diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
index a3fa880..9f7ea33 100644
--- a/.gds/bundle.lock.yaml
+++ b/.gds/bundle.lock.yaml
@@ -2,17 +2,17 @@
 schema_version: 1
 
 bundle:
-  version: "0.9.2-dev"
+  version: "0.9.3-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:0c885d2d0f12f74a4ea83a0cfcdab9d7458c815a89bb555f8dfe8aa8030b5366"
-  digest: "sha256:0442b90d82ad533ad4cc3e8647f3948dc00feddd2dd529f6665ee4baa59f4419"
+  source_tree_digest: "sha256:dbbd338cb723846e6f140f16fd2e76594fea9377bf792c03fbae60a54e88ee01"
+  digest: "sha256:d8b7f50891831664b429e19e5df040fcc7e1fd6d1b544cf8c8ebf3147cc2afef"
 
 projection:
-  input_digest: "sha256:6990797ab8ff381018560945ee46b08f218e45c29d9330611e4aedc72269ea81"
-  output_digest: "sha256:6e34a0f22dbff41e27b75cee5aee8166b00acea9573fed77ca622e9e4209e6cc"
+  input_digest: "sha256:a56667c2156bdae3807b57a647c5f92c07223bf37b0edefbb4a50eb0038bd3e1"
+  output_digest: "sha256:5a94f145b67e94ed66d769850bed7a5e2a9ea29439d5aebcd400fab18eb49ec1"
   files:
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:f22de75f2bb598a052f336948b85dbcf10c368d83dca323b518eee96ff6f8d42"
+      digest: "sha256:26f4268e1b6df625045487c49b80342e94c5c6a81f2d8dc966f1a3a05021ac37"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:e2c0d4349fe9b3cfba25794893c7aeda31e92347cb367484d83aaf2aea50828d"
+      digest: "sha256:e12974ce96d1fccf477eaab11d2def7a22240df5d0a4e5bfb78c5c2b70e8fc7d"
diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json
index d58fd9c..0509719 100644
--- a/.gds/compiled-policy.json
+++ b/.gds/compiled-policy.json
@@ -2,8 +2,8 @@
   "schema_version": 1,
   "compiled_policy": {
     "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
-    "bundle_version": "0.9.2-dev",
-    "digest": "sha256:dafc90cc077d4cf850bdf756eb99a6bfb7c532832c0fc43fb4fa8d60ded37d69"
+    "bundle_version": "0.9.3-dev",
+    "digest": "sha256:497a28d43aad2a561c0144598da07c453bd1d48de59f02a5321c88f03f27e291"
   },
   "sources": [
     {
diff --git a/.gds/repository.yaml b/.gds/repository.yaml
index 54891ce..bc4d27e 100644
--- a/.gds/repository.yaml
+++ b/.gds/repository.yaml
@@ -77,11 +77,11 @@ git:
 
 ci:
   profile: "go"
-  go_version: "1.26.7"
+  go_version: "1.27.1"
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
-  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05"
+  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7"
   # A public repository, so GitHub-hosted runners are unmetered and a fork's
   # pull request cannot reach anything of ours. Self-hosted hardware here would
   # turn a fork PR into remote code execution on it.
@@ -109,8 +109,8 @@ verification:
     - "test"
     - "build"
   required_contexts:
-    - "GDS fast / go (1.26.7)"
-    - "GDS PR required / go (1.26.7)"
+    - "GDS fast / go (1.27.1)"
+    - "GDS PR required / go (1.27.1)"
 
 agent:
   context_profile: "project-default"
diff --git a/.github/rulesets/branch-main.json b/.github/rulesets/branch-main.json
index ddbf71a..17ee610 100644
--- a/.github/rulesets/branch-main.json
+++ b/.github/rulesets/branch-main.json
@@ -46,10 +46,10 @@
         "do_not_enforce_on_create": false,
         "required_status_checks": [
           {
-            "context": "GDS fast / go (1.26.7)"
+            "context": "GDS fast / go (1.27.1)"
           },
           {
-            "context": "GDS PR required / go (1.26.7)"
+            "context": "GDS PR required / go (1.27.1)"
           }
         ]
       }
diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml
index ab0efdf..174d1ef 100644
--- a/.github/workflows/gds-ci.yml
+++ b/.github/workflows/gds-ci.yml
@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
-# bundle: 0.9.2-dev
-# source-tree-digest: sha256:0c885d2d0f12f74a4ea83a0cfcdab9d7458c815a89bb555f8dfe8aa8030b5366
-# input-digest: sha256:6990797ab8ff381018560945ee46b08f218e45c29d9330611e4aedc72269ea81
-# output-digest: sha256:8c045e745cc69b731bc695a4a9d58a48c10f1ab7dd85b7354db7bfd0e072711c
+# bundle: 0.9.3-dev
+# source-tree-digest: sha256:dbbd338cb723846e6f140f16fd2e76594fea9377bf792c03fbae60a54e88ee01
+# input-digest: sha256:a56667c2156bdae3807b57a647c5f92c07223bf37b0edefbb4a50eb0038bd3e1
+# output-digest: sha256:15b87303cd0692fd8e5d88281771dded9fdc2fc027d600681155cb4e71f42386
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -34,7 +34,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -42,7 +42,7 @@ jobs:
       cache: true
 
       runner: "ubuntu-latest"
-      go_version: "1.26.7"
+      go_version: "1.27.1"
       # Declared fast commands own their build scope; the complete build is below.
       build_command: ""
       test_command: "scripts/validate_shell.sh && scripts/validate_go_core.sh --fast"
@@ -54,12 +54,12 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7
     with:
       fetch_depth: 0
       cache: true
       runner: "ubuntu-latest"
-      go_version: "1.26.7"
+      go_version: "1.27.1"
       build_command: "go build -trimpath ./core/cmd/gds"
       test_command: "go test ./... && python3 -m pip install --quiet --require-hashes -r requirements/test.txt && python3 -m pytest"
       timeout_minutes: 30
diff --git a/.github/workflows/platforms.yml b/.github/workflows/platforms.yml
index 17ead60..1d06294 100644
--- a/.github/workflows/platforms.yml
+++ b/.github/workflows/platforms.yml
@@ -35,9 +35,8 @@ jobs:
     # `macos-latest` is Apple Silicon, so it covers darwin/arm64. `ubuntu-24.04-arm`
     # covers linux/arm64. Both are standard hosted runners and unmetered on public
     # repositories; macOS-XL and larger runners are billed even here and are not used.
-    # darwin/amd64 stays uncovered: it needs `macos-13`, the last Intel image, whose
-    # retirement is already announced — worth adding only if that target is still
-    # shipped when this is next revisited.
+    # Standard Intel macOS runners remain available as macos-15-intel. Together
+    # with the main Linux X64 workflow these jobs execute all four shipped targets.
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 20
@@ -51,6 +50,8 @@ jobs:
             runner: macos-latest
           - name: linux-arm64
             runner: ubuntu-24.04-arm
+          - name: darwin-amd64
+            runner: macos-15-intel
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/release-bundle.yml b/.github/workflows/release-bundle.yml
index d36f996..64c203b 100644
--- a/.github/workflows/release-bundle.yml
+++ b/.github/workflows/release-bundle.yml
@@ -56,7 +56,7 @@ jobs:
     permissions:
       contents: read
     env:
-      GOTOOLCHAIN: go1.26.7
+      GOTOOLCHAIN: go1.27.1
       VERSION: ${{ inputs.version }}
       RELEASE_SEQUENCE: ${{ inputs.release_sequence }}
       CHANNEL: ${{ inputs.channel }}
@@ -74,7 +74,7 @@ jobs:
       - name: Install exact Go toolchain
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.27.1"
           cache: true
 
       - name: Run release gates
diff --git a/README.md b/README.md
index 4e46fd7..fe27312 100644
--- a/README.md
+++ b/README.md
@@ -37,8 +37,8 @@ topology.
 ## Local development
 
 ```bash
-GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds ./core/cmd/gds
-GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds-codex-runtime-driver \
+GOTOOLCHAIN=go1.27.1 go build -trimpath -o /tmp/gds ./core/cmd/gds
+GOTOOLCHAIN=go1.27.1 go build -trimpath -o /tmp/gds-codex-runtime-driver \
   ./core/cmd/gds-codex-runtime-driver
 /tmp/gds --json context
 /tmp/gds --json status
diff --git a/core/README.md b/core/README.md
index 11ef4b7..630bcdd 100644
--- a/core/README.md
+++ b/core/README.md
@@ -132,7 +132,7 @@ Root pytest discovery is limited by `pytest.ini` to `tests/`; it never collects
 tests from independent workspace repositories. The full Go validator
 runs module integrity, vet, unit/integration/race tests, schemas, and CGo-free
 cross-builds for macOS and Linux on arm64 and amd64. It requires the exact
-source-registered release builder (`go1.26.7`). Quick validation may run on an
+source-registered release builder (`go1.27.1`). Quick validation may run on an
 older local toolchain but leaves release evidence `NOT_PROVEN`.
 
 `gds-assurance` is a separate release-gate binary. It requires a clean source
diff --git a/core/app/module_verify_lanes_test.go b/core/app/module_verify_lanes_test.go
index 8c7d540..b6c2cb7 100644
--- a/core/app/module_verify_lanes_test.go
+++ b/core/app/module_verify_lanes_test.go
@@ -30,6 +30,9 @@ func TestCleanupPendingStopsLaterLanesInSource(t *testing.T) {
 }
 
 func TestFailedRemoveWorktreeDoesNotDeleteWorkspace(t *testing.T) {
+	// Production must retain a checkout whose removal was not proven. Keep that
+	// deliberately retained fixture inside the test's own temporary lifetime.
+	t.Setenv("TMPDIR", t.TempDir())
 	root, oid := moduleVerifyRepository(t)
 	runner, err := gitprovider.NewMutationRunner()
 	if err != nil {
@@ -60,6 +63,10 @@ func TestFailedRemoveWorktreeDoesNotDeleteWorkspace(t *testing.T) {
 	if !foundCleanup {
 		t.Fatalf("cleanup finding missing: %#v", findings)
 	}
+	retained, err := filepath.Glob(filepath.Join(os.TempDir(), "gds-module-verify-*", "checkout", "fixture.txt"))
+	if err != nil || len(retained) != 1 {
+		t.Fatalf("failed cleanup did not preserve the workspace: %v, %v", retained, err)
+	}
 }
 
 func TestFailedRemoveWorktreeSourceContract(t *testing.T) {
diff --git a/core/app/projection_operations.go b/core/app/projection_operations.go
index 79f04be..6920730 100644
--- a/core/app/projection_operations.go
+++ b/core/app/projection_operations.go
@@ -139,20 +139,6 @@ func (services *Services) PlanRepositoryProjection(
 		Plan: plan, StatePath: statePath, Candidate: current.candidate,
 	})
 	envelope.Scope["repository_id"] = current.repositoryID
-	// A lock generated over uncommitted sources binds worktree content: the
-	// moment those files are committed, the canonical source digest moves and
-	// the freshly applied lock reads as GDS_CONTEXT_POLICY_SOURCE_DIGEST_
-	// MISMATCH. That cost two regenerate round-trips in one day before it was
-	// named. The plan still works -- a deliberate worktree materialization is
-	// legitimate -- so this is a warning at the one moment an operator reads
-	// findings, not a refusal.
-	if status, statusErr := services.Git.InspectStatus(ctx, current.root); statusErr == nil &&
-		status.Changes.Staged+status.Changes.Unstaged+status.Changes.Conflicted > 0 {
-		envelope.Findings = append(envelope.Findings, domain.Finding{
-			Code: "GDS_PROJECTION_SOURCES_UNCOMMITTED", Severity: domain.SeverityMedium,
-			Message: "Tracked sources are uncommitted: a lock applied from this plan will mismatch the canonical source digest once they are committed. Commit first, then plan, then apply.",
-		})
-	}
 	return envelope
 }
 
@@ -305,11 +291,9 @@ func (services *Services) projectionOperationContext(
 	if err != nil {
 		return projectionContext{}, []domain.Finding{dependencyFinding(path, err)}
 	}
-	if _, err := services.Git.CommittedSourceOID(
-		ctx, repositoryInfo.WorktreeRoot, []string{".gds/repository.yaml"},
-	); err != nil {
-		return projectionContext{}, []domain.Finding{dependencyFinding(path, err)}
-	}
+	// The exact manifest bytes are bound below by ManifestDigest, and the
+	// observer rechecks them before apply. Requiring an earlier anchor commit
+	// would prevent an anchor edit and its projections from landing atomically.
 	if !source.released() {
 		// Trace metadata only; see the equivalent note in services.go. An
 		// uncommitted canonical source must not block generation, because that
diff --git a/core/cli/projection_staged_test.go b/core/cli/projection_staged_test.go
new file mode 100644
index 0000000..8eaf325
--- /dev/null
+++ b/core/cli/projection_staged_test.go
@@ -0,0 +1,63 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestStagedAnchorAndProjectionsLandInOneCommit(t *testing.T) {
+	root := testEstateRoot(t)
+	t.Setenv("GDS_ESTATE_ROOT", root)
+	anchorPath := filepath.Join(root, ".gds", "repository.yaml")
+	raw, err := os.ReadFile(anchorPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw = []byte(strings.Replace(string(raw), `display_name: "github-device-sync"`, `display_name: "staged projection fixture"`, 1))
+	if err := os.WriteFile(anchorPath, raw, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runSessionGit(t, root, "add", ".gds/repository.yaml")
+	base := []string{"--json", "--cwd", root, "generate", "repository",
+		"--state-path", sessionStatePath(t), "--device-id", "device_01JEXAMPZ00000000000000000",
+		"--session-id", "staged-projection"}
+	exit, planned, stderr := executeJSON(t, append(base, "--plan")...)
+	if exit != 0 || len(planned.Findings) != 0 {
+		t.Fatalf("plan exit=%d stderr=%s result=%#v", exit, stderr, planned)
+	}
+	planID := syncPlanID(t, planned.Data)
+
+	// An edit after planning must not be authorized by the earlier plan.
+	changed := append(append([]byte(nil), raw...), []byte("\n# changed after planning\n")...)
+	if err := os.WriteFile(anchorPath, changed, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	exit, refused, _ := executeJSON(t, append(base, "--apply", planID)...)
+	if exit == 0 || refused.Mutation.Completed {
+		t.Fatalf("changed manifest was applied: %#v", refused)
+	}
+	if err := os.WriteFile(anchorPath, raw, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// A refused attempt has its own journal; plan again against restored input.
+	exit, planned, stderr = executeJSON(t, append(base, "--plan")...)
+	if exit != 0 {
+		t.Fatalf("replan exit=%d stderr=%s result=%#v", exit, stderr, planned)
+	}
+	exit, applied, stderr := executeJSON(t, append(base, "--apply", syncPlanID(t, planned.Data))...)
+	if exit != 0 || !applied.Mutation.Completed {
+		t.Fatalf("apply exit=%d stderr=%s result=%#v", exit, stderr, applied)
+	}
+	exit, verified, stderr := executeJSON(t, append(base, "--verify", applied.OperationID)...)
+	if exit != 0 {
+		t.Fatalf("verify exit=%d stderr=%s result=%#v", exit, stderr, verified)
+	}
+	runSessionGit(t, root, "add", ".")
+	runSessionGit(t, root, "commit", "-qm", "stage anchor and generated projections together")
+	exit, checked, stderr := executeJSON(t, "--json", "--cwd", root, "generate", "repository", "--check")
+	if exit != 0 || len(checked.Findings) != 0 {
+		t.Fatalf("post-commit drift: exit=%d stderr=%s result=%#v", exit, stderr, checked)
+	}
+}
diff --git a/core/cli/root.go b/core/cli/root.go
index d8f69b7..5acdf09 100644
--- a/core/cli/root.go
+++ b/core/cli/root.go
@@ -22,7 +22,7 @@ import (
 // Version is the development default; a release build overrides it with the
 // exact tag via -X. It carries the -dev suffix so an unstamped binary can
 // never claim to be a released one.
-var Version = "0.9.2-dev"
+var Version = "0.9.3-dev"
 
 type options struct {
 	json    bool
diff --git a/core/cli/root_test.go b/core/cli/root_test.go
index d5b9ed8..cce395b 100644
--- a/core/cli/root_test.go
+++ b/core/cli/root_test.go
@@ -177,9 +177,7 @@ func TestGenerateRepositoryReturnsCandidateWithoutMutation(t *testing.T) {
 	if envelope.Mutation.Attempted || envelope.Mutation.Completed {
 		t.Fatalf("mutation = %#v", envelope.Mutation)
 	}
-	// A committed tree plans without the uncommitted-sources warning; the
-	// warning's loud half fires only on dirty tracked files, where a lock
-	// applied now would mismatch the canonical digest after the commit.
+	// Content-addressed generation does not require a preparatory source commit.
 	for _, finding := range envelope.Findings {
 		if finding.Code == "GDS_PROJECTION_SOURCES_UNCOMMITTED" {
 			t.Fatalf("clean tree warned about uncommitted sources: %#v", finding)
diff --git a/core/cmd/gds-controller/main.go b/core/cmd/gds-controller/main.go
index ecd00c1..f6413f5 100644
--- a/core/cmd/gds-controller/main.go
+++ b/core/cmd/gds-controller/main.go
@@ -25,7 +25,7 @@ import (
 
 // version is the development default; the release builder stamps the exact
 // tag via -X main.version. The -dev suffix keeps an unstamped binary honest.
-var version = "0.9.2-dev"
+var version = "0.9.3-dev"
 
 func main() {
 	ctx, stop := signal.NotifyContext(
diff --git a/core/compiler/types.go b/core/compiler/types.go
index 1cd2cd7..5884731 100644
--- a/core/compiler/types.go
+++ b/core/compiler/types.go
@@ -12,7 +12,7 @@ import (
 // policy-owner checkout. It tracks the current release line with a -dev
 // suffix so a development bundle is dated honestly; the development channel
 // field, not this string, is what classifies the bundle.
-const DevelopmentBundleVersion = "0.9.2-dev"
+const DevelopmentBundleVersion = "0.9.3-dev"
 
 type PolicySource struct {
 	SchemaVersion int               `json:"schema_version"`
diff --git a/core/domain/repository.go b/core/domain/repository.go
index 224936c..4bedd05 100644
--- a/core/domain/repository.go
+++ b/core/domain/repository.go
@@ -96,7 +96,7 @@ type VerificationPolicy struct {
 	// protected branch enforces, as the anchor claims them.
 	//
 	// It is a separate vocabulary from Commands on purpose. A required context
-	// is a check run name -- "govulncheck", "ci-gate", "GDS fast / go (1.26.7)"
+	// is a check run name -- "govulncheck", "ci-gate", "GDS fast / go (1.27.1)"
 	// -- and not a command, so no derivation connects the two. Stating the set
 	// is what makes it comparable with what the provider actually enforces; the
 	// alternative, inferring a gate from the commands beside it, would produce a
diff --git a/core/releasebuilder/builder.go b/core/releasebuilder/builder.go
index fd5ed05..9eaeaa0 100644
--- a/core/releasebuilder/builder.go
+++ b/core/releasebuilder/builder.go
@@ -539,7 +539,7 @@ func releaseEnvironment(goos string, goarch string, cache string, home string) [
 		"CGO_ENABLED=0", "GOAMD64=v1", "GOARM64=v8.0", "GOENV=off",
 		"GOCACHE="+cache, "GOMODCACHE="+filepath.Join(home, "go", "pkg", "mod"),
 		"GOPROXY=https://proxy.golang.org,direct", "GOSUMDB=sum.golang.org",
-		"GOTELEMETRY=off", "GOTOOLCHAIN=go1.26.7", "GOWORK=off",
+		"GOTELEMETRY=off", "GOTOOLCHAIN=go1.27.1", "GOWORK=off",
 		"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_NOSYSTEM=1", "GIT_TERMINAL_PROMPT=0",
 		"HOME="+home, "LANG=C", "LC_ALL=C", "TZ=UTC",
 	)
diff --git a/core/releasebuilder/types.go b/core/releasebuilder/types.go
index 10f741c..8606de3 100644
--- a/core/releasebuilder/types.go
+++ b/core/releasebuilder/types.go
@@ -8,7 +8,7 @@ import (
 	"github.com/NDDev-OpenNetwork/github-device-sync/core/bundle"
 )
 
-const ExpectedGoVersion = "go1.26.7"
+const ExpectedGoVersion = "go1.27.1"
 
 type Target = bundle.ReleaseTarget
 
diff --git a/core/workspace/device.go b/core/workspace/device.go
index c0951dd..ff3b589 100644
--- a/core/workspace/device.go
+++ b/core/workspace/device.go
@@ -173,12 +173,12 @@ func ResolvePlacement(
 	}
 	if len(matches) == 0 {
 		return Placement{
-				DeviceID: descriptor.Device.ID, RepositoryID: anchor.Repository.ID,
-				Mode: descriptor.Materialization.DefaultMode,
-			}, []domain.Finding{workspaceFinding(
-				"GDS_WORKSPACE_PLACEMENT_NOT_SELECTED",
-				"Repository does not match a device materialization assignment.", anchor.Repository.ID,
-			)}
+			DeviceID: descriptor.Device.ID, RepositoryID: anchor.Repository.ID,
+			Mode: descriptor.Materialization.DefaultMode,
+		}, []domain.Finding{workspaceFinding(
+			"GDS_WORKSPACE_PLACEMENT_NOT_SELECTED",
+			"Repository does not match a device materialization assignment.", anchor.Repository.ID,
+		)}
 	}
 	if len(matches) != 1 {
 		return Placement{}, []domain.Finding{workspaceFinding(
diff --git a/docs/adr/0014-go-production-core.md b/docs/adr/0014-go-production-core.md
index a4caa44..fe8a31d 100644
--- a/docs/adr/0014-go-production-core.md
+++ b/docs/adr/0014-go-production-core.md
@@ -24,7 +24,7 @@ Implement the production `gds` CLI and portable control-plane core in Go.
 
 - Set the module language baseline to Go 1.25 so the two currently supported
   Go release families can build it. Pin the release builder separately to the
-  exact verified toolchain, currently Go 1.26.7. A builder older than Go 1.26.7
+  exact verified toolchain, currently Go 1.27.1. A builder older than Go 1.27.1
   is release-blocked; accepting a later builder requires a source-register
   update and the same release gates.
 - Build release artifacts with `CGO_ENABLED=0` for macOS and Linux on amd64 and
diff --git a/docs/contracts/bundle-release-v1.md b/docs/contracts/bundle-release-v1.md
index 2342728..a3e428a 100644
--- a/docs/contracts/bundle-release-v1.md
+++ b/docs/contracts/bundle-release-v1.md
@@ -1,11 +1,9 @@
 # GDS immutable bundle release v1 contract
 
-Status: local build, verification, installation, rollback, and removal contracts
-implemented. The repository is private and owned by the example-org
-organization, so artifact attestation is available. Hosted attestation and
-publication are proven: `gds-v0.1.0` (source commit `bace996`) was built,
-attested, and published on 2026-07-24T10:11:01Z. Consumer adoption, canary
-rollout, and Linux consumer execution remain NOT_PROVEN (see "Not proven").
+Status: build, verification, installation, upgrade, rollback, and removal
+contracts are implemented. This public engine produces portable releases;
+each consuming estate owns device acceptance and rollout evidence. The assets
+and workflow run attached to an exact release establish its publication state.
 
 ## Portable source boundary
 
@@ -27,12 +25,15 @@ markers, and unexpected executable content fail closed.
 ## Reproducible release unit
 
 `gds-release-builder` requires a fully tracked clean Git worktree, exact source
-ref resolving to `HEAD`, Go `1.26.7`, read-only modules, CGO disabled, portable
+ref resolving to `HEAD`, Go `1.27.1`, read-only modules, CGO disabled, portable
 CPU baselines, and an isolated build environment without ambient credentials or
 Git configuration. Stable and frozen channels require
 `refs/tags/gds-v<version>`; canary accepts only `refs/heads/main` or that exact
 tag.
 
+The Darwin binaries require macOS 13 or later, matching Go 1.27's supported
+platform baseline. Linux and Darwin each retain amd64 and arm64 targets.
+
 The builder obtains the same process-wide `core/gitauthority` used by runtime
 Git providers before source inspection and retains it through private fetch,
 tree comparison, and archive creation. Caller `PATH`, repository-selection,
@@ -246,23 +247,18 @@ own trusted root — and the hosting provider adds nothing to that. The earlier
 rule that releases must be GitHub-hosted made the estate's own builds
 un-installable and has been removed.
 
-The control-plane repository is private and owned by the example-org
-organization, so the hosted `actions/attest` steps are an available release
-path. An ad hoc signing key or a workflow that silently omits attestations is
-still not an accepted fallback. A change of repository visibility or ownership
-re-opens the trust-boundary decision before the next dispatch.
+The public release workflow uses `actions/attest`. An ad hoc signing key or a
+workflow that omits attestations is not an accepted fallback. A change of
+repository visibility or ownership requires renewed verification of the exact
+consumer trust policy before dispatch.
 
-## Proven
+## Publication and acceptance evidence
 
-- one live GitHub Actions run of the release workflow per channel: run
-  `30046936069` (canary, `refs/heads/main`, 2026-07-23) and run `30064955206`
-  (stable, `refs/tags/gds-v0.1.0`, 2026-07-24);
-- hosted `actions/attest` provenance over the five checksummed release files
-  and an SPDX SBOM attestation over the bundle artifact;
-- external artifact publication: the six-file release directory is attached to
-  the `gds-v0.1.0` GitHub Release. From the workflow revision that followed that
-  tag, publication also attaches the offline evidence directory to the same
-release, so a release and its evidence are one durable artifact set.
+A current release attaches the six-file release unit and its three offline
+verification inputs to the same GitHub Release. Download all assets into a
+staging directory, then split release files, offline evidence, and auxiliary
+build results as described in `docs/runbooks/seed-clean-device.md`. Auxiliary
+result JSON belongs to neither verifier input directory.
 
 A tag-triggered build, attestation, or publication failure is retained as a
 GitHub prerelease with `release-failure-envelope.json`. The schema binds the
@@ -271,22 +267,9 @@ failed job names, and an initially null `superseded_by`. A later accepted
 release may name the failed tag as superseded; failed tags are never rewritten
 or silently deleted.
 
-## Not proven
-
-- durable retention of the offline evidence directory for `gds-v0.1.0`
-  specifically: that tag predates the evidence attachment, so its evidence
-  exists only as the producing run's workflow artifact under a 30-day retention
-  window. Later releases attach it. Because the release and its evidence are
-  then published together, a consumer must download into a staging directory
-  and split the assets into the two consumer inputs: the release directory
-  accepts exactly six entries and the evidence directory exactly the three
-  required inputs (`docs/runbooks/seed-clean-device.md`, step 2b). Auxiliary
-  result JSON published alongside the evidence belongs to neither input;
-- GitHub-enforced release immutability: the published release is not marked
-  with GitHub's immutable-releases flag, so release-asset immutability rests on
-  this contract's digest/envelope/sequence binding, not on the provider;
-- consumer-side verification of the published artifact on a clean device;
-- Linux consumer execution of install/upgrade/rollback/remove;
-- canary repository adoption, merge, rollback, or broad rollout.
-
-Those remain external mutation boundaries and require separate exact approval.
+Provider-enforced immutability must be read from the exact GitHub Release;
+digest, envelope, and sequence checks remain mandatory. A successful published
+build does not prove installation on a particular device, repository adoption,
+or a broad rollout. Each consuming estate records those results separately.
+Historical releases that predate durable offline attachments retain their
+original evidence limits; this contract does not retroactively certify them.
diff --git a/docs/runbooks/bootstrap-device.md b/docs/runbooks/bootstrap-device.md
index 247bbbe..ace1353 100644
--- a/docs/runbooks/bootstrap-device.md
+++ b/docs/runbooks/bootstrap-device.md
@@ -76,7 +76,7 @@ Verifies the host OS/arch, the control-plane root, the bootstrap submodule, and
 
 ### Phase 1 — seed Go + build gds
 
-Installs the pinned Go toolchain (`go1.26.7`, the security floor) into
+Installs the pinned Go toolchain (`go1.27.1`, the security floor) into
 `~/sdk/go<version>` (the `GOTOOLCHAIN` pattern) and builds the `gds` CLI from
 the control-plane source into `~/.local/bin/gds`. The source build carries the
 nearest release version plus the exact source commit (for example,
@@ -165,6 +165,22 @@ modules/github-device-sync/scripts/bootstrap-device.sh --estate-root . \
 # Combined phase-3 apply is intentionally rejected.
 ```
 
+For an already-approved release lifecycle plan, pass its exact identity inputs
+to the helper. It supplies those inputs to apply, then verifies the stored
+operation without replaying release paths or rollback selectors:
+
+```bash
+scripts/gds-exact-apply.sh --plan-id <plan-id> --approval-file <approval.json> \
+  --state-path <db> --device-id <id> --session-id <id> -- \
+  gds --json release install --install-root <root> \
+  --release-directory <release> --evidence-directory <evidence> \
+  --trust-policy <independent-trust-policy>
+```
+
+The same rule applies to upgrade, rollback, and remove. Harness lifecycle
+verification retains its harness and target selectors. Failure in enable,
+apply, or verify stops the sequence and never reports a successful result.
+
 At the end the orchestrator prints the `export PATH` line to add the Go
 toolchain. It does **not** edit `~/.bashrc` silently.
 
@@ -202,14 +218,14 @@ mutation.
 
 ## Status
 
-- macOS `arm64`: locally rehearsable through `seed-clean-device.md`.
-- Ubuntu `24.04`/`26.04`: **`NOT_PROVEN`** until produced on a real device
-  (completion plan residual #8; stage `C9`). The `example-user-ubuntu-1` device
-  is the first concrete Linux rehearsal; its observed evidence closes part of
-  that residual but does not by itself accept Linux consumer execution. Its
-  device integrity receipt verifies `PROVEN` against the current contract,
-  proving the runtime/tool layer is reproducible on Linux even though the full
-  release-bound production path is not yet exercised.
+- The source bootstrap pins reviewed Go archives for Linux and macOS, on
+  amd64 and arm64. Go 1.27 requires macOS 13 or later.
+- Use `seed-clean-device.md` for release-bound initialization. Availability
+  of a platform binary and a passing source build do not certify a new device;
+  verify its OS receipt, independent release trust, exact installation, GitHub
+  access, selected harnesses, and doctor result on that device.
+- Device-specific rehearsal and acceptance records belong to the consuming
+  estate. An example descriptor is not a live acceptance result.
 - Source-build phase 1 is a development/canary path and is not a release
   artifact. A hosted release remains the production boundary.
 
diff --git a/docs/runbooks/controller-operations.md b/docs/runbooks/controller-operations.md
index 2e82f2d..5d7fd7d 100644
--- a/docs/runbooks/controller-operations.md
+++ b/docs/runbooks/controller-operations.md
@@ -23,10 +23,10 @@ this document.
 ## Build and local validation
 
 ```bash
-GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds-controller ./core/cmd/gds-controller
+GOTOOLCHAIN=go1.27.1 go build -trimpath -o /tmp/gds-controller ./core/cmd/gds-controller
 /tmp/gds-controller --version
 python3 scripts/validate_gds_schemas.py --root . --json
-GOTOOLCHAIN=go1.26.7 go test ./core/controller ./core/webhooks ./core/state -race -count=1
+GOTOOLCHAIN=go1.27.1 go test ./core/controller ./core/webhooks ./core/state -race -count=1
 ```
 
 ## Start
diff --git a/docs/source-register/review-2026-09-12.md b/docs/source-register/review-2026-09-12.md
new file mode 100644
index 0000000..dc0aa51
--- /dev/null
+++ b/docs/source-register/review-2026-09-12.md
@@ -0,0 +1,49 @@
+# Technology and source review, 2026-09-12
+
+The next patch release uses Go 1.27.1, the current stable toolchain listed by
+the Go project. The bootstrap archive digests cover all four release targets.
+Darwin now requires macOS 13. Keep the existing JSON API and wire contracts;
+the Go compatibility changes are verified by the complete test and release
+reproduction gates, without an unrelated serialization migration.
+
+The Go graph promotes agent-runtime to its published v0.1.2 and updates SQLite,
+platform support, Unicode, flag parsing, and the SQLite runtime dependencies.
+The vulnerability scanner is pinned to v1.8.0. Cobra, JSON Schema, and the
+reviewed YAML v4 release candidate have no newer compatible release. The
+Python test runtime moves to 3.14.7 with uv 0.12.13. The direct package pins
+remain current; their complete hash-locked graphs are
+verified separately.
+
+GitHub CLI 2.100.0 replaces the previous verifier. Each of the four extracted
+executables is bound to the release checksums and the independently read
+GitHub asset digest. The independently fetched Sigstore trusted-root bytes
+still match the existing consumer pin. A consumer must deliberately adopt
+the new verifier policy; a bundle cannot authorize its own verifier.
+
+The source register was reviewed against current official pages and feeds.
+OpenAI instruction, skill, and hook pages moved to ChatGPT Learn; plugin
+packaging now documents a portable root manifest while explicitly preserving
+the `.codex-plugin/plugin.json` compatibility format used by GDS. Antigravity
+CLI reference/plugin pages moved under `/docs/cli/`; their former pages return
+HTML redirects. The old Cursor CLI URL redirected to the documentation index,
+so its record now points at the CLI overview. The GitHub REST contract remains
+2026-03-10. The existing pinned checkout, setup-go, attest, and artifact actions
+match their current stable releases.
+
+These are source and dependency observations. They do not extend delegated
+runtime evidence, signing-key validity, or device acceptance. Stable releases
+still require fresh evidence for every supported harness.
+
+Sources: [Go release history](https://go.dev/doc/devel/release),
+[Go 1.27 compatibility notes](https://go.dev/doc/go1.27),
+[GitHub CLI 2.100.0](https://github.com/cli/cli/releases/tag/v2.100.0),
+[OpenAI plugin packaging](https://developers.openai.com/plugins/build/plugins),
+[Antigravity CLI plugins](https://antigravity.google/docs/cli/plugins),
+[Cursor CLI](https://cursor.com/docs/cli/overview). Exact response digests and
+governed contracts are recorded in `sources.yaml`.
+
+The shipped Darwin amd64 target now has a native test lane on the standard
+`macos-15-intel` runner. The previous claim that only retired macOS 13 could
+provide Intel execution was stale; the current [hosted runner reference](https://docs.github.com/en/actions/reference/runners/github-hosted-runners)
+lists standard Intel images. Linux amd64 remains covered by the main workflow,
+with both ARM targets and Darwin amd64 in the platform workflow.
diff --git a/docs/source-register/sources.yaml b/docs/source-register/sources.yaml
index c647d44..c21e560 100644
--- a/docs/source-register/sources.yaml
+++ b/docs/source-register/sources.yaml
@@ -2,47 +2,47 @@ schema_version: 1
 sources:
   - id: openai-codex-agents
     authority: official
-    url: https://developers.openai.com/codex/guides/agents-md
+    url: https://learn.chatgpt.com/docs/agent-configuration/agents-md
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:59b5bcbf18d8c955efb65bd140d6c124e43509191113de5a2874526c342f1222
+    content_digest: sha256:d54ef066bc568d7e605888050ee702490a4f9dac8b34c4a93ff864ea843abd59
     governs:
       - codex.instruction-discovery
       - codex.instruction-budget
   - id: openai-codex-skills
     authority: official
-    url: https://developers.openai.com/codex/skills
+    url: https://learn.chatgpt.com/docs/build-skills
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:c8b2ca8481ec06368591057e60bb781a7cd98bac845532d483ce44c4d48ef42a
+    content_digest: sha256:1fbf81b79b26e60d62767129698fc51121bf8796a71128cbc014b7ce0258d138
     governs:
       - codex.skill-discovery
       - codex.skill-metadata-budget
       - codex.explicit-only-invocation
   - id: openai-codex-hooks
     authority: official
-    url: https://developers.openai.com/codex/hooks
+    url: https://learn.chatgpt.com/docs/hooks
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:860f550c8e3674c9ec5049918d783dc9e1798a99c2a4026453d1d365e496279a
+    content_digest: sha256:1b787df9ba118879aead18e555048a150a8fab6c0b19cc80ccffce285a7cf13d
     governs:
       - codex.hook-schema
       - codex.hook-trust
       - codex.hook-limitations
   - id: openai-codex-plugins
     authority: official
-    url: https://developers.openai.com/codex/plugins/build
+    url: https://developers.openai.com/plugins/build/plugins
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:605face331e44ea6befdc54c63b3d1e560f0595635db9083a20b9bbd19554e18
+    content_digest: sha256:5a339e3524080ab42d07e4a1eacf2449c53823deaf2b43f852eb6ebcc70ad77b
     governs:
       - codex.plugin-layout
       - codex.plugin-manifest
@@ -50,10 +50,10 @@ sources:
     authority: official
     url: https://code.claude.com/docs/en/memory.md
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:2501989d713a4d5ec03e7c237dd6f3a6ecb9e497536989294b2c141b7bc3086a
+    content_digest: sha256:f212449ea6fbdb88bea34ad85c967ae3681470bdbd376ac84bda7f535029e677
     governs:
       - claude-code.instruction-discovery
       - claude-code.imports
@@ -61,10 +61,10 @@ sources:
     authority: official
     url: https://code.claude.com/docs/en/skills.md
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:556658106012768aaa3b3724463cdd99b660c3c914e312626fe966c15e3a9990
+    content_digest: sha256:8552fefb7d225fcdc1c4098f6a33616d6a55e63206b9d84f0522c7411d0c4c41
     governs:
       - claude-code.skill-discovery
       - claude-code.explicit-only-invocation
@@ -72,20 +72,20 @@ sources:
     authority: official
     url: https://code.claude.com/docs/en/hooks-guide.md
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:2b962612e67bf824e0e2359a73f30b2f2fa0ef2ddf83edadb9f396aca92dffe3
+    content_digest: sha256:e388b1bb4c83d9773396a13ad0c70978b562ea40aefd297045475bbe5e7af41c
     governs:
       - claude-code.hooks
   - id: google-antigravity-cli
     authority: official
-    url: https://antigravity.google/docs/cli-reference
+    url: https://antigravity.google/docs/cli/reference
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:46da618e24ae4dc3ba27151971cc044523621dcae3c64a492eb49d1a722a316f
+    content_digest: sha256:aca0b66ce4b24912f9614e50d4861a2dadce7baec0a1e7bdc0f5cf69b5d6c17e
     governs:
       - antigravity-cli.identity
       - antigravity-cli.instruction-discovery
@@ -93,20 +93,20 @@ sources:
     authority: official
     url: https://antigravity.google/docs/skills?app=antigravity-ide
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:40c64faf28c399b8ccaf36f8639eb000a01d923e714634c1fe384a34c432df93
+    content_digest: sha256:e388a0390f1fe6e606e2fca972b4101711996e9e4df79ad6079b4a88cfa73ba5
     governs:
       - antigravity-cli.skill-discovery
   - id: google-antigravity-plugins
     authority: official
-    url: https://antigravity.google/docs/cli-plugins
+    url: https://antigravity.google/docs/cli/plugins
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:39d0a1d599b02e0d18050794a7343572d7703f824d20709cbd631b233eb4bc19
+    content_digest: sha256:3df5110bc91d9a8b9cc3eaf5bdc6f2d0ec75df5b5c024a29ca86ef926a62aa53
     governs:
       - antigravity-cli.plugin-layout
       - antigravity-cli.hooks
@@ -115,30 +115,30 @@ sources:
     authority: official
     url: https://opencode.ai/docs/rules/
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:93b2b080ae21c0168acabe02c59972404577505971499c039cfc4adc0bc60b23
+    content_digest: sha256:c24dff71b129995933bdc94f4f393612355709c61e475b95162f5f973614e564
     governs:
       - opencode.instruction-discovery
   - id: opencode-skills
     authority: official
     url: https://opencode.ai/docs/skills/
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:1ee38e39d59645367e6542a309f78cc0a2309701bf238ce32b3c5a6142e75683
+    content_digest: sha256:ff610a25120b3197763a2c14ffbdf24918a0de0302b6f7fdb27406cb339ddea3
     governs:
       - opencode.skill-discovery
   - id: pi-context-and-cli
     authority: official
     url: https://pi.dev/docs/latest/usage
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:91bd8df3fb9da5dce609b4bf22791abd3b01daa766f7f9e20fa8259c0ed90d40
+    content_digest: sha256:588896ba21944ff002d637444edc22698fd24959c59fe25f95010b9707b47d92
     governs:
       - pi.instruction-discovery
       - pi.runtime-detection
@@ -146,21 +146,21 @@ sources:
     authority: official
     url: https://pi.dev/docs/latest/skills
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:0e24fa64c74f05b6fefc45f693c23c9649f96d153834c0074105e9f752d1dc87
+    content_digest: sha256:e44738f2de44436b1ef56ab64231116fdc68a451213b96b27a5338d6296176c7
     governs:
       - pi.skill-discovery
       - pi.explicit-only-invocation
   - id: cursor-cli
     authority: official
-    url: https://docs.cursor.com/en/cli/using
+    url: https://cursor.com/docs/cli/overview
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:85c94b2dc0a7b0d254a680962aab8dbb5b6195c5fecb5af6a0d9f4d830c2778a
+    content_digest: sha256:c56ae1d766654ca892b2cfb513a2f7f5ef0082f107d225fb4319fa9f20109e85
     governs:
       - cursor-cli.instruction-discovery
       - cursor-cli.skill-discovery
@@ -170,8 +170,8 @@ sources:
     authority: official
     url: https://docs.x.ai/build/features/project-rules
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:1077d4bf3497f8c2a9022d82c251876e091f621e98f85e0b1c4eb1d5fceab383
     governs:
@@ -180,8 +180,8 @@ sources:
     authority: official
     url: https://docs.x.ai/build/features/skills-plugins-marketplaces
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:8a43a3409c751c943b4c9aaba199adf9938e8ea00663cd3a134c815e0970d6ac
     governs:
@@ -190,8 +190,8 @@ sources:
     authority: official
     url: https://agentskills.io/specification
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current
     content_digest: sha256:2b1dbb4fd80c31748d15812c4ebd3e66c09383d0c792801f617718684489e40d
     governs:
@@ -201,8 +201,8 @@ sources:
     authority: official
     url: https://agentskills.io/skill-creation/best-practices
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current
     content_digest: sha256:8e78d596cf2b24eadcfea8e7a67dbf7b2a0f70953942849b8872664f9d69d836
     governs:
@@ -213,31 +213,31 @@ sources:
     authority: official
     url: https://go.dev/doc/devel/release
     volatility: medium
-    verified_at: "2026-08-28"
-    next_review: "2026-09-28"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-release-builder-pinned
-    content_digest: sha256:4c9ddc4b23faefa2fd1c9d97f7a175251e408591cecf58bce4a2612113f01b6e
+    content_digest: sha256:10fa2f83a0e37e1663172a96f102f59ce40f02506d89e3a6f08c5a2d1c63a0af
     governs:
       - go.supported-releases
       - go.release-builder
-  - id: go-1-26-release-notes
+  - id: go-1-27-release-notes
     authority: official
-    url: https://go.dev/doc/go1.26
+    url: https://go.dev/doc/go1.27
     volatility: low
-    verified_at: "2026-07-12"
-    next_review: "2027-01-12"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current
-    content_digest: sha256:4399238e3ba0509479885d4d8494faa95259014ab11b17be392fbd0f8504affe
+    content_digest: sha256:2de75a072079c47b0b21c39c398654bcf33c4cecec7bd873ac7c1561778252d9
     governs:
       - go.module-language-baseline
   - id: go-2026-4970
     authority: official-vulnerability-database
     url: https://pkg.go.dev/vuln/GO-2026-4970
     volatility: critical
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: mitigated-by-release-builder
-    content_digest: sha256:d7b332834026fa294ce1470fa726f08bb701e25f3a63d85185c3505dd35b3df9
+    content_digest: sha256:d14e0a07daf13a0041ab42f8897ff780ceefbe922af13f1b590be086c947d925
     governs:
       - go.release-builder
       - security.path-boundary
@@ -245,10 +245,10 @@ sources:
     authority: official-vulnerability-database
     url: https://pkg.go.dev/vuln/GO-2026-5856
     volatility: critical
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: mitigated-by-release-builder
-    content_digest: sha256:684654c646aafe531206be3d5d99ca1babd1e156bb0751c8bac66d72e2e8ec84
+    content_digest: sha256:9ecb7d89ac997ef1081f371d9436ab1e4eeea2600200da8f375d9d50cbc7bbe2
     governs:
       - go.release-builder
       - security.transport
@@ -256,10 +256,10 @@ sources:
     authority: official-vulnerability-database
     url: https://pkg.go.dev/vuln/GO-2026-6218
     volatility: critical
-    verified_at: "2026-08-28"
-    next_review: "2026-09-28"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: mitigated-by-release-builder
-    content_digest: sha256:de05a77cf80fd7d66bd2ebad31692e0b07f960c747b6b106e57e2c4ba81205e5
+    content_digest: sha256:562a782df99650901ed8a3f437ca0ccb3a2386dc540ade3c59abd7b1a58ed8b5
     governs:
       - go.release-builder
       - security.path-boundary
@@ -267,28 +267,28 @@ sources:
     authority: official-package-index
     url: https://pypi.org/project/pytest/
     volatility: medium
-    verified_at: "2026-07-12"
+    verified_at: "2026-09-12"
     next_review: "2026-10-12"
     status: current
-    content_digest: sha256:e6f8735481b3c2dd7c29ec409a2b033612c76dde71693af3961ec2b4b6762496
+    content_digest: sha256:63d989d97e552a1f6097496dc825dd0457f486a8cc1800830137af7f04dfd8a4
     governs:
       - python.test-runner
   - id: cobra-releases
     authority: official-source-repository
     url: https://github.com/spf13/cobra/releases.atom
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current
-    content_digest: sha256:9736f38330c600e1896b09c98d4bde67d8824e5b7456cf4b957e19ed6051ee9b
+    content_digest: sha256:11f342f54fb7fe10d87b290f547fbc486beb2df84c60708c581f51acbca828b9
     governs:
       - go.cli-adapter
   - id: jsonschema-v6
     authority: official-source-repository
     url: https://github.com/santhosh-tekuri/jsonschema/releases.atom
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current
     content_digest: sha256:2e804ccd599ce8983977d292b52d13e65758ae744a87b53d6c07a25535c72eb6
     governs:
@@ -297,8 +297,8 @@ sources:
     authority: official-source-repository
     url: https://github.com/yaml/go-yaml/tags.atom
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: pre-release
     content_digest: sha256:0ea54a6a0e660ff774ad58acba76168409d645d3953a65296976a296f8a0e05d
     governs:
@@ -308,10 +308,10 @@ sources:
     authority: official-package-documentation
     url: https://pkg.go.dev/modernc.org/sqlite
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: selected-local-state-driver
-    content_digest: sha256:119ab6beee70c3c94decef6725bd49def1072bcbfca889ed51bb8ec9ac1b07ac
+    content_digest: sha256:bae82ecaa803504449943cfcada93b5bc661f03d040894310ba864ff48b58a73
     governs:
       - state.sqlite-driver
       - state.cgo-free-build
@@ -319,8 +319,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/about-the-rest-api/api-versions
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:c8e40bd4bbeb96fc37c3366eb466b9071a9bf7bfe02025a0f58af1208360f2a9
     governs:
@@ -330,8 +330,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:4466447484a8364f0b5e4272c9d5be9aed88862944bd38d8596f93f0babe8763
     governs:
@@ -341,18 +341,18 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/apps/installations
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:c5d63464aaa378704f9ebf8f28ab5af8be6e390f457a3c17a8b4648cc3e63cd9
+    content_digest: sha256:0c49e07b84c092f9d8325252feab68d0d950ea36375695c52a29cc146558fc40
     governs:
       - github.installation-discovery
   - id: github-repository-metadata
     authority: official
     url: https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:a53d404d83b90a79de207067fba2d18f9b316ab527326f98ef5cc16c11021c23
     governs:
@@ -364,8 +364,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/repos/rules?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:6269b409dfb5dba426c5c72c4dd33656b513ab477250fbe8d83c5b929afb7ea4
     governs:
@@ -374,8 +374,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/actions/permissions?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:68c489fd983bc0dafeca295108590825b611c849fd26cf458f728e03ac4a0c65
     governs:
@@ -385,8 +385,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/checks/runs?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:1e43fb9d855d41ceaefd0ad110d9cc1b4cd378ab3e6e3fb098649bbb6f083d66
     governs:
@@ -395,8 +395,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/pulls/pulls?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:833e79c758af0ae0fe0c77a4cdf83f34aec7c74b276f1d1d2420970f957ced98
     governs:
@@ -406,8 +406,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/repos/contents?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:099f0886f2ddd136fd69afb2395dd6b42cde1e36e123ad088d3274cb363f5bb7
     governs:
@@ -417,8 +417,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/git/refs?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:1e6aee928c80afdc4662ab5c433c3876aa9fa7a2a828a29a3f42cd4666419c71
     governs:
@@ -427,8 +427,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/commits/commits?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:1e47cad3f1df34aa4b38151fe95e6d60df66ba6dbe7605f5067a0accb6a1f4a4
     governs:
@@ -437,18 +437,18 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/repos/custom-properties?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:770eebc33ed68063360607ffab02c9a7b7377ba2a3b584bd27794e1128cf4348
+    content_digest: sha256:13abd6d714cbc1b056d28b449c19b4a55e33194621889e193bd820fa28a780e1
     governs:
       - github.custom-property-value-mutation
   - id: github-rest-rate-limits
     authority: official
     url: https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:97f2f169fc98314ad6a0de057f9f95bd3c3d0cddfcfb4fefe553bd0bfc330ff3
     governs:
@@ -459,18 +459,18 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api
     volatility: medium
-    verified_at: "2026-07-12"
+    verified_at: "2026-09-12"
     next_review: "2026-10-12"
     status: current
-    content_digest: sha256:57c9bb3c954f64d9e92aafbf226988e71ca141a520798aca696edc020fd56d04
+    content_digest: sha256:531f02a4b4b1e6741d99373255b4895d2001fdbce9ebf41278ccbe8af6c53658
     governs:
       - github.link-pagination
   - id: github-webhook-best-practices
     authority: official
     url: https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:230868edc79e3f7e7ded0d777368f2b8dee4523dd0d2c4b144405e295db33688
     governs:
@@ -481,10 +481,10 @@ sources:
     authority: official
     url: https://docs.github.com/en/webhooks/webhook-events-and-payloads
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:d005a8846efa7d7e3d33fa060ad1c04c5deabca6e6156160fa7f0911bcacbea3
+    content_digest: sha256:34ba333da24fc389f2c04bf540878c91e744ca223661b40613a680a10456e6e6
     governs:
       - github.webhook-event-allowlist
       - github.webhook-governance-events
@@ -492,8 +492,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-private-plan-not-proven
     content_digest: sha256:92a4dd79ae290785e5d7b923103dfe576dc42ce8e5e4945add4b4f18731701e8
     governs:
@@ -504,8 +504,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/verify-attestations-offline
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
     content_digest: sha256:552c8826aa44b2201b34ea3ec127696d336b372fe49c59da8139c5beaa001bca
     governs:
@@ -514,12 +514,12 @@ sources:
       - bundle.offline-trusted-root-digest-pin
   - id: github-cli-attestation-verifier
     authority: official-source-repository
-    url: https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_checksums.txt
+    url: https://github.com/cli/cli/releases/download/v2.100.0/gh_2.100.0_checksums.txt
     volatility: high
-    verified_at: "2026-09-11"
-    next_review: "2026-10-11"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: release-checksums-verified-runtime-not-proven
-    content_digest: sha256:61905c69ec8660f310814ec98395cdd0c2d07aabf024c597ec45813984a02334
+    content_digest: sha256:6b5916dffcfa6f593b1db7890f2ddc485318e99fa263acf73aa28ebb877b53cd
     governs:
       - bundle.attestation-verifier-version
       - bundle.attestation-verifier-digest
@@ -528,9 +528,9 @@ sources:
     authority: official-source-repository
     url: https://github.com/actions/attest/releases.atom
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
-    status: source-verified-workflow-not-activated
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
+    status: source-verified
     content_digest: sha256:80ada36d410382545fe1eca25ebcca37d18945b7c530f90f4a14f290ea3d95bd
     governs:
       - bundle.attestation-action-pin
@@ -538,19 +538,19 @@ sources:
     authority: official
     url: https://docs.github.com/en/actions/reference/workflows-and-actions/variables
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-not-proven
-    content_digest: sha256:4824f302711e97312831d93c0c2e7dba5ac63e3d41e7a9250654a9ab3e9aef76
+    content_digest: sha256:2d729035c6949fcaa4e4d84ed9f500dff2a6f71f5d00cca48af141e3e693c844
     governs:
       - bundle.release-sequence
   - id: actions-checkout-release
     authority: official-source-repository
     url: https://github.com/actions/checkout/releases.atom
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
-    status: source-verified-workflow-not-activated
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
+    status: source-verified
     content_digest: sha256:52ac445486661cac338c9c78b492c453ddb03384b5e361f443b844155d68210a
     governs:
       - bundle.checkout-action-pin
@@ -558,19 +558,19 @@ sources:
     authority: official-source-repository
     url: https://github.com/actions/setup-go/releases.atom
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
-    status: source-verified-workflow-not-activated
-    content_digest: sha256:973662d191e656cb340f47af56f1870e3e1c58b2774c8204079a92dc892dd43e
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
+    status: source-verified
+    content_digest: sha256:a659cfd6ef930ba17dc529b4c9962de7a791e2fa4fe1d17b22e3fd1fbe482922
     governs:
       - bundle.setup-go-action-pin
   - id: actions-upload-artifact-release
     authority: official-source-repository
     url: https://github.com/actions/upload-artifact/releases.atom
     volatility: high
-    verified_at: "2026-08-13"
-    next_review: "2026-09-13"
-    status: source-verified-workflow-not-activated
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
+    status: source-verified
     content_digest: sha256:7ecf438a606b0e09018d48a1e5f5f69f29936d9ddb0907308c98da01116b909f
     governs:
       - bundle.upload-action-pin
@@ -578,10 +578,10 @@ sources:
     authority: official-package-documentation
     url: https://pkg.go.dev/cmd/go
     volatility: medium
-    verified_at: "2026-07-12"
+    verified_at: "2026-09-12"
     next_review: "2026-10-12"
     status: current
-    content_digest: sha256:fca69b3543a28b86bee38bdfeb940f62c3e22fa4f3def11fcdd0f6ca32903987
+    content_digest: sha256:1315667b643280e4a1e5b9b04c8ef5aff70a7667422b0586bfeb4300f82a1246
     governs:
       - bundle.go-build-flags
       - bundle.go-build-environment
@@ -589,8 +589,8 @@ sources:
     authority: official
     url: https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10
     volatility: high
-    verified_at: "2026-09-11"
-    next_review: "2026-10-11"
+    verified_at: "2026-09-12"
+    next_review: "2026-10-12"
     status: current-docs-verified-runtime-observed
     content_digest: sha256:a53d404d83b90a79de207067fba2d18f9b316ab527326f98ef5cc16c11021c23
     governs:
diff --git a/go.mod b/go.mod
index 2276b09..7c21f0b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,15 +1,15 @@
 module github.com/NDDev-OpenNetwork/github-device-sync
 
-go 1.26.7
+go 1.27.1
 
 require (
-	github.com/NDDev-OpenNetwork/agent-runtime v0.1.2-0.20260828080341-a0738060888d
+	github.com/NDDev-OpenNetwork/agent-runtime v0.1.2
 	github.com/dlclark/regexp2 v1.12.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
 	go.yaml.in/yaml/v4 v4.0.0-rc.6
-	golang.org/x/sys v0.47.0
-	modernc.org/sqlite v1.57.0
+	golang.org/x/sys v0.48.0
+	modernc.org/sqlite v1.58.0
 )
 
 require (
@@ -19,9 +19,9 @@ require (
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	modernc.org/libc v1.74.4 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	modernc.org/libc v1.75.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
+	modernc.org/memory v1.12.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 3b0cbde..46a45f1 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-github.com/NDDev-OpenNetwork/agent-runtime v0.1.2-0.20260828080341-a0738060888d h1:L77kZXzJtNVLHFJoLyEXOwjQOUCpcyU+cdMIhDMebZI=
-github.com/NDDev-OpenNetwork/agent-runtime v0.1.2-0.20260828080341-a0738060888d/go.mod h1:4W4dEgssqaWVQcxErXWuH2B9jb8tKj9O08x0TRwYikw=
+github.com/NDDev-OpenNetwork/agent-runtime v0.1.2 h1:BjZbWFyulBamcxkKGZycQKWrkEnKTzAx49j0Xrlw56M=
+github.com/NDDev-OpenNetwork/agent-runtime v0.1.2/go.mod h1:W8AOg6wT5coWm+VyUxmLhJw4xpOaJDPEQ7QK7SiClHk=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
@@ -24,46 +24,47 @@ github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57Hu
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
-golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
-modernc.org/cc/v4 v4.29.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
-modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
+modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
+modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
+modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
-modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
+modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
-modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
+modernc.org/libc v1.75.7 h1:o3DTP9/0p9pKmY2WCKQaySW6wIiZhNM7wc2lUoyhfew=
+modernc.org/libc v1.75.7/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
+modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.57.0 h1:qNQP6xnx5M0ISNtlnxoOX0+cD5bJ0/gr9aMmndFczzg=
-modernc.org/sqlite v1.57.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
+modernc.org/sqlite v1.58.0 h1:38u40/bwkfM7f0Myhosl+SEMltSDxnGdQf8o6Kjmys0=
+modernc.org/sqlite v1.58.0/go.mod h1:rsD2CckafgObKC4DhBlGBf+RiHxkc3hINGt1Xw32tVY=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
diff --git a/requirements/bundle-trust.yaml b/requirements/bundle-trust.yaml
index dd2ab4b..621efd3 100644
--- a/requirements/bundle-trust.yaml
+++ b/requirements/bundle-trust.yaml
@@ -25,17 +25,17 @@ verification:
   trusted_root_digest: "sha256:65ca537f6ed8a47fd0e560c421baa1f6c1efb8b25fc200d8c5c02c0e92eb2b9c"
   verifier:
     name: "github-cli"
-    version: "2.97.0"
+    version: "2.100.0"
     executables:
       - os: "darwin"
         arch: "amd64"
-        digest: "sha256:4b577e0896583c40900ccf61b6de46ce1d3a92ed7f799b97c06d8938b44db764"
+        digest: "sha256:43f9c5f8fb3e6ed097bff7d1b7b86158cddddd4fc6b6704b6e1c3c2b7d35dcbd"
       - os: "darwin"
         arch: "arm64"
-        digest: "sha256:0d17dddf96bcc1dc50f3420a064d593d64016b0be16286a6c26121f2a5cb8316"
+        digest: "sha256:51f1bd7ed1724774d2c1d91fb4efdb676d3eb200ce95c0021c8544fe7435bc13"
       - os: "linux"
         arch: "amd64"
-        digest: "sha256:141507c337e8b202ad398550c3b73d72f5af92e86f71665214538a81efd4c409"
+        digest: "sha256:553949e2efa12842771efe6012aa4de21f1d591530ec17fc435f610f10e017ee"
       - os: "linux"
         arch: "arm64"
-        digest: "sha256:ccbb0f14178faefac1cb0f336a853071fa63a1d0df23ef5ab7a304fe3859e082"
+        digest: "sha256:28a037b967065aa314cb6d539943b55d27ef2f97c523ab2b6023ccf284e1828d"
diff --git a/requirements/schema-validator.txt b/requirements/schema-validator.txt
index 1717bb6..f82ef49 100644
--- a/requirements/schema-validator.txt
+++ b/requirements/schema-validator.txt
@@ -94,123 +94,122 @@ referencing==0.37.0 \
     #   -r requirements/schema-validator.in
     #   jsonschema
     #   jsonschema-specifications
-rpds-py==2026.6.3 \
-    --hash=sha256:0be972be84cfcaf46c8c6edf690ca0f154ac17babf1f6a955a51579b34ad2dc5 \
-    --hash=sha256:127565fead0a10943b282957bd5447804ff3160ad79f2ad2635e6d249e380680 \
-    --hash=sha256:127e08c0642d880cf32ca47ec2a4a77b901f7e2dd1ad9762adb13955d72ffcc9 \
-    --hash=sha256:166cf54d9f44fc6ceb53c7860258dde44a81406646de79f8ed3234fca3b6e538 \
-    --hash=sha256:168c733a7112e071bb7a66460e667edfcff06c017a3c523f7a8a8e08d0140804 \
-    --hash=sha256:1967debc37f64f2c4dc90a7f563aec558b471966e12adcac4e1c4240496b6ebf \
-    --hash=sha256:1cebd1337c242e4ec2293e541f712b2da849b29f48f0c293684b71c0632625d4 \
-    --hash=sha256:1cf01971c4f2c5553b772a542e4aaf191789cd331bc2cd4ff0e6e65ba49e1e97 \
-    --hash=sha256:1e5822dfc2f0d4ab7e745eaa6d85945069329beeccef965af3f3bb26058fcab6 \
-    --hash=sha256:22bffe6042b9bcb0822bcd1955ec00e245daf17b4344e4ed8e9551b976b63e96 \
-    --hash=sha256:23a439f31ccbeff1574e24889128821d1f7917470e830cf6544dced1c662262a \
-    --hash=sha256:24e9c5386e16669b674a69c156c8eeefcb578f3b3397b713b08e6d60f3c7b187 \
-    --hash=sha256:270b293dae9058fc9fcedab50f13cebf46fb8ed1d1d54e0521a9da5d6b211975 \
-    --hash=sha256:29dfa0533a5d4c94d4dfa1b694fcb56c9c63aad8330ffdd816fd225d0a7a162f \
-    --hash=sha256:2a9c6f195058cb45335e8cc3802745c603d716eb96bc9625950c1aac71c0c703 \
-    --hash=sha256:2bfd04c19ddbd6640de0b51894d764bd2758854d5b75bd102d2ef10cb9c293a9 \
-    --hash=sha256:2c54a076ca4d370980ab57bc0e31df57bbe8d41340436a90ef8b1219a3cbb127 \
-    --hash=sha256:2c958bf94822e9290a40aaf2a822d4bc5c88099093e3948ad6c571eca9272e5f \
-    --hash=sha256:2c99f7e8ccb3dd6e3e4bfeac657a7b208c9bac8075f4b078c02d7404c34107fa \
-    --hash=sha256:2f7c26fbc5acd2522b95d4177fe4710ffd8e9b20529e703ffbf8db4d93903f05 \
-    --hash=sha256:30c6dc199b24a5e3e81d50da0f00858c5bbdb2617a750395687f4339c5818171 \
-    --hash=sha256:38a2fea2787428f811719ceb9114cb78964a3138838320c29ac39526c79c16ba \
-    --hash=sha256:3a83ae6c67b7676b9878378547ca8e93ed77a580037bcbcd1d32f739e1e6089c \
-    --hash=sha256:3cfe765c1da0072636ca06628261e0ea05688e160d5c8a03e0217c3854037223 \
-    --hash=sha256:421aba32367055614287a4292b6a17f1939c9452299f7a0209c117e990b646d4 \
-    --hash=sha256:425560c6fa0415f27261727bb20bd097568485e5eb0c121f1949417d1c516885 \
-    --hash=sha256:4470ce197d4090875cf6affbf1f853338387428df97c4fb7b7106317b8214698 \
-    --hash=sha256:4cf2d36a2357e4d07bb5a4f98801265327b48256867816cfd2ceb001e9754a8f \
-    --hash=sha256:4f4bca01b63096f606e095734dd56e74e175f94cfbf24ff3d63281cec61f7bb7 \
-    --hash=sha256:501f9f04a588d6a09179368c57071301445191767c64e4b52a6aa9871f1ef5ed \
-    --hash=sha256:536bceea4fa4acf7e1c61da2b5786304367c816c8895be71b8f537c480b0ea1f \
-    --hash=sha256:538949e262e46caa31ac01bdb3c1e8f642622922cacbabbae6a8445d9dc33eaf \
-    --hash=sha256:539d75de9e0d536c84ff18dfeb805398e58227001ce09231a26a08b9aed1ee0e \
-    --hash=sha256:54f45a148e28767bf343d33a684693c70e451c6f4c0e9904709a723fafbdfc1f \
-    --hash=sha256:55927d532399c2c646100ff7feb48eaa940ad70f42cd68e1328f3ded9f81ca24 \
-    --hash=sha256:58eadac9cd119677b60e1cf8ac4052f35949d71b8a9e5556efccbe82533cf22a \
-    --hash=sha256:5e8d07bddee435a2ff6f1920e18feff28d0bc4533e42f4bf6927fbd073312c41 \
-    --hash=sha256:62698275682bf121181861295c9181e789030a2d516071f5b8f3c23c170cd0fc \
-    --hash=sha256:639c8929aa0afe81be836b04de888460d6bed38b9c54cfc18da8f6bfabf5af5d \
-    --hash=sha256:67e3a721ffc5d8d2210d3671872298c4a84e4b8035cfe42ffd7cde35d772b146 \
-    --hash=sha256:6de4744d05bd1aa1be4ed7ea1189e3979196808008113bbbf899a460966b925e \
-    --hash=sha256:6e84adbcf4bf841aed8116a8264b9f50b4cb3e7bd89b516122e616ac56ca269e \
-    --hash=sha256:7491ee23305ac3eb59e492b6945881f5cd77a6f731061a3f25b77fd40f9e99a4 \
-    --hash=sha256:79486287de1730dbaff3dbd124d0ca4d2ef7f9d29bf2544f1f93c09b5bcbbd12 \
-    --hash=sha256:7b689145a1485c335569bd056464f3243a29af7ed3871c7be31ad624ba239bc7 \
-    --hash=sha256:7f88d653e7b3b779d71ae7454e20dcc9b6bae903f33c269db9f2be41bda3f261 \
-    --hash=sha256:8020133a74bd81b4572dd8e4be028a6b1ebcd70e6726edc3918008c08bee6ee6 \
-    --hash=sha256:808345f53cb952433ca2816f1604ff3515608a81784954f38d4452acfe8e61d5 \
-    --hash=sha256:83e35b57523816c8613fd0776b40cd8bb9f596b37ddd2692eb4a6bb5ab2f8c93 \
-    --hash=sha256:842e7b070435622248c7a2c44ae53fa1440e073cc3023bc919fed570884097a7 \
-    --hash=sha256:847927daf4cffbd4e90e42bc890069897101edd015f956cb8721b3473372edda \
-    --hash=sha256:882076c00c0a608b131187055ddc5ae29f2e7eaf870d6168980420d58528a5c8 \
-    --hash=sha256:8b95977e7211527ab0ba576e286d023389fbeeb32a6b7b771665d333c60e5342 \
-    --hash=sha256:8bb68f03f395eb793220b45c097bd4d8c32944393da0fad8b999efac0868fc8c \
-    --hash=sha256:8c2642a7603ec0b16ed77da4555db3b4b472341904873788327c0b0d7b95f1bb \
-    --hash=sha256:8c3d1e9c15b9d51ca0391e13da1a25a0a4df3c58a37c9dc368e0736cf7f69df0 \
-    --hash=sha256:8c6e5a2f750cc71c3e3b11d71661f21d6f9bc6cebc6564b1466417a1ec03ec77 \
-    --hash=sha256:8d2294a31386bfa251d8c8a39472beee17db67d4f1a6eabea665d35c9a4461c3 \
-    --hash=sha256:8e4320744c1ffdd95a603def63344bfab2d33edeab301c5007e7de9f9f5b3885 \
-    --hash=sha256:8e65860d238379ed982fd9ba690579b5e95af2f4840f99c772816dbe573cb826 \
-    --hash=sha256:8f2e5c5ee828d42cb11760761c0af6507927bec42d0ad5458f97c9203b054617 \
-    --hash=sha256:900a67df3fd1660b035a4761c4ce73c382ea6b35f90f9863c36c6fd8bf8b09bb \
-    --hash=sha256:913ca42ccad3f8cc6e292b587ae8ae49c8c823e5dce51a736252fc7c7cdfa577 \
-    --hash=sha256:9250a9a0a6fd4648b3f868da8d91a4c52b5811a62df58e753d50ae4454a36f80 \
-    --hash=sha256:931908d9fc855d8f74783377822be318edb6dcb19e47169dc038f9a1bf60b06e \
-    --hash=sha256:9826217f048f620d9a712672818bf231442c1b35d96b227a07eabd11b4bb6945 \
-    --hash=sha256:9891e594296ab9dada6551c8e7b387b2721f27a67eecd528412e8906247a7b90 \
-    --hash=sha256:9c1255b302953c86a486b81d330d5ee1d5bd937691ce271b6be0ef0e299eaab7 \
-    --hash=sha256:a0811d33247c3d6128a3001d763f2aa056bb3425204335400ac54f89eec3a0d0 \
-    --hash=sha256:a136d453475ac0fcbda502ef1e6504bd28d6d904700915d278deeab0d00fe140 \
-    --hash=sha256:a214c993455f99a89aaeadc9b21241900037adc9d97203e374d75513c5911822 \
-    --hash=sha256:a3086b538543802f84c843911242db20447de00d8752dd0efc936dbcf02218ba \
-    --hash=sha256:a3450b693fde92133e9f51060568a4c31fcca76d5e53bbd611e689ca446517e9 \
-    --hash=sha256:a550fb4950a06dde3beb4721f5ad4b25bf4513784665b0a8522c792e2bd822a4 \
-    --hash=sha256:a9f4645593036b81bbdb36b9c8e0ea0d1c3fee968c4d59db0344c14087ef143a \
-    --hash=sha256:aca6c1ef08a82bfe327cc156da694660f599923e2e6665b6d81c9c2d0ac9ffc8 \
-    --hash=sha256:acac386b453c2516111b50985d60ce46e7fadb5ea71ae7b25f4c946935bf27cf \
-    --hash=sha256:acc992ab27b15f852c76755eb2ab7dce86585ddadba6fa5946e58556088845b4 \
-    --hash=sha256:ae3d4fe8c0b9213624fdce7279d70e3b148b682ca20719ebd193a23ebfa47324 \
-    --hash=sha256:ae50181a047c871561212bb97f7932a2d45fb53e947bd9b57ebad85b529cbc53 \
-    --hash=sha256:ae6dd8f10bd17aad820876d24caec9efdafd80a318d16c0a48edb5e136902c6b \
-    --hash=sha256:af05d726809bff6b141be124d4c7ce998f9c9c7f30edb1f46c07aa103d540b41 \
-    --hash=sha256:afd70d95892096cdb26f15a00c45907b17817577aa8d1c76b2dcc2788391f9e9 \
-    --hash=sha256:b5c2dc92304aa48a4a60443b548bb12f12e119d4b72f314015e67b9e1be97fca \
-    --hash=sha256:bc0011654b91cc4fb2ae701bec0a0ba1e552c0714247fa7af6c59e0ccfa3a4e1 \
-    --hash=sha256:bcfbcf66006befb9fd2aeaa9e01feaf881b4dc330a02ba07d2322b1c11be7b5d \
-    --hash=sha256:bdbd97738551fca3917c1bd7188bec1920bb520104f28e7e1007f9ceb17b7690 \
-    --hash=sha256:c60924535c75f1566b6eb75b5c31a48a43fef04fa2d0d201acbad8a9969c6107 \
-    --hash=sha256:c7b9a2f8f4d8e90af72571d3d495deebdd7e3c75451f5b41719aee166e940fc2 \
-    --hash=sha256:ca6546b66be9dc4738b1b043d5ebd5488c66c578c5ff0fd0e8065313fe3afb76 \
-    --hash=sha256:ccffae9a092a00deb7efd545fe5e2c33c33b88e7c054337e9a74c179347d0b7d \
-    --hash=sha256:cdc7e35386f3847df728fbcb5e887e2d79c19e2fa1eba9e51b6621d23e3243af \
-    --hash=sha256:d15fde0e6fb0d88a60d221204873743e5d9f0b7d29165e62cd86d0413ad74ba6 \
-    --hash=sha256:d34c20167764fbcf927194d532dd7e0c56772f0a5f943fa5ef9e9afbba8fb9db \
-    --hash=sha256:d483fe17f01ad64b7bf7cc38fcefff1ca9fb83f8c2b2542b68f97ffe0611b369 \
-    --hash=sha256:d7469697dce35be237db177d42e2a2ee26e6dcc5fc052078a6fefabd288c6edd \
-    --hash=sha256:db08f45aecde626498fb3df07bcf6d2ec040af42e859a4f5040d79c200342911 \
-    --hash=sha256:dc319e5a1de4b6913aac94bf6a2f9e847371e0a140a43dd4991db1a09bc2d504 \
-    --hash=sha256:de3eceba0b683bcbb1ab93da016d0270df1f9ae7be716b40214c5dafac6ea45a \
-    --hash=sha256:dfcc8b909769d19db55c7cc9541eb64b9b774b1057ffffb4f1048070475bb9f9 \
-    --hash=sha256:e059c5dde6452b44424bd1834557556c226b57781dee1227af23518459722b13 \
-    --hash=sha256:e4316bf32babbed84e691e352faf967ce2f0f024174a8643c37c94a1080374fc \
-    --hash=sha256:e52655eaf81e32593abedaa4bfe33170c8cfedf3365ed9be6e11e07f148f0278 \
-    --hash=sha256:e55d236be29255554da47abe5c577637db7c24a02b8b46f0ca9524c855801868 \
-    --hash=sha256:ea7bb13b7c9a29791f87a0387ba7d3ad3a6d783d827e4d3f27b40a0ff44495e2 \
-    --hash=sha256:ea964164cc9afa72d4d9b23cc28dafae93693c0a53e0b42acbff15b22c3f9ddd \
-    --hash=sha256:ec829541c45bca16e61c7ae50c20501f213605beb75d1aba91a6ee37fbbb56a4 \
-    --hash=sha256:ecabd69db66de867690f9797f2f8fa27ba501bbc24540cbdbdc649cd15888ba6 \
-    --hash=sha256:ed0c1e5d10cdc7135537988c74a0188da68e2f3c30813ba3744ab1e42e0480f9 \
-    --hash=sha256:f0840b5b17057f7fd918b76183a4b5a0635f43e14eb2ce60dce1d4ee4707ea00 \
-    --hash=sha256:f4d78253f6996be4901669ad25319f842f740eccf4d58e3c7f3dd39e6dde1d8f \
-    --hash=sha256:f56f1695bc5c0871cbc33dc0130fcf503aab0c57dcc5a6700a4f49eba4f2652e \
-    --hash=sha256:f826877d462181e5eb1c26a0026b8d0cab05d99844ecb6d8bf3627a2ca0c0442 \
-    --hash=sha256:f8f23ead891a3b762f35ab3b04623da7056545b48aa60d59957e6789914545da \
-    --hash=sha256:f90938e92afda60266da758ee7d363447f7f0138c9559f9e1811629580582d90 \
-    --hash=sha256:faa679d19a6696fd54259ad321251ad77a13e70e03dd834daa762a44fb6196ef
+rpds-py==0.30.0 \
+    --hash=sha256:07ae8a593e1c3c6b82ca3292efbe73c30b61332fd612e05abee07c79359f292f \
+    --hash=sha256:0a59119fc6e3f460315fe9d08149f8102aa322299deaa5cab5b40092345c2136 \
+    --hash=sha256:0c0e95f6819a19965ff420f65578bacb0b00f251fefe2c8b23347c37174271f3 \
+    --hash=sha256:0d08f00679177226c4cb8c5265012eea897c8ca3b93f429e546600c971bcbae7 \
+    --hash=sha256:0ed177ed9bded28f8deb6ab40c183cd1192aa0de40c12f38be4d59cd33cb5c65 \
+    --hash=sha256:12f90dd7557b6bd57f40abe7747e81e0c0b119bef015ea7726e69fe550e394a4 \
+    --hash=sha256:1726859cd0de969f88dc8673bdd954185b9104e05806be64bcd87badbe313169 \
+    --hash=sha256:1ab5b83dbcf55acc8b08fc62b796ef672c457b17dbd7820a11d6c52c06839bdf \
+    --hash=sha256:1b151685b23929ab7beec71080a8889d4d6d9fa9a983d213f07121205d48e2c4 \
+    --hash=sha256:1f3587eb9b17f3789ad50824084fa6f81921bbf9a795826570bda82cb3ed91f2 \
+    --hash=sha256:250fa00e9543ac9b97ac258bd37367ff5256666122c2d0f2bc97577c60a1818c \
+    --hash=sha256:2771c6c15973347f50fece41fc447c054b7ac2ae0502388ce3b6738cd366e3d4 \
+    --hash=sha256:27f4b0e92de5bfbc6f86e43959e6edd1425c33b5e69aab0984a72047f2bcf1e3 \
+    --hash=sha256:2e6ecb5a5bcacf59c3f912155044479af1d0b6681280048b338b28e364aca1f6 \
+    --hash=sha256:32c8528634e1bf7121f3de08fa85b138f4e0dc47657866630611b03967f041d7 \
+    --hash=sha256:33f559f3104504506a44bb666b93a33f5d33133765b0c216a5bf2f1e1503af89 \
+    --hash=sha256:3896fa1be39912cf0757753826bc8bdc8ca331a28a7c4ae46b7a21280b06bb85 \
+    --hash=sha256:389a2d49eded1896c3d48b0136ead37c48e221b391c052fba3f4055c367f60a6 \
+    --hash=sha256:39c02563fc592411c2c61d26b6c5fe1e51eaa44a75aa2c8735ca88b0d9599daa \
+    --hash=sha256:3adbb8179ce342d235c31ab8ec511e66c73faa27a47e076ccc92421add53e2bb \
+    --hash=sha256:3d4a69de7a3e50ffc214ae16d79d8fbb0922972da0356dcf4d0fdca2878559c6 \
+    --hash=sha256:3e62880792319dbeb7eb866547f2e35973289e7d5696c6e295476448f5b63c87 \
+    --hash=sha256:3e8eeb0544f2eb0d2581774be4c3410356eba189529a6b3e36bbbf9696175856 \
+    --hash=sha256:422c3cb9856d80b09d30d2eb255d0754b23e090034e1deb4083f8004bd0761e4 \
+    --hash=sha256:4559c972db3a360808309e06a74628b95eaccbf961c335c8fe0d590cf587456f \
+    --hash=sha256:46e83c697b1f1c72b50e5ee5adb4353eef7406fb3f2043d64c33f20ad1c2fc53 \
+    --hash=sha256:47b0ef6231c58f506ef0b74d44e330405caa8428e770fec25329ed2cb971a229 \
+    --hash=sha256:47e77dc9822d3ad616c3d5759ea5631a75e5809d5a28707744ef79d7a1bcfcad \
+    --hash=sha256:47f236970bccb2233267d89173d3ad2703cd36a0e2a6e92d0560d333871a3d23 \
+    --hash=sha256:47f9a91efc418b54fb8190a6b4aa7813a23fb79c51f4bb84e418f5476c38b8db \
+    --hash=sha256:495aeca4b93d465efde585977365187149e75383ad2684f81519f504f5c13038 \
+    --hash=sha256:4c5f36a861bc4b7da6516dbdf302c55313afa09b81931e8280361a4f6c9a2d27 \
+    --hash=sha256:4cc2206b76b4f576934f0ed374b10d7ca5f457858b157ca52064bdfc26b9fc00 \
+    --hash=sha256:4e7fc54e0900ab35d041b0601431b0a0eb495f0851a0639b6ef90f7741b39a18 \
+    --hash=sha256:51a1234d8febafdfd33a42d97da7a43f5dcb120c1060e352a3fbc0c6d36e2083 \
+    --hash=sha256:55f66022632205940f1827effeff17c4fa7ae1953d2b74a8581baaefb7d16f8c \
+    --hash=sha256:58edca431fb9b29950807e301826586e5bbf24163677732429770a697ffe6738 \
+    --hash=sha256:5965af57d5848192c13534f90f9dd16464f3c37aaf166cc1da1cae1fd5a34898 \
+    --hash=sha256:5ba103fb455be00f3b1c2076c9d4264bfcb037c976167a6047ed82f23153f02e \
+    --hash=sha256:5d4c2aa7c50ad4728a094ebd5eb46c452e9cb7edbfdb18f9e1221f597a73e1e7 \
+    --hash=sha256:61046904275472a76c8c90c9ccee9013d70a6d0f73eecefd38c1ae7c39045a08 \
+    --hash=sha256:613aa4771c99f03346e54c3f038e4cc574ac09a3ddfb0e8878487335e96dead6 \
+    --hash=sha256:626a7433c34566535b6e56a1b39a7b17ba961e97ce3b80ec62e6f1312c025551 \
+    --hash=sha256:669b1805bd639dd2989b281be2cfd951c6121b65e729d9b843e9639ef1fd555e \
+    --hash=sha256:679ae98e00c0e8d68a7fda324e16b90fd5260945b45d3b824c892cec9eea3288 \
+    --hash=sha256:67b02ec25ba7a9e8fa74c63b6ca44cf5707f2fbfadae3ee8e7494297d56aa9df \
+    --hash=sha256:68f19c879420aa08f61203801423f6cd5ac5f0ac4ac82a2368a9fcd6a9a075e0 \
+    --hash=sha256:692bef75a5525db97318e8cd061542b5a79812d711ea03dbc1f6f8dbb0c5f0d2 \
+    --hash=sha256:6abc8880d9d036ecaafe709079969f56e876fcf107f7a8e9920ba6d5a3878d05 \
+    --hash=sha256:6bdfdb946967d816e6adf9a3d8201bfad269c67efe6cefd7093ef959683c8de0 \
+    --hash=sha256:6de2a32a1665b93233cde140ff8b3467bdb9e2af2b91079f0333a0974d12d464 \
+    --hash=sha256:73c67f2db7bc334e518d097c6d1e6fed021bbc9b7d678d6cc433478365d1d5f5 \
+    --hash=sha256:74a3243a411126362712ee1524dfc90c650a503502f135d54d1b352bd01f2404 \
+    --hash=sha256:76fec018282b4ead0364022e3c54b60bf368b9d926877957a8624b58419169b7 \
+    --hash=sha256:7c64d38fb49b6cdeda16ab49e35fe0da2e1e9b34bc38bd78386530f218b37139 \
+    --hash=sha256:7cee9c752c0364588353e627da8a7e808a66873672bcb5f52890c33fd965b394 \
+    --hash=sha256:7e6ecfcb62edfd632e56983964e6884851786443739dbfe3582947e87274f7cb \
+    --hash=sha256:806f36b1b605e2d6a72716f321f20036b9489d29c51c91f4dd29a3e3afb73b15 \
+    --hash=sha256:858738e9c32147f78b3ac24dc0edb6610000e56dc0f700fd5f651d0a0f0eb9ff \
+    --hash=sha256:8d6d1cc13664ec13c1b84241204ff3b12f9bb82464b8ad6e7a5d3486975c2eed \
+    --hash=sha256:9027da1ce107104c50c81383cae773ef5c24d296dd11c99e2629dbd7967a20c6 \
+    --hash=sha256:922e10f31f303c7c920da8981051ff6d8c1a56207dbdf330d9047f6d30b70e5e \
+    --hash=sha256:945dccface01af02675628334f7cf49c2af4c1c904748efc5cf7bbdf0b579f95 \
+    --hash=sha256:946fe926af6e44f3697abbc305ea168c2c31d3e3ef1058cf68f379bf0335a78d \
+    --hash=sha256:95f0802447ac2d10bcc69f6dc28fe95fdf17940367b21d34e34c737870758950 \
+    --hash=sha256:9854cf4f488b3d57b9aaeb105f06d78e5529d3145b1e4a41750167e8c213c6d3 \
+    --hash=sha256:993914b8e560023bc0a8bf742c5f303551992dcb85e247b1e5c7f4a7d145bda5 \
+    --hash=sha256:99b47d6ad9a6da00bec6aabe5a6279ecd3c06a329d4aa4771034a21e335c3a97 \
+    --hash=sha256:9a4e86e34e9ab6b667c27f3211ca48f73dba7cd3d90f8d5b11be56e5dbc3fb4e \
+    --hash=sha256:9cf69cdda1f5968a30a359aba2f7f9aa648a9ce4b580d6826437f2b291cfc86e \
+    --hash=sha256:a090322ca841abd453d43456ac34db46e8b05fd9b3b4ac0c78bcde8b089f959b \
+    --hash=sha256:a1010ed9524c73b94d15919ca4d41d8780980e1765babf85f9a2f90d247153dd \
+    --hash=sha256:a161f20d9a43006833cd7068375a94d035714d73a172b681d8881820600abfad \
+    --hash=sha256:a1d0bc22a7cdc173fedebb73ef81e07faef93692b8c1ad3733b67e31e1b6e1b8 \
+    --hash=sha256:a2bffea6a4ca9f01b3f8e548302470306689684e61602aa3d141e34da06cf425 \
+    --hash=sha256:a452763cc5198f2f98898eb98f7569649fe5da666c2dc6b5ddb10fde5a574221 \
+    --hash=sha256:a4796a717bf12b9da9d3ad002519a86063dcac8988b030e405704ef7d74d2d9d \
+    --hash=sha256:a51033ff701fca756439d641c0ad09a41d9242fa69121c7d8769604a0a629825 \
+    --hash=sha256:a8fa71a2e078c527c3e9dc9fc5a98c9db40bcc8a92b4e8858e36d329f8684b51 \
+    --hash=sha256:ac37f9f516c51e5753f27dfdef11a88330f04de2d564be3991384b2f3535d02e \
+    --hash=sha256:ac98b175585ecf4c0348fd7b29c3864bda53b805c773cbf7bfdaffc8070c976f \
+    --hash=sha256:acd7eb3f4471577b9b5a41baf02a978e8bdeb08b4b355273994f8b87032000a8 \
+    --hash=sha256:ad1fa8db769b76ea911cb4e10f049d80bf518c104f15b3edb2371cc65375c46f \
+    --hash=sha256:b40fb160a2db369a194cb27943582b38f79fc4887291417685f3ad693c5a1d5d \
+    --hash=sha256:b4dc1a6ff022ff85ecafef7979a2c6eb423430e05f1165d6688234e62ba99a07 \
+    --hash=sha256:ba3af48635eb83d03f6c9735dfb21785303e73d22ad03d489e88adae6eab8877 \
+    --hash=sha256:ba81a9203d07805435eb06f536d95a266c21e5b2dfbf6517748ca40c98d19e31 \
+    --hash=sha256:c2262bdba0ad4fc6fb5545660673925c2d2a5d9e2e0fb603aad545427be0fc58 \
+    --hash=sha256:c77afbd5f5250bf27bf516c7c4a016813eb2d3e116139aed0096940c5982da94 \
+    --hash=sha256:ca28829ae5f5d569bb62a79512c842a03a12576375d5ece7d2cadf8abe96ec28 \
+    --hash=sha256:cdc62c8286ba9bf7f47befdcea13ea0e26bf294bda99758fd90535cbaf408000 \
+    --hash=sha256:d948b135c4693daff7bc2dcfc4ec57237a29bd37e60c2fabf5aff2bbacf3e2f1 \
+    --hash=sha256:d96c2086587c7c30d44f31f42eae4eac89b60dabbac18c7669be3700f13c3ce1 \
+    --hash=sha256:d9a0ca5da0386dee0655b4ccdf46119df60e0f10da268d04fe7cc87886872ba7 \
+    --hash=sha256:da279aa314f00acbb803da1e76fa18666778e8a8f83484fba94526da5de2cba7 \
+    --hash=sha256:dbd936cde57abfee19ab3213cf9c26be06d60750e60a8e4dd85d1ab12c8b1f40 \
+    --hash=sha256:dc4f992dfe1e2bc3ebc7444f6c7051b4bc13cd8e33e43511e8ffd13bf407010d \
+    --hash=sha256:dc824125c72246d924f7f796b4f63c1e9dc810c7d9e2355864b3c3a73d59ade0 \
+    --hash=sha256:dd8ff7cf90014af0c0f787eea34794ebf6415242ee1d6fa91eaba725cc441e84 \
+    --hash=sha256:dea5b552272a944763b34394d04577cf0f9bd013207bc32323b5a89a53cf9c2f \
+    --hash=sha256:dff13836529b921e22f15cb099751209a60009731a68519630a24d61f0b1b30a \
+    --hash=sha256:e0b65193a413ccc930671c55153a03ee57cecb49e6227204b04fae512eb657a7 \
+    --hash=sha256:e5d3e6b26f2c785d65cc25ef1e5267ccbe1b069c5c21b8cc724efee290554419 \
+    --hash=sha256:e7536cd91353c5273434b4e003cbda89034d67e7710eab8761fd918ec6c69cf8 \
+    --hash=sha256:eb0b93f2e5c2189ee831ee43f156ed34e2a89a78a66b98cadad955972548be5a \
+    --hash=sha256:eb2c4071ab598733724c08221091e8d80e89064cd472819285a9ab0f24bcedb9 \
+    --hash=sha256:ec7c4490c672c1a0389d319b3a9cfcd098dcdc4783991553c332a15acf7249be \
+    --hash=sha256:ee454b2a007d57363c2dfd5b6ca4a5d7e2c518938f8ed3b706e37e5d470801ed \
+    --hash=sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a \
+    --hash=sha256:f14fc5df50a716f7ece6a80b6c78bb35ea2ca47c499e422aa4463455dd96d56d \
+    --hash=sha256:f207f69853edd6f6700b86efb84999651baf3789e78a466431df1331608e5324 \
+    --hash=sha256:f251c812357a3fed308d684a5079ddfb9d933860fc6de89f2b7ab00da481e65f \
+    --hash=sha256:f83424d738204d9770830d35290ff3273fbb02b41f919870479fab14b9d303b2 \
+    --hash=sha256:f8d1736cfb49381ba528cd5baa46f82fdc65c06e843dab24dd70b63d09121b3f \
+    --hash=sha256:fe5fa731a1fa8a0a56b0977413f8cacac1768dad38d16b3a296712709476fbd5
     # via
     #   jsonschema
     #   referencing
diff --git a/requirements/test.txt b/requirements/test.txt
index 1efc492..3c57ec2 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -4,6 +4,10 @@ attrs==26.1.0 \
     # via
     #   jsonschema
     #   referencing
+exceptiongroup==1.3.1 \
+    --hash=sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219 \
+    --hash=sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598
+    # via pytest
 iniconfig==2.3.0 \
     --hash=sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730 \
     --hash=sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12
@@ -16,17 +20,17 @@ jsonschema-specifications==2025.9.1 \
     --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe \
     --hash=sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d
     # via jsonschema
-packaging==26.2 \
-    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
-    --hash=sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
     # via pytest
 pluggy==1.6.0 \
     --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
     --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
     # via pytest
-pygments==2.20.0 \
-    --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \
-    --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+pygments==2.21.0 \
+    --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \
+    --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c
     # via pytest
 pytest==9.1.1 \
     --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \
@@ -114,127 +118,177 @@ referencing==0.37.0 \
     #   -r requirements/schema-validator.in
     #   jsonschema
     #   jsonschema-specifications
-rpds-py==2026.6.3 \
-    --hash=sha256:0be972be84cfcaf46c8c6edf690ca0f154ac17babf1f6a955a51579b34ad2dc5 \
-    --hash=sha256:127565fead0a10943b282957bd5447804ff3160ad79f2ad2635e6d249e380680 \
-    --hash=sha256:127e08c0642d880cf32ca47ec2a4a77b901f7e2dd1ad9762adb13955d72ffcc9 \
-    --hash=sha256:166cf54d9f44fc6ceb53c7860258dde44a81406646de79f8ed3234fca3b6e538 \
-    --hash=sha256:168c733a7112e071bb7a66460e667edfcff06c017a3c523f7a8a8e08d0140804 \
-    --hash=sha256:1967debc37f64f2c4dc90a7f563aec558b471966e12adcac4e1c4240496b6ebf \
-    --hash=sha256:1cebd1337c242e4ec2293e541f712b2da849b29f48f0c293684b71c0632625d4 \
-    --hash=sha256:1cf01971c4f2c5553b772a542e4aaf191789cd331bc2cd4ff0e6e65ba49e1e97 \
-    --hash=sha256:1e5822dfc2f0d4ab7e745eaa6d85945069329beeccef965af3f3bb26058fcab6 \
-    --hash=sha256:22bffe6042b9bcb0822bcd1955ec00e245daf17b4344e4ed8e9551b976b63e96 \
-    --hash=sha256:23a439f31ccbeff1574e24889128821d1f7917470e830cf6544dced1c662262a \
-    --hash=sha256:24e9c5386e16669b674a69c156c8eeefcb578f3b3397b713b08e6d60f3c7b187 \
-    --hash=sha256:270b293dae9058fc9fcedab50f13cebf46fb8ed1d1d54e0521a9da5d6b211975 \
-    --hash=sha256:29dfa0533a5d4c94d4dfa1b694fcb56c9c63aad8330ffdd816fd225d0a7a162f \
-    --hash=sha256:2a9c6f195058cb45335e8cc3802745c603d716eb96bc9625950c1aac71c0c703 \
-    --hash=sha256:2bfd04c19ddbd6640de0b51894d764bd2758854d5b75bd102d2ef10cb9c293a9 \
-    --hash=sha256:2c54a076ca4d370980ab57bc0e31df57bbe8d41340436a90ef8b1219a3cbb127 \
-    --hash=sha256:2c958bf94822e9290a40aaf2a822d4bc5c88099093e3948ad6c571eca9272e5f \
-    --hash=sha256:2c99f7e8ccb3dd6e3e4bfeac657a7b208c9bac8075f4b078c02d7404c34107fa \
-    --hash=sha256:2f7c26fbc5acd2522b95d4177fe4710ffd8e9b20529e703ffbf8db4d93903f05 \
-    --hash=sha256:30c6dc199b24a5e3e81d50da0f00858c5bbdb2617a750395687f4339c5818171 \
-    --hash=sha256:38a2fea2787428f811719ceb9114cb78964a3138838320c29ac39526c79c16ba \
-    --hash=sha256:3a83ae6c67b7676b9878378547ca8e93ed77a580037bcbcd1d32f739e1e6089c \
-    --hash=sha256:3cfe765c1da0072636ca06628261e0ea05688e160d5c8a03e0217c3854037223 \
-    --hash=sha256:421aba32367055614287a4292b6a17f1939c9452299f7a0209c117e990b646d4 \
-    --hash=sha256:425560c6fa0415f27261727bb20bd097568485e5eb0c121f1949417d1c516885 \
-    --hash=sha256:4470ce197d4090875cf6affbf1f853338387428df97c4fb7b7106317b8214698 \
-    --hash=sha256:4cf2d36a2357e4d07bb5a4f98801265327b48256867816cfd2ceb001e9754a8f \
-    --hash=sha256:4f4bca01b63096f606e095734dd56e74e175f94cfbf24ff3d63281cec61f7bb7 \
-    --hash=sha256:501f9f04a588d6a09179368c57071301445191767c64e4b52a6aa9871f1ef5ed \
-    --hash=sha256:536bceea4fa4acf7e1c61da2b5786304367c816c8895be71b8f537c480b0ea1f \
-    --hash=sha256:538949e262e46caa31ac01bdb3c1e8f642622922cacbabbae6a8445d9dc33eaf \
-    --hash=sha256:539d75de9e0d536c84ff18dfeb805398e58227001ce09231a26a08b9aed1ee0e \
-    --hash=sha256:54f45a148e28767bf343d33a684693c70e451c6f4c0e9904709a723fafbdfc1f \
-    --hash=sha256:55927d532399c2c646100ff7feb48eaa940ad70f42cd68e1328f3ded9f81ca24 \
-    --hash=sha256:58eadac9cd119677b60e1cf8ac4052f35949d71b8a9e5556efccbe82533cf22a \
-    --hash=sha256:5e8d07bddee435a2ff6f1920e18feff28d0bc4533e42f4bf6927fbd073312c41 \
-    --hash=sha256:62698275682bf121181861295c9181e789030a2d516071f5b8f3c23c170cd0fc \
-    --hash=sha256:639c8929aa0afe81be836b04de888460d6bed38b9c54cfc18da8f6bfabf5af5d \
-    --hash=sha256:67e3a721ffc5d8d2210d3671872298c4a84e4b8035cfe42ffd7cde35d772b146 \
-    --hash=sha256:6de4744d05bd1aa1be4ed7ea1189e3979196808008113bbbf899a460966b925e \
-    --hash=sha256:6e84adbcf4bf841aed8116a8264b9f50b4cb3e7bd89b516122e616ac56ca269e \
-    --hash=sha256:7491ee23305ac3eb59e492b6945881f5cd77a6f731061a3f25b77fd40f9e99a4 \
-    --hash=sha256:79486287de1730dbaff3dbd124d0ca4d2ef7f9d29bf2544f1f93c09b5bcbbd12 \
-    --hash=sha256:7b689145a1485c335569bd056464f3243a29af7ed3871c7be31ad624ba239bc7 \
-    --hash=sha256:7f88d653e7b3b779d71ae7454e20dcc9b6bae903f33c269db9f2be41bda3f261 \
-    --hash=sha256:8020133a74bd81b4572dd8e4be028a6b1ebcd70e6726edc3918008c08bee6ee6 \
-    --hash=sha256:808345f53cb952433ca2816f1604ff3515608a81784954f38d4452acfe8e61d5 \
-    --hash=sha256:83e35b57523816c8613fd0776b40cd8bb9f596b37ddd2692eb4a6bb5ab2f8c93 \
-    --hash=sha256:842e7b070435622248c7a2c44ae53fa1440e073cc3023bc919fed570884097a7 \
-    --hash=sha256:847927daf4cffbd4e90e42bc890069897101edd015f956cb8721b3473372edda \
-    --hash=sha256:882076c00c0a608b131187055ddc5ae29f2e7eaf870d6168980420d58528a5c8 \
-    --hash=sha256:8b95977e7211527ab0ba576e286d023389fbeeb32a6b7b771665d333c60e5342 \
-    --hash=sha256:8bb68f03f395eb793220b45c097bd4d8c32944393da0fad8b999efac0868fc8c \
-    --hash=sha256:8c2642a7603ec0b16ed77da4555db3b4b472341904873788327c0b0d7b95f1bb \
-    --hash=sha256:8c3d1e9c15b9d51ca0391e13da1a25a0a4df3c58a37c9dc368e0736cf7f69df0 \
-    --hash=sha256:8c6e5a2f750cc71c3e3b11d71661f21d6f9bc6cebc6564b1466417a1ec03ec77 \
-    --hash=sha256:8d2294a31386bfa251d8c8a39472beee17db67d4f1a6eabea665d35c9a4461c3 \
-    --hash=sha256:8e4320744c1ffdd95a603def63344bfab2d33edeab301c5007e7de9f9f5b3885 \
-    --hash=sha256:8e65860d238379ed982fd9ba690579b5e95af2f4840f99c772816dbe573cb826 \
-    --hash=sha256:8f2e5c5ee828d42cb11760761c0af6507927bec42d0ad5458f97c9203b054617 \
-    --hash=sha256:900a67df3fd1660b035a4761c4ce73c382ea6b35f90f9863c36c6fd8bf8b09bb \
-    --hash=sha256:913ca42ccad3f8cc6e292b587ae8ae49c8c823e5dce51a736252fc7c7cdfa577 \
-    --hash=sha256:9250a9a0a6fd4648b3f868da8d91a4c52b5811a62df58e753d50ae4454a36f80 \
-    --hash=sha256:931908d9fc855d8f74783377822be318edb6dcb19e47169dc038f9a1bf60b06e \
-    --hash=sha256:9826217f048f620d9a712672818bf231442c1b35d96b227a07eabd11b4bb6945 \
-    --hash=sha256:9891e594296ab9dada6551c8e7b387b2721f27a67eecd528412e8906247a7b90 \
-    --hash=sha256:9c1255b302953c86a486b81d330d5ee1d5bd937691ce271b6be0ef0e299eaab7 \
-    --hash=sha256:a0811d33247c3d6128a3001d763f2aa056bb3425204335400ac54f89eec3a0d0 \
-    --hash=sha256:a136d453475ac0fcbda502ef1e6504bd28d6d904700915d278deeab0d00fe140 \
-    --hash=sha256:a214c993455f99a89aaeadc9b21241900037adc9d97203e374d75513c5911822 \
-    --hash=sha256:a3086b538543802f84c843911242db20447de00d8752dd0efc936dbcf02218ba \
-    --hash=sha256:a3450b693fde92133e9f51060568a4c31fcca76d5e53bbd611e689ca446517e9 \
-    --hash=sha256:a550fb4950a06dde3beb4721f5ad4b25bf4513784665b0a8522c792e2bd822a4 \
-    --hash=sha256:a9f4645593036b81bbdb36b9c8e0ea0d1c3fee968c4d59db0344c14087ef143a \
-    --hash=sha256:aca6c1ef08a82bfe327cc156da694660f599923e2e6665b6d81c9c2d0ac9ffc8 \
-    --hash=sha256:acac386b453c2516111b50985d60ce46e7fadb5ea71ae7b25f4c946935bf27cf \
-    --hash=sha256:acc992ab27b15f852c76755eb2ab7dce86585ddadba6fa5946e58556088845b4 \
-    --hash=sha256:ae3d4fe8c0b9213624fdce7279d70e3b148b682ca20719ebd193a23ebfa47324 \
-    --hash=sha256:ae50181a047c871561212bb97f7932a2d45fb53e947bd9b57ebad85b529cbc53 \
-    --hash=sha256:ae6dd8f10bd17aad820876d24caec9efdafd80a318d16c0a48edb5e136902c6b \
-    --hash=sha256:af05d726809bff6b141be124d4c7ce998f9c9c7f30edb1f46c07aa103d540b41 \
-    --hash=sha256:afd70d95892096cdb26f15a00c45907b17817577aa8d1c76b2dcc2788391f9e9 \
-    --hash=sha256:b5c2dc92304aa48a4a60443b548bb12f12e119d4b72f314015e67b9e1be97fca \
-    --hash=sha256:bc0011654b91cc4fb2ae701bec0a0ba1e552c0714247fa7af6c59e0ccfa3a4e1 \
-    --hash=sha256:bcfbcf66006befb9fd2aeaa9e01feaf881b4dc330a02ba07d2322b1c11be7b5d \
-    --hash=sha256:bdbd97738551fca3917c1bd7188bec1920bb520104f28e7e1007f9ceb17b7690 \
-    --hash=sha256:c60924535c75f1566b6eb75b5c31a48a43fef04fa2d0d201acbad8a9969c6107 \
-    --hash=sha256:c7b9a2f8f4d8e90af72571d3d495deebdd7e3c75451f5b41719aee166e940fc2 \
-    --hash=sha256:ca6546b66be9dc4738b1b043d5ebd5488c66c578c5ff0fd0e8065313fe3afb76 \
-    --hash=sha256:ccffae9a092a00deb7efd545fe5e2c33c33b88e7c054337e9a74c179347d0b7d \
-    --hash=sha256:cdc7e35386f3847df728fbcb5e887e2d79c19e2fa1eba9e51b6621d23e3243af \
-    --hash=sha256:d15fde0e6fb0d88a60d221204873743e5d9f0b7d29165e62cd86d0413ad74ba6 \
-    --hash=sha256:d34c20167764fbcf927194d532dd7e0c56772f0a5f943fa5ef9e9afbba8fb9db \
-    --hash=sha256:d483fe17f01ad64b7bf7cc38fcefff1ca9fb83f8c2b2542b68f97ffe0611b369 \
-    --hash=sha256:d7469697dce35be237db177d42e2a2ee26e6dcc5fc052078a6fefabd288c6edd \
-    --hash=sha256:db08f45aecde626498fb3df07bcf6d2ec040af42e859a4f5040d79c200342911 \
-    --hash=sha256:dc319e5a1de4b6913aac94bf6a2f9e847371e0a140a43dd4991db1a09bc2d504 \
-    --hash=sha256:de3eceba0b683bcbb1ab93da016d0270df1f9ae7be716b40214c5dafac6ea45a \
-    --hash=sha256:dfcc8b909769d19db55c7cc9541eb64b9b774b1057ffffb4f1048070475bb9f9 \
-    --hash=sha256:e059c5dde6452b44424bd1834557556c226b57781dee1227af23518459722b13 \
-    --hash=sha256:e4316bf32babbed84e691e352faf967ce2f0f024174a8643c37c94a1080374fc \
-    --hash=sha256:e52655eaf81e32593abedaa4bfe33170c8cfedf3365ed9be6e11e07f148f0278 \
-    --hash=sha256:e55d236be29255554da47abe5c577637db7c24a02b8b46f0ca9524c855801868 \
-    --hash=sha256:ea7bb13b7c9a29791f87a0387ba7d3ad3a6d783d827e4d3f27b40a0ff44495e2 \
-    --hash=sha256:ea964164cc9afa72d4d9b23cc28dafae93693c0a53e0b42acbff15b22c3f9ddd \
-    --hash=sha256:ec829541c45bca16e61c7ae50c20501f213605beb75d1aba91a6ee37fbbb56a4 \
-    --hash=sha256:ecabd69db66de867690f9797f2f8fa27ba501bbc24540cbdbdc649cd15888ba6 \
-    --hash=sha256:ed0c1e5d10cdc7135537988c74a0188da68e2f3c30813ba3744ab1e42e0480f9 \
-    --hash=sha256:f0840b5b17057f7fd918b76183a4b5a0635f43e14eb2ce60dce1d4ee4707ea00 \
-    --hash=sha256:f4d78253f6996be4901669ad25319f842f740eccf4d58e3c7f3dd39e6dde1d8f \
-    --hash=sha256:f56f1695bc5c0871cbc33dc0130fcf503aab0c57dcc5a6700a4f49eba4f2652e \
-    --hash=sha256:f826877d462181e5eb1c26a0026b8d0cab05d99844ecb6d8bf3627a2ca0c0442 \
-    --hash=sha256:f8f23ead891a3b762f35ab3b04623da7056545b48aa60d59957e6789914545da \
-    --hash=sha256:f90938e92afda60266da758ee7d363447f7f0138c9559f9e1811629580582d90 \
-    --hash=sha256:faa679d19a6696fd54259ad321251ad77a13e70e03dd834daa762a44fb6196ef
+rpds-py==0.30.0 \
+    --hash=sha256:07ae8a593e1c3c6b82ca3292efbe73c30b61332fd612e05abee07c79359f292f \
+    --hash=sha256:0a59119fc6e3f460315fe9d08149f8102aa322299deaa5cab5b40092345c2136 \
+    --hash=sha256:0c0e95f6819a19965ff420f65578bacb0b00f251fefe2c8b23347c37174271f3 \
+    --hash=sha256:0d08f00679177226c4cb8c5265012eea897c8ca3b93f429e546600c971bcbae7 \
+    --hash=sha256:0ed177ed9bded28f8deb6ab40c183cd1192aa0de40c12f38be4d59cd33cb5c65 \
+    --hash=sha256:12f90dd7557b6bd57f40abe7747e81e0c0b119bef015ea7726e69fe550e394a4 \
+    --hash=sha256:1726859cd0de969f88dc8673bdd954185b9104e05806be64bcd87badbe313169 \
+    --hash=sha256:1ab5b83dbcf55acc8b08fc62b796ef672c457b17dbd7820a11d6c52c06839bdf \
+    --hash=sha256:1b151685b23929ab7beec71080a8889d4d6d9fa9a983d213f07121205d48e2c4 \
+    --hash=sha256:1f3587eb9b17f3789ad50824084fa6f81921bbf9a795826570bda82cb3ed91f2 \
+    --hash=sha256:250fa00e9543ac9b97ac258bd37367ff5256666122c2d0f2bc97577c60a1818c \
+    --hash=sha256:2771c6c15973347f50fece41fc447c054b7ac2ae0502388ce3b6738cd366e3d4 \
+    --hash=sha256:27f4b0e92de5bfbc6f86e43959e6edd1425c33b5e69aab0984a72047f2bcf1e3 \
+    --hash=sha256:2e6ecb5a5bcacf59c3f912155044479af1d0b6681280048b338b28e364aca1f6 \
+    --hash=sha256:32c8528634e1bf7121f3de08fa85b138f4e0dc47657866630611b03967f041d7 \
+    --hash=sha256:33f559f3104504506a44bb666b93a33f5d33133765b0c216a5bf2f1e1503af89 \
+    --hash=sha256:3896fa1be39912cf0757753826bc8bdc8ca331a28a7c4ae46b7a21280b06bb85 \
+    --hash=sha256:389a2d49eded1896c3d48b0136ead37c48e221b391c052fba3f4055c367f60a6 \
+    --hash=sha256:39c02563fc592411c2c61d26b6c5fe1e51eaa44a75aa2c8735ca88b0d9599daa \
+    --hash=sha256:3adbb8179ce342d235c31ab8ec511e66c73faa27a47e076ccc92421add53e2bb \
+    --hash=sha256:3d4a69de7a3e50ffc214ae16d79d8fbb0922972da0356dcf4d0fdca2878559c6 \
+    --hash=sha256:3e62880792319dbeb7eb866547f2e35973289e7d5696c6e295476448f5b63c87 \
+    --hash=sha256:3e8eeb0544f2eb0d2581774be4c3410356eba189529a6b3e36bbbf9696175856 \
+    --hash=sha256:422c3cb9856d80b09d30d2eb255d0754b23e090034e1deb4083f8004bd0761e4 \
+    --hash=sha256:4559c972db3a360808309e06a74628b95eaccbf961c335c8fe0d590cf587456f \
+    --hash=sha256:46e83c697b1f1c72b50e5ee5adb4353eef7406fb3f2043d64c33f20ad1c2fc53 \
+    --hash=sha256:47b0ef6231c58f506ef0b74d44e330405caa8428e770fec25329ed2cb971a229 \
+    --hash=sha256:47e77dc9822d3ad616c3d5759ea5631a75e5809d5a28707744ef79d7a1bcfcad \
+    --hash=sha256:47f236970bccb2233267d89173d3ad2703cd36a0e2a6e92d0560d333871a3d23 \
+    --hash=sha256:47f9a91efc418b54fb8190a6b4aa7813a23fb79c51f4bb84e418f5476c38b8db \
+    --hash=sha256:495aeca4b93d465efde585977365187149e75383ad2684f81519f504f5c13038 \
+    --hash=sha256:4c5f36a861bc4b7da6516dbdf302c55313afa09b81931e8280361a4f6c9a2d27 \
+    --hash=sha256:4cc2206b76b4f576934f0ed374b10d7ca5f457858b157ca52064bdfc26b9fc00 \
+    --hash=sha256:4e7fc54e0900ab35d041b0601431b0a0eb495f0851a0639b6ef90f7741b39a18 \
+    --hash=sha256:51a1234d8febafdfd33a42d97da7a43f5dcb120c1060e352a3fbc0c6d36e2083 \
+    --hash=sha256:55f66022632205940f1827effeff17c4fa7ae1953d2b74a8581baaefb7d16f8c \
+    --hash=sha256:58edca431fb9b29950807e301826586e5bbf24163677732429770a697ffe6738 \
+    --hash=sha256:5965af57d5848192c13534f90f9dd16464f3c37aaf166cc1da1cae1fd5a34898 \
+    --hash=sha256:5ba103fb455be00f3b1c2076c9d4264bfcb037c976167a6047ed82f23153f02e \
+    --hash=sha256:5d4c2aa7c50ad4728a094ebd5eb46c452e9cb7edbfdb18f9e1221f597a73e1e7 \
+    --hash=sha256:61046904275472a76c8c90c9ccee9013d70a6d0f73eecefd38c1ae7c39045a08 \
+    --hash=sha256:613aa4771c99f03346e54c3f038e4cc574ac09a3ddfb0e8878487335e96dead6 \
+    --hash=sha256:626a7433c34566535b6e56a1b39a7b17ba961e97ce3b80ec62e6f1312c025551 \
+    --hash=sha256:669b1805bd639dd2989b281be2cfd951c6121b65e729d9b843e9639ef1fd555e \
+    --hash=sha256:679ae98e00c0e8d68a7fda324e16b90fd5260945b45d3b824c892cec9eea3288 \
+    --hash=sha256:67b02ec25ba7a9e8fa74c63b6ca44cf5707f2fbfadae3ee8e7494297d56aa9df \
+    --hash=sha256:68f19c879420aa08f61203801423f6cd5ac5f0ac4ac82a2368a9fcd6a9a075e0 \
+    --hash=sha256:692bef75a5525db97318e8cd061542b5a79812d711ea03dbc1f6f8dbb0c5f0d2 \
+    --hash=sha256:6abc8880d9d036ecaafe709079969f56e876fcf107f7a8e9920ba6d5a3878d05 \
+    --hash=sha256:6bdfdb946967d816e6adf9a3d8201bfad269c67efe6cefd7093ef959683c8de0 \
+    --hash=sha256:6de2a32a1665b93233cde140ff8b3467bdb9e2af2b91079f0333a0974d12d464 \
+    --hash=sha256:73c67f2db7bc334e518d097c6d1e6fed021bbc9b7d678d6cc433478365d1d5f5 \
+    --hash=sha256:74a3243a411126362712ee1524dfc90c650a503502f135d54d1b352bd01f2404 \
+    --hash=sha256:76fec018282b4ead0364022e3c54b60bf368b9d926877957a8624b58419169b7 \
+    --hash=sha256:7c64d38fb49b6cdeda16ab49e35fe0da2e1e9b34bc38bd78386530f218b37139 \
+    --hash=sha256:7cee9c752c0364588353e627da8a7e808a66873672bcb5f52890c33fd965b394 \
+    --hash=sha256:7e6ecfcb62edfd632e56983964e6884851786443739dbfe3582947e87274f7cb \
+    --hash=sha256:806f36b1b605e2d6a72716f321f20036b9489d29c51c91f4dd29a3e3afb73b15 \
+    --hash=sha256:858738e9c32147f78b3ac24dc0edb6610000e56dc0f700fd5f651d0a0f0eb9ff \
+    --hash=sha256:8d6d1cc13664ec13c1b84241204ff3b12f9bb82464b8ad6e7a5d3486975c2eed \
+    --hash=sha256:9027da1ce107104c50c81383cae773ef5c24d296dd11c99e2629dbd7967a20c6 \
+    --hash=sha256:922e10f31f303c7c920da8981051ff6d8c1a56207dbdf330d9047f6d30b70e5e \
+    --hash=sha256:945dccface01af02675628334f7cf49c2af4c1c904748efc5cf7bbdf0b579f95 \
+    --hash=sha256:946fe926af6e44f3697abbc305ea168c2c31d3e3ef1058cf68f379bf0335a78d \
+    --hash=sha256:95f0802447ac2d10bcc69f6dc28fe95fdf17940367b21d34e34c737870758950 \
+    --hash=sha256:9854cf4f488b3d57b9aaeb105f06d78e5529d3145b1e4a41750167e8c213c6d3 \
+    --hash=sha256:993914b8e560023bc0a8bf742c5f303551992dcb85e247b1e5c7f4a7d145bda5 \
+    --hash=sha256:99b47d6ad9a6da00bec6aabe5a6279ecd3c06a329d4aa4771034a21e335c3a97 \
+    --hash=sha256:9a4e86e34e9ab6b667c27f3211ca48f73dba7cd3d90f8d5b11be56e5dbc3fb4e \
+    --hash=sha256:9cf69cdda1f5968a30a359aba2f7f9aa648a9ce4b580d6826437f2b291cfc86e \
+    --hash=sha256:a090322ca841abd453d43456ac34db46e8b05fd9b3b4ac0c78bcde8b089f959b \
+    --hash=sha256:a1010ed9524c73b94d15919ca4d41d8780980e1765babf85f9a2f90d247153dd \
+    --hash=sha256:a161f20d9a43006833cd7068375a94d035714d73a172b681d8881820600abfad \
+    --hash=sha256:a1d0bc22a7cdc173fedebb73ef81e07faef93692b8c1ad3733b67e31e1b6e1b8 \
+    --hash=sha256:a2bffea6a4ca9f01b3f8e548302470306689684e61602aa3d141e34da06cf425 \
+    --hash=sha256:a452763cc5198f2f98898eb98f7569649fe5da666c2dc6b5ddb10fde5a574221 \
+    --hash=sha256:a4796a717bf12b9da9d3ad002519a86063dcac8988b030e405704ef7d74d2d9d \
+    --hash=sha256:a51033ff701fca756439d641c0ad09a41d9242fa69121c7d8769604a0a629825 \
+    --hash=sha256:a8fa71a2e078c527c3e9dc9fc5a98c9db40bcc8a92b4e8858e36d329f8684b51 \
+    --hash=sha256:ac37f9f516c51e5753f27dfdef11a88330f04de2d564be3991384b2f3535d02e \
+    --hash=sha256:ac98b175585ecf4c0348fd7b29c3864bda53b805c773cbf7bfdaffc8070c976f \
+    --hash=sha256:acd7eb3f4471577b9b5a41baf02a978e8bdeb08b4b355273994f8b87032000a8 \
+    --hash=sha256:ad1fa8db769b76ea911cb4e10f049d80bf518c104f15b3edb2371cc65375c46f \
+    --hash=sha256:b40fb160a2db369a194cb27943582b38f79fc4887291417685f3ad693c5a1d5d \
+    --hash=sha256:b4dc1a6ff022ff85ecafef7979a2c6eb423430e05f1165d6688234e62ba99a07 \
+    --hash=sha256:ba3af48635eb83d03f6c9735dfb21785303e73d22ad03d489e88adae6eab8877 \
+    --hash=sha256:ba81a9203d07805435eb06f536d95a266c21e5b2dfbf6517748ca40c98d19e31 \
+    --hash=sha256:c2262bdba0ad4fc6fb5545660673925c2d2a5d9e2e0fb603aad545427be0fc58 \
+    --hash=sha256:c77afbd5f5250bf27bf516c7c4a016813eb2d3e116139aed0096940c5982da94 \
+    --hash=sha256:ca28829ae5f5d569bb62a79512c842a03a12576375d5ece7d2cadf8abe96ec28 \
+    --hash=sha256:cdc62c8286ba9bf7f47befdcea13ea0e26bf294bda99758fd90535cbaf408000 \
+    --hash=sha256:d948b135c4693daff7bc2dcfc4ec57237a29bd37e60c2fabf5aff2bbacf3e2f1 \
+    --hash=sha256:d96c2086587c7c30d44f31f42eae4eac89b60dabbac18c7669be3700f13c3ce1 \
+    --hash=sha256:d9a0ca5da0386dee0655b4ccdf46119df60e0f10da268d04fe7cc87886872ba7 \
+    --hash=sha256:da279aa314f00acbb803da1e76fa18666778e8a8f83484fba94526da5de2cba7 \
+    --hash=sha256:dbd936cde57abfee19ab3213cf9c26be06d60750e60a8e4dd85d1ab12c8b1f40 \
+    --hash=sha256:dc4f992dfe1e2bc3ebc7444f6c7051b4bc13cd8e33e43511e8ffd13bf407010d \
+    --hash=sha256:dc824125c72246d924f7f796b4f63c1e9dc810c7d9e2355864b3c3a73d59ade0 \
+    --hash=sha256:dd8ff7cf90014af0c0f787eea34794ebf6415242ee1d6fa91eaba725cc441e84 \
+    --hash=sha256:dea5b552272a944763b34394d04577cf0f9bd013207bc32323b5a89a53cf9c2f \
+    --hash=sha256:dff13836529b921e22f15cb099751209a60009731a68519630a24d61f0b1b30a \
+    --hash=sha256:e0b65193a413ccc930671c55153a03ee57cecb49e6227204b04fae512eb657a7 \
+    --hash=sha256:e5d3e6b26f2c785d65cc25ef1e5267ccbe1b069c5c21b8cc724efee290554419 \
+    --hash=sha256:e7536cd91353c5273434b4e003cbda89034d67e7710eab8761fd918ec6c69cf8 \
+    --hash=sha256:eb0b93f2e5c2189ee831ee43f156ed34e2a89a78a66b98cadad955972548be5a \
+    --hash=sha256:eb2c4071ab598733724c08221091e8d80e89064cd472819285a9ab0f24bcedb9 \
+    --hash=sha256:ec7c4490c672c1a0389d319b3a9cfcd098dcdc4783991553c332a15acf7249be \
+    --hash=sha256:ee454b2a007d57363c2dfd5b6ca4a5d7e2c518938f8ed3b706e37e5d470801ed \
+    --hash=sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a \
+    --hash=sha256:f14fc5df50a716f7ece6a80b6c78bb35ea2ca47c499e422aa4463455dd96d56d \
+    --hash=sha256:f207f69853edd6f6700b86efb84999651baf3789e78a466431df1331608e5324 \
+    --hash=sha256:f251c812357a3fed308d684a5079ddfb9d933860fc6de89f2b7ab00da481e65f \
+    --hash=sha256:f83424d738204d9770830d35290ff3273fbb02b41f919870479fab14b9d303b2 \
+    --hash=sha256:f8d1736cfb49381ba528cd5baa46f82fdc65c06e843dab24dd70b63d09121b3f \
+    --hash=sha256:fe5fa731a1fa8a0a56b0977413f8cacac1768dad38d16b3a296712709476fbd5
     # via
     #   jsonschema
     #   referencing
+tomli==2.4.1 \
+    --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
+    --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
+    --hash=sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5 \
+    --hash=sha256:1d8591993e228b0c930c4bb0db464bdad97b3289fb981255d6c9a41aedc84b2d \
+    --hash=sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd \
+    --hash=sha256:2c1c351919aca02858f740c6d33adea0c5deea37f9ecca1cc1ef9e884a619d26 \
+    --hash=sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54 \
+    --hash=sha256:3d48a93ee1c9b79c04bb38772ee1b64dcf18ff43085896ea460ca8dec96f35f6 \
+    --hash=sha256:47149d5bd38761ac8be13a84864bf0b7b70bc051806bc3669ab1cbc56216b23c \
+    --hash=sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a \
+    --hash=sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd \
+    --hash=sha256:504aa796fe0569bb43171066009ead363de03675276d2d121ac1a4572397870f \
+    --hash=sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5 \
+    --hash=sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9 \
+    --hash=sha256:559db847dc486944896521f68d8190be1c9e719fced785720d2216fe7022b662 \
+    --hash=sha256:5a881ab208c0baf688221f8cecc5401bd291d67e38a1ac884d6736cbcd8247e9 \
+    --hash=sha256:5cb41aa38891e073ee49d55fbc7839cfdb2bc0e600add13874d048c94aadddd1 \
+    --hash=sha256:5e262d41726bc187e69af7825504c933b6794dc3fbd5945e41a79bb14c31f585 \
+    --hash=sha256:5ee18d9ebdb417e384b58fe414e8d6af9f4e7a0ae761519fb50f721de398dd4e \
+    --hash=sha256:7008df2e7655c495dd12d2a4ad038ff878d4ca4b81fccaf82b714e07eae4402c \
+    --hash=sha256:734e20b57ba95624ecf1841e72b53f6e186355e216e5412de414e3c51e5e3c41 \
+    --hash=sha256:7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f \
+    --hash=sha256:7f86fd587c4ed9dd76f318225e7d9b29cfc5a9d43de44e5754db8d1128487085 \
+    --hash=sha256:7f94b27a62cfad8496c8d2513e1a222dd446f095fca8987fceef261225538a15 \
+    --hash=sha256:88dceee75c2c63af144e456745e10101eb67361050196b0b6af5d717254dddf7 \
+    --hash=sha256:8a650c2dbafa08d42e51ba0b62740dae4ecb9338eefa093aa5c78ceb546fcd5c \
+    --hash=sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36 \
+    --hash=sha256:96481a5786729fd470164b47cdb3e0e58062a496f455ee41b4403be77cb5a076 \
+    --hash=sha256:a120733b01c45e9a0c34aeef92bf0cf1d56cfe81ed9d47d562f9ed591a9828ac \
+    --hash=sha256:b1d22e6e9387bf4739fbe23bfa80e93f6b0373a7f1b96c6227c32bef95a4d7a8 \
+    --hash=sha256:b8c198f8c1805dc42708689ed6864951fd2494f924149d3e4bce7710f8eb5232 \
+    --hash=sha256:c2541745709bad0264b7d4705ad453b76ccd191e64aa6f0fc66b69a293a45ece \
+    --hash=sha256:c742f741d58a28940ce01d58f0ab2ea3ced8b12402f162f4d534dfe18ba1cd6a \
+    --hash=sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897 \
+    --hash=sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d \
+    --hash=sha256:d4d8fe59808a54658fcc0160ecfb1b30f9089906c50b23bcb4c69eddc19ec2b4 \
+    --hash=sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917 \
+    --hash=sha256:eab21f45c7f66c13f2a9e0e1535309cee140182a9cdae1e041d02e47291e8396 \
+    --hash=sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a \
+    --hash=sha256:ec9bfaf3ad2df51ace80688143a6a4ebc09a248f6ff781a9945e51937008fcbc \
+    --hash=sha256:ede3e6487c5ef5d28634ba3f31f989030ad6af71edfb0055cbbd14189ff240ba \
+    --hash=sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f \
+    --hash=sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257 \
+    --hash=sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30 \
+    --hash=sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf \
+    --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
+    --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
+    # via pytest
 typing-extensions==4.16.0 \
     --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
     --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
-    # via referencing
+    # via
+    #   exceptiongroup
+    #   referencing
diff --git a/scripts/bootstrap-device.sh b/scripts/bootstrap-device.sh
index 0a8be6a..2424439 100755
--- a/scripts/bootstrap-device.sh
+++ b/scripts/bootstrap-device.sh
@@ -47,7 +47,7 @@ ROOT=$(CDPATH='' cd -- "$SCRIPT_DIR/.." && pwd)
 SOURCE_ROOT="$ROOT"
 
 # Pinned toolchain (the security floor enforced by validate_go_core.sh).
-GO_VERSION="1.26.7"
+GO_VERSION="1.27.1"
 SDK_ROOT="${HOME}/sdk"
 GO_HOME="${SDK_ROOT}/go${GO_VERSION}"
 GDS_BIN_TARGET="${HOME}/.local/bin/gds"
@@ -386,15 +386,19 @@ phase_1() {
     goarch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
     tarball="go${GO_VERSION}.${goos}-${goarch}.tar.gz"
     case "${goos}-${goarch}" in
-      linux-amd64) expected_sha="ffb5f8de10c62550dfddab66b36b57030721e0a44a3218e9e1181d7b59f121ca" ;;
-      linux-arm64) expected_sha="5a4ec883379d51ee9ce1040d5e87f8d35e20387574dd8c947feb01eabc3c1b37" ;;
-      darwin-arm64) expected_sha="020a1e8224811be75163e920bc77e0926a1390a6aeea19bdcf23f74b9d749f6d" ;;
+      linux-amd64) expected_sha="63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445" ;;
+      linux-arm64) expected_sha="3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec" ;;
+      darwin-amd64) expected_sha="8f8f52c6649542cf027bbc9b9c68d1ec042f9f34808a40413f0b8b3f66f3caa4" ;;
+      darwin-arm64) expected_sha="ee215d57e0ec269c60cc9ceca68e6bda321ba9ee5afe24f4b0988703c2d87d12" ;;
       *) die "no reviewed Go ${GO_VERSION} archive digest for ${goos}-${goarch}" ;;
     esac
     local url="https://go.dev/dl/${tarball}"
     info "Downloading ${url}"
     local tmp; tmp=$(mktemp)
-    wget -nv -O "$tmp" "$url"
+    if ! wget -nv -O "$tmp" "$url"; then
+      rm -f -- "$tmp"
+      die "Go ${GO_VERSION} archive download failed"
+    fi
     local observed_sha
     if command -v sha256sum >/dev/null 2>&1; then
       observed_sha=$(sha256sum "$tmp" | awk '{print $1}')
diff --git a/scripts/gds-exact-apply.sh b/scripts/gds-exact-apply.sh
index 1e24190..5396b39 100755
--- a/scripts/gds-exact-apply.sh
+++ b/scripts/gds-exact-apply.sh
@@ -32,6 +32,29 @@ command=("$@")
 gds_bin="${command[0]}"
 command -v jq >/dev/null 2>&1 || die "jq is required"
 
+# Release verification takes its identity from the stored operation. Replaying
+# the install/upgrade/rollback inputs is explicitly rejected by the native CLI.
+# Other lifecycle commands still need their selectors (for example --harness).
+verify_command=("${command[@]}")
+for ((command_index = 1; command_index + 1 < ${#command[@]}; command_index++)); do
+  if [ "${command[command_index]}" = release ]; then
+    case "${command[command_index + 1]}" in
+      install|upgrade|rollback|remove)
+        verify_command=()
+        for ((index = 0; index < ${#command[@]}; index++)); do
+          case "${command[index]}" in
+            --install-root|--release-directory|--evidence-directory|--trust-policy|--target-release-key|--rollback-authorization)
+              ((index + 1 < ${#command[@]})) || die "missing value for ${command[index]}"
+              index=$((index + 1)) ;;
+            --install-root=*|--release-directory=*|--evidence-directory=*|--trust-policy=*|--target-release-key=*|--rollback-authorization=*) ;;
+            *) verify_command+=("${command[index]}") ;;
+          esac
+        done
+        break ;;
+    esac
+  fi
+done
+
 "$gds_bin" --json operation enable "$plan_id" \
   --state-path "$state_path" --approval-file "$approval_file" \
   --device-id "$device_id" --session-id "$session_id" |
@@ -41,7 +64,7 @@ apply_output=$("${command[@]}" --apply "$plan_id" --approval-ref "$approval_file
   --state-path "$state_path" --device-id "$device_id" --session-id "$session_id")
 operation_id=$(printf '%s' "$apply_output" | jq -er 'select(.result == "succeeded") | .operation_id')
 
-"${command[@]}" --verify "$operation_id" --state-path "$state_path" \
+"${verify_command[@]}" --verify "$operation_id" --state-path "$state_path" \
   --device-id "$device_id" --session-id "$session_id" |
   jq -e '.result == "succeeded"' >/dev/null
 
diff --git a/scripts/validate_assurance.sh b/scripts/validate_assurance.sh
index cebc85f..0faf188 100755
--- a/scripts/validate_assurance.sh
+++ b/scripts/validate_assurance.sh
@@ -17,7 +17,7 @@ BUILD_DIR=$(mktemp -d "${TMPDIR:-/tmp}/gds-assurance-gate.XXXXXX")
 trap 'rm -rf -- "$BUILD_DIR"' EXIT INT TERM
 
 cd "$ROOT"
-export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.7}
+export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.27.1}
 export GOWORK=off
 export GOFLAGS=-mod=readonly
 if [ "$RUN_TESTS" = true ]; then
diff --git a/scripts/validate_ci_tier.sh b/scripts/validate_ci_tier.sh
index 29f2494..9304e37 100755
--- a/scripts/validate_ci_tier.sh
+++ b/scripts/validate_ci_tier.sh
@@ -9,7 +9,7 @@ if [ "$#" -ne 1 ]; then
 fi
 
 cd "$ROOT"
-export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.7}
+export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.27.1}
 export GOWORK=off
 export GOFLAGS=-mod=readonly
 
diff --git a/scripts/validate_go_core.sh b/scripts/validate_go_core.sh
index dccf772..23631e9 100755
--- a/scripts/validate_go_core.sh
+++ b/scripts/validate_go_core.sh
@@ -3,9 +3,9 @@ set -euo pipefail
 
 ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
 MODE=full
-MINIMUM_SECURE_GO_VERSION=go1.26.7
-RELEASE_GO_VERSION=${GDS_RELEASE_GO_VERSION:-go1.26.7}
-GOVULNCHECK_VERSION=v1.6.0
+MINIMUM_SECURE_GO_VERSION=go1.27.1
+RELEASE_GO_VERSION=${GDS_RELEASE_GO_VERSION:-go1.27.1}
+GOVULNCHECK_VERSION=v1.8.0
 
 case "${1:-}" in
   --quick) MODE=quick; shift ;;
@@ -67,7 +67,10 @@ fi
 BUILD_DIR=$(mktemp -d "${TMPDIR:-/tmp}/gds-build.XXXXXX")
 trap 'rm -rf -- "$BUILD_DIR"' EXIT INT TERM
 
-UNFORMATTED=$(gofmt -l core schemas/embed.go)
+# GOTOOLCHAIN selects `go`, but does not replace a separate `gofmt` on PATH.
+# Use the formatter shipped with the exact toolchain this gate just verified.
+GOFMT="$(go env GOROOT)/bin/gofmt"
+UNFORMATTED=$("$GOFMT" -l core schemas/embed.go)
 if [ -n "$UNFORMATTED" ]; then
   printf 'gofmt required for:\n%s\n' "$UNFORMATTED" >&2
   exit 2
diff --git a/scripts/validate_python.sh b/scripts/validate_python.sh
index dc81b9d..153e102 100755
--- a/scripts/validate_python.sh
+++ b/scripts/validate_python.sh
@@ -2,9 +2,9 @@
 set -euo pipefail
 
 ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
-UV_VERSION=0.11.30
-UV_SHA256_X64=04bc7d180d6138bf6dc08387acf507a823f397a98fea55da36b0ccc7fbce3b68
-UV_SHA256_ARM64=8c11d90f5f66d232930cf8ae3a085c39877690d409e10878234802b028b20e2a
+UV_VERSION=0.12.13
+UV_SHA256_X64=745765a3b6e360ad76743599ae5c42e9278c7edf8bbff9fc76d05bf2623a04dd
+UV_SHA256_ARM64=2eaa5d94f5db7b3a1a092156b9420459e42ab0217d917fe74a876309cef9b5e9
 UV_HOME=""
 PYTHON_ENV=$(mktemp -d "${TMPDIR:-/tmp}/gds-python.XXXXXX")
 
@@ -36,7 +36,7 @@ if [ -z "$uv_binary" ] || [ "$("$uv_binary" --version 2>/dev/null | awk '{print
 fi
 
 cd "$ROOT"
-"$uv_binary" venv --python 3.14.4 "$PYTHON_ENV"
+"$uv_binary" venv --python 3.14.7 "$PYTHON_ENV"
 "$uv_binary" pip install --python "$PYTHON_ENV/bin/python" \
   --require-hashes -r requirements/test.txt
 "$PYTHON_ENV/bin/python" -m pytest
diff --git a/scripts/validate_release.sh b/scripts/validate_release.sh
index fb80bec..893bf68 100755
--- a/scripts/validate_release.sh
+++ b/scripts/validate_release.sh
@@ -6,7 +6,7 @@ BUILD_DIR=$(mktemp -d "${TMPDIR:-/tmp}/gds-release-gate.XXXXXX")
 trap 'rm -rf -- "$BUILD_DIR"' EXIT INT TERM
 
 cd "$ROOT"
-export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.7}
+export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.27.1}
 export GOWORK=off
 export GOFLAGS=-mod=readonly
 
diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md
index f838676..0306569 100644
--- a/tests/golden/projections/control-plane/.claude/CLAUDE.md
+++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md
@@ -1,9 +1,9 @@
 <!--
 GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
-bundle: 0.9.2-dev
+bundle: 0.9.3-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:b9052163aaad9f10df40e7fc38afc0834b977cd2f33539573b21e08998fbee42
+input-digest: sha256:2166c46344bebb92028b5e9c20165d60316a3481b322fd53601c12d36732ce14
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml
diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
index 7ea6d84..e832a0a 100644
--- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
+++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
@@ -2,21 +2,21 @@
 schema_version: 1
 
 bundle:
-  version: "0.9.2-dev"
+  version: "0.9.3-dev"
   release_sequence: 0
   channel: "development"
   source_tree_digest: "sha256:0000000000000000000000000000000000000000000000000000000000000001"
-  digest: "sha256:ae392a0202179f9c4ef4da17efaabfea9c7c0928613c363623fae57e07496433"
+  digest: "sha256:e456e1a242a6267b9832cc2f45e7ae89d422ba45773d2e5478b5e0a5390dd156"
 
 projection:
-  input_digest: "sha256:b9052163aaad9f10df40e7fc38afc0834b977cd2f33539573b21e08998fbee42"
-  output_digest: "sha256:8befbe5e1b17ca46ebe3290685ab13043358b0986992fdc1049d3f65eae6798c"
+  input_digest: "sha256:2166c46344bebb92028b5e9c20165d60316a3481b322fd53601c12d36732ce14"
+  output_digest: "sha256:587fa4e8aa5b2c401247809cccd4387bc8cae55a90d1efcfd9a2c896681bc56a"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:7adf638069b1d4c12b3b6916ce35ebc576562ff27fbd79f695721b8887ff98bf"
+      digest: "sha256:e523156c25acfe28213e755fee8323e27f6be06cd5f954d31b6084074fbc5529"
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:14249d1ab3963336c90dbc75b527ebe675648928c596bb90ce7fea7a896ff6dd"
+      digest: "sha256:6aed44f82d7b00a8f59aabc760779ce1b2f97e2c65f69196c350f77c4ffc2702"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:84f7a011c9c91e8c4b488479ab37d25ce4ecd06ab6096b76d1552d211e1a0c95"
+      digest: "sha256:5343f224f08fe265182397ce541c2f418b9b89765c79a32c69c424ffe74edb77"
     - path: "AGENTS.md"
-      digest: "sha256:14974e2c86b1dfc040efcfd498a77bd55c4a254919061101281e51ae1fd54f79"
+      digest: "sha256:b05202663aa8b91045731e625c635096324df6ee19ad7608efd9acc812e0e771"
diff --git a/tests/golden/projections/control-plane/.gds/compiled-policy.json b/tests/golden/projections/control-plane/.gds/compiled-policy.json
index 9948d50..4b6af80 100644
--- a/tests/golden/projections/control-plane/.gds/compiled-policy.json
+++ b/tests/golden/projections/control-plane/.gds/compiled-policy.json
@@ -2,8 +2,8 @@
   "schema_version": 1,
   "compiled_policy": {
     "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
-    "bundle_version": "0.9.2-dev",
-    "digest": "sha256:a8af2a75ab19ae492ee66798bc636b4e79ba0d375603d9b48929aa1e07c500e7"
+    "bundle_version": "0.9.3-dev",
+    "digest": "sha256:51a598c3755839fd82af1600ab810ab6d7b64d377c07e6c7487303ff5464ec6e"
   },
   "sources": [
     {
diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
index 1e917d7..bd00eed 100644
--- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
+++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
-# bundle: 0.9.2-dev
+# bundle: 0.9.3-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:b9052163aaad9f10df40e7fc38afc0834b977cd2f33539573b21e08998fbee42
-# output-digest: sha256:8c045e745cc69b731bc695a4a9d58a48c10f1ab7dd85b7354db7bfd0e072711c
+# input-digest: sha256:2166c46344bebb92028b5e9c20165d60316a3481b322fd53601c12d36732ce14
+# output-digest: sha256:15b87303cd0692fd8e5d88281771dded9fdc2fc027d600681155cb4e71f42386
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -33,7 +33,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -41,7 +41,7 @@ jobs:
       cache: true
 
       runner: "ubuntu-latest"
-      go_version: "1.26.7"
+      go_version: "1.27.1"
       # Declared fast commands own their build scope; the complete build is below.
       build_command: ""
       test_command: "scripts/validate_shell.sh && scripts/validate_go_core.sh --fast"
@@ -53,12 +53,12 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7
     with:
       fetch_depth: 0
       cache: true
       runner: "ubuntu-latest"
-      go_version: "1.26.7"
+      go_version: "1.27.1"
       build_command: "go build -trimpath ./core/cmd/gds"
       test_command: "go test ./... && python3 -m pip install --quiet --require-hashes -r requirements/test.txt && python3 -m pytest"
       timeout_minutes: 30
diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md
index a25935c..1574cdf 100644
--- a/tests/golden/projections/control-plane/AGENTS.md
+++ b/tests/golden/projections/control-plane/AGENTS.md
@@ -1,10 +1,10 @@
 <!--
 GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
-bundle: 0.9.2-dev
+bundle: 0.9.3-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:b9052163aaad9f10df40e7fc38afc0834b977cd2f33539573b21e08998fbee42
-output-digest: sha256:f1d598ee621024cb9518737f49c775aec0d01b16f7ecf137804a9a53bbf0c352
+input-digest: sha256:2166c46344bebb92028b5e9c20165d60316a3481b322fd53601c12d36732ce14
+output-digest: sha256:93d273d51063e15e4dd0ea53b03804a9b7e0005928550bda402b1e1b7714201f
 edit-source:
   - .gds/repository.yaml
   - policies/base/repository-default.yaml
@@ -67,6 +67,6 @@ GDS is the public engine for a multi-owner GitHub estate. It loads an external e
 
 ## Facts
 
-- Repository `repo_01M0EZ7TB3KNXNSP78Z8M64WXG`, roles `control-plane`, bundle `0.9.2-dev`.
+- Repository `repo_01M0EZ7TB3KNXNSP78Z8M64WXG`, roles `control-plane`, bundle `0.9.3-dev`.
 - Canonical inputs: `.gds/repository.yaml`; compiled result: `.gds/compiled-policy.json`.
 - Visibility `public`, data `public`.
diff --git a/tests/test_exact_apply.py b/tests/test_exact_apply.py
index 008021b..f4830b7 100644
--- a/tests/test_exact_apply.py
+++ b/tests/test_exact_apply.py
@@ -1,47 +1,103 @@
 from pathlib import Path
+import json
 import os
 import subprocess
 
+import pytest
+
 
 ROOT = Path(__file__).resolve().parents[1]
 
 
-def test_exact_apply_helper_is_argv_only_and_runs_separate_enablement() -> None:
-    script = (ROOT / "scripts" / "gds-exact-apply.sh").read_text(encoding="utf-8")
-    assert 'operation enable "$plan_id"' in script
-    assert '--approval-file "$approval_file"' in script
-    assert '"${command[@]}" --apply "$plan_id"' in script
-    assert '"${command[@]}" --verify "$operation_id"' in script
-    assert "eval " not in script
-    assert 'approval file must have mode 0600' in script
+@pytest.fixture(scope="module")
+def native_gds(tmp_path_factory: pytest.TempPathFactory) -> Path:
+    binary = tmp_path_factory.mktemp("exact-apply-cli") / "gds"
+    subprocess.run(
+        ["go", "build", "-trimpath", "-o", str(binary), "./core/cmd/gds"],
+        cwd=ROOT, check=True, capture_output=True, text=True,
+    )
+    return binary
 
 
-def test_exact_apply_helper_executes_enable_apply_verify_in_order(tmp_path: Path) -> None:
-    fake = tmp_path / "gds"
-    log = tmp_path / "calls"
+def run_helper(tmp_path: Path, arguments: list[str], native: Path | None = None,
+               failure: str = "") -> tuple[subprocess.CompletedProcess[str], list[list[str]]]:
+    fake = tmp_path / "gds shim"
+    log = tmp_path / "calls.jsonl"
     fake.write_text(
-        "#!/usr/bin/env bash\nset -eu\nprintf '%s\\n' \"$*\" >> \"$CALL_LOG\"\n"
-        "case \" $* \" in\n"
-        "  *' operation enable '*) printf '{\"result\":\"succeeded\",\"data\":{\"status\":\"active\"}}\\n' ;;\n"
-        "  *' --apply '*) printf '{\"result\":\"succeeded\",\"operation_id\":\"op-fixture\"}\\n' ;;\n"
-        "  *' --verify '*) printf '{\"result\":\"succeeded\"}\\n' ;;\n"
-        "  *) exit 2 ;;\n"
-        "esac\n",
+        "#!/usr/bin/env python3\n"
+        "import json, os, subprocess, sys\n"
+        "args = sys.argv[1:]\n"
+        "with open(os.environ['CALL_LOG'], 'a') as log:\n"
+        "    log.write(json.dumps(args) + '\\n')\n"
+        "phase = 'enable' if 'enable' in args else 'apply' if '--apply' in args else 'verify'\n"
+        "if os.environ.get('FAIL_PHASE') == phase:\n"
+        "    print(json.dumps({'result': 'failed'})); sys.exit(13)\n"
+        "if phase == 'verify' and os.environ.get('NATIVE_GDS'):\n"
+        "    result = subprocess.run([os.environ['NATIVE_GDS'], *args], capture_output=True, text=True)\n"
+        "    with open(os.environ['VERIFY_OUTPUT'], 'w') as output:\n"
+        "        output.write(result.stdout)\n"
+        "    print(result.stdout, end=''); sys.stderr.write(result.stderr); sys.exit(result.returncode)\n"
+        "print(json.dumps({'result': 'succeeded', 'data': {'status': 'active'}, 'operation_id': 'op-fixture'}))\n",
         encoding="utf-8",
     )
     fake.chmod(0o755)
-    approval = tmp_path / "approval.json"
+    approval = tmp_path / "approval with spaces.json"
     approval.write_text("{}\n", encoding="utf-8")
     approval.chmod(0o600)
     result = subprocess.run(
         [str(ROOT / "scripts" / "gds-exact-apply.sh"), "--state-path", str(tmp_path / "state.db"),
-         "--device-id", "device:test", "--session-id", "session-test",
+         "--device-id", "device_01JAZZQ0000000000000000000", "--session-id", "session-test",
          "--plan-id", "plan_0123456789ABCDEF", "--approval-file", str(approval), "--",
-         str(fake), "--json", "harness", "install", "--harness", "codex"],
-        check=True, capture_output=True, text=True, env={**os.environ, "CALL_LOG": str(log)},
+         str(fake), "--json", *arguments],
+        capture_output=True, text=True,
+        env={**os.environ, "CALL_LOG": str(log), "FAIL_PHASE": failure,
+             "NATIVE_GDS": str(native) if native else "", "VERIFY_OUTPUT": str(tmp_path / "verify.json")},
     )
-    assert '"operation_id":"op-fixture"' in result.stdout
-    calls = log.read_text(encoding="utf-8").splitlines()
-    assert "operation enable" in calls[0]
-    assert "--apply plan_0123456789ABCDEF" in calls[1]
-    assert "--verify op-fixture" in calls[2]
+    calls = [json.loads(line) for line in log.read_text(encoding="utf-8").splitlines()]
+    return result, calls
+
+
+def test_harness_selectors_and_literal_arguments_survive_verification(tmp_path: Path) -> None:
+    target = str(tmp_path / "target with spaces $(must-not-execute) ; `literal`")
+    base = ["harness", "install", "--harness", "codex", "--target-root", target]
+    result, calls = run_helper(tmp_path, base)
+    assert result.returncode == 0, result.stderr
+    assert json.loads(result.stdout)["operation_id"] == "op-fixture"
+    assert calls[0][:3] == ["--json", "operation", "enable"]
+    assert calls[1][1:1 + len(base)] == calls[2][1:1 + len(base)] == base
+    assert "--apply" in calls[1] and "--verify" in calls[2]
+    assert "--approval-ref" not in calls[2]
+
+
+@pytest.mark.parametrize("operation", ["install", "upgrade", "rollback", "remove"])
+@pytest.mark.parametrize("equals", [False, True])
+def test_release_verification_uses_stored_identity_with_native_cli(
+    tmp_path: Path, native_gds: Path, operation: str, equals: bool,
+) -> None:
+    inputs = {"install-root": str(tmp_path / "install root")}
+    if operation in {"install", "upgrade"}:
+        inputs.update({name: str(tmp_path / f"{name} with spaces") for name in
+                       ["release-directory", "evidence-directory", "trust-policy"]})
+    if operation == "rollback":
+        inputs.update({"target-release-key": "exact-key", "rollback-authorization": str(tmp_path / "rollback.json")})
+    flags = [arg for name, value in inputs.items()
+             for arg in ([f"--{name}={value}"] if equals else [f"--{name}", value])]
+    result, calls = run_helper(tmp_path, ["release", operation, *flags], native_gds)
+    assert result.returncode != 0  # The shim's synthetic operation was never stored.
+    assert calls[1][3:3 + len(flags)] == flags
+    assert calls[2][1:3] == ["release", operation]
+    assert all(arg.split("=", 1)[0] not in {f"--{name}" for name in inputs} for arg in calls[2])
+    envelope = json.loads((tmp_path / "verify.json").read_text(encoding="utf-8"))
+    assert envelope["result"] != "succeeded"
+    assert "GDS_RELEASE_VERIFY_INPUT_CONFLICT" not in json.dumps(envelope)
+    # Native verification reached the operation store, beyond CLI input checks.
+    assert envelope["findings"][0]["code"] == "GDS_LOCAL_OPERATION_NOT_PROVEN"
+    assert envelope["findings"][0]["evidence"]["path"] == str(tmp_path / "state.db")
+
+
+@pytest.mark.parametrize("phase,count", [("enable", 1), ("apply", 2), ("verify", 3)])
+def test_failed_phase_cannot_report_success_or_start_next_phase(tmp_path: Path, phase: str, count: int) -> None:
+    result, calls = run_helper(tmp_path, ["harness", "install", "--harness", "codex"], failure=phase)
+    assert result.returncode != 0
+    assert len(calls) == count
+    assert '"operation_id"' not in result.stdout