[levifig]

Summary

Loaf's infrastructure and security guidance told agents to pin versions exactly, with no limit on what kind of software. Reviews then flagged applications and tools that track a release channel on purpose, such as agent CLIs on a workstation.

The guidance now draws one line:

• Pin what a project builds from and runs: lockfile packages (including declared dev tools), providers, the release toolchain, and base images at a specific version.
• Let applications and tools installed for people or agents follow their documented upgrade policy, including third-party images a project deploys. That policy may be a release channel such as latest.
• Flag a floating version only when no upgrade policy is documented.

The Python Dockerfile example also pinned its uv image, which is a build input, so it now uses uv:0.13.4.

Native work

Closes #411

Verification

• The infrastructure skill, its CI/CD reference and the security review checklist each state the distinction.
• A search of content/skills for pin and :latest wording finds only lines that carry the distinction or apply to build inputs.
• The edited skills pass the skill authoring checklist: no frontmatter, sidecar or template changes, and every edited reference is under 100 lines.
• env -u LOAF_DB make verify-local passes.
• Regenerated dist/ and plugins/ copies match the source edits line for line.

Ship

Pending Ship review.

Migration / risks

None. Guidance only; no code or schema changes.

Out of scope

• How Loaf checks the agent harnesses it runs in, including its recorded harness versions.
• Personal agent instruction files outside this repository.
• Changing any existing project's pins or upgrade policies.

---

Agent notes

• Checks:
  • Pin sweep: grep -rnE '\b[Pp]in(s|ned|ning)?\b|:latest' content/skills, ignoring execpolicy, match-head and Ship's head-pinning lines
  • Generated output: compared git diff -U0 changed lines for each edited file in content/skills and plugins/loaf/skills
  • uv tag: ghcr.io/v2/astral-sh/uv/manifests/0.13.4 returned 200; astral-sh/uv release 0.13.4 published 2026-10-20
• Findings: full verify-local ran on c28a2e56; after merging main into f029dd64 (changelog conflict only, both entries kept), make build showed no drift and make ci-check and changelog coverage passed