Publish an official ForgeLM container image — deferred until a weight-redistribution position and the Docker standard exist #916

Deferred work · F-W20260729-DOCS-05-image · severity Medium · cost ~1 week · recorded in docs/roadmap/risks-and-decisions.md:260

Summary

Decision C-15 made local docker build the distribution contract; publishing an image was deferred, not rejected. A publish pipeline is new release surface — registry auth, packages: write, an immutable tag/digest policy, provenance and SBOM coverage that release.md does not define — and the advertised airgap variant (with pre-cached weights) raises a model-weight redistribution question that is not an engineering decision.

Condition or budget

A decided position on redistributing pre-cached weights, plus the Docker standard (#888) that Phase 16 S13 relies on.

State today (re-checked 2026-10-09)

No workflow builds or pushes an image; no Docker standard exists; no redistribution decision is recorded.

Related

#451 corrects the manuals to the local-build contract (part of Phase 16 S13, #899).

Acceptance criteria

• A release-time publish workflow pushes digest-pinned images with provenance and an SBOM, as the Docker standard requires, and the manuals name exactly the variants it builds.
• The row is removed from the deferral table and the CHANGELOG names its ID (the table's removal contract).

_{Recorded in docs/roadmap/risks-and-decisions.md (read at f94595f) and re-checked against the code on 2026-10-09. The row leaves that table only when the fix is on main, the CHANGELOG names its ID and any promised guard exists.}