diff --git a/deny.toml b/deny.toml
index 536624371..2b96d9c0e 100644
--- a/deny.toml
+++ b/deny.toml
@@ -14,14 +14,18 @@ ignore = [
     # RUSTSEC-2026-0249: `smartstring` 1.0.1 is unmaintained and has no patched
     # release. Its safe `From<String>` conversion has reported undefined
     # behavior (bodil/smartstring#49), also reproduced through Rhai's
-    # `ImmutableString` (rhaiscript/rhai#816). Rhai 1.25.1 pulls it into
+    # `ImmutableString` (rhaiscript/rhai#816). Rhai 1.26.1 pulls it into
     # Evidence, its authoring tools, and the shared language server exposed
     # through `relayctl`, where the affected owned-string conversion is
-    # reachable. This ignore records accepted residual risk, not a fix.
-    # Reviewed 2026-08-13. Review when Rhai replaces `smartstring`, if a
-    # maintained patched release appears, after changes to Evidence's Rhai
-    # string flow, before accepting untrusted scripts, or if upstream publishes
-    # further security findings.
+    # reachable. Evidence accepts governed, hash-covered scripts only and
+    # bounds adapter strings, arrays, and maps before converting them for Rhai;
+    # these controls limit exposure but do not remove the reported unsoundness.
+    # This ignore records accepted residual risk, not a fix. Reviewed 2026-09-22
+    # after selector-aware extraction added another bounded conversion path.
+    # Review by 2026-10-06, when Rhai replaces `smartstring`, if a maintained
+    # patched release appears, after further changes to Evidence's Rhai string
+    # flow, before accepting untrusted scripts, or if upstream publishes further
+    # security findings.
     "RUSTSEC-2026-0249",
     # The following advisories all arrive through the Typst rendering tree
     # (`typst`/`typst-pdf`/`krilla`/`typst-library`), which
diff --git a/products/relay-v2/security/advisory-baseline.json b/products/relay-v2/security/advisory-baseline.json
index 986958f51..39e29cb56 100644
--- a/products/relay-v2/security/advisory-baseline.json
+++ b/products/relay-v2/security/advisory-baseline.json
@@ -27,7 +27,7 @@
       "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614"
     ],
     "application_layer_ids": [
-      "sha256:f71bab192b90d68c1ef78bbd58c68f163b3077f59129ed8af45cb0a03fa8e274",
+      "sha256:302066fd41cf1075eb0e8bf16aa8467461330d1e777219b472cd11665246800a",
       "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
     ],
     "config": {
@@ -64,7 +64,7 @@
       ],
       "stop_signal": ""
     },
-    "definition_digest": "sha256:5c707fcf1de482143d5789562f3691260d2519333f51cfb50fec0089153981c2"
+    "definition_digest": "sha256:3a722bfd7ce830c3f482a867b937980075230ec96ebaa2e5e9c32c16df16c4b1"
   },
   "policies": [
     {
@@ -87,7 +87,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.32.0 Linux AMD64 Relay local reproduction from rehearsal run 34923868162 imports or dynamically resolves none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still records Trixie as vulnerable at this version under its no-DSA minor-issue tag, with a fixed glibc only in forky and sid.",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.33.0 Linux AMD64 Relay local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable imports none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. The one review-required nonconstant dlsym tail jump is SQLite's extension-symbol wrapper; governed SQL rejects load_extension and no first-party runtime caller enables or invokes SQLite C extension loading. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still records this Trixie version as vulnerable and fixes only forky and sid.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -105,14 +105,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:5c707fcf1de482143d5789562f3691260d2519333f51cfb50fec0089153981c2",
-      "component_layer_id": "sha256:f71bab192b90d68c1ef78bbd58c68f163b3077f59129ed8af45cb0a03fa8e274",
+      "runtime_definition_digest": "sha256:3a722bfd7ce830c3f482a867b937980075230ec96ebaa2e5e9c32c16df16c4b1",
+      "component_layer_id": "sha256:302066fd41cf1075eb0e8bf16aa8467461330d1e777219b472cd11665246800a",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:c1fda956208cdba3c5418ca98b6362942abf5124aa7edf4438b47e696e26f034",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:94d9d8439361ffec9fdc2ddd44c54b698632295998d8616276c9abf002d4a52c",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:5c707fcf1de482143d5789562f3691260d2519333f51cfb50fec0089153981c2",
+        "runtime_definition_digest": "sha256:3a722bfd7ce830c3f482a867b937980075230ec96ebaa2e5e9c32c16df16c4b1",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -132,10 +132,68 @@
           },
           {
             "path": "/usr/local/bin/relay",
-            "sha256": "sha256:bf8b0c401940e3f37fd280cac28110b648830cc3fe111706927508ac95a674aa"
+            "sha256": "sha256:e1ead11e4a0a3d748ca85b4fa922854d1fd4ee07a0e1b5fa36444e3ed324ef5c"
           }
         ],
-        "definition_digest": "sha256:7b8153aea0b91b3929d1afa6022a76e4fe64432b3714850ebe600e34d8ea825d"
+        "definition_digest": "sha256:5c81770a1cf1343d596783c549a949130db40a93fb0f3545eedd40dc78cb461b"
+      }
+    },
+    {
+      "vulnerability_id": "CVE-2026-19499",
+      "package": "libc6",
+      "installed_version": "2.41-12+deb13u4",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix; Grype reports wont-fix. The reviewed v0.33.0 Linux AMD64 Relay local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither imports nor contains strfmon or strfmon_l. The one review-required nonconstant dlsym tail jump is SQLite's extension-symbol wrapper; governed SQL rejects load_extension and no first-party runtime caller enables or invokes SQLite C extension loading. No caller-controlled right-justified monetary-format width path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian fixes the issue only in forky and sid.",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_config_changed",
+        "runtime_base_changed"
+      ],
+      "runtime_definition_digest": "sha256:3a722bfd7ce830c3f482a867b937980075230ec96ebaa2e5e9c32c16df16c4b1",
+      "component_layer_id": "sha256:302066fd41cf1075eb0e8bf16aa8467461330d1e777219b472cd11665246800a",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:94d9d8439361ffec9fdc2ddd44c54b698632295998d8616276c9abf002d4a52c",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:3a722bfd7ce830c3f482a867b937980075230ec96ebaa2e5e9c32c16df16c4b1",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/relay",
+            "sha256": "sha256:e1ead11e4a0a3d748ca85b4fa922854d1fd4ee07a0e1b5fa36444e3ed324ef5c"
+          }
+        ],
+        "definition_digest": "sha256:5c81770a1cf1343d596783c549a949130db40a93fb0f3545eedd40dc78cb461b"
       }
     },
     {
@@ -145,7 +203,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.32.0 Linux AMD64 Relay local reproduction from rehearsal run 34923868162 does not link libz or embed libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf in its executable. Its reviewed dynamic lookups do not select those functions, so no vulnerable stalled gzip-write followed by formatted-output path was identified. SQLite C extension-loading support is compiled in; its SQL entry point remains disabled and governed SQL explicitly denies load_extension, with no first-party runtime C-API loading or enabling caller identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still lists no fixed zlib package for Trixie.",
+      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.33.0 Linux AMD64 Relay local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither links libz nor contains libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. The one review-required nonconstant dlsym tail jump is SQLite's extension-symbol wrapper; governed SQL rejects load_extension and no first-party runtime caller enables or invokes SQLite C extension loading. No vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still lists no fixed zlib package for Trixie.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -163,14 +221,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:5c707fcf1de482143d5789562f3691260d2519333f51cfb50fec0089153981c2",
+      "runtime_definition_digest": "sha256:3a722bfd7ce830c3f482a867b937980075230ec96ebaa2e5e9c32c16df16c4b1",
       "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:c1fda956208cdba3c5418ca98b6362942abf5124aa7edf4438b47e696e26f034",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:94d9d8439361ffec9fdc2ddd44c54b698632295998d8616276c9abf002d4a52c",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:5c707fcf1de482143d5789562f3691260d2519333f51cfb50fec0089153981c2",
+        "runtime_definition_digest": "sha256:3a722bfd7ce830c3f482a867b937980075230ec96ebaa2e5e9c32c16df16c4b1",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -190,10 +248,10 @@
           },
           {
             "path": "/usr/local/bin/relay",
-            "sha256": "sha256:bf8b0c401940e3f37fd280cac28110b648830cc3fe111706927508ac95a674aa"
+            "sha256": "sha256:e1ead11e4a0a3d748ca85b4fa922854d1fd4ee07a0e1b5fa36444e3ed324ef5c"
           }
         ],
-        "definition_digest": "sha256:7b8153aea0b91b3929d1afa6022a76e4fe64432b3714850ebe600e34d8ea825d"
+        "definition_digest": "sha256:5c81770a1cf1343d596783c549a949130db40a93fb0f3545eedd40dc78cb461b"
       }
     }
   ]
diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py
index 8e5ba6a71..3c9ac1f0e 100644
--- a/release/scripts/test_check_advisory_baselines.py
+++ b/release/scripts/test_check_advisory_baselines.py
@@ -24,15 +24,17 @@
     ROOT / "release/security/casework-advisory-baseline.json",
     ROOT / "release/security/discovery-advisory-baseline.json",
     ROOT / "release/security/evidence-advisory-baseline.json",
+    ROOT / "release/security/scheduling-advisory-baseline.json",
 )
 LIVE_REFERENCE_IMAGE_DIGESTS = {
-    "relay": "sha256:c1fda956208cdba3c5418ca98b6362942abf5124aa7edf4438b47e696e26f034",
-    "breg": "sha256:9619bde5f36f1efc91b48253735659839366dc816ca4d46f3af286d7f3f44e6a",
-    "casework": "sha256:d12f62d91c4fb60532f441b4740790608b1fbc59a2f8eb31952f949c294f776b",
-    "discovery": "sha256:43140226dc11cde1dd1ca322462b891a00f29bf1e7181230a0bc6dd6eeb65b85",
-    "evidence": "sha256:af402e73cb104ee27039bf6c7b5cc5e7cbf37416449b91ff47086c6463b90483",
+    "relay": "sha256:94d9d8439361ffec9fdc2ddd44c54b698632295998d8616276c9abf002d4a52c",
+    "breg": "sha256:9299a1beece6ad8de828a7fbb72cbd109901e5f6f638f71e80fe31f1f78b7a90",
+    "casework": "sha256:ae50ec47af1b4916ff811bffdc7f928c4ef397e46f6208bb4f36c5ce655a1499",
+    "discovery": "sha256:26f3686b5b982d1883e83e64509ab30e35a56ece7bc9545d6350435cc72a0d7c",
+    "evidence": "sha256:ee06a933127294e9c2175de5c0115f651ee748eb1a546faeba0c737f594c5222",
+    "scheduling": "sha256:74f49c852500729542a73b6e057fe201f13b9f0aae5f51ba775e72a2f4903331",
 }
-LIVE_REFERENCE_SOURCE_REVISION = "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8"
+LIVE_REFERENCE_SOURCE_REVISION = "6a460c2cf66bc9d286cbe4a5454571c392488c05"
 # The date the live exceptions below were reviewed against, stated here rather
 # than derived from the baselines: deriving it from their own reviewed_at values
 # would make the checker's future-dated guard unreachable for the newest
@@ -44,6 +46,7 @@
     "casework": "local_reproduction",
     "discovery": "local_reproduction",
     "evidence": "local_reproduction",
+    "scheduling": "local_reproduction",
 }
 LIVE_EXECUTABLES = {
     "relay": "/usr/local/bin/relay",
@@ -51,6 +54,7 @@
     "casework": "/usr/local/bin/casework",
     "discovery": "/usr/local/bin/discovery",
     "evidence": "/usr/local/bin/evidence",
+    "scheduling": "/usr/local/bin/scheduling",
 }
 
 
diff --git a/release/security/breg-advisory-baseline.json b/release/security/breg-advisory-baseline.json
index 5d5d3d913..0b476ee0d 100644
--- a/release/security/breg-advisory-baseline.json
+++ b/release/security/breg-advisory-baseline.json
@@ -27,7 +27,7 @@
       "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614"
     ],
     "application_layer_ids": [
-      "sha256:a977e610c22a7d8990d3c1d628ed9f64662d691351c556e91f422c69c0c4a426",
+      "sha256:eb1c6f6d0fd86c36a6fb6a6f3da49ba6925fe3538f7597c18ce8944746e946c6",
       "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
     ],
     "config": {
@@ -51,7 +51,7 @@
       ],
       "stop_signal": ""
     },
-    "definition_digest": "sha256:df64c8a8b1579c5782fc3a86189622ff61f91de7ce73b74e85276f547093a8dd"
+    "definition_digest": "sha256:a66b272a90b900ea90b22cf3ff828d89b8e2d993e7dcd6a5bfe0d6b2b3ba7948"
   },
   "policies": [
     {
@@ -74,7 +74,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.32.0 Linux AMD64 BReg local reproduction from rehearsal run 34923868162 imports or dynamically resolves none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still records Trixie as vulnerable at this version under its no-DSA minor-issue tag, with a fixed glibc only in forky and sid.",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.33.0 Linux AMD64 BReg local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable imports none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. The one review-required address-taken dlsym use is Wasmtime's Intel JIT profiler availability probe and only selects NotifyEvent and Initialize. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still records this Trixie version as vulnerable and fixes only forky and sid.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -92,14 +92,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:df64c8a8b1579c5782fc3a86189622ff61f91de7ce73b74e85276f547093a8dd",
-      "component_layer_id": "sha256:a977e610c22a7d8990d3c1d628ed9f64662d691351c556e91f422c69c0c4a426",
+      "runtime_definition_digest": "sha256:a66b272a90b900ea90b22cf3ff828d89b8e2d993e7dcd6a5bfe0d6b2b3ba7948",
+      "component_layer_id": "sha256:eb1c6f6d0fd86c36a6fb6a6f3da49ba6925fe3538f7597c18ce8944746e946c6",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:9619bde5f36f1efc91b48253735659839366dc816ca4d46f3af286d7f3f44e6a",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:9299a1beece6ad8de828a7fbb72cbd109901e5f6f638f71e80fe31f1f78b7a90",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:df64c8a8b1579c5782fc3a86189622ff61f91de7ce73b74e85276f547093a8dd",
+        "runtime_definition_digest": "sha256:a66b272a90b900ea90b22cf3ff828d89b8e2d993e7dcd6a5bfe0d6b2b3ba7948",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -119,10 +119,68 @@
           },
           {
             "path": "/usr/local/bin/breg",
-            "sha256": "sha256:018bf46e8a100bbb26508c3371988b72a04a4513ec366b3dce5931d318fd5ee3"
+            "sha256": "sha256:61d9835ece3402fb5600a02dda3eae4e7ee5bf7d0acebb268e166350d3b705b2"
           }
         ],
-        "definition_digest": "sha256:029243998fe2b6aeb3cc7ddcc2d7f79ab8bad94ca442df3c43ec9432ffd23f57"
+        "definition_digest": "sha256:48a8a94eb657eed350b8b1c344068fff17f2abaac867038c524412cddda8fa70"
+      }
+    },
+    {
+      "vulnerability_id": "CVE-2026-19499",
+      "package": "libc6",
+      "installed_version": "2.41-12+deb13u4",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix; Grype reports wont-fix. The reviewed v0.33.0 Linux AMD64 BReg local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither imports nor contains strfmon or strfmon_l. The one review-required address-taken dlsym use is Wasmtime's Intel JIT profiler availability probe and only selects NotifyEvent and Initialize. No caller-controlled right-justified monetary-format width path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian fixes the issue only in forky and sid.",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_config_changed",
+        "runtime_base_changed"
+      ],
+      "runtime_definition_digest": "sha256:a66b272a90b900ea90b22cf3ff828d89b8e2d993e7dcd6a5bfe0d6b2b3ba7948",
+      "component_layer_id": "sha256:eb1c6f6d0fd86c36a6fb6a6f3da49ba6925fe3538f7597c18ce8944746e946c6",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:9299a1beece6ad8de828a7fbb72cbd109901e5f6f638f71e80fe31f1f78b7a90",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:a66b272a90b900ea90b22cf3ff828d89b8e2d993e7dcd6a5bfe0d6b2b3ba7948",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/breg",
+            "sha256": "sha256:61d9835ece3402fb5600a02dda3eae4e7ee5bf7d0acebb268e166350d3b705b2"
+          }
+        ],
+        "definition_digest": "sha256:48a8a94eb657eed350b8b1c344068fff17f2abaac867038c524412cddda8fa70"
       }
     },
     {
@@ -132,7 +190,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.32.0 Linux AMD64 BReg local reproduction from rehearsal run 34923868162 does not link libz or embed libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf in its executable. Its reviewed dynamic lookups do not select those functions, so no vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still lists no fixed zlib package for Trixie.",
+      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.33.0 Linux AMD64 BReg local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither links libz nor contains libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. The one review-required address-taken dlsym use is Wasmtime's Intel JIT profiler availability probe and only selects NotifyEvent and Initialize. No vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still lists no fixed zlib package for Trixie.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -150,14 +208,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:df64c8a8b1579c5782fc3a86189622ff61f91de7ce73b74e85276f547093a8dd",
+      "runtime_definition_digest": "sha256:a66b272a90b900ea90b22cf3ff828d89b8e2d993e7dcd6a5bfe0d6b2b3ba7948",
       "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:9619bde5f36f1efc91b48253735659839366dc816ca4d46f3af286d7f3f44e6a",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:9299a1beece6ad8de828a7fbb72cbd109901e5f6f638f71e80fe31f1f78b7a90",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:df64c8a8b1579c5782fc3a86189622ff61f91de7ce73b74e85276f547093a8dd",
+        "runtime_definition_digest": "sha256:a66b272a90b900ea90b22cf3ff828d89b8e2d993e7dcd6a5bfe0d6b2b3ba7948",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -177,10 +235,10 @@
           },
           {
             "path": "/usr/local/bin/breg",
-            "sha256": "sha256:018bf46e8a100bbb26508c3371988b72a04a4513ec366b3dce5931d318fd5ee3"
+            "sha256": "sha256:61d9835ece3402fb5600a02dda3eae4e7ee5bf7d0acebb268e166350d3b705b2"
           }
         ],
-        "definition_digest": "sha256:029243998fe2b6aeb3cc7ddcc2d7f79ab8bad94ca442df3c43ec9432ffd23f57"
+        "definition_digest": "sha256:48a8a94eb657eed350b8b1c344068fff17f2abaac867038c524412cddda8fa70"
       }
     }
   ]
diff --git a/release/security/casework-advisory-baseline.json b/release/security/casework-advisory-baseline.json
index 560d6d3b4..f2e2b13b7 100644
--- a/release/security/casework-advisory-baseline.json
+++ b/release/security/casework-advisory-baseline.json
@@ -27,7 +27,7 @@
       "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614"
     ],
     "application_layer_ids": [
-      "sha256:8f6a6a1d3bf865bf67481ef6ada53cf7cecac382d061819ac2dfdd4497b3b168",
+      "sha256:c526331d7e280980992c2b0f14a3f71e2d89df27ebc1a5832d925fb1bdbf1ed8",
       "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
     ],
     "config": {
@@ -52,7 +52,7 @@
       ],
       "stop_signal": ""
     },
-    "definition_digest": "sha256:599af5527226d6c09239257d46348e706b176e8968f29d288d11a95612fe73b1"
+    "definition_digest": "sha256:48d29db65e8e562f379a19d4015b4cc0e6c7ded4c00a51b9df797b8680d5c9e3"
   },
   "policies": [
     {
@@ -75,7 +75,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.32.0 Linux AMD64 Casework local reproduction is from rehearsal run 34923868162. Its executable imports or dynamically resolves none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr, and fp_nquery. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still records Trixie as vulnerable at this version under its no-DSA minor-issue tag, with a fixed glibc only in forky and sid.",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.33.0 Linux AMD64 Casework local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable imports none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. The exposure report has no review-required dynamic lookup. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still records this Trixie version as vulnerable and fixes only forky and sid.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -93,14 +93,14 @@
         "runtime_base_changed",
         "runtime_config_changed"
       ],
-      "runtime_definition_digest": "sha256:599af5527226d6c09239257d46348e706b176e8968f29d288d11a95612fe73b1",
-      "component_layer_id": "sha256:8f6a6a1d3bf865bf67481ef6ada53cf7cecac382d061819ac2dfdd4497b3b168",
+      "runtime_definition_digest": "sha256:48d29db65e8e562f379a19d4015b4cc0e6c7ded4c00a51b9df797b8680d5c9e3",
+      "component_layer_id": "sha256:c526331d7e280980992c2b0f14a3f71e2d89df27ebc1a5832d925fb1bdbf1ed8",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:d12f62d91c4fb60532f441b4740790608b1fbc59a2f8eb31952f949c294f776b",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:ae50ec47af1b4916ff811bffdc7f928c4ef397e46f6208bb4f36c5ce655a1499",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:599af5527226d6c09239257d46348e706b176e8968f29d288d11a95612fe73b1",
+        "runtime_definition_digest": "sha256:48d29db65e8e562f379a19d4015b4cc0e6c7ded4c00a51b9df797b8680d5c9e3",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -120,10 +120,68 @@
           },
           {
             "path": "/usr/local/bin/casework",
-            "sha256": "sha256:a6301604b6a588785e76310a670213bf0a39bed446161edf26e99bcd32e29584"
+            "sha256": "sha256:3ee3144dd2551ccf0d0f159275b6d152097630a0251583fa829d4fc32c6d83da"
           }
         ],
-        "definition_digest": "sha256:55c3faef5177007a91334c933de0d2c43932cd26aa12dd91c103de59083dc129"
+        "definition_digest": "sha256:139af03b983e13e6ea5bd5fb77750457a15e9e28553bbb01e8974bd553bfa239"
+      }
+    },
+    {
+      "vulnerability_id": "CVE-2026-19499",
+      "package": "libc6",
+      "installed_version": "2.41-12+deb13u4",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix; Grype reports wont-fix. The reviewed v0.33.0 Linux AMD64 Casework local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither imports nor contains strfmon or strfmon_l. The exposure report has no review-required dynamic lookup. No caller-controlled right-justified monetary-format width path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian fixes the issue only in forky and sid.",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_base_changed",
+        "runtime_config_changed"
+      ],
+      "runtime_definition_digest": "sha256:48d29db65e8e562f379a19d4015b4cc0e6c7ded4c00a51b9df797b8680d5c9e3",
+      "component_layer_id": "sha256:c526331d7e280980992c2b0f14a3f71e2d89df27ebc1a5832d925fb1bdbf1ed8",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:ae50ec47af1b4916ff811bffdc7f928c4ef397e46f6208bb4f36c5ce655a1499",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:48d29db65e8e562f379a19d4015b4cc0e6c7ded4c00a51b9df797b8680d5c9e3",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/casework",
+            "sha256": "sha256:3ee3144dd2551ccf0d0f159275b6d152097630a0251583fa829d4fc32c6d83da"
+          }
+        ],
+        "definition_digest": "sha256:139af03b983e13e6ea5bd5fb77750457a15e9e28553bbb01e8974bd553bfa239"
       }
     },
     {
@@ -133,7 +191,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.32.0 Linux AMD64 Casework local reproduction is from rehearsal run 34923868162. Its executable does not link libz or contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf, or gzvprintf. Its sole dlsym call selects the fixed _dl_find_object name, so no vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still lists no fixed zlib package for Trixie.",
+      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.33.0 Linux AMD64 Casework local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither links libz nor contains libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. The exposure report has no review-required dynamic lookup. No vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still lists no fixed zlib package for Trixie.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -151,14 +209,14 @@
         "runtime_base_changed",
         "runtime_config_changed"
       ],
-      "runtime_definition_digest": "sha256:599af5527226d6c09239257d46348e706b176e8968f29d288d11a95612fe73b1",
+      "runtime_definition_digest": "sha256:48d29db65e8e562f379a19d4015b4cc0e6c7ded4c00a51b9df797b8680d5c9e3",
       "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:d12f62d91c4fb60532f441b4740790608b1fbc59a2f8eb31952f949c294f776b",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:ae50ec47af1b4916ff811bffdc7f928c4ef397e46f6208bb4f36c5ce655a1499",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:599af5527226d6c09239257d46348e706b176e8968f29d288d11a95612fe73b1",
+        "runtime_definition_digest": "sha256:48d29db65e8e562f379a19d4015b4cc0e6c7ded4c00a51b9df797b8680d5c9e3",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -178,10 +236,10 @@
           },
           {
             "path": "/usr/local/bin/casework",
-            "sha256": "sha256:a6301604b6a588785e76310a670213bf0a39bed446161edf26e99bcd32e29584"
+            "sha256": "sha256:3ee3144dd2551ccf0d0f159275b6d152097630a0251583fa829d4fc32c6d83da"
           }
         ],
-        "definition_digest": "sha256:55c3faef5177007a91334c933de0d2c43932cd26aa12dd91c103de59083dc129"
+        "definition_digest": "sha256:139af03b983e13e6ea5bd5fb77750457a15e9e28553bbb01e8974bd553bfa239"
       }
     }
   ]
diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json
index ecd4ab3ab..8b8622d17 100644
--- a/release/security/discovery-advisory-baseline.json
+++ b/release/security/discovery-advisory-baseline.json
@@ -27,7 +27,7 @@
       "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614"
     ],
     "application_layer_ids": [
-      "sha256:2b2746ada5df57c6ce85bfba82ca709d7553c14a83e667e21a8d6e541117a9ed"
+      "sha256:4da2e235cacbc5cbdfac74e126d11d30573b4707638ef164598f3928e0521c16"
     ],
     "config": {
       "user": "65532",
@@ -50,7 +50,7 @@
       ],
       "stop_signal": ""
     },
-    "definition_digest": "sha256:e55918a4b972b772f8c170d6326edd065eb48fe08051ef52a2cee0b7c0fc39b8"
+    "definition_digest": "sha256:0eff517adb27fd2af9624a1be057cc7c6ba89d4402cdb8ff84dfc0cce8996faf"
   },
   "policies": [
     {
@@ -73,7 +73,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.32.0 Linux AMD64 Discovery local reproduction from rehearsal run 34923868162 imports or dynamically resolves none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still records Trixie as vulnerable at this version under its no-DSA minor-issue tag, with a fixed glibc only in forky and sid.",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.33.0 Linux AMD64 Discovery local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable imports none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. The exposure report has no review-required dynamic lookup. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still records this Trixie version as vulnerable and fixes only forky and sid.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -91,14 +91,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:e55918a4b972b772f8c170d6326edd065eb48fe08051ef52a2cee0b7c0fc39b8",
-      "component_layer_id": "sha256:2b2746ada5df57c6ce85bfba82ca709d7553c14a83e667e21a8d6e541117a9ed",
+      "runtime_definition_digest": "sha256:0eff517adb27fd2af9624a1be057cc7c6ba89d4402cdb8ff84dfc0cce8996faf",
+      "component_layer_id": "sha256:4da2e235cacbc5cbdfac74e126d11d30573b4707638ef164598f3928e0521c16",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:43140226dc11cde1dd1ca322462b891a00f29bf1e7181230a0bc6dd6eeb65b85",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:26f3686b5b982d1883e83e64509ab30e35a56ece7bc9545d6350435cc72a0d7c",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:e55918a4b972b772f8c170d6326edd065eb48fe08051ef52a2cee0b7c0fc39b8",
+        "runtime_definition_digest": "sha256:0eff517adb27fd2af9624a1be057cc7c6ba89d4402cdb8ff84dfc0cce8996faf",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -118,10 +118,68 @@
           },
           {
             "path": "/usr/local/bin/discovery",
-            "sha256": "sha256:180fc6ce80dd05b7080036542d315118129811cfb82cabd30f111a60f3ccd518"
+            "sha256": "sha256:dac501abb856fccde9425d0d449e7ec6146cbff9baca13986045047f98589a4a"
           }
         ],
-        "definition_digest": "sha256:d40df82e98a78adbe57f75066b72e18969d58f65dfc0821d92251f85810526e2"
+        "definition_digest": "sha256:3cfe5712674bd8fe6817b1ba5f9297f6bb1b88b4416561967da5edbe3cc92bf2"
+      }
+    },
+    {
+      "vulnerability_id": "CVE-2026-19499",
+      "package": "libc6",
+      "installed_version": "2.41-12+deb13u4",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix; Grype reports wont-fix. The reviewed v0.33.0 Linux AMD64 Discovery local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither imports nor contains strfmon or strfmon_l. The exposure report has no review-required dynamic lookup. No caller-controlled right-justified monetary-format width path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian fixes the issue only in forky and sid.",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_config_changed",
+        "runtime_base_changed"
+      ],
+      "runtime_definition_digest": "sha256:0eff517adb27fd2af9624a1be057cc7c6ba89d4402cdb8ff84dfc0cce8996faf",
+      "component_layer_id": "sha256:4da2e235cacbc5cbdfac74e126d11d30573b4707638ef164598f3928e0521c16",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:26f3686b5b982d1883e83e64509ab30e35a56ece7bc9545d6350435cc72a0d7c",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:0eff517adb27fd2af9624a1be057cc7c6ba89d4402cdb8ff84dfc0cce8996faf",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/discovery",
+            "sha256": "sha256:dac501abb856fccde9425d0d449e7ec6146cbff9baca13986045047f98589a4a"
+          }
+        ],
+        "definition_digest": "sha256:3cfe5712674bd8fe6817b1ba5f9297f6bb1b88b4416561967da5edbe3cc92bf2"
       }
     },
     {
@@ -131,7 +189,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.32.0 Linux AMD64 Discovery local reproduction from rehearsal run 34923868162 does not link libz or embed libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf in its executable. Its reviewed dynamic lookups do not select those functions, so no vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still lists no fixed zlib package for Trixie.",
+      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.33.0 Linux AMD64 Discovery local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither links libz nor contains libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. The exposure report has no review-required dynamic lookup. No vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still lists no fixed zlib package for Trixie.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -149,14 +207,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:e55918a4b972b772f8c170d6326edd065eb48fe08051ef52a2cee0b7c0fc39b8",
+      "runtime_definition_digest": "sha256:0eff517adb27fd2af9624a1be057cc7c6ba89d4402cdb8ff84dfc0cce8996faf",
       "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:43140226dc11cde1dd1ca322462b891a00f29bf1e7181230a0bc6dd6eeb65b85",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:26f3686b5b982d1883e83e64509ab30e35a56ece7bc9545d6350435cc72a0d7c",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:e55918a4b972b772f8c170d6326edd065eb48fe08051ef52a2cee0b7c0fc39b8",
+        "runtime_definition_digest": "sha256:0eff517adb27fd2af9624a1be057cc7c6ba89d4402cdb8ff84dfc0cce8996faf",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -176,10 +234,10 @@
           },
           {
             "path": "/usr/local/bin/discovery",
-            "sha256": "sha256:180fc6ce80dd05b7080036542d315118129811cfb82cabd30f111a60f3ccd518"
+            "sha256": "sha256:dac501abb856fccde9425d0d449e7ec6146cbff9baca13986045047f98589a4a"
           }
         ],
-        "definition_digest": "sha256:d40df82e98a78adbe57f75066b72e18969d58f65dfc0821d92251f85810526e2"
+        "definition_digest": "sha256:3cfe5712674bd8fe6817b1ba5f9297f6bb1b88b4416561967da5edbe3cc92bf2"
       }
     }
   ]
diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json
index 424bcfaea..e6cd23162 100644
--- a/release/security/evidence-advisory-baseline.json
+++ b/release/security/evidence-advisory-baseline.json
@@ -27,7 +27,7 @@
       "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614"
     ],
     "application_layer_ids": [
-      "sha256:cacbb2735b18b7e96265e0d53366b7795942fe69aa2ad0851848b2de360a08f5",
+      "sha256:b2c04963eb443c9d089d42a0e691f59e6a5143878b0f65f4b02d35392efcb71d",
       "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
     ],
     "config": {
@@ -51,7 +51,7 @@
       ],
       "stop_signal": ""
     },
-    "definition_digest": "sha256:1507821e5a8bff6ed880be012edebcd86e3f0aabc55af669516d240f4dcbd7a2"
+    "definition_digest": "sha256:e1dbda4bdbc0e26d9657176208a07176a1c1ff965acbb5144554fefea718492f"
   },
   "policies": [
     {
@@ -74,7 +74,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.32.0 Linux AMD64 Evidence local reproduction from rehearsal run 34923868162 imports or dynamically resolves none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still records Trixie as vulnerable at this version under its no-DSA minor-issue tag, with a fixed glibc only in forky and sid.",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.33.0 Linux AMD64 Evidence local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable imports none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. The one review-required nonconstant dlsym tail jump is SQLite's extension-symbol wrapper; governed SQL rejects load_extension and no first-party runtime caller enables or invokes SQLite C extension loading. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still records this Trixie version as vulnerable and fixes only forky and sid.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -92,14 +92,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:1507821e5a8bff6ed880be012edebcd86e3f0aabc55af669516d240f4dcbd7a2",
-      "component_layer_id": "sha256:cacbb2735b18b7e96265e0d53366b7795942fe69aa2ad0851848b2de360a08f5",
+      "runtime_definition_digest": "sha256:e1dbda4bdbc0e26d9657176208a07176a1c1ff965acbb5144554fefea718492f",
+      "component_layer_id": "sha256:b2c04963eb443c9d089d42a0e691f59e6a5143878b0f65f4b02d35392efcb71d",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:af402e73cb104ee27039bf6c7b5cc5e7cbf37416449b91ff47086c6463b90483",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:ee06a933127294e9c2175de5c0115f651ee748eb1a546faeba0c737f594c5222",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:1507821e5a8bff6ed880be012edebcd86e3f0aabc55af669516d240f4dcbd7a2",
+        "runtime_definition_digest": "sha256:e1dbda4bdbc0e26d9657176208a07176a1c1ff965acbb5144554fefea718492f",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -119,10 +119,68 @@
           },
           {
             "path": "/usr/local/bin/evidence",
-            "sha256": "sha256:0cfb47fdadfcafda9d5ec1a05ade6df206ca38231c4860613966630ed27ab323"
+            "sha256": "sha256:2d19b3f3fe4ff403de2035b3c1e827870c95dbbd809dd52fb4661da361f64e61"
           }
         ],
-        "definition_digest": "sha256:112c919ffecd618e81a1defcc3b909ae6d5a70645c573eed26ce63272e6006d3"
+        "definition_digest": "sha256:39e550f9a2cb149b0d2863b260e784f45d070307c43c42b2cb6cee8ce10c137c"
+      }
+    },
+    {
+      "vulnerability_id": "CVE-2026-19499",
+      "package": "libc6",
+      "installed_version": "2.41-12+deb13u4",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix; Grype reports wont-fix. The reviewed v0.33.0 Linux AMD64 Evidence local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither imports nor contains strfmon or strfmon_l. The one review-required nonconstant dlsym tail jump is SQLite's extension-symbol wrapper; governed SQL rejects load_extension and no first-party runtime caller enables or invokes SQLite C extension loading. No caller-controlled right-justified monetary-format width path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian fixes the issue only in forky and sid.",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_config_changed",
+        "runtime_base_changed"
+      ],
+      "runtime_definition_digest": "sha256:e1dbda4bdbc0e26d9657176208a07176a1c1ff965acbb5144554fefea718492f",
+      "component_layer_id": "sha256:b2c04963eb443c9d089d42a0e691f59e6a5143878b0f65f4b02d35392efcb71d",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:ee06a933127294e9c2175de5c0115f651ee748eb1a546faeba0c737f594c5222",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:e1dbda4bdbc0e26d9657176208a07176a1c1ff965acbb5144554fefea718492f",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/evidence",
+            "sha256": "sha256:2d19b3f3fe4ff403de2035b3c1e827870c95dbbd809dd52fb4661da361f64e61"
+          }
+        ],
+        "definition_digest": "sha256:39e550f9a2cb149b0d2863b260e784f45d070307c43c42b2cb6cee8ce10c137c"
       }
     },
     {
@@ -132,7 +190,7 @@
       "severity": "High",
       "status": "accepted_risk",
       "owner": "@jeremi",
-      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.32.0 Linux AMD64 Evidence local reproduction from rehearsal run 34923868162 does not link libz or embed libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf in its executable. Its reviewed dynamic lookups do not select those functions, so no vulnerable stalled gzip-write followed by formatted-output path was identified. SQLite C extension-loading support is compiled in; its SQL entry point remains disabled and governed SQL explicitly denies load_extension, with no first-party runtime C-API loading or enabling caller identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Re-reviewed on 2026-09-22 with the evidence bindings unchanged: the release Dockerfiles still pin the reviewed runtime base, and Debian still lists no fixed zlib package for Trixie.",
+      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.33.0 Linux AMD64 Evidence local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither links libz nor contains libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. The one review-required nonconstant dlsym tail jump is SQLite's extension-symbol wrapper; governed SQL rejects load_extension and no first-party runtime caller enables or invokes SQLite C extension loading. No vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still lists no fixed zlib package for Trixie.",
       "reviewed_at": "2026-09-22",
       "expires_at": "2026-10-06",
       "invalidation_triggers": [
@@ -150,14 +208,14 @@
         "runtime_config_changed",
         "runtime_base_changed"
       ],
-      "runtime_definition_digest": "sha256:1507821e5a8bff6ed880be012edebcd86e3f0aabc55af669516d240f4dcbd7a2",
+      "runtime_definition_digest": "sha256:e1dbda4bdbc0e26d9657176208a07176a1c1ff965acbb5144554fefea718492f",
       "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
       "exposure_assertion": {
         "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:af402e73cb104ee27039bf6c7b5cc5e7cbf37416449b91ff47086c6463b90483",
-        "reference_source_revision": "5e6120ad1ec2d17bc4189dfbaf38894cb8f7dbe8",
+        "reference_image_digest": "sha256:ee06a933127294e9c2175de5c0115f651ee748eb1a546faeba0c737f594c5222",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
         "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:1507821e5a8bff6ed880be012edebcd86e3f0aabc55af669516d240f4dcbd7a2",
+        "runtime_definition_digest": "sha256:e1dbda4bdbc0e26d9657176208a07176a1c1ff965acbb5144554fefea718492f",
         "files": [
           {
             "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
@@ -177,10 +235,10 @@
           },
           {
             "path": "/usr/local/bin/evidence",
-            "sha256": "sha256:0cfb47fdadfcafda9d5ec1a05ade6df206ca38231c4860613966630ed27ab323"
+            "sha256": "sha256:2d19b3f3fe4ff403de2035b3c1e827870c95dbbd809dd52fb4661da361f64e61"
           }
         ],
-        "definition_digest": "sha256:112c919ffecd618e81a1defcc3b909ae6d5a70645c573eed26ce63272e6006d3"
+        "definition_digest": "sha256:39e550f9a2cb149b0d2863b260e784f45d070307c43c42b2cb6cee8ce10c137c"
       }
     }
   ]
diff --git a/release/security/scheduling-advisory-baseline.json b/release/security/scheduling-advisory-baseline.json
new file mode 100644
index 000000000..467fce710
--- /dev/null
+++ b/release/security/scheduling-advisory-baseline.json
@@ -0,0 +1,246 @@
+{
+  "version": 4,
+  "service": "scheduling",
+  "runtime": {
+    "image": "gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c",
+    "layer_ids": [
+      "sha256:50abe06dfc0957e14cb8332ed242e8b884ef2563a9eb202e5172f243f62792f7",
+      "sha256:621c35e751a51a9a9dc3e80aa0b7fe8be2a93402ea6ccd307d30852cd7776cda",
+      "sha256:c8b007d0206e4b10ed4d3b3d99dfeab47c2648e82011989fd78a5731baf33fc3",
+      "sha256:bec7e6bb35e05d1284f28b10d2150c259717d91c658c4c10c08424bb9466caba",
+      "sha256:275a30dd8ce958b21daa9ad962c6fbc09f98306ee2f486b65c9075dc257b1412",
+      "sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368",
+      "sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc",
+      "sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4",
+      "sha256:bd3cdfae1d3fdd83a2231d608969b38b82349777c2fff9a7c12d54f8ac5c9b38",
+      "sha256:4cde6b0bb6f50a5f255eef7b2a42162c661cf776b803225dcac9a659e396bb6b",
+      "sha256:ad51d0769d16ba578106a177987dfe3d2e02c1668c852b795b2f6b024068242a",
+      "sha256:187cfc6d1e3e8a40a5e64653bcd3239c140807dcf1c09e48021178705a5a6139",
+      "sha256:f2392a9484bf6b18f06beaf705b994e31dbb2716c99cf7d03c9c495cd107f364",
+      "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e",
+      "sha256:ada8421c741188c83c2e6de96450043e65ce6233e7d2a1d84cd789a0ad97f420",
+      "sha256:c0e409312adc366898967307565f692bb33d43a439d3de48e27d14b742389725",
+      "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
+      "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c",
+      "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a",
+      "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43",
+      "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614"
+    ],
+    "application_layer_ids": [
+      "sha256:8353c69184dcf0e3edb575df9eacb53343c651d78b3dbbc30efaefdd1c1cdd3c",
+      "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
+    ],
+    "config": {
+      "user": "65532",
+      "entrypoint": [
+        "/usr/local/bin/scheduling"
+      ],
+      "command": [
+        "--runtime-config",
+        "/etc/registry-scheduling/runtime.yaml",
+        "serve"
+      ],
+      "working_dir": "/var/lib/registry-scheduling",
+      "environment": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"
+      ],
+      "healthcheck": null,
+      "args_escaped": true,
+      "exposed_ports": [
+        "8105/tcp"
+      ],
+      "stop_signal": ""
+    },
+    "definition_digest": "sha256:fb6df3af0cec28a46e2f05b77314cccacbf2c23b6f1e5e6e4eb433e2e0736a5c"
+  },
+  "policies": [
+    {
+      "tool": "zizmor",
+      "minimum_severity": "high",
+      "action": "block_unreviewed"
+    },
+    {
+      "tool": "grype",
+      "minimum_severity": "high",
+      "action": "block_unreviewed",
+      "block_fixable": true
+    }
+  ],
+  "exceptions": [
+    {
+      "vulnerability_id": "CVE-2026-5435",
+      "package": "libc6",
+      "installed_version": "2.41-12+deb13u4",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_base_changed",
+        "runtime_config_changed"
+      ],
+      "runtime_definition_digest": "sha256:fb6df3af0cec28a46e2f05b77314cccacbf2c23b6f1e5e6e4eb433e2e0736a5c",
+      "component_layer_id": "sha256:8353c69184dcf0e3edb575df9eacb53343c651d78b3dbbc30efaefdd1c1cdd3c",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The reviewed v0.33.0 Linux AMD64 Scheduling local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable imports none of the deprecated resolver-printing interfaces, including ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr and fp_nquery. The exposure report has no review-required dynamic lookup. Ordinary resolver initialization does not enter the vulnerable TSIG diagnostic-printing path. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still records this Trixie version as vulnerable and fixes only forky and sid.",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:74f49c852500729542a73b6e057fe201f13b9f0aae5f51ba775e72a2f4903331",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:fb6df3af0cec28a46e2f05b77314cccacbf2c23b6f1e5e6e4eb433e2e0736a5c",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/scheduling",
+            "sha256": "sha256:16cd6ac6345d92f61d9f9f31671c37aaf93748a8438d8f0e47d34f54575311cd"
+          }
+        ],
+        "definition_digest": "sha256:314e66a3557d845286963ce50e8fd709cf1ef5607ba989fe530e12515d8e12c7"
+      }
+    },
+    {
+      "vulnerability_id": "CVE-2026-19499",
+      "package": "libc6",
+      "installed_version": "2.41-12+deb13u4",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_base_changed",
+        "runtime_config_changed"
+      ],
+      "runtime_definition_digest": "sha256:fb6df3af0cec28a46e2f05b77314cccacbf2c23b6f1e5e6e4eb433e2e0736a5c",
+      "component_layer_id": "sha256:8353c69184dcf0e3edb575df9eacb53343c651d78b3dbbc30efaefdd1c1cdd3c",
+      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix; Grype reports wont-fix. The reviewed v0.33.0 Linux AMD64 Scheduling local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither imports nor contains strfmon or strfmon_l. The exposure report has no review-required dynamic lookup. No caller-controlled right-justified monetary-format width path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian fixes the issue only in forky and sid.",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:74f49c852500729542a73b6e057fe201f13b9f0aae5f51ba775e72a2f4903331",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:fb6df3af0cec28a46e2f05b77314cccacbf2c23b6f1e5e6e4eb433e2e0736a5c",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/scheduling",
+            "sha256": "sha256:16cd6ac6345d92f61d9f9f31671c37aaf93748a8438d8f0e47d34f54575311cd"
+          }
+        ],
+        "definition_digest": "sha256:314e66a3557d845286963ce50e8fd709cf1ef5607ba989fe530e12515d8e12c7"
+      }
+    },
+    {
+      "vulnerability_id": "CVE-2026-85091",
+      "package": "zlib1g",
+      "installed_version": "1:1.3.dfsg+really1.3.1-1+b1",
+      "severity": "High",
+      "status": "accepted_risk",
+      "owner": "@jeremi",
+      "reviewed_at": "2026-09-22",
+      "expires_at": "2026-10-06",
+      "invalidation_triggers": [
+        "candidate_image_identity_mismatch",
+        "candidate_rootfs_changed",
+        "component_layer_changed",
+        "expired",
+        "exposure_assertion_changed",
+        "exposure_assertion_false",
+        "exposure_assertion_unevaluable",
+        "fix_available",
+        "material_finding_changed",
+        "package_version_changed",
+        "rootfs_evidence_mismatch",
+        "runtime_base_changed",
+        "runtime_config_changed"
+      ],
+      "runtime_definition_digest": "sha256:fb6df3af0cec28a46e2f05b77314cccacbf2c23b6f1e5e6e4eb433e2e0736a5c",
+      "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
+      "rationale": "Debian Trixie has no fixed package and Grype reports no fix. The reviewed v0.33.0 Linux AMD64 Scheduling local reproduction is exact rehearsal run 35711552030 at source 6a460c2cf66bc9d286cbe4a5454571c392488c05. Its executable neither links libz nor contains libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. The exposure report has no review-required dynamic lookup. No vulnerable stalled gzip-write followed by formatted-output path was identified. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound reviewed executable, loader, libc, libm and libpthread file digests. Reviewed on 2026-09-22; Debian still lists no fixed zlib package for Trixie.",
+      "exposure_assertion": {
+        "kind": "whole_image_fingerprint_equals",
+        "reference_image_digest": "sha256:74f49c852500729542a73b6e057fe201f13b9f0aae5f51ba775e72a2f4903331",
+        "reference_source_revision": "6a460c2cf66bc9d286cbe4a5454571c392488c05",
+        "reference_provenance": "local_reproduction",
+        "runtime_definition_digest": "sha256:fb6df3af0cec28a46e2f05b77314cccacbf2c23b6f1e5e6e4eb433e2e0736a5c",
+        "files": [
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
+            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
+            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
+          },
+          {
+            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
+            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
+          },
+          {
+            "path": "/usr/local/bin/scheduling",
+            "sha256": "sha256:16cd6ac6345d92f61d9f9f31671c37aaf93748a8438d8f0e47d34f54575311cd"
+          }
+        ],
+        "definition_digest": "sha256:314e66a3557d845286963ce50e8fd709cf1ef5607ba989fe530e12515d8e12c7"
+      }
+    }
+  ]
+}