Node Agent v0.13.30

Node Agent 0.13.30 updates the official compiler to checksum-pinned Go 1.27.3 for the Linux amd64 binary and Windows amd64 cross-build. It preserves the dependency graph and business behavior, and binds the existing strict Linux Host API version guard to official Host API 0.38.6 without relaxing equality or enabling fallback.

Only actual blocking official Ubuntu fixes were applied: curl 8.18.0-1ubuntu2.8, OpenSSL 3.5.5-1ubuntu3.7, and builder-only linux-libc-dev 7.0.0-38.38. Signed snapshot/TLS settings and security thresholds remain unchanged. The existing builder-only no-kernel-code policy covers the exact 295 currently unfixed header findings; all fixable High/Critical findings and all applicable High/Critical/secret findings are zero. No new waiver or runtime exception was added.

These assets are the original, unchanged packages retained by Security release gate run 39680289223 (package artifact 12383831714; security evidence 12383776725). They were not locally rebuilt or substituted with a different workflow's archives. Both binaries record Go 1.27.3, exact producer revision, and vcs.modified=false.

Actual binary/archive producer: 246df59
Producer tree: 195696a464277991ea30abdf1b12ec3046ffc2f4
Verified signed integration main: 73e3a7c (PR #14; identical tree)

The original complete CI, Linux binary reproducibility, runtime --version smoke, source/product-rootfs/runtime/builder security gates, and required plus extended CodeQL checks passed. Validate run 39680289287 remains separate evidence and is not the asset source.

Windows qualification is cross-build, package and PE/Go metadata verification only; this release does not establish new Windows native acceptance, stream delegation, or durable terminal evidence support. No Server deployment or QA acceptance is claimed.

Verify the attached SHA256SUMS before use. Component publication and Server assembly/deployment remain separate evidence boundaries.