Harden source release preparation and record verified security follow-up

2026-09-08 08:04:12 +02:00
parent 9554657bb5
commit 58d320d9b3
26 changed files with 3833 additions and 163 deletions
@@ -361,6 +361,15 @@ and WebUI API proxy traffic across API replicas. The WebUI and API services do
 not publish host ports. HAProxy has no Docker socket and discovers only the
 bounded replica slots rendered into `load-balancer.cfg`.

+New installation specifications default to HAProxy `3.2.23-alpine`, pinned to
+registry index `sha256:6343ce34a132a5dceaa24767d739df2bd519f8f7c1079ae39e4821334e8eb42e`.
+This patch remains on HAProxy 3.2 LTS and Alpine 3.24.1. Loading an existing
+specification preserves its explicit image; it does not perform an upgrade.
+The [runtime remediation evidence](../security/RUNTIME_IMAGE_REMEDIATION_2026-09-08.md)
+records both architecture scans and the pending binary/configuration, runtime,
+inventory and final-image checks. The source default is not a release approval:
+runtime publication remains held in Meta #52.
+
 Replica counts are desired state:

 ```sh