plane(1.4): up.sh by profile -- context, registry, pool and images file from kind.toml

ops/ax/up.sh reads kube_context, registry, pools.default and the images path
with `python -m openultrasast.plane.profile --print`, writes the runner digest to
ops/k8s/profiles/kind-images.json instead of ~/.cache/.../runner-image, renders
ops/ax/workerpool.yaml.tmpl from the profile's pool (POOL_NAME/REPLICAS/CPU/
MEMORY, WORKER_IMAGE), and keeps an existing pool and an ax CLI newer than its
checkout instead of rebuilding them (ko and go install would refill several GB
of Go cache on this disk). smoke-run.sh takes the runner from `--print
images.runner` and runs the checkout's code with OUSAST_PYTHON. repin_templates
reads the JSON images file (runner key; the one-line pin still reads). `--print
images` returns the file path (the first live rerun fell over this). Templates
and the generated validation-46 Tasks re-pinned to the rebuilt image (128
lines, one digest).

Live: up.sh reran idempotently on kind in 38 s (every step kept except the
runner build); smoke-run.sh done in 24 s on the new image, facts.json 451 B,
summary.json 238 B delivered (record: benchmarks/measurements/2026-10-02-k8s-01-profile/).

Gates: pytest 2010 passed, 42 skipped, exit 0; ruff check 0; ruff format 0;
mypy 0; mkdocs build --strict 0.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.kiro/specs/plane-on-kubernetes/tasks.md

@@ -36,7 +36,7 @@ go-ahead** with a ceiling; steps that need a hand on a cluster that does not exi
     `ax-tunnel`; fails listing `path:line`.
   - Evidence: the test passes on this commit and fails when a literal is reinserted (shown once in the record).
   - _Requirements: 1.3_
-- [ ] 1.4 `up.sh` by profile
+- [x] 1.4 `up.sh` by profile
   - `ops/ax/up.sh`: `KO_DOCKER_REPO` and the context from `kind.toml` (read with `python -m
     openultrasast.plane.profile --print registry|kube_context`); writes `kind-images.json` instead of
     `runner-image`; `generate.repin_templates` accepts that file (runner key only until task 4.3).

ops/ax/README.md

@@ -12,7 +12,10 @@ single-node kind cluster. ax is the only executor; `ousast plane run` submits, r
     ops/ax/down.sh        # deletes the cluster and its registry
 
 Tools live in `~/go/bin` (kind, ax, ko, kubectl-ate) and `~/.local/bin` (kubectl); sources and rendered files
-in `~/.cache/ousast/ax-src/` (the runner digest pin is `runner-image` there).
+in `~/.cache/ousast/ax-src/`. The cluster's context, registry and pool sizes come from the kind profile
+(`ops/k8s/profiles/kind.toml`); `up.sh` writes the runner's digest pin to that profile's images file
+(`ops/k8s/profiles/kind-images.json`), which the templates are re-pinned from and which is committed with them.
+`up.sh` and `smoke-run.sh` run the checkout's code with `OUSAST_PYTHON` (default `.venv/bin/python`).
 
 ## How a Run executes
 

ops/ax/smoke-run.sh

@@ -1,14 +1,18 @@
 #!/usr/bin/env bash
-# Render the end-to-end smoke Run with the current runner digest and execute it through the reconciler on ax.
+# Render the end-to-end smoke Run with the profile's runner digest and execute it through the reconciler on ax.
+# The profile (OUSAST_PLANE_PROFILE, default kind; ops/k8s/profiles/) names the images file up.sh wrote.
 set -euo pipefail
 export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
 SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}"
-RUNNER_IMAGE="$(cat "$SRC/runner-image")"; export RUNNER_IMAGE
+REPO="$(cd "$(dirname "$0")/../.." && pwd)"
+PY="${OUSAST_PYTHON:-$REPO/.venv/bin/python}"
+RUNNER_IMAGE="$(PYTHONPATH="$REPO/src" "$PY" -m openultrasast.plane.profile --profile "${OUSAST_PLANE_PROFILE:-kind}" --print images.runner)"
+export RUNNER_IMAGE
 # Actors reach the receiver by its Service name through the egress gateway (ops/ax/receiver-service.yaml.tmpl,
 # applied by up.sh, endpoint this host at OUSAST_ARTIFACT_PORT): the runner dials the Service's ClusterIP on port
 # 80 with that name as Host; the reconciler looks the ClusterIP up unless OUSAST_ARTIFACT_DIAL is set.
 export OUSAST_ARTIFACT_PORT="${OUSAST_ARTIFACT_PORT:-18090}"
 envsubst < "$(dirname "$0")/smoke-run.yaml.tmpl" > "$SRC/smoke-run.yaml"
-REPO="$(cd "$(dirname "$0")/../.." && pwd)"
-"$REPO/.venv/bin/ousast" plane run "$SRC/smoke-run.yaml" "$@"
-"$REPO/.venv/bin/ousast" plane status ax-e2e-smoke
+ousast() { PYTHONPATH="$REPO/src" "$PY" -m openultrasast.cli "$@"; }   # this checkout's code, whatever python runs it
+ousast plane run "$SRC/smoke-run.yaml" "$@"
+ousast plane status ax-e2e-smoke

ops/ax/up.sh

@@ -1,13 +1,21 @@
 #!/usr/bin/env bash
 # Bring up ax on this host: kind cluster + local registry, Agent Substrate, the ax control plane, one smoke
-# Task. Idempotent enough to rerun; `down.sh` removes everything. Requires docker, go, kubectl, kind, ko, ax.
+# Task. Idempotent: every step is skipped when already done; `down.sh` removes everything. Requires docker, go,
+# kubectl, kind, ko, ax. The cluster's context, the registry and the pool sizes come from the kind profile
+# (ops/k8s/profiles/kind.toml; OUSAST_PLANE_PROFILE selects another file with exec = "local"). This script may
+# name the kind cluster because it creates it; the code reads the profile (tests/test_plane_literals.py).
 set -euo pipefail
 trap 'rc=$?; echo "up.sh FAILED at line $LINENO (exit $rc)"' ERR
 trap 'echo "up.sh exit $?"' EXIT
 export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
 export GOTOOLCHAIN=auto
-export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-ousast}"
-export KO_DOCKER_REPO="${KO_DOCKER_REPO:-localhost:5001}"
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PY="${OUSAST_PYTHON:-$REPO_ROOT/.venv/bin/python}"
+profile() { PYTHONPATH="$REPO_ROOT/src" "$PY" -m openultrasast.plane.profile --profile "${OUSAST_PLANE_PROFILE:-kind}" --print "$@"; }
+CTX="$(profile kube_context)"                       # kind names its context kind-<cluster>
+export KIND_CLUSTER_NAME="${CTX#kind-}"
+export KO_DOCKER_REPO="${KO_DOCKER_REPO:-$(profile registry)}"
+IMAGES_FILE="$(profile images)"                     # the digest pins the reconciler and the templates read
 SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}"
 
 for t in docker go kubectl kind ko ax; do
@@ -19,9 +27,8 @@ clone substrate https://github.com/agent-substrate/substrate.git
 clone ax https://github.com/google/ax.git
 step() { printf '\n== %s (%s)\n' "$1" "$(date +%H:%M:%S)"; }
 
-step "kind cluster '$KIND_CLUSTER_NAME' + registry $KO_DOCKER_REPO"
+step "kind cluster '$KIND_CLUSTER_NAME' (context $CTX) + registry $KO_DOCKER_REPO"
 # Each step is skipped when already done: the substrate helper DELETES an existing cluster before creating one.
-CTX="kind-$KIND_CLUSTER_NAME"
 ready() { kubectl --context "$CTX" -n "$1" get pods --no-headers 2>/dev/null | awk '$2 ~ /^[0-9]+\/[0-9]+$/ {n++; split($2,a,"/"); if (a[1]!=a[2] && $3!="Completed") bad++} END {exit !(n>0 && bad==0)}'; }
 if kind get clusters 2>/dev/null | grep -qx "$KIND_CLUSTER_NAME"; then
   echo "cluster exists; kept"
@@ -56,25 +63,36 @@ KIND_GATEWAY="$(docker network inspect kind --format '{{range .IPAM.Config}}{{if
 export KIND_GATEWAY OUSAST_ARTIFACT_PORT="${OUSAST_ARTIFACT_PORT:-18090}"   # the reconciler's fixed receiver port
 envsubst < "$(dirname "$0")/receiver-service.yaml.tmpl" | kubectl --context "$CTX" apply -f -
 
-step "worker pool (gVisor)"
+step "worker pool (gVisor): pools.default of the profile"
+# `ko apply` builds the worker image from the Substrate checkout (several GB of Go caches): only when the pool
+# is absent. A size change in the profile is applied with `kubectl patch` or by deleting the pool first.
+export POOL_NAME=ousast-pool POOL_REPLICAS="$(profile pools.default.replicas)" POOL_CPU="$(profile pools.default.cpu)" POOL_MEMORY="$(profile pools.default.memory)"
+export WORKER_IMAGE="ko://github.com/agent-substrate/substrate/cmd/ateom-gvisor"
 SUBSTRATE_VERSION="$(kubectl --context "$CTX" get nodes -o jsonpath='{.items[0].metadata.labels.ate\.dev/substrate-version}')"
 export SUBSTRATE_VERSION
 envsubst < "$(dirname "$0")/workerpool.yaml.tmpl" > "$SRC/workerpool.yaml"
-(cd "$SRC/substrate" && KO_DOCKER_REPO="$KO_DOCKER_REPO" ko apply -f "$SRC/workerpool.yaml")
-kubectl --context "$CTX" -n ax-system wait --for=condition=Ready pod -l ate.dev/worker-pool=ousast-pool --timeout=600s \
+if kubectl --context "$CTX" -n ax-system get workerpool "$POOL_NAME" >/dev/null 2>&1; then
+  echo "pool $POOL_NAME exists ($(kubectl --context "$CTX" -n ax-system get workerpool "$POOL_NAME" -o jsonpath='{.status.readyReplicas}/{.spec.replicas}') ready); kept"
+else
+  (cd "$SRC/substrate" && KO_DOCKER_REPO="$KO_DOCKER_REPO" ko apply -f "$SRC/workerpool.yaml")
+fi
+kubectl --context "$CTX" -n ax-system wait --for=condition=Ready pod -l "ate.dev/worker-pool=$POOL_NAME" --timeout=600s \
   || kubectl --context "$CTX" -n ax-system get pods
 
 step "runner image $KO_DOCKER_REPO/ousast-runner"
-REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 docker build -q -f "$REPO_ROOT/plane/Dockerfile.runner" -t "$KO_DOCKER_REPO/ousast-runner:dev" "$REPO_ROOT"
 docker push -q "$KO_DOCKER_REPO/ousast-runner:dev"
 RUNNER_IMAGE="$(docker inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$KO_DOCKER_REPO/ousast-runner:dev" | grep "^$KO_DOCKER_REPO/ousast-runner@" | head -1)"
 [ -n "$RUNNER_IMAGE" ] || { echo "no digest for the runner image" >&2; exit 2; }
-export RUNNER_IMAGE; echo "$RUNNER_IMAGE" > "$SRC/runner-image"   # the reconciler reads this pin
-echo "runner image $RUNNER_IMAGE"
+export RUNNER_IMAGE
+printf '{\n  "runner": "%s"\n}\n' "$RUNNER_IMAGE" > "$IMAGES_FILE"   # the profile's images file: commit it with the templates
+echo "runner image $RUNNER_IMAGE -> $IMAGES_FILE"
+echo "re-pin the templates with: ousast plane workspaces ... --runner-image $IMAGES_FILE (or ousast plane repin, task 4.3)"
 
 step "ax CLI from the deployed checkout (a release CLI skews from the server)"
-(cd "$SRC/ax" && go install ./cmd/ax)
+if [ -x "$HOME/go/bin/ax" ] && [ "$HOME/go/bin/ax" -nt "$SRC/ax/.git/HEAD" ]; then echo "ax CLI newer than the checkout; kept"; else
+  (cd "$SRC/ax" && go install ./cmd/ax)
+fi
 
 step "smoke task"
 ax delete task ousast-smoke >/dev/null 2>&1 || true

ops/ax/workerpool.yaml.tmpl

@@ -1,23 +1,26 @@
-# Warm gVisor workers for ax tasks on this host (Agent Substrate WorkerPool). ax's per-task ActorTemplates
-# set no workerSelector, so every pool of the matching sandbox class is eligible. Two workers of 1 CPU /
-# 1.5 GiB fit the 7 GB host beside the control planes; an actor occupies a whole worker.
+# Warm gVisor workers for ax tasks (Agent Substrate WorkerPool), rendered by ops/ax/up.sh (and by
+# ops/ax/probe-placement.sh for the placement probe) from the profile's pool: POOL_NAME, POOL_REPLICAS, POOL_CPU,
+# POOL_MEMORY (ops/k8s/profiles/<profile>.toml, [pools.default]) and WORKER_IMAGE (ko:// for a build, or a
+# digest-pinned reference of a built worker image). ax's per-task ActorTemplates set no workerSelector, so every
+# pool of the matching sandbox class is eligible. An actor occupies a whole worker. Replaced by the renderer of
+# plane-on-kubernetes task 6.1 (ops/k8s/base/workerpool-*.yaml.tmpl).
 apiVersion: ate.dev/v1alpha1
 kind: WorkerPool
 metadata:
-  name: ousast-pool
+  name: ${POOL_NAME}
   namespace: ax-system
   labels:
     workload: ousast
 spec:
-  replicas: 2
-  workerImage: ko://github.com/agent-substrate/substrate/cmd/ateom-gvisor
+  replicas: ${POOL_REPLICAS}
+  workerImage: ${WORKER_IMAGE}
   template:
     nodeSelector:
       ate.dev/substrate-version: "${SUBSTRATE_VERSION}"
     resources:
       limits:
-        cpu: "1"
-        memory: 1536Mi
+        cpu: "${POOL_CPU}"
+        memory: ${POOL_MEMORY}
       requests:
         cpu: 250m
-        memory: 1536Mi
+        memory: ${POOL_MEMORY}

ops/k8s/profiles/kind-images.json

@@ -1,3 +1,3 @@
 {
-  "runner": "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  "runner": "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
 }

plane/tasks/agree.yaml

@@ -7,7 +7,7 @@ metadata:
   name: agree
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["agree"]
   resources:
     requests:

plane/tasks/alerts.yaml

@@ -7,7 +7,7 @@ metadata:
   name: alerts
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["alerts"]
   resources:
     requests:

plane/tasks/features.yaml

@@ -7,7 +7,7 @@ metadata:
   name: features
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["features"]
   resources:
     requests:

plane/tasks/loop.yaml

@@ -7,7 +7,7 @@ metadata:
   name: loop
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["loop"]
   resources:
     requests:

plane/tasks/remember.yaml

@@ -7,7 +7,7 @@ metadata:
   name: remember
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["remember"]
   resources:
     requests:

plane/tasks/repo-facts.yaml

@@ -8,7 +8,7 @@ metadata:
   name: repo-facts
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["repo-facts"]
   resources:
     requests:

plane/tasks/roles.yaml

@@ -11,7 +11,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["roles"]
   resources:
     requests:

plane/tasks/validation-46.yaml

@@ -5,9 +5,9 @@ metadata:
   name: repo-facts-budibase-mongo-template-nosqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"b4ef709df34ab08c","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"b7e63df737eede85d951aa9665b0c0778ece7ccb","repo":"github.com/Budibase/budibase"}'
+    openultrasast.io/memory-key: '{"candidates":"b4ef709df34ab08c","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"b7e63df737eede85d951aa9665b0c0778ece7ccb","repo":"github.com/Budibase/budibase"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -36,7 +36,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -67,7 +67,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -96,7 +96,7 @@ metadata:
   name: agree-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -123,9 +123,9 @@ metadata:
   name: repo-facts-cct-studio-server-cmdi
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"6c9fa4a6e47cda37","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"acdb5893412a81eaec9862ee24a4613bf296ab45","repo":"github.com/davila7/claude-code-templates"}'
+    openultrasast.io/memory-key: '{"candidates":"6c9fa4a6e47cda37","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"acdb5893412a81eaec9862ee24a4613bf296ab45","repo":"github.com/davila7/claude-code-templates"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -154,7 +154,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -185,7 +185,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -214,7 +214,7 @@ metadata:
   name: agree-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -241,9 +241,9 @@ metadata:
   name: repo-facts-contextforge-prompt-ssti
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"b272af6456664ebc","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"0f8e0ad679f1fff685f486e17f642ac863c8ca9e","repo":"github.com/IBM/mcp-context-forge"}'
+    openultrasast.io/memory-key: '{"candidates":"b272af6456664ebc","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"0f8e0ad679f1fff685f486e17f642ac863c8ca9e","repo":"github.com/IBM/mcp-context-forge"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -272,7 +272,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -303,7 +303,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -332,7 +332,7 @@ metadata:
   name: agree-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -359,9 +359,9 @@ metadata:
   name: repo-facts-froxlor-admin-ip-second-order-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"c52240d980ef0105","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"9bf03de643a2edee4642bfc6c94db1f05253da02","repo":"github.com/froxlor/froxlor"}'
+    openultrasast.io/memory-key: '{"candidates":"c52240d980ef0105","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"9bf03de643a2edee4642bfc6c94db1f05253da02","repo":"github.com/froxlor/froxlor"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -390,7 +390,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -421,7 +421,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -450,7 +450,7 @@ metadata:
   name: agree-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -477,9 +477,9 @@ metadata:
   name: repo-facts-fuxa-tdengine-escape-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"ec699ee54d38a8ee","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"193a888f8e3f805325072829b1644a2c768c948b","repo":"github.com/frangoteam/FUXA"}'
+    openultrasast.io/memory-key: '{"candidates":"ec699ee54d38a8ee","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"193a888f8e3f805325072829b1644a2c768c948b","repo":"github.com/frangoteam/FUXA"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -508,7 +508,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -539,7 +539,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -568,7 +568,7 @@ metadata:
   name: agree-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -595,9 +595,9 @@ metadata:
   name: repo-facts-lmdeploy-media-url-ssrf
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"1337c9c717f5ac87","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"71648d239c978452720a6d6692fe914efc8a7b94","repo":"github.com/InternLM/lmdeploy"}'
+    openultrasast.io/memory-key: '{"candidates":"1337c9c717f5ac87","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"71648d239c978452720a6d6692fe914efc8a7b94","repo":"github.com/InternLM/lmdeploy"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -626,7 +626,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -657,7 +657,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -686,7 +686,7 @@ metadata:
   name: agree-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -713,9 +713,9 @@ metadata:
   name: repo-facts-medplum-external-auth-open-redirect
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"17ba609d5b1a1a00","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"5d4a8654b02aa67c444f96ae1eb5663c09854006","repo":"github.com/medplum/medplum"}'
+    openultrasast.io/memory-key: '{"candidates":"17ba609d5b1a1a00","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"5d4a8654b02aa67c444f96ae1eb5663c09854006","repo":"github.com/medplum/medplum"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -744,7 +744,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -775,7 +775,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -804,7 +804,7 @@ metadata:
   name: agree-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -831,9 +831,9 @@ metadata:
   name: repo-facts-pgadmin-maintenance-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"7f1b83a88024c2d4","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"d112dc3b962218efc3613fa727d54f0fc5b1d527","repo":"github.com/pgadmin-org/pgadmin4"}'
+    openultrasast.io/memory-key: '{"candidates":"7f1b83a88024c2d4","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"d112dc3b962218efc3613fa727d54f0fc5b1d527","repo":"github.com/pgadmin-org/pgadmin4"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -862,7 +862,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -893,7 +893,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -922,7 +922,7 @@ metadata:
   name: agree-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -949,9 +949,9 @@ metadata:
   name: repo-facts-qwed-sympy-eval
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"f071e8db5f5517ab","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"06801f68cbf9c9b5e54cc17f2a61cb2792da7a26","repo":"github.com/QWED-AI/qwed-verification"}'
+    openultrasast.io/memory-key: '{"candidates":"f071e8db5f5517ab","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"06801f68cbf9c9b5e54cc17f2a61cb2792da7a26","repo":"github.com/QWED-AI/qwed-verification"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -980,7 +980,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1011,7 +1011,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1040,7 +1040,7 @@ metadata:
   name: agree-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1067,9 +1067,9 @@ metadata:
   name: repo-facts-reactpress-findall-column-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"ecb82a10249c6fed","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"c3dd10681b3d2b5e224f7ac647b3769557603975","repo":"github.com/fecommunity/reactpress"}'
+    openultrasast.io/memory-key: '{"candidates":"ecb82a10249c6fed","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"c3dd10681b3d2b5e224f7ac647b3769557603975","repo":"github.com/fecommunity/reactpress"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1098,7 +1098,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1129,7 +1129,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1158,7 +1158,7 @@ metadata:
   name: agree-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1185,9 +1185,9 @@ metadata:
   name: repo-facts-unleash-addon-webhook-ssrf
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"4d3debd51fd86f9c","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"b9f3217d327f24094b4352130baa30387f85cffe","repo":"github.com/Unleash/unleash"}'
+    openultrasast.io/memory-key: '{"candidates":"4d3debd51fd86f9c","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"b9f3217d327f24094b4352130baa30387f85cffe","repo":"github.com/Unleash/unleash"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1216,7 +1216,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1247,7 +1247,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1276,7 +1276,7 @@ metadata:
   name: agree-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1303,9 +1303,9 @@ metadata:
   name: repo-facts-winml-cli-serve-cors
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"e3b0c44298fc1c14","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"02179d185f0e3ac23518236b5ca1f61fd37ef680","repo":"github.com/microsoft/winml-cli"}'
+    openultrasast.io/memory-key: '{"candidates":"e3b0c44298fc1c14","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"02179d185f0e3ac23518236b5ca1f61fd37ef680","repo":"github.com/microsoft/winml-cli"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1334,7 +1334,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1365,7 +1365,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1394,7 +1394,7 @@ metadata:
   name: agree-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1421,9 +1421,9 @@ metadata:
   name: repo-facts-wp-directorist-avatar-ssrf
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"d6963021f588f39e","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"77cfc9bc8b453f97ab7e720330706fa4ef056867","repo":"github.com/sovware/directorist"}'
+    openultrasast.io/memory-key: '{"candidates":"d6963021f588f39e","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"77cfc9bc8b453f97ab7e720330706fa4ef056867","repo":"github.com/sovware/directorist"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1452,7 +1452,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1483,7 +1483,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1512,7 +1512,7 @@ metadata:
   name: agree-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1539,9 +1539,9 @@ metadata:
   name: repo-facts-wp-gopay-log-filter-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"626bc8b5f8d33de6eefd921e3a05ed52ac320bcd","repo":"github.com/gopaycommunity/gopay-woocommerce-integration"}'
+    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"626bc8b5f8d33de6eefd921e3a05ed52ac320bcd","repo":"github.com/gopaycommunity/gopay-woocommerce-integration"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1570,7 +1570,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1601,7 +1601,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1630,7 +1630,7 @@ metadata:
   name: agree-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1657,9 +1657,9 @@ metadata:
   name: repo-facts-wp-groundhogg-confirm-redirect
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"9472a1dd79d4556c40eece501a61930793f170d3","repo":"github.com/groundhoggwp/groundhogg"}'
+    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"9472a1dd79d4556c40eece501a61930793f170d3","repo":"github.com/groundhoggwp/groundhogg"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1688,7 +1688,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1719,7 +1719,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1748,7 +1748,7 @@ metadata:
   name: agree-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1777,7 +1777,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1808,7 +1808,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1839,7 +1839,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1870,7 +1870,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1901,7 +1901,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1932,7 +1932,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1963,7 +1963,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1994,7 +1994,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2025,7 +2025,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2056,7 +2056,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2087,7 +2087,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2118,7 +2118,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2149,7 +2149,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2180,7 +2180,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2211,7 +2211,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2240,7 +2240,7 @@ metadata:
   name: features-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2263,7 +2263,7 @@ metadata:
   name: remember-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2288,7 +2288,7 @@ metadata:
   name: features-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2311,7 +2311,7 @@ metadata:
   name: remember-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2336,7 +2336,7 @@ metadata:
   name: features-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2359,7 +2359,7 @@ metadata:
   name: remember-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2384,7 +2384,7 @@ metadata:
   name: features-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2407,7 +2407,7 @@ metadata:
   name: remember-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2432,7 +2432,7 @@ metadata:
   name: features-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2455,7 +2455,7 @@ metadata:
   name: remember-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2480,7 +2480,7 @@ metadata:
   name: features-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2503,7 +2503,7 @@ metadata:
   name: remember-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2528,7 +2528,7 @@ metadata:
   name: features-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2551,7 +2551,7 @@ metadata:
   name: remember-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2576,7 +2576,7 @@ metadata:
   name: features-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2599,7 +2599,7 @@ metadata:
   name: remember-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2624,7 +2624,7 @@ metadata:
   name: features-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2647,7 +2647,7 @@ metadata:
   name: remember-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2672,7 +2672,7 @@ metadata:
   name: features-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2695,7 +2695,7 @@ metadata:
   name: remember-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2720,7 +2720,7 @@ metadata:
   name: features-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2743,7 +2743,7 @@ metadata:
   name: remember-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2768,7 +2768,7 @@ metadata:
   name: features-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2791,7 +2791,7 @@ metadata:
   name: remember-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2816,7 +2816,7 @@ metadata:
   name: features-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2839,7 +2839,7 @@ metadata:
   name: remember-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2864,7 +2864,7 @@ metadata:
   name: features-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2887,7 +2887,7 @@ metadata:
   name: remember-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2912,7 +2912,7 @@ metadata:
   name: features-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2935,7 +2935,7 @@ metadata:
   name: remember-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:

plane/tasks/verify.yaml

@@ -10,7 +10,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["verify"]
   resources:
     requests:

src/openultrasast/plane/generate.py

@@ -45,8 +45,9 @@ The recorded triage cost is derived per file: a batched-check record's ``usd`` p
 hunts, and its ``usage`` counts only the hunts (``verify_sinks._Recording`` slices the client's usage from the
 first hunt on), so the triage share is ``usd`` minus that usage priced at the reference model's list price.
 
-``--runner-image FILE`` (``~/.cache/ousast/ax-src/runner-image``, written by ``ops/ax/up.sh``) re-pins the
-templates' ``image:`` to the digest in that file before generating, so a rebuilt image is one command.
+``--runner-image FILE`` (the profile's images file, ``ops/k8s/profiles/kind-images.json``, written by ``ops/ax/up.sh``;
+the older one-line pin file still reads) re-pins the templates' ``image:`` to the runner digest in that file before
+generating, so a rebuilt image is one command.
 """
 
 from __future__ import annotations
@@ -485,11 +486,18 @@ _IMAGE_LINE = re.compile(r'^(\s*image:\s*)"?[^"\s]+"?\s*$', re.MULTILINE)
 
 
 def repin_templates(plane: Path, image_file: Path) -> str:
-    """Set every template's ``image:`` to the digest-pinned reference in ``image_file`` (as ``ops/ax/up.sh``
-    writes it); comments and layout are kept. Returns the reference."""
-    image = image_file.read_text(encoding="utf-8").strip()
-    if not re.fullmatch(r"\S+@sha256:[0-9a-f]{64}", image):
-        raise ValueError(f"{image_file}: expected a digest-pinned image reference, got {image!r}")
+    """Set every template's ``image:`` to the runner reference of ``image_file``: a profile images file
+    (``{"runner": "<registry>/<name>@sha256:..."}``, as ``ops/ax/up.sh`` writes it) or the older one-line pin; a
+    reference without a digest is refused. Comments and layout are kept. Returns the reference. (Task 4.3 gives
+    the engine template ``images["engine"]``; until then only the runner key is read.)"""
+    from .profile import ProfileError, load_images
+
+    try:
+        image = load_images(image_file)["runner"]
+    except ProfileError as exc:
+        raise ValueError(str(exc)) from None
+    except KeyError:
+        raise ValueError(f"{image_file}: no runner image in the images file") from None
     for name in TEMPLATES:
         path = plane / "tasks" / f"{name}.yaml"
         text = path.read_text(encoding="utf-8")

src/openultrasast/plane/profile.py

@@ -229,7 +229,7 @@ def load_profile(name: str | None = None, environ: Mapping[str, str] | None = No
 
 def _lookup(profile: PlaneProfile, dotted: str) -> str:
     head, _, rest = dotted.partition(".")
-    if head == "images":
+    if head == "images" and rest:
         images = profile.load_images()
         if rest not in images:
             raise ProfileError(f"{profile.images}: no image named {rest!r} (have {', '.join(sorted(images))})")

tests/test_plane_increment.py

@@ -292,6 +292,23 @@ def test_case_record_carries_sites_in_set_and_cost_and_the_image_is_repinned(tmp
         repin_templates(paths["plane"], tmp_path / "runner-image")
 
 
+def test_repin_reads_the_profiles_images_file(tmp_path: Path) -> None:
+    """plane-on-kubernetes 1.4: ``ops/ax/up.sh`` writes ``kind-images.json`` ({"runner": ...}); repin reads it, the
+    older one-line pin still reads, and a file without a runner key or without a digest is refused by name."""
+    paths = _fixture(tmp_path)
+    digest = "localhost:5001/ousast-runner@sha256:" + "cd" * 32
+    images = tmp_path / "kind-images.json"
+    images.write_text(json.dumps({"runner": digest}) + "\n")
+    assert repin_templates(paths["plane"], images) == digest
+    assert {t.image for t in load_manifests(sorted((paths["plane"] / "tasks").glob("*.yaml"))).tasks.values()} == {digest}
+    images.write_text(json.dumps({"engine": digest}))
+    with pytest.raises(ValueError, match="no runner image"):
+        repin_templates(paths["plane"], images)
+    images.write_text(json.dumps({"runner": "localhost:5001/ousast-runner:dev"}))
+    with pytest.raises(ValueError, match="not digest-pinned"):
+        repin_templates(paths["plane"], images)
+
+
 def test_workspaces_go_to_the_profiles_atespace(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     """plane-on-kubernetes 1.2: ``generate.ATESPACE`` is a default; ``increment`` takes the profile's atespace."""
     paths = _fixture(tmp_path)

tests/test_plane_profile.py

@@ -144,6 +144,8 @@ def test_print_for_shell_scripts(capsys: pytest.CaptureFixture[str], tmp_path: P
     fields = ["registry", "kube_context", "images.runner", "pools.default.replicas"]
     assert profile_module.main(["--profile", str(path), "--print", *fields]) == 0
     assert capsys.readouterr().out.splitlines() == ["registry.test:5000", "kind-test", f"registry.test:5000/ousast-runner@{DIGEST}", "3"]
+    assert profile_module.main(["--profile", str(path), "--print", "images"]) == 0, "the images file's path itself (up.sh writes it)"
+    assert capsys.readouterr().out.strip() == str(tmp_path / "images.json")
     assert profile_module.main(["--profile", str(path), "--print", "images.engine"]) == 2
     assert "no image named 'engine'" in capsys.readouterr().err
     assert profile_module.main(["--profile", str(path), "--print", "nothing"]) == 2