd64438e08f73bcc5627b72c815906e1130.false
Date: Thu, 28 May 2026 01:41:27 GMT
NAME                   IMAGE                                       COMMAND            SERVICE      CREATED         STATUS         PORTS
nexo-core-push-proxy   toki-labs.com:5050/nexo/push-proxy:latest   "/usr/local/b..."   push-proxy   3 seconds ago   Up 2 seconds   0.0.0.0:18066->8066/tcp

---

Current Repo Runtime and App Evidence

This section presents the verification matrix for nexo local/remote runtime components and apps inside this repository.

Target	Command / Manual Step	Environment	Expected Result	Actual Evidence	Status / Follow-up
Remote Runtime Smoke	ssh toki@toki-labs.com '...'	Remote host (toki-labs.com Mac ARM64)	Active system ping returns "status":"OK", docker compose services are healthy.	{"status":"OK"}, all containers (core, db, push-proxy) show Up and healthy on ports 18065/18066.	PASS
Unit & Widget Tests	bin/test	Local workspace container	All tests in packages/messaging_flutter and apps/flutter-test pass successfully.	All tests passed! output from both Flutter plugin package and test app.	PASS
Static Code Analysis	bin/lint	Local workspace container	Both projects analyze cleanly with zero static issues or lint warnings.	Analyzing messaging_flutter... No issues found!, Analyzing flutter-test... No issues found!.	PASS
Android Build Unit Tests	ssh toki@toki-labs.com 'cd ~/works/nexo/apps/flutter-test/android && ./gradlew testDebugUnitTest'	Remote host Android SDK (emulator-5554)	Gradle compiles and runs native unit tests for the Android host wrapper.	Remote Gradle test completed with BUILD SUCCESSFUL in 22s; NexoMessagingPluginTest > onMethodCall_getPlatformVersion_returnsExpectedValue() PASSED.	PASS
Flutter Integration Test	ssh toki@toki-labs.com 'cd ~/works/nexo/apps/flutter-test && flutter test && flutter test integration_test -d emulator-5554'	Remote host Flutter + Android emulator (emulator-5554)	Integration test validates plugin debug event flow on connected device/emulator.	Widget tests passed (4/4), debug APK built/installed on emulator-5554, and integration suite completed with all 3 tests passing.	PASS
Original Mattermost App	ssh toki@toki-labs.com 'cd ~/works/nexo/apps/mattermost && npm ci && npm run check-test'	Remote host Node/Ruby/watchman Mattermost workspace	Dependencies install, ESLint + TypeScript check + Jest unit tests pass.	npm ci completed after remote Ruby/watchman setup. npm run check-test executed ESLint/TypeScript/Jest but failed app/components/formatted_date/index.test.tsx: Test Suites: 1 failed, 2 skipped, 611 passed; Tests: 2 failed, 7 skipped, 8160 passed; Korean snapshot expected AM but received 오전. A Node 22.22.3 targeted retry produced the same 2 snapshot failures.	FAIL — check whether the upstream Mattermost locale snapshots should be updated/pinned for this test host.
Detox E2E Testing	ssh toki@toki-labs.com 'cd ~/works/nexo/apps/mattermost && npm run e2e:android'	Remote host Android emulator + Mattermost runtime	Detox builds and executes end-to-end user flows against the emulated app.	Detox dependencies installed, but Android build failed before test-account login: :app:processDebugGoogleServices FAILED because google-services.json is missing from apps/mattermost/android/app or expected src/debug locations. No matching file was found under the remote nexo work/compose paths.	BLOCKED — requires a Firebase google-services.json debug config or Gradle/test build adjustment before Detox can run.

---

Consumer Project Evidence

This section records the setup, integration status, and verification metrics for sibling/consumer projects.

Target	Command / Manual Step	Environment	Expected Result	Actual Evidence	Status / Follow-up
../nomadcode Setup & Dependency	File scanning for dependency references	Local workspace sibling	Local path dependency registered and mapped to packages/messaging_flutter.	apps/client/pubspec.yaml maps dependency nexo_messaging to path ../../../nexo/packages/messaging_flutter (successfully generated/resolved in .flutter-plugins-dependencies, pubspec.lock).	PASS
../nomadcode Test & Smoke	../nomadcode/bin/test	Local workspace sibling	Core Go test suite and Client Flutter tests pass cleanly (includes push host integration).	All Go module tests (cmd/plane-smoke, internal/adapters/*, etc.) and all Flutter widget tests pass successfully.	PASS
../nomadcode Android Smoke	Remote Android notification smoke	Remote Android emulator env	Real FCM credential loads, push notification arrives, and ACK is verified.	Confirmed and archived in task mattermost-messaging-android-smoke on 2026-05-26/27.	PASS
../iop Setup & Test	cd ../iop/apps/portal && flutter test	Local workspace sibling	Verify integration of messaging plugin and code stability.	Compiling tests failed due to upstream protobuf package version mismatch in the shared proto-socket module. No nexo_messaging dependency is integrated yet.	SKIP (upstream protobuf compilation mismatch; no nexo integration yet)
../alt Setup & Test	../alt/bin/test	Local workspace sibling	Verify integration of messaging plugin and code stability.	All tests passed! output from ALT Go server components and Flutter widget tests. No nexo_messaging dependency is integrated yet.	PASS (clean baseline; no nexo integration yet)