Repository navigation
Fix Catalog launch request wire and register unfixed builder findings - #15
Merged
chen21019 merged 1 commit intoNov 1, 2026
Merged
Conversation
chen21019
deleted the
verification/compose-cli-0.14.41-qualified-20261102
branch
November 1, 2026 17:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Catalog launch preview serialized the generated SDK Resource envelope into Service and Volume mutation inputs, and omitted an empty
serviceLinkslist. The Engine correctly rejected that wire payload before native child validation, preventing a normal Catalog launch.The private preview producer now emits business request fields and an explicit
serviceLinks: []. Its typed projection excludes only an anonymously embedded SDK Resource envelope; labels, environment, metadata, log options and ordinary SDK serialization retain their values. Parser, conversion, sidekick and native link owners remain unchanged. The component version advances to 0.14.41; release and security gates retain their existing checks.Validation: nine focused Catalog tests, a real local binary inspect/finalize round trip, and strict Engine graph/native schema preflight checks. The local binary is a test fixture; publication must use the successful original CI artifact. Runtime Catalog launch and permission/weak-model acceptance will run on QA 8080 with the matching Engine and Server. No production changes.
The builder scan also identified 99 additional Medium linux-libc-dev findings without an official fix. Each is registered against exact package/PURL, pinned Canonical evidence, scan digests and a review date. Existing policy thresholds, header whitelist, VEX and product dependencies are unchanged. The 22 directly affected policy cases pass, including rejection of a newly available fix or severity/identity drift.