catalog: prepare 0.3.14 with verified October runtime revisions

.github/workflows/validate.yml

@@ -32,13 +32,13 @@ jobs:
       - name: Set up pinned Python toolchain
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.14.6'
+          python-version: '3.14.9'
           check-latest: false
 
       - name: Validate images, schema, and localized metadata
         env:
-          CATALOG_SERVICE_VERSION: 0.20.11
-          CATALOG_SERVICE_SHA256: b44bc4d337ea3b54d5a5febca2060ce23e3b988c298c2fb926227fea3c228d3d
+          CATALOG_SERVICE_VERSION: 0.20.15
+          CATALOG_SERVICE_SHA256: 7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b
           PASTURESTACK_CATALOG_ALLOWED_LOCAL_ROOTS: /tmp
           TMPDIR: /tmp
           SOURCE_SHA: ${{ github.sha }}
@@ -57,14 +57,24 @@ jobs:
           }
           trap cleanup EXIT
 
-          test "$(cat .python-version)" = '3.14.6'
+          test "$(cat .python-version)" = '3.14.9'
           test "$(python -c 'import platform; print(platform.python_version())')" = \
-            '3.14.6'
+            '3.14.9'
+          python tools/pip-security-overlay/build-pip-overlay.py \
+            --work "$work_root/pip-build" --output "$work_root/pip-dist"
+          python -m venv --without-pip "$work_root/python-env"
+          export PATH="$work_root/python-env/bin:$PATH"
+          PYTHONPATH="$work_root/pip-dist/pip-26.2.2+pasturestack.1-py3-none-any.whl" \
+            python -m pip install --no-index --no-deps \
+            "$work_root/pip-dist/pip-26.2.2+pasturestack.1-py3-none-any.whl"
           python -m pip install \
             --disable-pip-version-check \
             --require-hashes \
             --only-binary=:all: \
+            --find-links "$work_root/pip-dist" \
             --requirement integration/requirements.lock
+          python -c "import pip, certifi, pip._vendor.certifi as bundled; assert pip.__version__ == '26.2.2+pasturestack.1'; assert certifi.__version__ == '2026.10.19'; assert bundled.__version__ == '2026.10.19'; print(pip.__version__, certifi.__version__, bundled.__version__)"
+          python tools/pip-security-overlay/test-pip-overlay.py
           python -m flake8 integration/core
 
           bash scripts/audit-deployable-images
@@ -243,7 +253,7 @@ jobs:
             python -m pytest -q integration/core \
               -k 'not test_validate_exits_normal'
 
-          echo "CATALOG_TW_LOCALIZATION_OK source=$SOURCE_SHA templates=22 infra_first_party=21 python=3.14.6"
+          echo "CATALOG_TW_LOCALIZATION_OK source=$SOURCE_SHA templates=22 infra_first_party=21 python=3.14.9"
 
   release:
     if: github.event_name == 'push' && github.ref_type == 'tag'

.python-version

@@ -1 +1 @@
-3.14.6
+3.14.9

SUPPORTED.md

@@ -9,33 +9,40 @@ or out-of-scope templates from being presented as deployable software.
 | Entry | Type | Version | Image policy | Release state |
 |---|---|---|---|---|
 | PastureStack Native | Project template | v0.3.0 | Composes only reviewed, semantic-versioned infrastructure entries | Clean single-host provisioning and restart passed; restored-data validation pending |
-| PastureStack Container Schedule | Infrastructure scheduling service | v0.6.0 | Public PastureStack GHCR image with an explicit version tag | Race tests, anonymous distribution, HIGH/CRITICAL scan, and Docker start/stop lifecycle passed |
-| PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.0 | Public PastureStack GHCR image with an explicit version tag | Mock compatibility API discovery, real Docker pull/cache lifecycle, anonymous distribution, and HIGH/CRITICAL scan passed |
-| PastureStack Amazon ECR Credential Sync | Infrastructure registry service | v3.1.0 | Public PastureStack GHCR image with an explicit version tag | Source tests, anonymous distribution, and credential lifecycle gates passed |
-| Metadata Healthcheck | Infrastructure stack | v0.3.16 | Public PastureStack GHCR image with a non-overwritten version tag | Link-local Metadata integration and stdout/stderr routing passed; production rolling upgrade pending |
-| PastureStack Network Services | Infrastructure system stack | v0.3.8 candidate | Published Network Plugin Manager v0.8.22; Metadata Service v0.9.11 and Internal DNS v0.17.11 unchanged | Formal component Release and fresh-DB all-severity runtime/secret scan passed; exact-image QA upgrade and rollback remain required; the previous two-host evidence below belongs to v0.8.21 |
-| PastureStack Network Diagnostics | Infrastructure diagnostics service | v0.2.1 | Two public PastureStack GHCR images with explicit version tags | Reproducible builds, anonymous distribution, full snapshot and bundle lifecycle, persistence, localization, and HIGH/CRITICAL scan passed |
-| PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.2 | Public PastureStack GHCR image with an explicit version tag | Five consecutive two-host default-deny, directed TCP allow, rollback, cleanup, and zero-restart gates passed |
-| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.2 candidate | v0.14.27 published and manifest digest locked | Isolated VM two-container XFRM and encrypted-packet check passed; formal two-host control-plane lifecycle pending |
+| PastureStack Container Schedule | Infrastructure scheduling service | v0.6.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.2 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Amazon ECR Credential Sync | Infrastructure registry service | v3.1.6 | Public PastureStack GHCR image with an explicit version tag | Published component; full runtime raw scan has zero findings; Catalog integration and environment acceptance remain distinct |
+| Metadata Healthcheck | Infrastructure stack | v0.3.17 | Public PastureStack GHCR image with a non-overwritten version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Network Services | Infrastructure system stack | v0.3.9 | Published Network Plugin Manager v0.8.22; Metadata Service v0.9.11 and Internal DNS v0.17.11 unchanged | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Network Diagnostics | Infrastructure diagnostics service | v0.2.2 | Two public PastureStack GHCR images with explicit version tags | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.4 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.11 | v0.14.27 published and manifest digest locked | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Windows ECR Credential Sync | Windows infrastructure registry service | v3.1.2 | Public PastureStack GHCR Windows image with an explicit version tag | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending |
 | PastureStack Windows Network Services | Windows infrastructure Metadata and DNS stack | v0.3.0 | Two public PastureStack GHCR Windows images with explicit version tags | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending |
-| PastureStack Windows Container Networking | Windows NAT and transparent network-driver definition | v0.1.0 | Reviewed selector-only placeholder image with an explicit version tag | Catalog rendering and compatibility-boundary review passed; Windows-host network-driver lifecycle pending |
-| PastureStack Layer 2 Flat Network | Optional infrastructure network driver | v0.3.0 | Reviewed network image with a semantic version tag; bridge setup is opt-in | Packaged Flat CNI ADD/DEL and isolated physical-bridge setup passed |
-| Resource Scheduler | Infrastructure scheduling agent | v0.8.19 candidate | Published component v0.8.19, manifest digest and verified SBOM provenance recorded | Formal component release, reproducible builds, all-severity runtime gate, and isolated packaged-health CI passed; these checks do not qualify managed-system upgrade or rollback |
-| PastureStack Route 53 DNS Sync | Infrastructure external-DNS agent | v0.8.0 | Public PastureStack GHCR image with an explicit version tag | Route 53 create, update, restart, removal, health, secret, and vulnerability gates passed |
-| PastureStack Amazon EBS Storage | Infrastructure block-storage driver | v0.10.0 | Public PastureStack GHCR image with an explicit version tag | Existing-volume contract, safe opt-in provisioning boundary, anonymous distribution, and HIGH/CRITICAL scan passed; live AWS lifecycle pending |
-| PastureStack Amazon EFS Storage | Infrastructure shared-storage driver | v0.10.0 | Public PastureStack GHCR image with an explicit version tag | Existing-filesystem contract, controlled mount-target provisioning boundary, anonymous distribution, and HIGH/CRITICAL scan passed; live AWS lifecycle pending |
-| PastureStack NFS Storage | Infrastructure storage driver | v0.10.0 | Public PastureStack GHCR image with an explicit version tag | NFS v3 create, mount, read/write, unmount, retain, safe purge, anonymous distribution, and HIGH/CRITICAL scan passed |
-| PastureStack Secret Volume | Infrastructure secret-volume driver | v0.1.2 | Public PastureStack GHCR image with an explicit version tag | Production Catalog deployment, authenticated encrypted delivery, non-root `0400` materialization, restart continuity, tmpfs cleanup, anonymous distribution, and HIGH/CRITICAL scan passed |
-| PastureStack Vault Volume | Infrastructure Vault token-volume driver | v0.2.1 | Two public PastureStack GHCR images with explicit version tags | Real Vault issue, unwrap, restart recovery, accessor revocation, read-only Secret input, anonymous distribution, and HIGH/CRITICAL scans passed |
-| PastureStack Per-Host Subnet Network | Optional infrastructure network driver | v0.3.0 | Reviewed network image with a semantic version tag | Packaged Host-Local CNI ADD/DEL plus isolated route and IP-set reconciliation passed |
-| PastureStack VXLAN Overlay Network | Optional infrastructure network driver | v0.3.0 | Reviewed network image with a semantic version tag | Isolated two-node VXLAN forwarding and overlay traffic passed; Catalog lifecycle pending |
+| PastureStack Windows Container Networking | Windows NAT and transparent network-driver definition | v0.1.1 | Reviewed selector-only placeholder image with an explicit version tag | Catalog rendering and compatibility-boundary review passed; Windows-host network-driver lifecycle pending |
+| PastureStack Layer 2 Flat Network | Optional infrastructure network driver | v0.3.5 | Reviewed network image with a semantic version tag; bridge setup is opt-in | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| Resource Scheduler | Infrastructure scheduling agent | v0.8.20 | Published component v0.8.19, manifest digest and verified SBOM provenance recorded | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Route 53 DNS Sync | Infrastructure external-DNS agent | v0.8.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Amazon EBS Storage | Infrastructure block-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Amazon EFS Storage | Infrastructure shared-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack NFS Storage | Infrastructure storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Secret Volume | Infrastructure secret-volume driver | v0.1.3 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Vault Volume | Infrastructure Vault token-volume driver | v0.2.2 | Two public PastureStack GHCR images with explicit version tags | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Per-Host Subnet Network | Optional infrastructure network driver | v0.3.3 | Reviewed network image with a semantic version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack VXLAN Overlay Network | Optional infrastructure network driver | v0.3.4 | Reviewed network image with a semantic version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 
 Deployable image references contain semantic version tags only. A published
 version tag must never be replaced. Manifest digests are retained only in the
 corresponding GitHub Release verification evidence; they are not placed in
 Catalog, Compose, API, or user-interface values.
 
+## Historical acceptance evidence
+
+The sections below preserve earlier environment and feature acceptance context.
+They do not claim that those older image versions are the current defaults or
+that a new artifact has already passed an environment's upgrade/rollback. The
+table above and `catalog-images.json` are the current version and artifact record.
+
 ## PastureStack Native evidence
 
 The project template references only the four enabled PastureStack