FLEX-WP-0040-T07: v14 release candidate is the Go 1.26.10 image (main-f4c9f2b)

Candidate image forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c
(revision label f4c9f2b). Read-only checks: v14 and v13 policy directories
byte-identical to source, package digests 8911458f (v14) and 31be5985 (v13),
in-image validate 46/46 and 32/32, offline verify requests answer
self_approval_refused / approval_action_not_admitted on v14, Trivy
HIGH/CRITICAL = 0 (same pinned scanner). Values, twin, pin test, runbook
(scan gate passed; informed-decision side ready at RELEASE_SHA 005709a3,
image ca75f0be, carrying 80ef840) and evidence move to this digest; the
154726d2 image is superseded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

docs/compact-sitting-v14-release-runbook.md

@@ -5,7 +5,7 @@
 **Owner note:** `docs/compact-sitting-v14-present-existing.md` ("Live steps")
 **Approval:** founder, 2026-11-01, relayed by the net-kingdom coordinator
 **Runs:** the founder, from an access-engine checkout at the commit carrying this file
-**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json`
+**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json` (`release_candidate` = the image in the table below)
 
 ## Coordinated with informed-decision (same window)
 
@@ -29,6 +29,14 @@ is needed only for `service:nk-bind-executor` present-existing requests. Without
 are refused with `approval_action_not_admitted`; requests for requester
 `informed-decision` are unaffected by v14.
 
+**informed-decision's side is ready** (2026-11-01, relayed by the net-kingdom coordinator):
+RELEASE_SHA `005709a37228ba9e6d5a658aada0b62bf49649f5`, service image
+`forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b`
+(`main-c228583`), runbook `~/informed-decision/deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md`.
+That image carries the `approval_action` change (informed-decision commit `80ef840`). Its
+step 3 runs "access-engine first, then informed-decision": its 3a is steps 0-2 of this
+runbook, then its 3b pins v14; its rollback returns this release to revision 13.
+
 ## Release candidate
 
 | Field | Value |
@@ -36,20 +44,21 @@ are refused with `approval_action_not_admitted`; requests for requester
 | release / namespace | `flex-auth-informed-decision-sitting` / `flex-auth` |
 | chart | `charts/flex-auth` (this checkout) |
 | values | `values/informed-decision-sitting.yaml` (edited directly; twin `values/access-engine/informed-decision-sitting.yaml` regenerated, not deployed) |
-| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776` |
-| image tag / source | `main-2de0f86`, OCI revision label `2de0f862f9875f344f090b633813239a33d63426` (CI `.forgejo/workflows/image.yaml`, push to main) |
+| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c` |
+| image tag / source | `main-f4c9f2b`, OCI revision label `f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81` (CI `.forgejo/workflows/image.yaml`, push to main); v14 policy from `2de0f86`, Go 1.26.10 builder |
 | policy | `/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md` (file sha256 `dcfae737…40141`, package digest verified from the image) |
 | registry | unchanged path `/opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json` (byte-identical to the present-existing copy) |
 
-### Gate: image scan (founder decision)
+### Gate: image scan (passed)
 
-Trivy (HIGH/CRITICAL) finds four Go stdlib 1.26.7 CVEs in both binaries of the candidate
-(CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031; fixed in Go 1.26.9 /
-1.26.10). The image in force (`6c6dc263`) has **the same four**, so the candidate does not
-regress, but the earlier release bar (zero HIGH/CRITICAL, FLEX-WP-0034) is not met. Either
-accept for this release (no regression) or ask the owner for a Go toolchain bump and
-rebuild first, which yields a new digest and requires re-running the checks in the evidence
-file. Do not proceed without choosing.
+The first candidate (`main-2de0f86`, `sha256:154726d2…4776`) carried four Go stdlib 1.26.7
+HIGH CVEs (CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031), as does the image
+in force (`6c6dc263`). Founder decision 2026-11-01: bump Go and rebuild. Commit `f4c9f2b`
+moved the builder to `golang:1.26.10-alpine` and `go.mod` to `go 1.26.10`; nothing else changed.
+The rebuilt candidate above has **0 HIGH/CRITICAL** (same pinned Trivy, OS layer and both
+binaries). Its v14 and v13 policy directories are byte-identical to the source, the package
+digests are `8911458f…0fde` (v14) and `31be5985…3711873` (v13), and in-image `validate`
+passes 46/46 (v14) and 32/32 (v13). The `154726d2` image must not be released.
 
 ## Image in force (source evidence)
 
@@ -102,7 +111,7 @@ helm template $REL charts/flex-auth -n $NS -f values/informed-decision-sitting.y
 
 Expected diff, Deployment `flex-auth-informed-decision-sitting` only:
 
-- image `@sha256:6c6dc263…168e` → `@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776`
+- image `@sha256:6c6dc263…168e` → `@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c`
 - `--policy` `…/informed-decision-lifecycle-review/policy.md` → `…/informed-decision-present-existing-review/policy.md`
 - memory request `32Mi` → `40Mi` (FLEX-WP-0038 right-sizing, already in the values file)
 - possibly two added args `--caller-audience` `flex-auth` (FLEX-WP-0038 saw this chart
@@ -125,7 +134,8 @@ kubectl -n $NS rollout status deploy/$REL --timeout=2m
 
 ### 3. Pin the consumer (informed-decision, same window)
 
-Per informed-decision's own runbook: set the review runtime's `policy` object to
+Per informed-decision's own runbook (`RELEASE-INFD-WP-0010-T02.md`, step 3b, RELEASE_SHA
+`005709a3…49f5`, image `ca75f0be…`): set the review runtime's `policy` object to
 `informed-decision.compact-sitting` / `v14` /
 `sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` and release it.
 Until then review requests fail closed.