FLEX-WP-0040-T07: v14 release candidate is the Go 1.26.10 image (main-f4c9f2b)

Candidate image forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c
(revision label f4c9f2b). Read-only checks: v14 and v13 policy directories
byte-identical to source, package digests 8911458f (v14) and 31be5985 (v13),
in-image validate 46/46 and 32/32, offline verify requests answer
self_approval_refused / approval_action_not_admitted on v14, Trivy
HIGH/CRITICAL = 0 (same pinned scanner). Values, twin, pin test, runbook
(scan gate passed; informed-decision side ready at RELEASE_SHA 005709a3,
image ca75f0be, carrying 80ef840) and evidence move to this digest; the
154726d2 image is superseded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

docs/compact-sitting-v14-release-runbook.md

@@ -5,7 +5,7 @@
 **Owner note:** `docs/compact-sitting-v14-present-existing.md` ("Live steps")
 **Approval:** founder, 2026-11-01, relayed by the net-kingdom coordinator
 **Runs:** the founder, from an access-engine checkout at the commit carrying this file
-**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json`
+**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json` (`release_candidate` = the image in the table below)
 
 ## Coordinated with informed-decision (same window)
 
@@ -29,6 +29,14 @@ is needed only for `service:nk-bind-executor` present-existing requests. Without
 are refused with `approval_action_not_admitted`; requests for requester
 `informed-decision` are unaffected by v14.
 
+**informed-decision's side is ready** (2026-11-01, relayed by the net-kingdom coordinator):
+RELEASE_SHA `005709a37228ba9e6d5a658aada0b62bf49649f5`, service image
+`forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b`
+(`main-c228583`), runbook `~/informed-decision/deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md`.
+That image carries the `approval_action` change (informed-decision commit `80ef840`). Its
+step 3 runs "access-engine first, then informed-decision": its 3a is steps 0-2 of this
+runbook, then its 3b pins v14; its rollback returns this release to revision 13.
+
 ## Release candidate
 
 | Field | Value |
@@ -36,20 +44,21 @@ are refused with `approval_action_not_admitted`; requests for requester
 | release / namespace | `flex-auth-informed-decision-sitting` / `flex-auth` |
 | chart | `charts/flex-auth` (this checkout) |
 | values | `values/informed-decision-sitting.yaml` (edited directly; twin `values/access-engine/informed-decision-sitting.yaml` regenerated, not deployed) |
-| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776` |
+| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c` |
-| image tag / source | `main-2de0f86`, OCI revision label `2de0f862f9875f344f090b633813239a33d63426` (CI `.forgejo/workflows/image.yaml`, push to main) |
+| image tag / source | `main-f4c9f2b`, OCI revision label `f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81` (CI `.forgejo/workflows/image.yaml`, push to main); v14 policy from `2de0f86`, Go 1.26.10 builder |
 | policy | `/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md` (file sha256 `dcfae737…40141`, package digest verified from the image) |
 | registry | unchanged path `/opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json` (byte-identical to the present-existing copy) |
 
-### Gate: image scan (founder decision)
+### Gate: image scan (passed)
 
-Trivy (HIGH/CRITICAL) finds four Go stdlib 1.26.7 CVEs in both binaries of the candidate
+The first candidate (`main-2de0f86`, `sha256:154726d2…4776`) carried four Go stdlib 1.26.7
-(CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031; fixed in Go 1.26.9 /
+HIGH CVEs (CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031), as does the image
-1.26.10). The image in force (`6c6dc263`) has **the same four**, so the candidate does not
+in force (`6c6dc263`). Founder decision 2026-11-01: bump Go and rebuild. Commit `f4c9f2b`
-regress, but the earlier release bar (zero HIGH/CRITICAL, FLEX-WP-0034) is not met. Either
+moved the builder to `golang:1.26.10-alpine` and `go.mod` to `go 1.26.10`; nothing else changed.
-accept for this release (no regression) or ask the owner for a Go toolchain bump and
+The rebuilt candidate above has **0 HIGH/CRITICAL** (same pinned Trivy, OS layer and both
-rebuild first, which yields a new digest and requires re-running the checks in the evidence
+binaries). Its v14 and v13 policy directories are byte-identical to the source, the package
-file. Do not proceed without choosing.
+digests are `8911458f…0fde` (v14) and `31be5985…3711873` (v13), and in-image `validate`
+passes 46/46 (v14) and 32/32 (v13). The `154726d2` image must not be released.
 
 ## Image in force (source evidence)
 
@@ -102,7 +111,7 @@ helm template $REL charts/flex-auth -n $NS -f values/informed-decision-sitting.y
 
 Expected diff, Deployment `flex-auth-informed-decision-sitting` only:
 
-- image `@sha256:6c6dc263…168e` → `@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776`
+- image `@sha256:6c6dc263…168e` → `@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c`
 - `--policy` `…/informed-decision-lifecycle-review/policy.md` → `…/informed-decision-present-existing-review/policy.md`
 - memory request `32Mi` → `40Mi` (FLEX-WP-0038 right-sizing, already in the values file)
 - possibly two added args `--caller-audience` `flex-auth` (FLEX-WP-0038 saw this chart
@@ -125,7 +134,8 @@ kubectl -n $NS rollout status deploy/$REL --timeout=2m
 
 ### 3. Pin the consumer (informed-decision, same window)
 
-Per informed-decision's own runbook: set the review runtime's `policy` object to
+Per informed-decision's own runbook (`RELEASE-INFD-WP-0010-T02.md`, step 3b, RELEASE_SHA
+`005709a3…49f5`, image `ca75f0be…`): set the review runtime's `policy` object to
 `informed-decision.compact-sitting` / `v14` /
 `sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` and release it.
 Until then review requests fail closed.

docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json

@@ -1,6 +1,68 @@
 {
   "scope": "release-candidate artifact checks for compact-sitting v14; read-only, offline (docker create/cp, docker run --network none); not a general security attestation; nothing applied",
+  "release_candidate": {
     "checked_at": "2026-11-01",
+    "candidate": {
+      "repository": "forgejo.coulomb.social/coulomb/flex-auth",
+      "tag": "main-f4c9f2b",
+      "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c",
+      "revision_label": "f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81",
+      "platform": "linux/amd64",
+      "built_by": ".forgejo/workflows/image.yaml (push to main: Containerfile/go.mod), tools/publish-runtime-images.sh legacy mode",
+      "change_from_first_candidate": "builder golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 and go.mod go 1.26.10 (f4c9f2b); policy sources unchanged since 2de0f86"
+    },
+    "policy_file": {
+      "path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md",
+      "file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141",
+      "directory": "byte-identical to examples/informed-decision-present-existing-review at f4c9f2b",
+      "package": "informed-decision.compact-sitting",
+      "version": "v14",
+      "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
+      "image_validate": "valid; 46/46 Rego tests, fixtures pass"
+    },
+    "rollback_policy_in_same_image": {
+      "path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md",
+      "directory": "byte-identical to source",
+      "version": "v13",
+      "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
+      "image_validate": "valid; 32/32 Rego tests, fixtures pass"
+    },
+    "offline_verify_requests": {
+      "verify-self-approval.request.json": {
+        "v14": "deny self_approval_refused",
+        "v13": "deny unknown_class"
+      },
+      "verify-missing-action.request.json": {
+        "v14": "deny approval_action_not_admitted",
+        "v13": "deny unknown_class"
+      }
+    },
+    "scan": {
+      "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
+      "severities": [
+        "HIGH",
+        "CRITICAL"
+      ],
+      "image_id": "sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c",
+      "targets": [
+        {
+          "target": "forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c (debian 12.15)",
+          "vulnerabilities": 0
+        },
+        {
+          "target": "usr/local/bin/access-engine",
+          "vulnerabilities": 0
+        },
+        {
+          "target": "usr/local/bin/flex-auth",
+          "vulnerabilities": 0
+        }
+      ],
+      "vulnerabilities": 0,
+      "result": "0 HIGH/CRITICAL: release bar met"
+    }
+  },
+  "first_candidate": {
     "candidate": {
       "repository": "forgejo.coulomb.social/coulomb/flex-auth",
       "tag": "main-2de0f86",
@@ -19,23 +81,6 @@
       "package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)",
       "image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass"
     },
-  "rollback_policy_in_same_image": {
-    "path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md",
-    "version": "v13",
-    "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873"
-  },
-  "registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)",
-  "offline_verify_requests": {
-    "verify-self-approval.request.json": {
-      "v14": "deny self_approval_refused",
-      "v13": "deny unknown_class"
-    },
-    "verify-missing-action.request.json": {
-      "v14": "deny approval_action_not_admitted",
-      "v13": "deny unknown_class"
-    },
-    "note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused"
-  },
     "scan": {
       "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
       "severities": [
@@ -151,5 +196,10 @@
         ]
       },
       "assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides."
-  }
+    },
+    "status": "superseded: not to be released (four HIGH Go 1.26.7 stdlib CVEs); founder decision 2026-11-01 'bump Go and rebuild'"
+  },
+  "registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)",
+  "offline_verify_note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused",
+  "in_force_6c6dc263_scan": "same four Go 1.26.7 stdlib HIGH CVEs as the first candidate"
 }

internal/policy/informed_decision_attribute_test.go

@@ -103,10 +103,10 @@ func TestSittingImagePinMatchesRecordedBuild(t *testing.T) {
 	text := string(raw)
 	// values/informed-decision-sitting.yaml records the founder-approved
 	// FLEX-WP-0040-T07 compact-sitting v14 release candidate (CI image of
-	// 2de0f86, docs/compact-sitting-v14-release-runbook.md). The FLEX-WP-0034
+	// f4c9f2b, Go 1.26.10; docs/compact-sitting-v14-release-runbook.md). The FLEX-WP-0034
 	// v13 image (6c6dc263) is the rollback, kept in
 	// values/informed-decision-lifecycle-review.candidate.yaml.
-	if !strings.Contains(text, "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776") {
+	if !strings.Contains(text, "sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c") {
 		t.Fatal("sitting image digest differs from the recorded release candidate build")
 	}
 	if !strings.Contains(text, "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md") {

values/access-engine/informed-decision-sitting.yaml

@@ -2,7 +2,7 @@
 name: access-engine-informed-decision-sitting
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776
+  digest: sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c
 args:
 - serve
 - --addr

values/informed-decision-sitting.yaml

@@ -1,12 +1,12 @@
 # FLEX-WP-0040-T07 release candidate (founder-approved 2026-11-01; NOT yet applied):
 # compact-sitting v14 sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde,
-# CI image main-2de0f86. Runbook: docs/compact-sitting-v14-release-runbook.md.
+# CI image main-f4c9f2b (Go 1.26.10). Runbook: docs/compact-sitting-v14-release-runbook.md.
 # In force before this release (Helm rev 13, FLEX-WP-0034, v13): image 6c6dc263...168e,
 # exact values values/informed-decision-lifecycle-review.candidate.yaml (rollback).
 name: flex-auth-informed-decision-sitting
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776
+  digest: sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c
 args:
 - serve
 - --addr