# 2026-09-18 — Publishing the ori kit to Docker Hub

## State

Kit fixed so that `sbx kit pack` / `push` accept it (see history). Ready to publish; **not pushed yet**:

```bash
sbx kit push kits/ori docker.io/k33g/ori-kit:latest      # add --sign for a Sigstore signature
sbx kit inspect docker.io/k33g/ori-kit:latest            # check after push
sbx run -d claude . --template k33g/ori:0.0.1 --kit docker.io/k33g/ori-kit:latest --name ori -p 5555:8888
```
Auth order for push: `sbx login` session → `sbx secret set --registry` → Docker credential store (`~/.docker/config.json` has a docker.io entry).

## Traps

- No `sbx kit package`; verbs are `pack`, `push`, `validate`, `inspect`, `pull`, `sign`, `verify`, `provenance`. They take the kit **directory**.
- `sbx kit validate` succeeding does **not** guarantee `pack`/`push` will: validate expands `${{ kit.args.* }}` first, pack/push decode the raw YAML. Never put a placeholder in a non-string field (ports.container). Trial recipe: copy the kit to /tmp, edit, `sbx kit pack /tmp/copy -o /tmp/x.zip`.
- Provenance records the git commit of the directory: commit before pushing for a meaningful attestation.
- After publishing, the quickstart/README launch commands could reference `--kit docker.io/k33g/ori-kit:latest` instead of `./kits/ori` — not done, the user decides.