Record Core scan outcome and selected 1.13.1 upgrade #13

Merged

gitchegumi merged 2 commits from kiyi/core-1-13-status into main

2026-09-26 17:20:17 -05:00

kiyi commented

2026-09-26 16:49:15 -05:00

Member

Changes

Update the dated Core maintenance record following owner-provided run 4439 and selection of 1.13.1-unicorn with CLI 0.38.0.

Record verified hosted source/OIDC/KV/build/archive matching and GitchAuth evidence success.
Record 765 blocking finding occurrences in the previous upstream Core/init scan, zero scanner errors, and skipped signing/publication/deployment.
Distinguish the prepared Unicorn/identity-config 0.32.0 candidate from the recorded installed Core 1.11.1. The owner confirmed private package access. Exact archived-image scanning and mitigation preparation are source changes; a clean hosted scan and live acceptance remain pending.
Preserve init, private secret boundaries and the active scan gate. Detailed source/export triage and proposed mitigation entries stay in private platform PR #67; no new active exception is claimed here.

Public diff contains no secret values or private implementation links. Sources: owner direction, supplied registry exports, private Homelab/platform run 4439, issue #47 and PR #67.

Validation

npm run check passed (types, links, deployment guards).
npm run build passed.
Public diff review and git diff --check passed.

Commits: db86cdfe64 and eb4ee24. Implementation: Homelab/platform#67.

## Changes Update the dated Core maintenance record following owner-provided run 4439 and selection of **1.13.1-unicorn with CLI 0.38.0**. - Record verified hosted source/OIDC/KV/build/archive matching and GitchAuth evidence success. - Record 765 blocking finding occurrences in the previous upstream Core/init scan, zero scanner errors, and skipped signing/publication/deployment. - Distinguish the prepared Unicorn/identity-config 0.32.0 candidate from the recorded installed Core 1.11.1. The owner confirmed private package access. Exact archived-image scanning and mitigation preparation are source changes; a clean hosted scan and live acceptance remain pending. - Preserve init, private secret boundaries and the active scan gate. Detailed source/export triage and proposed mitigation entries stay in private platform PR #67; no new active exception is claimed here. Public diff contains no secret values or private implementation links. Sources: owner direction, supplied registry exports, private Homelab/platform run 4439, issue #47 and PR #67. ## Validation - npm run check passed (types, links, deployment guards). - npm run build passed. - Public diff review and git diff --check passed. Commits: db86cdfe64f08e2d4ed5a91a29db971317a42462 and eb4ee24. Implementation: https://git.gitchegumi.com/Homelab/platform/pulls/67.

kiyi added 1 commit

2026-09-26 16:49:15 -05:00

docs: record Core scan result and selected 1.13.1 upgrade

Source security / security (pull_request) Successful in 2m19s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

Documentation site checks / validate (pull_request) Successful in 2m42s

Details

db86cdfe64

kiyi added 1 commit

2026-09-26 17:12:56 -05:00