security watch: Docker Hub requests spaced, a 429 retried (NOT CHECKED only after the last try), tag lists cached 24 h per registry path on the runner (R-1334); W14

scripts/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 2026-10-28 (midday) — the watch asks Docker Hub gently: spaced, retried on 429, tag lists cached 24 h (R-1334)
+
+- **`security_watch.py`:** Docker Hub requests (`hub.docker.com`, `registry-1.docker.io`, `auth.docker.io`) go through
+  `Sources.hub_get`: one per `HUB_GAP_S` (1 s) across the six workers; a 429 waits (`Retry-After`, capped at 120 s, else
+  10/30/60 s) and is retried — NOT CHECKED only after `HUB_TRIES` (4). Tag lists are keyed by registry path (two names
+  of one path fetch once) and kept `TAG_CACHE_S` (24 h) in the runner's cache file `felhom-watch-tags.json` beside the
+  wheel cache (`--tag-cache=` overrides). The log gains `TAGS fetched=… from-cache=… retried-429=…`.
+- Measured before: night job 2446, 211 Docker Hub requests in ~2 min, 15 refused; dry job 2450, 224 in ~3.5 min, 0 refused.
+- Tests: W14 (7 checks; the 429 retry seen failing on the old code — the first 429 ended the image) — 71 checks.
+
 ## 2026-10-28 — the watch remembers a notice per GROUP: a catalog pin and a DooPlex pin of one image are two entries
 
 - **`security_watch.py`:** the memory key is `dooplex:<image>|<id>` for a DooPlex pin (`mem_image`), `<image>|<id>` as