Founder decision 2026-11-01: the v14 release must meet the zero HIGH/CRITICAL
bar. Trivy found CVE-2026-111943, -78667, -78669 and -97031 in Go stdlib
1.26.7 (fixed in 1.26.9/1.26.10). Builder image golang:1.26.10-alpine
(index sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308)
and go.mod go 1.26.10; runtime base unchanged. make test (race), go vet and
both compact-sitting policy packages (v14 46 tests, v13 32 tests) pass on
go1.26.10. Containerfile and go.mod trigger .forgejo/workflows/image.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
