Ripen, the container updater that refuses to guess

Field notes

Ripen compares three states—the orchestrator’s deployment, the running container, and the registry tag’s current digest—rather than treating a tag change as sufficient evidence. Its sample output shows a candidate becoming mature after two observations, while a Jellyfin service remains blocked because monitor mode is active and auto_apply is false. The documented container setup exposes a policy file, state directory, and selected Compose file, with no Docker socket mount.