Resource Scheduler 0.8.19

Official dependency-only security refresh; scheduler algorithms, APIs, event/metadata contracts, and health behavior are unchanged.

• Go 1.27.2 and the fixed Canonical 20261020T000000Z snapshot, plus official security module updates for the disposable Docker CLI/Buildx builder.
• Signed source/tag: d1720ddb65a285ed615f1461ccb44e50c2ad67a7 / v0.8.19.
• Published runtime manifest: sha256:46dfecc72fc1fceab5c66f881f46449874b6a084a208f59c6ef1184a0d15c3f9.
• Actual released runtime: 0 HIGH/CRITICAL/UNKNOWN, 0 vendor-fixed findings, and 0 secrets. Its 4 LOW and 47 MEDIUM vendor-unfixed package findings remain under_investigation, not resolved, in the attached risk register and OpenVEX.
• All attached SHA256SUMS assets and image/SBOM GitHub build-provenance attestations were independently verified against the exact source commit, tag, release workflow, and GitHub-hosted runner. The SBOM/scan image ID matches the public registry manifest's config digest.

The native CI evidence separately retains raw disposable-builder findings: 8 CRITICAL and 192 HIGH Linux header source-package matches receive 200 exact-CVE/package/archive/installed-content not_affected statements. Another 2,600 vendor-unfixed package findings remain, including one UNKNOWN module advisory. The actual Buildx compilation graph contains zero golang.org/x/crypto/openpgp packages, but its module advisory remains recorded rather than represented as fixed. Official CNA/Canonical source hashes are preserved in the review ledger. This package-only applicability evidence makes no claim about any host kernel.

Reproducible builds, source/race/vet checks, reachable Go analysis, and isolated packaged-health checks passed (non-root port 80, readiness 200, dependency failure 503, liveness 200, zero restarts). These results do not qualify a managed-system upgrade or rollback.

Catalog version 5 is available in producer commit 71ec6b2; historical versions 1-4 remain unchanged.