Point paid images at ACR; correct signing, SBOM and tag claims The paid line now publishes to a private Azure Container Registry rather than GHCR, which could only share private packages with organisation members. Subscribers are issued a pull-only registry token and need no GitHub, Microsoft or Azure account. Also corrects claims that had gone stale in both directions: - Signing, SBOM and build provenance were described as 'in the pipeline' on three pages while two others already advertised them as shipped. They are live on both lines and verifiable; the tables now say so consistently. - The tag table documented a scheme (3.8.1, 3.8-stable) that no build has ever published. Replaced with the tags that actually exist. - runtime-studio is versioned on Elsa Studio, not the engine, so its tag differs from server and combined. This was undocumented and is an easy way to write a manifest that cannot be pulled. - Troubleshooting still told subscribers to log in to ghcr.io with a read:packages token and described access as following team membership. Every image reference on every page was checked against the live registries.
Images are now non-root on a chiselled base CVE gating, SBOM and signing are in the pipeline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Community edition publishes to GHCR as public packages ghcr.io/valence-works/runtime-ce-{server,studio,combined} — free, no account, same build as the paid tiers. What a subscription adds is commitments and immutable tags, not different software. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rename product to Valence Runtime Images are now ghcr.io/valence-works/runtime-{server,studio,combined}. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Add Elsa Pro documentation Pulling, running and configuring the container images, plus persistence, Nuplane extensibility, a production checklist and troubleshooting. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>