From 98efcef2c019898f483f95a2901e50006be825c4 Mon Sep 17 00:00:00 2001
From: Louis Parkin <louis.parkin@suse.com>
Date: Wed, 5 Aug 2026 14:56:24 +0200
Subject: [PATCH 1/3] STAC-25457: publish and sign the agent and cluster-agent
 images

Ports the publishing half of pre_release_main_agent_image and
pre_release_cluster_agent_image, plus merge_docker_manifest_main_agent
and merge_docker_manifest_cluster_agent, from GitLab to GitHub Actions.
PR #446 landed the build-and-verify halves; this adds the push.

Each image gets a per-arch publish job that needs: the existing image
build job, and a manifest-merge job that assembles the multi-arch tag
from the two single-arch ones. Gated on `github.event_name == 'push'`
alone: the workflow's push filter only carries the release branch, so
the event check is the whole gate, and a workflow_dispatch on an
arbitrary branch cannot publish. This is the same reasoning the
cerberus-notify gate already uses.

Uses the StackVista/image-pipeline composite actions rather than an
open-coded docker push, matching stackstate-process-agent and the
STAC-24837 direction for product repos. Over publish_image.sh that adds
cosign signatures in both v2 and v3 bundle formats, SBOM and max-mode
provenance attestations, canonical SUSE Observability OCI labels, an
entrypoint ELF-architecture check that catches arch-mismatched images
before they are signed, and refusal to overwrite an existing tag.
Neither Dockerfile declares `ARG BASE_IMAGE`, so base-name is passed
explicitly; both final stages are registry.suse.com/bci/bci-micro.

Tag is the 8-character short SHA, matching GitLab's CI_COMMIT_SHORT_SHA.
The `<branch>-<arch>` tag publish_image.sh also pushed is deliberately
dropped: helm-charts-internal pins the agent and cluster-agent images to
an 8-character SHA (currently 9516cb41, the stackstate-7.78.2 HEAD), and
beest receives the tag as AGENT_HASH_UNDER_TEST, so nothing consumes a
branch-name tag. An org-wide code search for
stackstate-k8s-agent:master, :stackstate-7*, :$CI_COMMIT_REF_SLUG and
the cluster-agent equivalents returns no hits, verified against a
positive control so an empty result is not a false negative.

Both publish jobs need id-token: write for keyless cosign signing, and
are added to each workflow's cerberus-notify needs list so a failed
publish on the release branch still reaches Slack.

Requires STAC-25541 (terraform-infra #75): the stackstate+agent robot
behind QUAY_USER has no write grant on stackstate-k8s-agent or
stackstate-k8s-cluster-agent, since GitLab publishes them with the
legacy gitlabci robot instead. Without it these jobs fail exactly as
process-agent did in STAC-25510.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/build-binaries.yml | 105 +++++++++++++++++++++++++
 .github/workflows/build-deb.yml      | 112 +++++++++++++++++++++++++++
 2 files changed, 217 insertions(+)

diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 377d6fc2aab..b40b40e8de1 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -239,6 +239,109 @@ jobs:
             --entrypoint /opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent \
             "${LOCAL_IMAGE}" version
 
+  publish-cluster-agent-image:
+    name: Publish and sign cluster-agent image (${{ matrix.arch }})
+    if: github.event_name == 'push'
+    needs: build-cluster-agent-image
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: docker-public
+          - arch: arm64
+            runner: arm64-xlarge-public
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      IMAGE: quay.io/stackstate/stackstate-k8s-cluster-agent
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download cluster-agent binary
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: cluster-agent-binary-${{ matrix.arch }}
+
+      - name: Stage the cluster-agent binary in the image build context
+        run: |
+          set -eo pipefail
+          chmod +x bin/stackstate-cluster-agent/stackstate-cluster-agent
+          cp -r bin/stackstate-cluster-agent Dockerfiles/cluster-agent/
+
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Resolve canonical OCI labels
+        id: oci
+        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image-name: stackstate-k8s-cluster-agent
+          tag: ${{ steps.image.outputs.tag }}
+          title: SUSE Observability Cluster Agent
+          description: Cluster-level agent collecting Kubernetes topology and cluster checks for SUSE Observability.
+          component: stackstate-k8s-cluster-agent
+          dockerfile: Dockerfiles/cluster-agent/Dockerfile
+          base-name: registry.suse.com/bci/bci-micro:latest
+          registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+
+      - name: Build, publish, and sign architecture image
+        uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.IMAGE }}
+          tag: ${{ steps.image.outputs.tag }}
+          arch: ${{ matrix.arch }}
+          docker-context: Dockerfiles/cluster-agent
+          dockerfile: Dockerfiles/cluster-agent/Dockerfile
+          labels: |
+            ${{ steps.oci.outputs.labels }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          source-registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
+  merge-cluster-agent-manifest:
+    name: Publish and sign multi-architecture cluster-agent image
+    if: github.event_name == 'push'
+    needs: publish-cluster-agent-image
+    runs-on: docker-public
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Merge and sign multi-architecture manifest
+        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: quay.io/stackstate/stackstate-k8s-cluster-agent
+          tag: ${{ steps.image.outputs.tag }}
+          arches: amd64,arm64
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
   cerberus-notify:
     name: Report failure to Slack (Cerberus)
     needs:
@@ -247,6 +350,8 @@ jobs:
       - build-agent
       - build-cluster-agent
       - build-cluster-agent-image
+      - publish-cluster-agent-image
+      - merge-cluster-agent-manifest
     if: >-
       always()
       && github.event_name == 'push'
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 7c4b726c477..9eede0e2409 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -278,6 +278,116 @@ jobs:
           set -eo pipefail
           docker run --rm --entrypoint /opt/stackstate-agent/bin/agent/agent "${LOCAL_IMAGE}" version
 
+  publish-agent-image:
+    name: Publish and sign agent image (${{ matrix.arch }})
+    if: github.event_name == 'push'
+    needs: build-agent-image
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: docker-public
+          - arch: arm64
+            runner: arm64-xlarge-public
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      ARCH: ${{ matrix.arch }}
+      IMAGE: quay.io/stackstate/stackstate-k8s-agent
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download DEB package
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: deb-package-${{ matrix.arch }}
+
+      - name: Stage the DEB in the image build context
+        run: |
+          set -eo pipefail
+          shopt -s nullglob
+          debs=(outcomes/pkg/stackstate-agent_*_"${ARCH}".deb)
+          if [ "${#debs[@]}" -ne 1 ]; then
+            echo "Expected exactly one stackstate-agent_*_${ARCH}.deb, found ${#debs[@]}: ${debs[*]}" >&2
+            exit 1
+          fi
+          cp "${debs[0]}" Dockerfiles/agent/
+
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Resolve canonical OCI labels
+        id: oci
+        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image-name: stackstate-k8s-agent
+          tag: ${{ steps.image.outputs.tag }}
+          title: SUSE Observability Agent
+          description: Node agent collecting metrics, logs, traces and topology for SUSE Observability.
+          component: stackstate-k8s-agent
+          dockerfile: Dockerfiles/agent/Dockerfile
+          base-name: registry.suse.com/bci/bci-micro:latest
+          registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+
+      - name: Build, publish, and sign architecture image
+        uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.IMAGE }}
+          tag: ${{ steps.image.outputs.tag }}
+          arch: ${{ matrix.arch }}
+          docker-context: Dockerfiles/agent
+          dockerfile: Dockerfiles/agent/Dockerfile
+          build-args: ARCH=${{ matrix.arch }}
+          labels: |
+            ${{ steps.oci.outputs.labels }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          source-registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
+  merge-agent-manifest:
+    name: Publish and sign multi-architecture agent image
+    if: github.event_name == 'push'
+    needs: publish-agent-image
+    runs-on: docker-public
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Merge and sign multi-architecture manifest
+        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: quay.io/stackstate/stackstate-k8s-agent
+          tag: ${{ steps.image.outputs.tag }}
+          arches: amd64,arm64
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
   cerberus-notify:
     name: Report failure to Slack (Cerberus)
     needs:
@@ -286,6 +396,8 @@ jobs:
       - build-deb
       - test-deb-renaming
       - build-agent-image
+      - publish-agent-image
+      - merge-agent-manifest
     if: >-
       always()
       && github.event_name == 'push'

From 93709cd220943a802c93b5a40d056dc9482e46ed Mon Sep 17 00:00:00 2001
From: Louis Parkin <louis.parkin@suse.com>
Date: Thu, 6 Aug 2026 16:29:46 +0200
Subject: [PATCH 2/3] STAC-25457 Gate agent image publication on scans, deb
 branding, and proxy BCI bases

Address review feedback on #454.

Gate publication on the image scan: build-agent-image and
build-cluster-agent-image now run image-pipeline's scan-image in `mode: gate`
at the house severity (UNKNOWN..CRITICAL, Grype enabled) directly after the
smoke test. The publish jobs already depend on the build jobs, so a failing
scan now blocks publication instead of only informing. Because
build-agent-image also runs for same-repo pull requests, the gate executes on
this PR's own CI.

Make publication depend on all verification jobs: publish-agent-image now
needs test-deb-renaming as well as build-agent-image, so a .deb that still
carries DataDog branding cannot reach quay.io. test-deb-renaming lives in this
workflow only, so the cluster-agent lane is unaffected.

Pull the BCI bases through the SUSE proxy: both Dockerfiles take
BCI_IMAGE_REGISTRY as a build argument, defaulting to
registry.tooling.stackstate.io/suse/bci. This follows the existing
BASE_IMAGE_REGISTRY convention in the same files, so every build path picks it
up -- the GitHub workflows, the GitLab jobs, and build_images.sh -- without
each caller having to pass a build argument. The apply-oci-labels base-name
input stays on registry.suse.com so the provenance label keeps the upstream
identity that VEX data is keyed on.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/build-binaries.yml | 12 ++++++++++--
 .github/workflows/build-deb.yml      | 16 +++++++++++++---
 Dockerfiles/agent/Dockerfile         |  5 +++--
 Dockerfiles/cluster-agent/Dockerfile |  9 ++++++---
 4 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index b40b40e8de1..1de3a256353 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -209,8 +209,6 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -eo pipefail
-          # Dockerfiles/cluster-agent pulls its ubuntu builder stage through the
-          # proxy; the BCI stages come from registry.suse.com and need no auth.
           printf '%s' "${REGISTRY_PASSWORD}" | docker login -u "${REGISTRY_USER}" --password-stdin "${REGISTRY_HOST}"
 
       - name: Build cluster-agent image
@@ -239,6 +237,16 @@ jobs:
             --entrypoint /opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent \
             "${LOCAL_IMAGE}" version
 
+      - name: Scan cluster-agent image (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets)
+        uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.LOCAL_IMAGE }}
+          mode: gate
+          severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+          with-grype: true
+          upload-sarif: false
+          sarif-category: stackstate-k8s-cluster-agent-${{ matrix.arch }}
+
   publish-cluster-agent-image:
     name: Publish and sign cluster-agent image (${{ matrix.arch }})
     if: github.event_name == 'push'
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 9eede0e2409..9c4014c9ecc 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -255,8 +255,6 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -eo pipefail
-          # Dockerfiles/agent pulls its ubuntu extract stage through the proxy;
-          # the BCI stages come from registry.suse.com and need no auth.
           printf '%s' "${REGISTRY_PASSWORD}" | docker login -u "${REGISTRY_USER}" --password-stdin "${REGISTRY_HOST}"
 
       - name: Build agent image
@@ -278,10 +276,22 @@ jobs:
           set -eo pipefail
           docker run --rm --entrypoint /opt/stackstate-agent/bin/agent/agent "${LOCAL_IMAGE}" version
 
+      - name: Scan agent image (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets)
+        uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.LOCAL_IMAGE }}
+          mode: gate
+          severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+          with-grype: true
+          upload-sarif: false
+          sarif-category: stackstate-k8s-agent-${{ matrix.arch }}
+
   publish-agent-image:
     name: Publish and sign agent image (${{ matrix.arch }})
     if: github.event_name == 'push'
-    needs: build-agent-image
+    needs:
+      - build-agent-image
+      - test-deb-renaming
     strategy:
       fail-fast: false
       matrix:
diff --git a/Dockerfiles/agent/Dockerfile b/Dockerfiles/agent/Dockerfile
index 3e471e23f05..9ccde5ff4bd 100644
--- a/Dockerfiles/agent/Dockerfile
+++ b/Dockerfiles/agent/Dockerfile
@@ -1,5 +1,6 @@
 ARG BASE_IMAGE_REGISTRY=registry.tooling.stackstate.io/docker/library
 ARG BASE_IMAGE_UBUNTU_VERSION=24.04
+ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci
 
 ##########################################
 # Preparation stage: extract and cleanup #
@@ -27,7 +28,7 @@ RUN dpkg -x /stackstate-agent*_${ARCH}.deb . \
 #   - copy default config files
 COPY stackstate*.yaml etc/stackstate-agent/
 
-FROM registry.suse.com/bci/bci-base:latest AS software
+FROM ${BCI_IMAGE_REGISTRY}/bci-base:latest AS software
 # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12
 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm
 RUN :
@@ -35,7 +36,7 @@ RUN :
 # Actual docker image construction #
 ####################################
 
-FROM registry.suse.com/bci/bci-micro:latest
+FROM ${BCI_IMAGE_REGISTRY}/bci-micro:latest
 LABEL maintainer="StackState <info@stackstate.com>"
 # Install system packages using builder image that has zypper
 
diff --git a/Dockerfiles/cluster-agent/Dockerfile b/Dockerfiles/cluster-agent/Dockerfile
index bb252b5a996..bc077754202 100644
--- a/Dockerfiles/cluster-agent/Dockerfile
+++ b/Dockerfiles/cluster-agent/Dockerfile
@@ -1,8 +1,11 @@
+ARG BASE_IMAGE_REGISTRY=registry.tooling.stackstate.io/docker/library
+ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci
+
 ########################################
 # Preparation stage: layout and chmods #
 ########################################
 
-FROM registry.tooling.stackstate.io/docker/library/ubuntu:20.04 as builder
+FROM ${BASE_IMAGE_REGISTRY}/ubuntu:20.04 as builder
 
 WORKDIR /output
 
@@ -22,12 +25,12 @@ RUN chmod 755 entrypoint.sh \
 # Actual docker image construction #
 ####################################
 
-FROM registry.suse.com/bci/bci-base:latest AS software
+FROM ${BCI_IMAGE_REGISTRY}/bci-base:latest AS software
 # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12
 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm
 RUN :
 
-FROM registry.suse.com/bci/bci-micro:latest AS final
+FROM ${BCI_IMAGE_REGISTRY}/bci-micro:latest AS final
 LABEL maintainer="StackState <info@stackstate.com>"
 
 ARG user="stackstate-agent"

From 61e2bce26592c0ce03e58253107ad75c906d539a Mon Sep 17 00:00:00 2001
From: Louis Parkin <louis.parkin@suse.com>
Date: Fri, 7 Aug 2026 11:20:43 +0200
Subject: [PATCH 3/3] STAC-25457 Manage the agent image CVE backlog with
 time-limited exceptions

The image scan gate added in this branch surfaced a real backlog: 24 findings
in the agent image (embedded CPython 3.13.13, cryptography 48.0.1, two Go
advisories) and 2 in the cluster-agent image. Secret scanning is clean on both.

Keep the gate at mode: gate and declare every finding explicitly instead of
weakening the severity filter, so nothing new can slip in unnoticed. Each
exception carries a <=14-day expiry per the CVE remediation SLA, so the gate
starts failing again if the underlying bumps stall.

The omnibus runtime bumps (CPython 3.13.14, cryptography) are tracked in
STAC-25556; they are software-definition changes, not workflow changes.

LOCAL_IMAGE is renamed to the quay path the publish jobs already use because
the evaluator keys exceptions on the normalised image name, which strips only
the tag or digest and not the registry or namespace.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/build-binaries.yml          |  3 ++-
 .github/workflows/build-deb.yml               |  3 ++-
 .../stackstate-k8s-agent/CVE-2025-15366.yaml  | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2025-15367.yaml  | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-0864.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-11940.yaml  | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-11972.yaml  | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-12003.yaml  | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-1502.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-15308.yaml  | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-3276.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-3298.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-4360.yaml   | 22 +++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-4786.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-6019.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-6100.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-6879.yaml   | 22 +++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-69247.yaml  | 24 +++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-69248.yaml  | 22 +++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-69249.yaml  | 24 +++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-7210.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-7774.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-8328.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/CVE-2026-9669.yaml   | 26 ++++++++++++++++++
 .../stackstate-k8s-agent/GO-2026-5841.yaml    | 24 +++++++++++++++++
 .../stackstate-k8s-agent/GO-2026-5932.yaml    | 27 +++++++++++++++++++
 .../GO-2026-5841.yaml                         | 23 ++++++++++++++++
 .../GO-2026-5932.yaml                         | 26 ++++++++++++++++++
 28 files changed, 660 insertions(+), 2 deletions(-)
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-3276.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-3298.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-4786.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-6019.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-6100.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-7210.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-7774.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-8328.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-9669.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/GO-2026-5841.yaml
 create mode 100644 exceptions/stackstate-k8s-agent/GO-2026-5932.yaml
 create mode 100644 exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml
 create mode 100644 exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml

diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 1de3a256353..0a890d52c7c 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -190,7 +190,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
     env:
-      LOCAL_IMAGE: stackstate-cluster-agent:ci-${{ matrix.arch }}
+      LOCAL_IMAGE: quay.io/stackstate/stackstate-k8s-cluster-agent:ci-${{ matrix.arch }}
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -244,6 +244,7 @@ jobs:
           mode: gate
           severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
           with-grype: true
+          exceptions-path: exceptions
           upload-sarif: false
           sarif-category: stackstate-k8s-cluster-agent-${{ matrix.arch }}
 
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 9c4014c9ecc..ced8a545214 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -236,7 +236,7 @@ jobs:
     timeout-minutes: 60
     env:
       ARCH: ${{ matrix.arch }}
-      LOCAL_IMAGE: stackstate-agent:ci-${{ matrix.arch }}
+      LOCAL_IMAGE: quay.io/stackstate/stackstate-k8s-agent:ci-${{ matrix.arch }}
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -283,6 +283,7 @@ jobs:
           mode: gate
           severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
           with-grype: true
+          exceptions-path: exceptions
           upload-sarif: false
           sarif-category: stackstate-k8s-agent-${{ matrix.arch }}
 
diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml
new file mode 100644
index 00000000000..4784c149340
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2025-15366
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15366
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0a6, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml
new file mode 100644
index 00000000000..f9be944281b
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2025-15367
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15367
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0a6, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml
new file mode 100644
index 00000000000..5080525c552
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-0864
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-0864
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b4, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml
new file mode 100644
index 00000000000..f6d0d59faee
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-11940
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-11940
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b4, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml
new file mode 100644
index 00000000000..44a30b31721
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-11972
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-11972
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b4, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml
new file mode 100644
index 00000000000..7466dfe8720
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-12003
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-12003
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b3, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml
new file mode 100644
index 00000000000..3b82193536e
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-1502
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-1502
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml
new file mode 100644
index 00000000000..690ecbdd9cd
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-15308
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-15308
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-3276.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-3276.yaml
new file mode 100644
index 00000000000..a7158e95bec
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-3276.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-3276
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-3276
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-3298.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-3298.yaml
new file mode 100644
index 00000000000..0c8a6030662
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-3298.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-3298
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-3298
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml
new file mode 100644
index 00000000000..0079db8231f
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml
@@ -0,0 +1,22 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-4360
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_published
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-4360
+statement: |
+  Upstream has published no fixed CPython version for this CVE in any release
+  line, so no patch exists to apply. The date below is a short review
+  deadline, not an acceptance -- re-check upstream before renewing. Tracked
+  with the rest of the embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-4786.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-4786.yaml
new file mode 100644
index 00000000000..ee7701d888c
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-4786.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-4786
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-4786
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-6019.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-6019.yaml
new file mode 100644
index 00000000000..65a1f878a5f
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-6019.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-6019
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-6019
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-6100.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-6100.yaml
new file mode 100644
index 00000000000..2cdcd61a3fb
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-6100.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-6100
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-6100
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml
new file mode 100644
index 00000000000..5abe5fd4c54
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml
@@ -0,0 +1,22 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-6879
+  severity: LOW
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_published
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-6879
+statement: |
+  Upstream has published no fixed CPython version for this CVE in any release
+  line, so no patch exists to apply. The date below is a short review
+  deadline, not an acceptance -- re-check upstream before renewing. Tracked
+  with the rest of the embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml
new file mode 100644
index 00000000000..65fedbbae7a
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml
@@ -0,0 +1,24 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-69247
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:pypi/cryptography@48.0.1
+  paths:
+  - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: pyca
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69247
+statement: |
+  cryptography 50.0.0 fixes this, so a compatible patch exists and the
+  finding is inside the 14-day remediation window rather than being accepted.
+  The package is installed into the omnibus-embedded Python environment, so
+  the fix is a requirements bump in the omnibus build, tracked in STAC-25556.
+  Do not renew this exception without re-checking whether the bump has
+  landed.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml
new file mode 100644
index 00000000000..6f7d66fa127
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml
@@ -0,0 +1,22 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-69248
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:pypi/cryptography@48.0.1
+  paths:
+  - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_published
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: pyca
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69248
+statement: |
+  Trivy reports no fixed version for this CVE, so there is no patch to apply.
+  It will most likely be resolved incidentally by the cryptography bump that
+  clears CVE-2026-69247 and CVE-2026-69249; until then the date below is a
+  short review deadline, not an acceptance. Tracked in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml
new file mode 100644
index 00000000000..4ca636daae4
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml
@@ -0,0 +1,24 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-69249
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:pypi/cryptography@48.0.1
+  paths:
+  - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: pyca
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69249
+statement: |
+  cryptography 49.0.0 fixes this, so a compatible patch exists and the
+  finding is inside the 14-day remediation window rather than being accepted.
+  The package is installed into the omnibus-embedded Python environment, so
+  the fix is a requirements bump in the omnibus build, tracked in STAC-25556.
+  Do not renew this exception without re-checking whether the bump has
+  landed.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-7210.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-7210.yaml
new file mode 100644
index 00000000000..f4ae0c862df
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-7210.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-7210
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-7210
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-7774.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-7774.yaml
new file mode 100644
index 00000000000..4c19ae72e01
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-7774.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-7774
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-7774
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-8328.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-8328.yaml
new file mode 100644
index 00000000000..bf55aa30b62
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-8328.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-8328
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-8328
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-9669.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-9669.yaml
new file mode 100644
index 00000000000..592349d0a3a
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-9669.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-9669
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-9669
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml
new file mode 100644
index 00000000000..71c2ab63538
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml
@@ -0,0 +1,24 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5841
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:golang/github.com/klauspost/compress@v1.18.5
+  paths:
+  - opt/stackstate-agent/bin/agent/agent
+  - opt/stackstate-agent/bin/installer/installer
+status: under_investigation
+reason: transitive_dependency_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: klauspost
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5841
+statement: |
+  github.com/klauspost/compress v1.18.7 fixes this, so a compatible patch
+  exists and the finding is inside the 14-day remediation window. It reaches
+  the binary transitively through the upstream Datadog agent dependency
+  graph, so the bump has to go through a go.mod update rather than a direct
+  version pin. Tracked in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml
new file mode 100644
index 00000000000..b10a861cd1f
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml
@@ -0,0 +1,27 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5932
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:golang/golang.org/x/crypto@v0.53.0
+  paths:
+  - opt/stackstate-agent/bin/agent/agent
+  - opt/stackstate-agent/bin/installer/installer
+status: accepted_with_compensating_control
+reason: unpublished_image_vex_identity_bridge
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: golang
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
+statement: |
+  The affected openpgp and openpgp/clearsign packages are absent from this
+  binary's command dependency graph. StackVista/vexhub carries the reviewed
+  image-scoped not_affected statement, but Grype and Trivy match VEX products
+  by exact image digest or tag, and this gate scans a freshly built commit
+  image whose identity cannot exist in the VEX hub in advance. The same
+  bridge is already in place for stackstate-process-agent. Keep it only until
+  the scan pipeline can apply reviewed statements to unpublished images
+  without broadening them to every consumer of golang.org/x/crypto.
diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml
new file mode 100644
index 00000000000..aa78469d9b5
--- /dev/null
+++ b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml
@@ -0,0 +1,23 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5841
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-cluster-agent
+  image: quay.io/stackstate/stackstate-k8s-cluster-agent
+component:
+  purl: pkg:golang/github.com/klauspost/compress@v1.18.5
+  paths:
+  - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent
+status: under_investigation
+reason: transitive_dependency_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: klauspost
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5841
+statement: |
+  github.com/klauspost/compress v1.18.7 fixes this, so a compatible patch
+  exists and the finding is inside the 14-day remediation window. It reaches
+  the binary transitively through the upstream Datadog agent dependency
+  graph, so the bump has to go through a go.mod update rather than a direct
+  version pin. Tracked in STAC-25556.
diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml
new file mode 100644
index 00000000000..6025ad99e3d
--- /dev/null
+++ b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5932
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-cluster-agent
+  image: quay.io/stackstate/stackstate-k8s-cluster-agent
+component:
+  purl: pkg:golang/golang.org/x/crypto@v0.53.0
+  paths:
+  - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent
+status: accepted_with_compensating_control
+reason: unpublished_image_vex_identity_bridge
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: golang
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
+statement: |
+  The affected openpgp and openpgp/clearsign packages are absent from this
+  binary's command dependency graph. StackVista/vexhub carries the reviewed
+  image-scoped not_affected statement, but Grype and Trivy match VEX products
+  by exact image digest or tag, and this gate scans a freshly built commit
+  image whose identity cannot exist in the VEX hub in advance. The same
+  bridge is already in place for stackstate-process-agent. Keep it only until
+  the scan pipeline can apply reviewed statements to unpublished images
+  without broadening them to every consumer of golang.org/x/crypto.