model-orchestrator 1.0.3 → 1.0.5

package/AGENTS.md

@@ -33,6 +33,6 @@ When using the Claude Code plugin, follow [plugin/README.md](plugin/README.md).
 - **Installer safety:** writes remain inside `--dir` and `--project`; preserve user edits according to manifest hashes and explicit flags. Run no third-party installer.
 - **Runner safety:** preserve exit codes and the log schema. Before changing an output judge, add a failing case in `test/judges.test.js`.
 - **Secrets:** use environment-variable names only. Never add a credential value to code, examples or tests.
-- **Proof:** measure through `proof/scripts/`, store results in `proof/results.json` and regenerate the proof page. The suite rejects expired entries.
+- **Proof:** measure through `proof/scripts/`, store results in `proof/results.json` and regenerate the proof page. An expired entry warns and is re-measured; it never blocks tests or releases.
 - **Verify:** run `npm test` and report tests, pass, fail, skipped and exit code. The suite prints current counts. Use `npm pack --dry-run` to inspect publication contents.
 - **Style:** use short condition-to-action instructions and no em dashes. `test/prose.test.js` checks public vocabulary and examples.

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project are documented here. The format follows [Kee
 
 ## [Unreleased]
 
+## [1.0.5] - 2026-09-28
+
+### Changed
+
+- The proof page keeps only figures that measure this package. The two browser token figures measured the author's own browser subagent, which model-orchestrator does not ship, and are removed from the proof data, the site and the trailer.
+- An expired proof figure is a signal to re-measure: it warns and never fails tests, CI or a release. The product site leaves expired figures off.
+
+## [1.0.4] - 2026-09-28
+
+### Security
+
+- Level 3 images move to `ghcr.io/berriai/litellm:v1.100.3` (from v1.99.1, 23 advisories to 9) and `ollama/ollama:0.34.4` (from 0.33.3). The advisories still inside those vendor images are recorded as reviewed exceptions that expire on 2026-10-28, so the check flags anything new and asks for a fresh review then.
+
+### Fixed
+
+- The container advisory check records a Go binary's own unversioned module by name instead of reporting the whole image as unknown; any other package without a version still makes the image unknown.
+
 ## [1.0.3] - 2026-09-28
 
 ### Security
@@ -540,7 +557,9 @@ First release.
 - Tests: a case per fix, judges proven to go red, mutation checks; `npm test` prints the current count.
 - Adversarial audit: two Codex rounds plus a two-engine review (Codex, Antigravity); findings and fixes in `docs/audit-brief.md`. After the review: subagents go to the project root (`--project`), snippet paths computed from `--dir`, lane sections rendered from the selection, a primary agent required, level 3 asks for API keys separately from CLIs, images and CLI installs pinned, an activation summary at the end of every install.
 
-[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.3...HEAD
+[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.5...HEAD
+[1.0.5]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.4...v1.0.5
+[1.0.4]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.2...v1.0.3
 [1.0.2]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.0...v1.0.1

package/README.md

@@ -239,7 +239,7 @@ The lane wiring and the output judges were written against these versions, which
 | `grok` | xAI | 1.0.5 | `test/fixtures/grok-1.0.5.json`, a recorded run |
 | `hermes` | Nous Research | 0.20.0 | `test/fixtures/hermes-0.20.0.txt`, a recorded run |
 | `qwen` | Alibaba | 0.22.3 | `test/fixtures/qwen-0.22.3-nokey.json`, a recorded run |
-| `ollama` | Ollama | 0.33.3 | the pinned image the level 3 box runs, `ollama/ollama:0.33.3` |
+| `ollama` | Ollama | 0.34.4 | the pinned image the level 3 box runs, `ollama/ollama:0.34.4` |
 
 Generated from `src/catalog.js` by `npm run gen:catalog`; `npm test` fails if this table and the catalog disagree. Fixtures were captured 2026-09-06.
 

package/docs/catalog-advisories.md

@@ -59,6 +59,8 @@ GitHub Actions is the watcher. A maintainer reviews every affected or unknown re
 | unknown | Missing, unavailable, unsupported or malformed evidence, or an invalid exception policy | 2 |
 | excepted | Every advisory match has an exact, reviewed, unexpired exception | 0 if every result is clean or excepted |
 
+A Go binary built without module version stamping lists its own main module with no version (Trivy marks it `Relationship: root` in a language-package result). Its dependencies are still listed and scanned, so that one entry is recorded by name in `unversionedRoots` and does not make the image unknown. Any other package without a version keeps the image unknown.
+
 Any unknown takes precedence over affected for the exit code. Known advisory IDs are still retained when a detail lookup fails. Empty results never pass. Read the exclusions alongside the status; exclusions are never counted as clean pins.
 
 ## Failure modes

package/docs/catalog-advisory-exceptions.json

@@ -1 +1,1019 @@
-[]
+[
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44-locale-posix",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44-locale-posix",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "ld-linux-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "ld-linux-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "libcrypt1-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "libcrypt1-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "zlib",
+    "version": "1.3.2-r5",
+    "advisory": "CVE-2026-85091",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc-bin",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-18374",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc-bin",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-89092",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc6",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-18374",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc6",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-89092",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libelf1t64",
+    "version": "0.190-1.1ubuntu0.1",
+    "advisory": "CVE-2025-1352",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libelf1t64",
+    "version": "0.190-1.1ubuntu0.1",
+    "advisory": "CVE-2025-1376",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2025-66382",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56131",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56132",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56406",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56407",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56409",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56410",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56411",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-66046",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-72522",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-76641",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-76957",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libicu74",
+    "version": "74.2-1ubuntu3.1",
+    "advisory": "CVE-2025-5222",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libpcre2-8-0",
+    "version": "10.42-4ubuntu2.1",
+    "advisory": "CVE-2026-86145",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libpcre2-8-0",
+    "version": "10.42-4ubuntu2.1",
+    "advisory": "CVE-2026-89161",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libsystemd0",
+    "version": "255.4-1ubuntu8.17",
+    "advisory": "CVE-2026-40228",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libudev1",
+    "version": "255.4-1ubuntu8.17",
+    "advisory": "CVE-2026-40228",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "login",
+    "version": "1:4.13+dfsg1-4ubuntu3.2",
+    "advisory": "CVE-2024-56433",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "passwd",
+    "version": "1:4.13+dfsg1-4ubuntu3.2",
+    "advisory": "CVE-2024-56433",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "perl-base",
+    "version": "5.38.2-3.2ubuntu0.4",
+    "advisory": "CVE-2026-15534",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "perl-base",
+    "version": "5.38.2-3.2ubuntu0.4",
+    "advisory": "CVE-2026-19487",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "tar",
+    "version": "1.35+dfsg-3ubuntu0.4",
+    "advisory": "CVE-2026-18477",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "tar",
+    "version": "1.35+dfsg-3ubuntu0.4",
+    "advisory": "CVE-2026-18508",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "zlib1g",
+    "version": "1:1.3.dfsg-3.1ubuntu2.2",
+    "advisory": "CVE-2026-85091",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "github.com/buger/jsonparser",
+    "version": "v1.1.1",
+    "advisory": "CVE-2026-32285",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39828",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39829",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39830",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39831",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39832",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39835",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-42508",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-46595",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-46597",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-56854",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2025-47914",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2025-58181",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39827",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39833",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39834",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-46598",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-56855",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-78662",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "GO-2026-5932",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46602",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46603",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-33809",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-33812",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-33813",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-42500",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46599",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46601",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46604",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/mod",
+    "version": "v0.30.0",
+    "advisory": "CVE-2026-56864",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/mod",
+    "version": "v0.30.0",
+    "advisory": "CVE-2026-56865",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-25681",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-27136",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-33814",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-39821",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-46600",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-25680",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-42502",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-42506",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/sys",
+    "version": "v0.37.0",
+    "advisory": "CVE-2026-39824",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/text",
+    "version": "v0.30.0",
+    "advisory": "CVE-2026-56852",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-25679",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27137",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27145",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32280",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32281",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32283",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33810",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33811",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33814",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33818",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39820",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39821",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39822",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39836",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42499",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42504",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-46600",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56853",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56858",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56859",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56860",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56862",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27142",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32282",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32288",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32289",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39823",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39825",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39826",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42505",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42507",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27138",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27139",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  }
+]

package/docs/catalog.md

@@ -207,7 +207,7 @@ Generated from `src/catalog.js`. Do not hand-edit; `npm run gen:catalog` rewrite
 - **What it is:** A local model runtime; work sent here stays on the machine
 - **Install:** https://ollama.com/download (or `brew install ollama`)
 - **Sign in:** none
-- **Built against:** 0.33.3
+- **Built against:** 0.34.4
 
 **Capability facts.** An unverified value needs a current capability check before use. Role assignments come from the selected stack, using these facts.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "model-orchestrator",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Model router for AI coding agents: installs routing rules, 8 subagents, hooks and a CLI runner so your AI picks model and effort per task and saves tokens",
   "type": "module",
   "bin": {

package/proof/README.md

@@ -10,8 +10,6 @@ Environment: Node v22.22.3, darwin arm64. Timing varies with startup caches and
 | Lane runner overhead | 63.74 ms median difference | 7 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/runner-overhead.js) |
 | Empty results flagged | 10 fixtures rejected | 10 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/missing-results.js) |
 | Acceptance failures blocked | 4 fixtures rejected | 4 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/check-gate.js) |
-| Main conversation browser tokens | 408147 tokens per browser step (median) | 9775 | 2026-09-26 | 2026-10-27 | author setup, re-measured locally |
-| Small browser subagent tokens | 17197 tokens per step (highest of 5 runs) | 5 | 2026-09-27 | 2026-10-27 | author setup, re-measured locally |
 
 ## Run the proof scripts
 
@@ -21,7 +19,7 @@ node proof/scripts/render.js
 npm test
 ```
 
-The measurement command refreshes reproducible entries and preserves separately sourced author-setup entries. The test suite rejects expired, future-dated or incomplete entries and checks this page against the data. The weekly [refresh workflow](../.github/workflows/proof.yml) reruns the scripts and commits their data and generated page.
+The measurement command refreshes the reproducible entries. An expired entry is a signal to re-measure; the test suite rejects future-dated or incomplete entries and checks this page against the data. The weekly [refresh workflow](../.github/workflows/proof.yml) reruns the scripts and commits their data and generated page.
 
 ## Try the acceptance gate
 
@@ -70,22 +68,6 @@ Kind: reproducible local measurement. Sample size: 4. Measured: 2026-09-27. Expi
 
 Source: [proof/scripts/check-gate.js](../proof/scripts/check-gate.js).
 
-### Main conversation browser tokens
-
-Measured on the author's Claude Code sessions: every browser tool call in the transcripts, counting tokens re-read by the main conversation per step. Median: 408,147 tokens per browser step across 145 sessions and 9,775 browser steps. Sample size counts browser steps.
-
-Kind: measured on the author's setup. Sample size: 9775. Measured: 2026-09-26. Expires: 2026-10-27.
-
-Source: author setup, re-measured locally.
-
-### Small browser subagent tokens
-
-At least 23x fewer tokens per step in this sample: the main conversation median of 408,147 divided by the highest subagent run of 17,197 is 23.73x. Measured on the author's Claude Code sessions, with the same kind of work handed to a small browser subagent. Five runs, tokens divided by steps or tool calls per run: 17,197 (206,369 tokens / 12 steps, 2026-09-26); 4,077 (93,773 / 23), 4,201 (105,034 / 25), 4,585 (91,709 / 20), and 4,489 (94,263 / 21), all four on 2026-09-27. Range: 4,077 to 17,197; median of 5 runs: 4,489. Typical context, using the median of 5 runs: about 91x fewer tokens per step. These are measurements from the author's own sessions, not a controlled comparison or a guarantee for other setups. The four 2026-09-27 runs shared one browser pane, so some steps were spent recovering a drifting tab, which raises the step count and lowers per-step tokens. The first run counted steps; the later runs counted tool calls. Sample size counts runs.
-
-Kind: measured on the author's setup. Sample size: 5. Measured: 2026-09-27. Expires: 2026-10-27.
-
-Source: author setup, re-measured locally.
-
 ## Operation and verification
 
 - **What and why:** executable measurements keep public figures traceable to current output.
@@ -95,6 +77,6 @@ Source: author setup, re-measured locally.
 - **Reads:** package scripts, the installer, runner and acceptance-check runner. Fixture tests use an isolated home and PATH.
 - **Writes:** results.json, this generated page, temporary fixture directories and local fixture logs. The recorder writes gate-demo.cast and gate-demo.gif.
 - **Closed loop:** the workflow fails when measurement or tests fail. GitHub Actions records the failure; repository notification settings decide who receives it. No separate alert service is configured.
-- **Failure modes:** runner behavior changes, an expired catalog snapshot, missing runtime, unavailable write permission, or timing noise. Review the failed job, rerun locally, and send a reproducible issue to the repository maintainers.
-- **Run and verify:** run the commands above, inspect sample arrays and fixture exit codes in results.json, and require npm test to pass. A future-time unit test proves expiry can fail.
-- **Source of truth:** results.json and the scripts it names. Author-setup evidence is added separately by its owner.
+- **Failure modes:** runner behavior changes, missing runtime, unavailable write permission, or timing noise. Review the failed job, rerun locally, and send a reproducible issue to the repository maintainers.
+- **Run and verify:** run the commands above, inspect sample arrays and fixture exit codes in results.json, and require npm test to pass.
+- **Source of truth:** results.json and the scripts it names.

package/proof/results.json

@@ -169,30 +169,6 @@
           "exitCode": 1
         }
       ]
-    },
-    {
-      "id": "author-main-browser-tokens",
-      "label": "Main conversation browser tokens",
-      "kind": "author-setup",
-      "value": 408147,
-      "unit": "tokens per browser step (median)",
-      "measuredAt": "2026-09-26",
-      "method": "Measured on the author's Claude Code sessions: every browser tool call in the transcripts, counting tokens re-read by the main conversation per step. Median: 408,147 tokens per browser step across 145 sessions and 9,775 browser steps. Sample size counts browser steps.",
-      "sampleSize": 9775,
-      "script": "author setup, re-measured locally",
-      "expiresAt": "2026-10-27"
-    },
-    {
-      "id": "author-subagent-browser-tokens",
-      "label": "Small browser subagent tokens",
-      "kind": "author-setup",
-      "value": 17197,
-      "unit": "tokens per step (highest of 5 runs)",
-      "measuredAt": "2026-09-27",
-      "method": "At least 23x fewer tokens per step in this sample: the main conversation median of 408,147 divided by the highest subagent run of 17,197 is 23.73x. Measured on the author's Claude Code sessions, with the same kind of work handed to a small browser subagent. Five runs, tokens divided by steps or tool calls per run: 17,197 (206,369 tokens / 12 steps, 2026-09-26); 4,077 (93,773 / 23), 4,201 (105,034 / 25), 4,585 (91,709 / 20), and 4,489 (94,263 / 21), all four on 2026-09-27. Range: 4,077 to 17,197; median of 5 runs: 4,489. Typical context, using the median of 5 runs: about 91x fewer tokens per step. These are measurements from the author's own sessions, not a controlled comparison or a guarantee for other setups. The four 2026-09-27 runs shared one browser pane, so some steps were spent recovering a drifting tab, which raises the step count and lowers per-step tokens. The first run counted steps; the later runs counted tool calls. Sample size counts runs.",
-      "sampleSize": 5,
-      "script": "author setup, re-measured locally",
-      "expiresAt": "2026-10-27"
     }
   ]
 }

package/proof/scripts/lib.js

@@ -64,7 +64,9 @@ export function validateResults(data, now = new Date()) {
     else {
       if (item.measuredAt > today) errors.push(`${item.id}: measurement is in the future`);
       if (item.expiresAt < item.measuredAt) errors.push(`${item.id}: expiry precedes measurement`);
-      if (item.expiresAt < today) errors.push(`${item.id}: expired ${item.expiresAt}`);
+      // Expiry is a refresh signal, never a gate: an expired figure is reported and
+      // left off the pages, and tests, CI and releases keep running.
+      if (item.expiresAt < today) console.warn(`proof: ${item.id} expired ${item.expiresAt}; rerun node proof/scripts/measure.js`);
     }
     const localAuthorSource = item.kind === 'author-setup' && item.script === 'author setup, re-measured locally';
     if (!localAuthorSource && (typeof item.script !== 'string' || !/^proof\/scripts\/[A-Za-z0-9_-]+\.js$/.test(item.script))) errors.push(`${item.id}: script must name a proof script`);

package/proof/scripts/render.js

@@ -7,7 +7,7 @@ export function proofMarkdown(data) {
   const source = (e, label) => e.kind === 'author-setup' && e.script === 'author setup, re-measured locally' ? e.script : `[${label}](../${e.script})`;
   const rows = data.entries.map(e => `| ${e.label} | ${e.value.toFixed(Number.isInteger(e.value) ? 0 : 2)} ${e.unit} | ${e.sampleSize} | ${e.measuredAt} | ${e.expiresAt} | ${source(e, 'script')} |`);
   const methods = data.entries.map(e => `### ${e.label}\n\n${e.method}\n\nKind: ${e.kind === 'author-setup' ? "measured on the author's setup" : 'reproducible local measurement'}. Sample size: ${e.sampleSize}. Measured: ${e.measuredAt}. Expires: ${e.expiresAt}.\n\nSource: ${source(e, e.script)}.`).join('\n\n');
-  return `# Reproduce the measurements\n\nGenerated from [results.json](results.json). Each figure has a method, sample size, measurement date and expiry. Run the scripts on your own machine to compare.\n\nEnvironment: Node ${data.environment.node}, ${data.environment.platform} ${data.environment.arch}. Timing varies with startup caches and other work on the machine. Synthetic cases show what those fixtures exercise.\n\n| Measurement | Result | Sample size | Measured | Expires | Reproduce |\n|---|---|---|---|---|---|\n${rows.join('\n')}\n\n## Run the proof scripts\n\n\`\`\`sh\nnode proof/scripts/measure.js\nnode proof/scripts/render.js\nnpm test\n\`\`\`\n\nThe measurement command refreshes reproducible entries and preserves separately sourced author-setup entries. The test suite rejects expired, future-dated or incomplete entries and checks this page against the data. The weekly [refresh workflow](../.github/workflows/proof.yml) reruns the scripts and commits their data and generated page.\n\n## Try the acceptance gate\n\n\`\`\`sh\naunx checks ACCEPTANCE_CHECKS.json\naunx checks run ACCEPTANCE_CHECKS.json\n\`\`\`\n\nThe scaffold starts red. Replace the sample with commands that prove your requirements, then put \`aunx checks run ACCEPTANCE_CHECKS.json && <your-release-command>\` in your own release sequence. Commands are local code you review before running. Manual evidence stays UNVERIFIED and blocks the gate.\n\n![Acceptance gate rejects a missing output, then passes after the output exists](gate-demo.gif)\n\nThe [recording script](scripts/record-gate.js) captures real command output into an asciicast, then renders it with an already installed agg. Companion tools are installed by their users.\n\n## Measurement methods\n\n${methods}\n\n## Operation and verification\n\n- **What and why:** executable measurements keep public figures traceable to current output.\n- **Trigger:** weekly schedule, workflow dispatch, or \`node proof/scripts/measure.js\`.\n- **Invocation chain:** workflow -> measurement functions -> isolated Node fixtures -> results.json -> this page -> npm test.\n- **Dependencies:** Node and the repository. The optional GIF recorder uses agg from the asciinema project.\n- **Reads:** package scripts, the installer, runner and acceptance-check runner. Fixture tests use an isolated home and PATH.\n- **Writes:** results.json, this generated page, temporary fixture directories and local fixture logs. The recorder writes gate-demo.cast and gate-demo.gif.\n- **Closed loop:** the workflow fails when measurement or tests fail. GitHub Actions records the failure; repository notification settings decide who receives it. No separate alert service is configured.\n- **Failure modes:** runner behavior changes, an expired catalog snapshot, missing runtime, unavailable write permission, or timing noise. Review the failed job, rerun locally, and send a reproducible issue to the repository maintainers.\n- **Run and verify:** run the commands above, inspect sample arrays and fixture exit codes in results.json, and require npm test to pass. A future-time unit test proves expiry can fail.\n- **Source of truth:** results.json and the scripts it names. Author-setup evidence is added separately by its owner.\n`;
+  return `# Reproduce the measurements\n\nGenerated from [results.json](results.json). Each figure has a method, sample size, measurement date and expiry. Run the scripts on your own machine to compare.\n\nEnvironment: Node ${data.environment.node}, ${data.environment.platform} ${data.environment.arch}. Timing varies with startup caches and other work on the machine. Synthetic cases show what those fixtures exercise.\n\n| Measurement | Result | Sample size | Measured | Expires | Reproduce |\n|---|---|---|---|---|---|\n${rows.join('\n')}\n\n## Run the proof scripts\n\n\`\`\`sh\nnode proof/scripts/measure.js\nnode proof/scripts/render.js\nnpm test\n\`\`\`\n\nThe measurement command refreshes the reproducible entries. An expired entry is a signal to re-measure; the test suite rejects future-dated or incomplete entries and checks this page against the data. The weekly [refresh workflow](../.github/workflows/proof.yml) reruns the scripts and commits their data and generated page.\n\n## Try the acceptance gate\n\n\`\`\`sh\naunx checks ACCEPTANCE_CHECKS.json\naunx checks run ACCEPTANCE_CHECKS.json\n\`\`\`\n\nThe scaffold starts red. Replace the sample with commands that prove your requirements, then put \`aunx checks run ACCEPTANCE_CHECKS.json && <your-release-command>\` in your own release sequence. Commands are local code you review before running. Manual evidence stays UNVERIFIED and blocks the gate.\n\n![Acceptance gate rejects a missing output, then passes after the output exists](gate-demo.gif)\n\nThe [recording script](scripts/record-gate.js) captures real command output into an asciicast, then renders it with an already installed agg. Companion tools are installed by their users.\n\n## Measurement methods\n\n${methods}\n\n## Operation and verification\n\n- **What and why:** executable measurements keep public figures traceable to current output.\n- **Trigger:** weekly schedule, workflow dispatch, or \`node proof/scripts/measure.js\`.\n- **Invocation chain:** workflow -> measurement functions -> isolated Node fixtures -> results.json -> this page -> npm test.\n- **Dependencies:** Node and the repository. The optional GIF recorder uses agg from the asciinema project.\n- **Reads:** package scripts, the installer, runner and acceptance-check runner. Fixture tests use an isolated home and PATH.\n- **Writes:** results.json, this generated page, temporary fixture directories and local fixture logs. The recorder writes gate-demo.cast and gate-demo.gif.\n- **Closed loop:** the workflow fails when measurement or tests fail. GitHub Actions records the failure; repository notification settings decide who receives it. No separate alert service is configured.\n- **Failure modes:** runner behavior changes, missing runtime, unavailable write permission, or timing noise. Review the failed job, rerun locally, and send a reproducible issue to the repository maintainers.\n- **Run and verify:** run the commands above, inspect sample arrays and fixture exit codes in results.json, and require npm test to pass.\n- **Source of truth:** results.json and the scripts it names.\n`;
 }
 export function renderPage() {
   const data = readResults();

package/src/catalog.js

@@ -300,7 +300,7 @@ export const AIS = [
     summary: 'A local model runtime; work sent here stays on the machine',
     minLevel: 2,
     install: { url: 'https://ollama.com/download', brew: 'ollama' },
-    builtAgainst: '0.33.3',
+    builtAgainst: '0.34.4',
     auth: 'none',
     rulesFile: null,
   },
@@ -457,8 +457,8 @@ export const providerById = Object.fromEntries(PROVIDERS.map((p) => [p.id, p]));
 // Container image pins for the level 3 templates. Bump deliberately; a
 // reviewed box should not change underneath the user on a restart.
 export const IMAGES = {
-  litellm: 'ghcr.io/berriai/litellm:v1.99.1',
-  ollama: 'ollama/ollama:0.33.3'
+  litellm: 'ghcr.io/berriai/litellm:v1.100.3',
+  ollama: 'ollama/ollama:0.34.4'
 };
 
 export const byId = Object.fromEntries(AIS.map((a) => [a.id, a]));