[rmcdaniel]

The daily security workflow scans a superseded image index, so it misses the bytes currently published as Waterline 2.14.0. Point release/service-image-security.json at the exact published 2.14.0 index. This is a one-line policy-data correction on current main, separate from #272.

Addresses #273. Keep the issue open until the post-merge rescan proves both published platforms.

Verified publication binding:

• Index: sha256:b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98.
• amd64: sha256:d0c0d039846b6ba408f19b0b38bbe6661c5ddb79821dc11874168d10303c57fb.
• arm64: sha256:43e444deb984910fcc29f034a865e554b6957731bb185948b6542a0a82af6f31.
• Anonymous registry index inspection matches the 2.14.0 release, including both public attestation manifests.
• Signed GitHub index provenance verifies with the repository, protected publisher identity, source digest 73c63d4047e34510b784966825f13112fbe02459, and denial of self-hosted runners. Its verified run identity is publisher 41782261187.

Validation: OCI policy contracts 15/15; JSON/diff and public-boundary checks pass. The diff contains only the expected public digest. No package or image is republished.

After exact-head Security review and General's merge decision, dispatch the existing service-image-security.yml workflow from main and record both platform summaries on #273 before closing it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact head dbf5b24dfeeda8547f7dd4c2b179d2b4ea096a87 is fully qualified: 35 passing checks, 4 expected skips, 0 failures. Full qualification passes. The branch diff from main remains exactly the one public image-digest replacement.

Signed GitHub attestations now independently verify for the index and both platform digests, each constrained to the repository, protected publisher certificate identity, source 73c63d4047e34510b784966825f13112fbe02459, and GitHub-hosted runners. All three verified statements identify publisher run 41782261187/attempts/1. The index references exactly the amd64 and arm64 image digests listed in this PR.

Ready for Security's exact-head review and General's merge decision. After merge, the next action is to dispatch service-image-security.yml on main and retain both fresh published-platform scan summaries on #273. No release publication is part of this PR.

[rmcdaniel]

Security exact-head review: MERGE GO for dbf5b24dfeeda8547f7dd4c2b179d2b4ea096a87 only.

Evidence reconciled:

• the mergeable delta from base 5319282a2ed037aa11c1e33c8d194a11517f310e is exactly one line: stable_image moves from stale index 5d1ed06;�u����f to the published 2.14.0 index b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98;
• the public index resolves to amd64 d0c0d03;�u����f and arm64 43e444de�w^~)�v, plus both public attestation manifests;
• independent gh attestation verify with the repository, protected publisher identity, source digest 73c63d40�w^~)�v, and self-hosted runners denied binds the index to publisher run 41782261187 attempt 1;
• OCI contracts are 15/15;
• hosted qualification is terminal: 35 success, four expected skips, zero failures, zero pending; diff-check is clean.

Scope is only restoration of the scheduled-scan target. After General verifies the exact-SHA merge, dispatch the existing service-image-security workflow and record both exact platform summaries on #273. Keep #273 open until those scans classify the current published image. The prior HIGH findings were against the old index and are not evidence that 2.14.0 is clean or vulnerable. No publication or unrelated #272 clearance is included.

[rmcdaniel]

General merged Security-cleared head dbf5b24dfeeda8547f7dd4c2b179d2b4ea096a87 as 4406d934f4d533bf56cf92e70149b0b6641c42e1 after a fresh readback of 35 successful checks and four intended skips. The merge tree equals the reviewed tree (85a428817b8f375ecfa5d4902d43c841005e9efd), the head is a merge parent, and the merged remote branch is absent (404).

The Waterline owner should now dispatch the existing published-image security scan from this main and record both current-platform summaries on #273. Keep #273 open until the actual scan outcomes are classified. This merge restores the target pointer; it makes no clean-image claim and does not clear #272.