Stale
Every “safe to ship” verdict is a cached value with evidence behind it. When the world changes (a root is distrusted, a security release ships, a table grows), Stale re-proves it and fixes it, with no human in the loop.
Claims
anchor-trusted
VALIDThe serving Node is patched for its line, and no distrusted or weak root is in its effective trust store.
- Issue#1510-27 03:08 UTC
- Duo fix!13auto-merged by CI
- Releasecanary → 100%
- Minted10-27 03:42 UTC
- ✓Node release:
v24.22.1security floor for v24.x is v24.22.1 - ✓Distrusted roots in effective CA set:
none1 distrusted in the root feed; trust policy removed 1
- Last minted
- 2026-10-27 03:42:20 UTC on
ledger-api-p2992600961 - Fingerprint
sha256:8596a320913315cf
migration-safe
VALIDNo pending migration takes a blocking lock on a large table; concurrent index builds are retry-safe.
- Issue#1610-27 03:08 UTC
- Duo fix!14auto-merged by CI
- Releasecanary → 100%
- Minted10-27 03:42 UTC
- ·ledger_entries rows (estimate):
850,004blocking DDL is unsafe at 500,000+ rows - ✓Merchant index:
present, validmust be built CONCURRENTLY, outside a transaction, with lock_timeout
- Last minted
- 2026-10-27 03:42:20 UTC on
ledger-api-p2992600961 - Fingerprint
sha256:34f4d5508efed394
States come from the claim issues and the minted lockfile on main. The checks above are recomputed by this page from the same public feeds and the database for display; Stale's control loop and pipelines make the decisions.
What changed in the world
Facts outside the repository, read live. None of them is a commit.
| Source | Fact | For this revision |
|---|---|---|
| Node.js release feed | v24.22.1 is the newest security release for v24.x (2026-10-20) | ✓ serving v24.22.1 includes it |
| Root-program distrust feed | CN=Demo Root G3 distrusted (2026-10-24) | ✓ excluded by this revision's trust policy |
| Live database statistics | ledger_entries ≈ 850,004 rows | · large: blocking DDL is unsafe |
Rollout
Last release gate: RELEASE 10-27 03:28 UTC · child pipeline
Release when every claim is proven; defer while another claim's fix is in flight; block if a claim is stale with no fix.
Latest release: pipeline 2992600961, success, started 10-27 03:28 UTC.
- Canary 0%own tag URL, no traffic
- Probesclaims re-proved on the canary
- 50% → 100%k6 SLO + 5xx per ring
- Promotestable tag moves
- Mintproof committed, issue closed
Live loop activity
Control loop last ran 12 h ago — success. It runs every 15 minutes on a schedule; no commit or human is needed to start it.
| Claim issue | Claim | Opened by the control loop | Outcome | Time to fix |
|---|---|---|---|---|
| #16 | migration-safe | 10-27 03:08 UTC | closed by mint 10-27 03:42 UTC |
34 min |
| #15 | anchor-trusted | 10-27 03:08 UTC | closed by mint 10-27 03:42 UTC |
34 min |
| #14 | migration-safe | 10-27 00:38 UTC | closed by mint 10-27 01:04 UTC |
26 min |
| #13 | anchor-trusted | 10-27 00:38 UTC | closed by mint 10-27 01:04 UTC |
26 min |
| #12 | migration-safe | 10-27 00:38 UTC | closed by mint 10-27 01:31 UTC |
53 min |
| #11 | anchor-trusted | 10-27 00:38 UTC | closed by mint 10-27 01:31 UTC |
53 min |
Serving revision
- Revision
ledger-api-p2992600961- Commit
765417a0- Node
v24.22.1- Schema
20261021090000
- Trust policy
- loaded
- Excluded SPKIs
- 1
- Roots removed
- 1 of 120
- Demo Root G3
- not trusted
How the loop works
- The world changes, with no commit: a feed, live database statistics, or the serving revision.
- The scheduled control loop collects evidence from this revision and the database; deterministic rules open a claim issue.
- A GitLab Duo flow is assigned and opens one merge request, editing only the claim's allowed paths.
- CI proves the fix: policy check, security scans, re-proof inside the built image, shadow migration under write load, then auto-merge.
- The release deploys a 0% canary with its own URL, probes it, shifts traffic 50% → 100%, re-mints the claim and closes the issue. Any failure restores the stable revision.