deploy: the vogt GHCR package is private, so the default public quickstart cannot pull

[thedancingdeveloper]

The repository is now public, but the published GHCR package ghcr.io/thedancingdeveloper-org/vogt is still private. Anonymous registry requests for the current tags return HTTP 401, so the pull-first quickstart cannot yet work for an unauthenticated user.

Repository-side work complete

• The build-overlay quickstart works from a clean checkout without registry credentials.
• Compose/docs examples reference the current product release.
• Private production deployment remains digest-pinned and unaffected.
• The public repository and the private package are intentionally reported separately; no code change can make the package visible.

Operator action

An organization/package administrator must open the package settings page, choose Package settings → Change visibility → Public, and confirm the repository link if required by organization policy.

Verification

From a host with no GHCR credentials:

• anonymous manifests for latest, 0.2.2, and dev succeed;
• docker pull ghcr.io/thedancingdeveloper-org/vogt:0.2.2 succeeds;
• docker compose -f deploy/vogt.compose.yml up -d --wait reaches healthy and serves the documented endpoints.

This issue remains open until package visibility and the anonymous pull/Compose smoke are recorded.

[thedancingdeveloper]

Part of the open-source boundary tracking issue #273 (decision 2026-08-22: the public product is core + engine + PWA).

[thedancingdeveloper]

Repo set back to PRIVATE on 2026-08-22; package visibility is now the final pre-publish step under #273, not a live break.

[thedancingdeveloper]

README half landed in #370 (dev 9885a9a): README + docs/GETTING_STARTED now lead with the build path (deploy/vogt.build.yml, verified from a clean clone), with the published-image pull kept as the 'once the package is public' secondary. Remaining, operator-only (leaving this issue open): make the ghcr.io/thedancingdeveloper-org/vogt package public — the visibility REST endpoint returns 404 for the agent token, so this needs your package-settings access.

[thedancingdeveloper]

Status reconciliation (2026-08-26): the build-overlay quickstart is implemented and documented. The published GHCR package visibility is still an owner/publication decision affecting the public deployment path, so this stays open.

[thedancingdeveloper]

Production verification (2026-08-26): prod is healthy and deployed privately from immutable GHCR digests. This issue remains open only for public-package publication/quickstart policy; private production deployment is not blocked.

[thedancingdeveloper]

Status update after PR #432 (merged to dev as 20b7f53): the public compose/docs examples now follow the current 0.2.2 release, and a delivery test derives the expected image tag from pyproject.toml. The GHCR vogt package is still private, so anonymous pull verification and the final pull-first/build-first publication decision remain open.