Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH022

LH022: Can a Drupal image build be linked to the fixed PHP base?

Protocol 0.1, fixed 22 October 2026 UTC before reading Drupal's production publishing records for this probe. Writer: Codex, GPT-6 Sol in ChatGPT Work Mode. This is one purposive case from LH021, not a prevalence estimate. LH021 already saw Drupal head 6ca4d039… and two successful source runs at that head around 15:03 UTC on 21 October, before official-images PR #22541 merged; four sampled Dockerfiles literally referenced php:8.3 variants. LH018–LH020 and LH019's 22 October checkpoint already establish the selected PHP publisher observations. A public official-images issue #22546, discovered before this protocol, reported missing amd64 manifests during deployment and a maintainer acknowledged a deploy glitch; this is prior knowledge, not an LH022 discovery.

Question and selection

Can the public production recipe, a particular build run, its resolved PHP base digest and a published Drupal derivative be linked across the patch event? Use docker-library/drupal and the library/drupal entry in docker-library/official-images. Choose the first manifest stanza, in file order at the observation, whose Tags field contains an exact 11.3-php8.3-fpm tag; if absent, record no selected derivative and stop that path. The stanza's GitRepo, GitCommit and Directory choose the production Dockerfile, not an alphabetic repository sample. Freeze the upstream repository's latest commit before 21 October 00:00 UTC and its default branch head at the read; read the selected recipe at both commits when the path exists. Do not substitute a different tag or project after seeing a result.

For workflow linkage, inspect at most 20 public Actions runs of docker-library/drupal around 21–22 October, and at most two plausible jobs' public logs, preferring a run whose head equals a frozen source commit and whose time follows the 21 October PHP image publication. Record missing logs or absent matching runs as unknown. If a log explicitly records a base-image digest, compare it to the same PHP variant digest; a successful job without that line is not a resolved-base observation. Inspect the chosen derived tag's current Docker Hub index, amd64 manifest and config at most once; if present, retain digest, declared ancestry if any, and timestamp. A current derivative is left-censored with respect to when it changed absent earlier retained registry state.

Comparison and limits

Compare the two immutable source commits for instructions and the run's exact head for execution. A source FROM php:8.3-fpm is an instruction whose resolution depends on build time and cache; a derivative image digest is an artifact, not evidence of deployment. No project or machine denominator exists. Keep source publication, base resolution, derived publication and deployment distinct. A failure to expose a job or digest is unknown for that boundary, not negative uptake. Classify the deployment issue's reports as self-reported, not an exhaustive outage interval.

At most 40 GitHub API reads, six Docker Hub or OCI reads, 12 MiB retained response bodies, and two CI log reads. No image layers, builds, executable runs, secrets or private data. Stop on rate limit or ceiling, retain full bounded response bodies, retrieval times, statuses and hashes, and provide offline replay of the measured fields. The stopping condition is one attempted reading at each boundary, including missingness. This case cannot estimate overall adoption or the effect of the advisory.

  • Amendment, 9 November 2026, by the scheduled run's robots sweep (in force from the next read; not retroactive). The keeper decided on 8 November 2026 that Lighthouse obeys robots.txt as its own agent and as whatever runs it (AGENTS.md, Rules that matter; scripts/robots_rules.py, scripts/robots_tokens.json). The gate is scripts/robots_gate.py, which reads each host's robots.txt once per run. scripts/collect.py now requests through scripts/lh_fetch.py's gated urlopen (api.github.com and Docker Hub, the anonymous bearer request included); a URL not allowed is not requested, and its row in the read log has no status and the error "NotFetched: not fetched: ..." with the deciding group and rule, a missing reading and never a negative. The User-Agent now carries Lighthouse's token (Mozilla/5.0 (compatible; Lighthouse-research/1.0; +https://lighthouse.harbour.cat); it was Lighthouse-LH022/0.1), and email addresses are withheld from kept bodies; the logged sha256 stays that of the bytes received, so an offline replay that compares it with a kept file would differ for a body where an address was withheld. Earlier reads were made without this check, and whether each host's robots.txt allowed them on those days was not checked. The study is finished and no further read is scheduled.

From studies/LH022/brief.md in the repository, last changed 9 November 2026.