fix(talos): stop the audit flood by selecting AppArmor correctly

.github/actions/deploy-prod/action.yml

@@ -83,7 +83,7 @@ runs:
       shell: bash
       env:
         # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-        KSAIL_VERSION: "7.202.28"
+        KSAIL_VERSION: "7.202.58"
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         .github/scripts/setup-ksail.sh

.github/workflows/cd.yaml

@@ -185,7 +185,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/ci.yaml

@@ -1042,6 +1042,7 @@ jobs:
               - 'scripts/verify-kubelet-config-readback.sh'
               - 'scripts/tests/test-kubelet-config-readback.sh'
               - 'scripts/tests/test-talos-apparmor-lsm.sh'
+              - 'scripts/tests/test-talos-apparmor-lsm-regressions.sh'
               - 'ksail.prod.yaml'
               - 'ksail.yaml'
               - '.github/scripts/setup-talosctl.sh'
@@ -1355,7 +1356,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 
@@ -2521,7 +2522,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           .github/scripts/setup-ksail.sh
@@ -2968,8 +2969,8 @@ jobs:
 
       - name: 🛡️ Validate the Talos AppArmor LSM contract
         run: |
-          shellcheck scripts/tests/test-talos-apparmor-lsm.sh
-          bash scripts/tests/test-talos-apparmor-lsm.sh
+          shellcheck scripts/tests/test-talos-apparmor-lsm.sh scripts/tests/test-talos-apparmor-lsm-regressions.sh
+          bash scripts/tests/test-talos-apparmor-lsm-regressions.sh
 
       - name: ⏱️ Validate the Talos drain budget
         run: |
@@ -3603,7 +3604,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/dr-rebuild.yaml

@@ -173,7 +173,7 @@ jobs:
         # deploy-prod action; renovate keeps the pin current in all places.
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           .github/scripts/setup-ksail.sh

.github/workflows/prove-scoped-package-access.yaml

@@ -42,7 +42,7 @@ jobs:
       - name: Setup KSail for the existing encrypted pull credential
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/validate-image-verifier-liveness.yaml

@@ -167,7 +167,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/validate-main.yaml

@@ -83,7 +83,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 
@@ -268,7 +268,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.202.28"
+          KSAIL_VERSION: "7.202.58"
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           .github/scripts/setup-ksail.sh

docs/runtime-security.md

@@ -32,6 +32,9 @@ they sit inside a wider set of controls:
 | Runtime enforcement | **Tetragon** | Declarative kernel-hook policies that **terminate the offending process** (SIGKILL) on a policy match |
 | Forensics | **API audit log** ([`talos/cluster/enable-audit-logging.yaml`](../talos/cluster/enable-audit-logging.yaml)) | Who-did-what record of control-plane mutations |
 
+With the configured `lsm=` order, AppArmor is the exclusive major LSM; SELinux is
+skipped, so Talos's default SELinux labeling of its own services does not apply.
+
 This document focuses on the two middle-to-bottom rows — the eBPF sensors.
 
 ---

scripts/reconcile-talos-kernel-args/README.md

@@ -24,8 +24,12 @@ fold inputs are:
 | `charts/` | Carries the generated `Cluster` schema published from those types; earlier audits compared it, so it stays part of the set. |
 | `go.mod`, `go.sum` | Pin the Talos machinery that encodes the machine configuration. |
 
-`--check-pins` reads all explicit KSail pins in CI, CD and the production
-deployment action. They must be explicit release versions and must all agree.
+`--check-pins` reads all explicit KSail pins in CI, CD, the production
+deployment action, direct-main validation, disaster recovery and the two
+operational proof workflows. They must be explicit release versions and must all agree.
+The disposable, non-Talos Cilium default-deny proof keeps its separately audited
+KSail 7.193.8 / Cilium image pairing. The caller inventory accounts for that
+independent profile without treating it as a deployment renderer.
 It then fetches that release's tag from the public KSail repository, reads the
 git object ID of each input, and passes only when all six equal one set
 recorded in [`audited_inputs.go`](audited_inputs.go). A git tree ID covers every
@@ -229,6 +233,22 @@ local configurations with the pinned Talos client. The ownership repair changes
 how cluster updates cooperate with existing Helm owners; this adoption preserves
 the intended production schematic and strict node-image readback.
 
+**7.202.56**, commit `5e387655892643dcf322a03d2ceb6d9ca6030979`, is audited
+against 7.202.28 for bounded Image Factory registration retries. The Talos
+generator and cluster API trees are byte-identical. The configuration manager
+reapplies a selected cluster name after inherited patches during regeneration;
+its kernel-argument fold and distribution caller are unchanged. Extension
+activation, the union and reconciliation of both roles' arguments, and explicit
+schematic-ID precedence therefore remain unchanged. The chart changes normalize
+its label and quote a README example; the extension and schematic-ID fields,
+types and defaults are unchanged. Go and unrelated dependencies move, with
+qualified source-authentication and Kubernetes compatibility replacements;
+Talos machinery, Image Factory, YAML and protobuf versions and checksums are
+unchanged. The offline render regression exercises both production and local
+roles with the pinned Talos client. This adoption retains the intended production
+schematic and strict node-image readback; retries share the original deadline
+and do not accept permanent registration failures.
+
 ```bash
 go run ./scripts/reconcile-talos-kernel-args --check-pins
 go run ./scripts/reconcile-talos-kernel-args ksail.prod.yaml controlplane.yaml worker.yaml
@@ -244,3 +264,21 @@ The same actual caller preserves both roles' arguments and UKI values with an
 explicit schematic ID, while a whitespace-only ID still permits folding.
 `TALOSCTL_BIN` may point at a locally verified client of the pinned version.
 No local cluster is started.
+
+**7.202.3**, commit `f9172ab810fdcb94b47351d04d70708f6878e10a`, is audited as
+the range 7.197.1 → 7.202.3. The Talos generator is byte-identical. The changed
+configuration manager adds pod/service network patches for the nested Kubernetes
+provider; that path is a no-op for this platform's Hetzner provider. The fold's
+trigger, argument normalization, both-role output, installer-image selection and
+explicit schematic-ID boundary are unchanged. The API and chart changes add
+network defaults and clarify existing settings; the extensions and schematic-ID
+fields retain their names, types and defaults. Dependency updates do not change
+Talos machinery or its YAML encoder. The offline render test still exercises both
+roles and rejects invalid patches.
+
+This release also contains [KSail #7300](https://github.com/devantler-tech/ksail/pull/7300):
+same-version boot-image changes now trigger a node rollout instead of being
+silently skipped. Its [final-head provider trial](https://github.com/devantler-tech/ksail/actions/runs/37591901167)
+verified a same-version image update, readiness, a second no-change plan and
+cleanup on a temporary single-node cluster. That trial does not cover autoscaled
+nodes or an interrupted rollout; the release's regression tests cover those paths.

scripts/reconcile-talos-kernel-args/audited_inputs.go

@@ -113,6 +113,14 @@ var auditedFoldInputs = []struct {
 		"go.mod":                     "aa4556d3ce50ca3a2f7397a5f0125d302bb9431f",
 		"go.sum":                     "5c4e0d2343d48b4844bbbe1fd7e706b0e767439a",
 	}},
+	{"7.202.56", map[string]string{
+		"pkg/fsutil/configmanager":   "88779a5a93cc49f116d4f5eda8389becc14d1cd8",
+		"pkg/fsutil/generator/talos": "25c9c416e06b77937e68e71a213c1b2e9ed61205",
+		"pkg/apis":                   "83982b42d9ec0b34d159783969c39ff8832e6714",
+		"charts":                     "4351b93273821f333e9f0641e323ba99387844bb",
+		"go.mod":                     "b1d9e18582954ce6a9851a64bdd1c7344d36067a",
+		"go.sum":                     "b11643f42c4e3950f2513b6370c4ede1a99f3a0e",
+	}},
 }
 
 // verifyFoldInputs passes only when every fold input of the pinned release was

scripts/reconcile-talos-kernel-args/main.go

@@ -26,7 +26,11 @@ func run(args []string) error {
 		return fmt.Errorf("usage: reconcile-talos-kernel-args --check-pins | <ksail-config> <control-plane-config> <worker-config>")
 	}
 	var pins [][]byte
-	for _, path := range []string{".github/workflows/ci.yaml", ".github/workflows/cd.yaml", ".github/actions/deploy-prod/action.yml"} {
+	for _, path := range []string{
+		".github/workflows/ci.yaml", ".github/workflows/cd.yaml", ".github/actions/deploy-prod/action.yml",
+		".github/workflows/validate-main.yaml", ".github/workflows/dr-rebuild.yaml",
+		".github/workflows/validate-image-verifier-liveness.yaml", ".github/workflows/prove-scoped-package-access.yaml",
+	} {
 		data, err := os.ReadFile(path)
 		if err != nil {
 			return fmt.Errorf("read deployment pin %s: %w", path, err)
@@ -280,8 +284,8 @@ func fold(config, cp, worker []byte) ([]byte, []byte, error) {
 	return outputs[0], outputs[1], nil
 }
 
-// verifyPins returns the one KSail release that CI, CD and the production
-// deployment action all pin. It reads no KSail source: whether the mirrored
+// verifyPins returns the one KSail release that validation, deployment,
+// recovery and operational proofs all pin. It reads no KSail source: whether the mirrored
 // fold is valid for that release is decided by verifyFoldInputs.
 func verifyPins(inputs ...[]byte) (string, error) {
 	if len(inputs) == 0 {