The published image is a compatibility candidate for isolated PastureStack integration testing. It is not a general-purpose or currently supported etcd release.

• Treat dependency and Go toolchain changes as storage-critical changes.
• Run unit, integration, snapshot, WAL, lease, watch, upgrade, rollback, backup, and member-replacement tests against the exact candidate.
• Do not weaken TLS, authentication, peer validation, or request-size controls for compatibility.
• Verify health endpoints against the managed etcd.<stack> DNS identity even when the TCP connection targets a container alias or loopback address; never add an insecure TLS fallback.
• Block publication when the exact candidate contains a HIGH or CRITICAL vulnerability or a detected secret.
• Keep raw and applicable scan results for build-only images. A not_affected OpenVEX statement is accepted only when the raw HIGH/CRITICAL CVE and package-PURL set exactly matches the reviewed statement set; the runtime candidate must remain zero without VEX suppression.
• Treat the three inherited public test keys as non-deployable fixtures only. Their paths and content hashes are fixed by trivy-secret.yaml and scripts/validate, and the runtime image must contain none of them.
• Do not commit cluster snapshots, WAL files, credentials, certificates, private endpoints, personal registry coordinates, or production topology.
• Block a v2-to-v3 migration when the read-only preflight finds TTL keys. The official offline transformer does not preserve expiry semantics.
• Never skip an etcd minor-version boundary, run the offline migration against a live member data directory, or disable v2 before every member passes the 3.5.33 v2store-and-WAL check.

Report suspected vulnerabilities through this repository's private security advisory channel. Do not include live credentials, private cluster data, or production snapshots in a public issue.