[dependabot]

Scope

Updates the runner Debian 13.7 slim base from sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad to sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4.

The source includes accepted main through PR #165 by an ordinary merge without rewriting branch history. Against that base, only runner/Dockerfile and docs/MANAGED-IMAGES.md change. The complete two-file patch is byte-identical to the previously reviewed patch. The Dockerfile changes only its base digest. Controller inputs, Debian snapshot, runner/tool versions, workflows, validators, executor, tests, capabilities and template files match the base exactly.

Exact candidate

• Source: d6dfbefde6956f7ea67515dab964c6ed02357823
• Base: c51844cf05f7a9f647322f4b7cbbb6379f40ad5d
• Tree: 329612424c40b6fc4b2a0736291d982eccb463fb
• Two-file patch SHA256: 062ca0a91376887e4bf477285609571fc63ffbeefad64d3daec545b67ab84266

Verification

The official Docker Hub index, Linux amd64/arm64 manifests and config bytes matched their referenced SHA256 digests. Selected configs were created on 2026-10-27, replacing configs created on 2026-10-20. This reuses the existing owner verification for the same immutable selection. Registry metadata does not establish package compatibility, a specific CVE fix or a successful build. No latest-image claim is made, and layer bytes were not verified by that metadata check.

Fresh focused checks passed on the reconciled exact candidate: all 46 Markdown files have valid local links; proposed commit and PR-title policy, merge-message policy, proposed committed-tree secret scanning, whitespace, base ancestry and two-file scope assertions passed.

Direct independent review approved the reconciled source/base/tree above with no findings on 2026-11-07 at 03:53:20 UTC. The durable exact-source/base binding receipt has SHA256 b0b1407b73448dac50c26a25fe962481fe3d505a9d29c6e1d7b73c0fafcd8a98. It independently checked actual Git objects, all 233 tracked entries, byte-identical patch preservation, inherited PR165 changes and affected callers. It reuses the earlier technical review of source 42487bd5bc981e91d738f5de33441dcf71ace6b1 against base 4c30089f2476e4cb7d8a8659845bd76d0dd714b7, whose frozen receipt has SHA256 9f0a155b399bd0032523b5be7f1f955df54e3252abbf3fccbaee51f6de489e7a. No new registry request, behavior-suite rerun, review panel or bot request was used. These are technical source-review records, not submitted human GitHub approvals or native acceptance.

Complete exact-source/base native validation passed in run 42337158684, attempt 1, including the required Build without registering a runner job and all eight full-suite stages with no expected skips. The admitted policy merge was c8d391d1428b28fff901dadca476100dade7d8bd. All 22 executor controls passed. This is PR160's own normal Actions result, not an inherited PR165 or app check. No required protection or validation coverage changed.

The official nine-file artifact was independently verified against GitHub's archive digest and all stage/log bindings. The 12-member worker audit export and the complete 66-file terminal evidence manifest were verified. Scoped temporary credential, grant and JIT cleanup, baseline executor restoration and final role/idle admission passed. The closed receipt SHA256 is da308ec673e7b4469b27cb016afc4d460eccc3b21e8295f5c0b8d42e1cf43714; terminal manifest SHA256 is 7497549996dcdb425a449be9c5a9ec36fe6dc6ef3847c3139dc771b93b2fa454.

Worker/official result-byte equality was unavailable after normal runner-temp cleanup and is not claimed; the official archive was independently verified. Two uncertain-ownership or unexpired volume reports were retained without removal. No global prune, protected-resource removal or retention-policy change occurred.

Documentation and rollout

docs/MANAGED-IMAGES.md records the selected runner digest and verified platform metadata, preserves the historical runner review, and leaves the controller selection unchanged.

No standalone configuration-template change is needed. This digest refresh changes no schema, desired state, initializer, validation contract, capability evidence, example, setup or operator contract. PR165's separate template follow-up is unaffected. There is no visual interface change, so screenshots do not apply.

The existing coordinator completed PR160's isolated native transaction and released the operator gate for a fresh normal protected merge. The worker remains coordinator-reserved for queued validation; VM disposal is not authorized. Image publication, private engine/image pin promotion, host activation and deployment remain separately authorized operations.

Native acceptance used the unchanged required workflow on two guarded one-job isolated runners for exact source d6dfbef and base c51844c under full-send authority. Temporary producer settings were restored after assignment; final observation confirmed the workflow disabled, temporary variables absent and registrations zero. Export, scoped cleanup and final admission completed before the normal merge procedure.

🤖 Generated with Claude Code

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that automated-review signal was skipped. The remaining evidence is a pinned runner Debian digest update with matching managed-image review notes and does not require human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}