Upgrade components and bump ESF to 0.6.1

.github/workflows/ci.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Confirm toolchain
         run: test "$(go env GOVERSION)" = "go1.27.1"
       - name: Scan source for secrets
-        run: go run github.com/zricethezav/gitleaks/v8@v8.24.2 dir --redact --no-banner .
+        run: go run github.com/zricethezav/gitleaks/v8@v8.30.1 dir --redact --no-banner .
       - name: Install frontend dependencies
         working-directory: internal/controlplane/web
         run: npm ci

.github/workflows/images.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       image_tag:
-        description: Candidate or RC tag matching inventory, such as v0.6.0-rc.1
+        description: Candidate or RC tag matching inventory, such as v0.6.1-rc.1
         required: true
         type: string
       publish:
@@ -55,20 +55,20 @@ jobs:
           python3 scripts/verify-release-inventory.py
       - name: Log in to GHCR
         if: inputs.publish
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Enable buildx
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
         with:
           platforms: arm64
       - name: Create image builder
         run: docker buildx create --use
       - name: Build candidate image
         id: push
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ${{ matrix.file }}
@@ -93,7 +93,7 @@ jobs:
         with:
           subject-path: ${{ matrix.component }}-image.oci.tar
       - name: Generate linux/amd64 image SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         env:
           SYFT_PLATFORM: linux/amd64
         with:
@@ -118,7 +118,7 @@ jobs:
           sbom-path: image-sbom-linux-amd64.cdx.json
       - name: Generate linux/arm64 image SBOM
         if: matrix.component != 'cube-template'
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         env:
           SYFT_PLATFORM: linux/arm64
         with:

.github/workflows/issue-triage.yml

@@ -42,7 +42,7 @@ jobs:
           fi
       - name: Prepare issue prompt
         id: prepare
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           REQUESTED_ISSUE: ${{ inputs.issue_number }}
         with:
@@ -57,7 +57,7 @@ jobs:
             core.setOutput('issue_number', number);
       - name: Classify with Codex Luna
         id: codex
-        uses: openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1
+        uses: openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675 # v1
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           model: gpt-6-luna
@@ -80,7 +80,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Validate and apply label
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ISSUE_NUMBER: ${{ needs.classify.outputs.issue_number }}
           CLASSIFICATION: ${{ needs.classify.outputs.classification }}

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Unpublished candidate version matching inventory, such as v0.6.0-rc.1
+        description: Unpublished candidate version matching inventory, such as v0.6.1-rc.1
         required: true
         type: string
 

.mise.toml

@@ -1,4 +1,4 @@
 [tools]
 go = "1.27.1"
 node = "24.21.0"
-python = "3.14.7"
+python = "3.14.8"

CONTRIBUTING.md

@@ -13,7 +13,7 @@ Install:
 
 - Go 1.27.1
 - Node.js 24.21.0, plus npm
-- Python 3.14.7 and uv 0.11.14 for optional Python checks
+- Python 3.14.8 and uv 0.12.23 for optional Python checks
 - Git
 - `just` for repository shortcuts
 - the agent CLI needed for any real execution checks

Justfile

@@ -5,7 +5,7 @@ frontend:
 
 build: frontend
     mkdir -p bin
-    go build -ldflags="-X main.version=v0.6.0" -o bin/machinist ./cmd/machinist
+    go build -ldflags="-X main.version=v0.6.1" -o bin/machinist ./cmd/machinist
 
 # Start the local control plane.
 control-plane: build

Makefile

@@ -10,8 +10,8 @@ SHELL := /bin/bash
 
 GO ?= go
 UV ?= uv
-PYTHON_VERSION ?= 3.14.7
-ESF_VERSION ?= 0.6.0
+PYTHON_VERSION ?= 3.14.8
+ESF_VERSION ?= 0.6.1
 ESF_COMMIT := $(shell git rev-parse HEAD)
 
 BIN_DIR    := bin
@@ -61,9 +61,9 @@ test-python: ## Run optional Python tool tests against uv.lock
 	fi
 
 .PHONY: test-python-docker
-test-python-docker: ## Test optional Python tools in the pinned 3.14.7 image
+test-python-docker: ## Test optional Python tools in the pinned 3.14.8 image
 	docker build -f deploy/images/Dockerfile.intake --build-arg ESF_COMMIT=$$(git rev-parse HEAD) -t esf/intake:python-tests .
-	docker run --rm --entrypoint /opt/esf/.venv/bin/python esf/intake:python-tests -c 'import sys; assert sys.version_info[:3] == (3, 14, 7)'
+	docker run --rm --entrypoint /opt/esf/.venv/bin/python esf/intake:python-tests -c 'import sys; assert sys.version_info[:3] == (3, 14, 8)'
 	docker run --rm --entrypoint /opt/esf/.venv/bin/python esf/intake:python-tests -m unittest discover -s tools/intake/tests -p 'test_*.py'
 	docker run --rm --entrypoint /opt/esf/.venv/bin/python esf/intake:python-tests -m unittest discover -s tools/brief_lab/tests -p 'test_*.py'
 

README.md

@@ -32,9 +32,11 @@ and adds factory orchestration. See [upstream attribution](docs/upstream.md).
 This is actively developed software. Review the [validated behavior and
 operational requirements](docs/production-readiness.md) before deployment.
 ESF produces changes for review; it does not decide what ships.
-ESF 0.6.0 is a release candidate. Production qualification requires a matching,
+ESF 0.6.1 is a release candidate. The
+[component upgrade record](release/qualification/component-upgrade-2026-10-06.md)
+records its local validation. Production qualification requires a matching,
 attested companion manifest for its exact source and asset digests. The
-[release procedure](docs/release-v0.6.0.md) and
+[release procedure](docs/release-v0.6.1.md) and
 [review record](docs/review-v0.6.0.md) track the remaining gates.
 
 > **Upgrading:** the factory now refuses to start when an egress policy leaves
@@ -44,7 +46,7 @@ attested companion manifest for its exact source and asset digests. The
 
 ## Quick start
 
-Requirements for v0.6.0 development: Go 1.27.1, Node.js 24.21.0, Git,
+Requirements for v0.6.1 development: Go 1.27.1, Node.js 24.21.0, Git,
 an existing CubeSandbox deployment with a READY template, and Temporal.
 Python tools use the frozen `uv.lock`; they are optional. Docker Compose can
 run the included local Temporal stack.

agents/opencode/package.json

@@ -3,6 +3,6 @@
   "private": true,
   "version": "0.5.0",
   "dependencies": {
-    "@opencode/cli": "2.0.18"
+    "@opencode/cli": "2.0.24"
   }
 }

agents/pi/dist/SHA256SUMS

@@ -1 +1 @@
-9dab48151c793cf3265af4058ea7aac8671d1778b31873ee25ac3fc24afe0e2c  pi-runner.mjs
+018aec9e0215eff09aede13a2b707f6e6872d1dcf2b44727d5afc3d6e97c42fc  pi-runner.mjs