[rmcdaniel]

The daily security workflow still scans Waterline2.15.0 after2.18.0 was published and independently accepted. Point its existing policy at the exact accepted2.18.0 index so subsequent daily scans cover the current release.

Only stable_image changes. The pinned scanner, freshness/severity policy and workflow remain unchanged. Release follow-through and acceptance are recorded on #304, following the earlier stale-target correction #273.

Verified raw index SHA256 2750484b0ec80b6b34026cbebb69677a966f4c342a26e7c9313f2b89d3cbb315:

Platform	Image digest
linux/amd64	sha256:55930b99e5d0e87968331c1c4acb27d79c01172c816838244e5087f2d4c5c14d
linux/arm64	sha256:32a3529dc382ced7198b07eb873aef65ee05410962a417e5f4f2ba5f89b8d975

Both exact attached BuildKit manifests pass the existing provenance/SBOM validator and bind version2.18.0/source 9c241c573f479a13982fa390c21b226ed19759d1 to native build43359778665/attempt1. GitHub CLI independently verified signed provenance for the index and both images through both API and registry paths, requiring the protected main publisher certificate, exact source digest and GitHub-hosted runners. Protected publisher43360151693 and the existing independent Security acceptance agree with those identities.

Validation: all16 existing OCI release tests pass; parsed before/after policy differs only at stable_image; whitespace and secret-pattern checks pass.

Next: independent exact-head Security review and normal repository merge, followed by the existing main-branch scan workflow. Keep this release follow-through open until fresh summaries classify both exact platform images under the existing policy. No publication or deployment is involved.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security image-selection review — PASS on exact head d6bdffc5cbe20b4b194b8236c47afd8143de485a.

The only change advances the daily immutable stable_image from the recorded 2.15 image to the already accepted Waterline 2.18 index sha256:2750484b0ec80b6b34026cbebb69677a966f4c342a26e7c9313f2b89d3cbb315; scanner identity and database-age policy are unchanged.

I independently resolved the public Docker index and re-hashed its raw OCI document: both equal 2750484b…. It contains the expected linux/amd64 child 55930b99…, linux/arm64 child 32a3529d…, and attached attestation manifests for both. All exact-head source, release-contract, both-architecture build, published conformance, target qualification, CodeQL, and Sonar checks pass.

This approves the immutable scan selector only. It does not publish, deploy, or replace the existing release record; the normal post-merge fresh scan of both architectures remains required.

[rmcdaniel]

Merged exact Security-approved d6bdffc5cbe20b4b194b8236c47afd8143de485a through GitHub as 321b588cb39c66688173ed9fc8171b3503b98405, after all37 checks passed with four declared skips. The merge's tree equals the approved tree, includes that exact head as a parent, and differs from its first parent only at the scan-policy file. The remote head is absent404; the clean local worktree and completed branch are removed.

Dispatched the existing both-platform daily scan43413768745 from that exact main. It selects the verified2.18.0 index and its two exact platform children. Waterline owns inspecting and classifying both fresh summaries before the release follow-through is complete. This merge changes the scan selector only; no publication, deployment or vulnerability result is inferred from it.

[rmcdaniel]

The post-merge daily scan43413768745 passed from exact main 321b588cb39c66688173ed9fc8171b3503b98405. I downloaded both retained summaries and independently checked schema, exact subject/platform, pinned scanner, pass result, zero HIGH/CRITICAL count and database freshness.

Platform	Exact published image	HIGH / CRITICAL	Report digest
amd64	sha256:55930b99e5d0e87968331c1c4acb27d79c01172c816838244e5087f2d4c5c14d	0 / 0	sha256:03eb24fa8b0c589e376410ff1b29673941fc33cf219991be6cc5ce05faccde52
arm64	sha256:32a3529dc382ced7198b07eb873aef65ee05410962a417e5f4f2ba5f89b8d975	0 / 0	sha256:735ba3c088c14c29f7804e72b7cb8a1a5d1c6a130549c1305180b0979723cd35

Both summaries use Trivy0.76.1/index 790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c. The database was updated2026-11-13T07:00:07.938173847Z and downloaded around11:02UTC, within the24-hour policy. The recorded inventories include Alpine, Composer and Node packages; the summaries report no findings.

Classification: the current accepted Waterline2.18.0 image passes the configured fresh HIGH/CRITICAL policy on both architectures. The stale scan-selector correction, independent exact-head review, merge/head cleanup and post-merge scan acceptance are complete in #308. This is release monitoring follow-through for #304; no image publication or production change occurred.