truf-server/openspec/changes/optimize-dockerhub-discovery-rotation/tasks.md

1. Runtime Safety

• 1.1 Canonically stop the live supervisor and verify all managed workers and PostgreSQL are down before editing application or configuration files

2. Durable Discovery Storage

• 2.1 Add and validate the additive PostgreSQL discovery retry queue schema, required indexes, migration metadata, and bounded lifecycle fields
• 2.2 Implement strict page admission plus retry enqueue, claim, reclaim, backoff, hold, and fenced completion database operations
• 2.3 Add SQL-shape and PostgreSQL migration/integration coverage for idempotency, concurrent claims, expired leases, and stale-token rejection

3. Incremental DockerHub Discovery

• 3.1 Refactor managed DockerHub pagination to validate, deduplicate, and durably admit successful pages sequentially without invoking the resolver per page
• 3.2 Implement two-consecutive-preexisting-page stopping with current-pass duplicate protection and fail-open knownness handling
• 3.3 Implement per-query policy-hashed 72-hour deep scheduling that bypasses only seen-page stopping
• 3.4 Delegate page-one, later-page, and unavailable-tail failures to durable retry work and advance the main cursor only after authoritative delegation
• 3.5 Process bounded retry work independently of main rotation with lease fencing, backoff, policy/query validation, and safe diagnostics

4. Discovery Policy

• 4.1 Configure every DockerHub query for a 30-page by 100-result ceiling and append the exact 12 confirmed product/framework queries once
• 4.2 Disable periodic completed-anchor digest refresh while preserving initial/partial resolver and immutable-digest scan retries
• 4.3 Add permanent configuration regressions for query order/count, effective breadth, disabled periodic refresh, and unchanged retry/resource policy

5. Verification And Deployment

• 5.1 Run focused pagination, retry-queue, source-state, migration, and configuration tests without creating application bytecode
• 5.2 Run broader relevant scanner, queue, runtime-safety, and PostgreSQL integration suites and complete an independent read-only review
• 5.3 Strictly validate the OpenSpec change and verify no secret-bearing diagnostics or unrelated behavior changes
• 5.4 Canonically start the runtime and verify PostgreSQL readiness, migrations, pipeline workers, DockerHub authentication/worker health, retry/deep state, restart counters, and absence of application bytecode