diff --git a/docs/evidence/2026-10-04-infd-lifecycle/policy-scan.json b/docs/evidence/2026-10-04-infd-lifecycle/policy-scan.json
index 6462967..0e377b6 100644
--- a/docs/evidence/2026-10-04-infd-lifecycle/policy-scan.json
+++ b/docs/evidence/2026-10-04-infd-lifecycle/policy-scan.json
@@ -1,17 +1,20 @@
 {
   "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
   "scanner_version": "0.74.0",
-  "scanned_at": "2026-10-04T19:35:45.454792771Z",
-  "artifact": "flex-auth:wp0007-candidate",
-  "image_id": "sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37",
+  "scanned_at": "2026-10-04T19:45:06.255864835Z",
+  "artifact": "forgejo.coulomb.social/coulomb/flex-auth:main-d2d0b6f",
+  "image_id": "sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99",
   "severities": [
     "HIGH",
     "CRITICAL"
   ],
   "vulnerabilities": 0,
-  "full_report_sha256": "e41d19c961f0e0d3a4051362c6769edc3069b4286612239861818d403c16ee6a",
+  "full_report_sha256": "a3f2cefbef113ea150072efacfefbe9d6f0195bb7cf728776eac136fc8995466",
   "warnings": [
     "vendor severity selection"
   ],
-  "scope": "candidate artifact scan; not a general security attestation"
+  "scope": "candidate artifact scan; not a general security attestation",
+  "source_commit": "d2d0b6feeb",
+  "build_url": "https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316",
+  "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99"
 }
diff --git a/values/informed-decision-lifecycle-review.candidate.yaml b/values/informed-decision-lifecycle-review.candidate.yaml
index b31eaae..3f0749c 100644
--- a/values/informed-decision-lifecycle-review.candidate.yaml
+++ b/values/informed-decision-lifecycle-review.candidate.yaml
@@ -2,7 +2,7 @@
 name: flex-auth-informed-decision-sitting
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
+  digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
 args:
 - serve
 - --addr
diff --git a/values/informed-decision-lifecycle.candidate.yaml b/values/informed-decision-lifecycle.candidate.yaml
index f348866..933a2ea 100644
--- a/values/informed-decision-lifecycle.candidate.yaml
+++ b/values/informed-decision-lifecycle.candidate.yaml
@@ -2,7 +2,7 @@
 name: flex-auth-informed-decision-lifecycle
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
+  digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
 args:
 - serve
 - --addr
diff --git a/workplans/FLEX-WP-0033-informed-decision-lifecycle.md b/workplans/FLEX-WP-0033-informed-decision-lifecycle.md
index 506b038..8b288b3 100644
--- a/workplans/FLEX-WP-0033-informed-decision-lifecycle.md
+++ b/workplans/FLEX-WP-0033-informed-decision-lifecycle.md
@@ -14,7 +14,7 @@ state_hub_workstream_id: "cc97d906-68df-537c-a88f-fb2dcf7285c9"
 ---
 
 Founder selected net-kingdom-admins humans and the State Hub workload for the
-first release. Source work is on infd-wp0007-lifecycle; no live grants applied.
+first release. Source work was prepared in an isolated checkout and pushed to main; no live grants applied.
 
 ## Define and prove the initial lifecycle authorization contract
 
@@ -100,3 +100,9 @@ The existing chart's port-only API egress, advisory CARING dimensions and unsign
 consumer assertions are explicitly retained limitations, not newly enforced
 controls. T04 remains open; requester projection and State Hub production
 forwarding also remain prerequisites in their owner workplans.
+
+
+Forgejo run 316 built committed source d2d0b6f. Final candidate values now pin
+forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
+This supersedes the local candidate above for rollout. Both embedded packages
+validate in the CI artifact. No deployed values or cluster objects changed.