[chen21019]

Result

Add Resource Scheduler catalog version 5 using the formally published v0.8.19. Only its image and visible version change; command, credentials, questions, scheduling labels, and health contracts remain identical to version 4. Historical versions 1-4 are byte-unchanged.

Published evidence

• Release: https://github.com/PastureStack/resource-scheduler/releases/tag/v0.8.19
• Verified signed source/tag: d1720ddb65a285ed615f1461ccb44e50c2ad67a7 / refs/tags/v0.8.19
• Public manifest: sha256:46dfecc72fc1fceab5c66f881f46449874b6a084a208f59c6ef1184a0d15c3f9
• SBOM SHA256: 1ffbad2e58a5eaa5b7d72c83f8d8586f9f0eda337aacc41eb8d05a106951dc6e
• All release checksums, SBOM and image GitHub build-provenance attestations verified against the exact tag, source commit, release workflow, and hosted runner. SBOM/scan image ID equals the public manifest's config digest.
• Actual released runtime: 0 HIGH/CRITICAL/UNKNOWN, 0 vendor-fixed findings, 0 secrets; 4 LOW and 47 MEDIUM remain vendor-unfixed under_investigation. No zero-CVE claim.

Validation boundary

New focused local contract and version-label checks pass. All 24 retained Git-blob hashes equal the existing audit allowlist; Windows working-tree CRLF makes the raw local byte audit differ, with all LF-normalized bytes matching (no audit policy or historical file changed). Native Linux CI must pass the unmodified raw audit, schema/localization checks, CodeQL, and real Catalog Service API tests including old version 4 and new version 5 before merge.

Packaged component health CI passed non-root port 80/readiness/dependency-failure/liveness/zero-restart checks. This publication and Catalog PR do not qualify a managed-system upgrade or rollback. No VM, volume, deployment, unrelated network template, or business/API behavior is changed.