Scans survive a real catalog
gstack: a qualified scanner catalog no longer breaks every /cso scan
REDACTION_FAILEDan 11-digit Actions run id read as a phone number
Scan completesrun ids kept as catalog metadata, redacted anywhere else
In gstack, a /cso scan against a qualified scanner catalog no longer fails. The redactor took an eleven-digit Actions run ID for a phone number and stopped every scan. The same digits anywhere else are still redacted.
Rails fits the signing limit
The Rails runtime image now fits under the signing limit
Rails bill of materials, against a 16 MiB attestation cap
The Rails runtime's software bill of materials listed about twenty thousand files, too big to sign. Release workflows now sign a package-level list under a megabyte, so the first staging run on main can finish.
Qualification checks its own evidence
A /cso runtime has to earn its qualification
Runtimes for Node, Bun, Python and Rails are now graded on two architectures. A producer sees only an opaque cell ID, so it can't learn its answer key, and skipped Docker tests no longer count as passes.
Audits unchanged for now
Your /cso audit stays the same until a qualified runtime catalog merges
CHANGELOG.mdFull notes for 1.91.25.0 and 1.91.27.0None of this changes a /cso audit yet. That waits until a qualified runtime catalog merges into gstack. The full notes for both releases are in the project's changelog.
