diff --git a/lib/cso/runtime-catalog.json b/lib/cso/runtime-catalog.json
index b80298cfc..b9adbc692 100644
--- a/lib/cso/runtime-catalog.json
+++ b/lib/cso/runtime-catalog.json
@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "revision": "cso-v3-build-reviewed-2026-09-10",
-  "previousRevision": null,
+  "revision": "cso-v3-39674065531-133cb360842d",
+  "previousRevision": "cso-v3-build-reviewed-2026-09-10",
   "helperAbi": 3,
   "buildRevision": "cso-runtime-inputs-2026-09-10",
   "profiles": [
@@ -10,7 +10,11 @@
       "stack": "node",
       "platform": "linux/amd64",
       "state": "build_reviewed",
-      "versions": { "node": "24.4.0", "npm": "11.4.2", "cso-preparation": "1.0.0" },
+      "versions": {
+        "node": "24.4.0",
+        "npm": "11.4.2",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -18,7 +22,11 @@
       "stack": "node",
       "platform": "linux/arm64",
       "state": "build_reviewed",
-      "versions": { "node": "24.4.0", "npm": "11.4.2", "cso-preparation": "1.0.0" },
+      "versions": {
+        "node": "24.4.0",
+        "npm": "11.4.2",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -26,7 +34,10 @@
       "stack": "bun",
       "platform": "linux/amd64",
       "state": "build_reviewed",
-      "versions": { "bun": "1.3.10", "cso-preparation": "1.0.0" },
+      "versions": {
+        "bun": "1.3.10",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -34,7 +45,10 @@
       "stack": "bun",
       "platform": "linux/arm64",
       "state": "build_reviewed",
-      "versions": { "bun": "1.3.10", "cso-preparation": "1.0.0" },
+      "versions": {
+        "bun": "1.3.10",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -42,7 +56,11 @@
       "stack": "python",
       "platform": "linux/amd64",
       "state": "build_reviewed",
-      "versions": { "python": "3.13.4", "uv": "0.8.0", "cso-preparation": "1.0.0" },
+      "versions": {
+        "python": "3.13.4",
+        "uv": "0.8.0",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -50,7 +68,11 @@
       "stack": "python",
       "platform": "linux/arm64",
       "state": "build_reviewed",
-      "versions": { "python": "3.13.4", "uv": "0.8.0", "cso-preparation": "1.0.0" },
+      "versions": {
+        "python": "3.13.4",
+        "uv": "0.8.0",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -58,7 +80,11 @@
       "stack": "rails",
       "platform": "linux/amd64",
       "state": "build_reviewed",
-      "versions": { "ruby": "3.4.4", "bundler": "2.6.7", "cso-preparation": "1.0.0" },
+      "versions": {
+        "ruby": "3.4.4",
+        "bundler": "2.6.7",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -66,7 +92,11 @@
       "stack": "rails",
       "platform": "linux/arm64",
       "state": "build_reviewed",
-      "versions": { "ruby": "3.4.4", "bundler": "2.6.7", "cso-preparation": "1.0.0" },
+      "versions": {
+        "ruby": "3.4.4",
+        "bundler": "2.6.7",
+        "cso-preparation": "1.0.0"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -74,7 +104,9 @@
       "stack": "postgresql",
       "platform": "linux/amd64",
       "state": "build_reviewed",
-      "versions": { "postgresql": "17.2" },
+      "versions": {
+        "postgresql": "17.2"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     },
     {
@@ -82,9 +114,298 @@
       "stack": "postgresql",
       "platform": "linux/arm64",
       "state": "build_reviewed",
-      "versions": { "postgresql": "17.2" },
+      "versions": {
+        "postgresql": "17.2"
+      },
       "reviewedAt": "2026-09-10T00:00:00.000Z"
     }
   ],
-  "runtimes": []
+  "promotion": {
+    "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+    "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+    "evidenceDigest": "sha256:3e7b150d2baa737c49743a5ca04c126a1a03e40e3f761c3820076949d8d886df",
+    "qualificationEvidenceDigest": "sha256:0ddc6d6876ae8b6c630faf576e8fbbb95323bd193998e37c4a83e42dafe1bc9c",
+    "requalification": {
+      "helperAbi": 3,
+      "isolationPolicyHash": "2ae25762ae556094cff083d1e9f0eb4884f22f5918920609c7b05a57c8e208fc",
+      "preparationSha256": "c721b5851c661dda35218994f714043472ad09bc339c4c3b5c7cb6961f69b898",
+      "buildInputsRevision": "cso-runtime-inputs-2026-09-10"
+    }
+  },
+  "runtimes": [
+    {
+      "id": "node-24.4.0-amd64",
+      "stack": "node",
+      "platform": "linux/amd64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/node-amd64@sha256:f7a52b8916cc78a846650c52b7847839b475fa6e81c5f3a7fd9b57e6b2915444",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "cso-preparation": "1.0.0",
+        "node": "24.4.0",
+        "npm": "11.4.2"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:1f33ea574738bf16ae2433f5a03a731654c2a808404e1547a6a598f3e955a973",
+        "provenanceDigest": "sha256:9e7d120e174eba06610ba853c8f89837f3e9d29547e9b63fa961531edee43239",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "node-24.4.0-arm64",
+      "stack": "node",
+      "platform": "linux/arm64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/node-arm64@sha256:a21c1aae3279793f546c09106528e3e05189e90f46c74a1dfd4bd294cd37f7ba",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "cso-preparation": "1.0.0",
+        "node": "24.4.0",
+        "npm": "11.4.2"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:6e13ed8415018576ab6cca8d962f6f3ea547c7c26ec01d645aee2910f9a2fa28",
+        "provenanceDigest": "sha256:39e5fa6d84ca0b22206d3c2c37827df490e2e21122f6a25dc03d117ce1e6e238",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "bun-1.3.10-amd64",
+      "stack": "bun",
+      "platform": "linux/amd64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/bun-amd64@sha256:49809f7c933954c2468c6dda731d1cef0d38ad1eb6b29d341f715fe09073aa89",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "bun": "1.3.10",
+        "cso-preparation": "1.0.0"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:b20227dfa4d520ebc7c0a448535e1bf0defcfc8aa5ffaca01157db246f5573a5",
+        "provenanceDigest": "sha256:bb111e4982d61b72d6e564d7a915440d6c61c0cb8e081810bfef33cefdc40323",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "bun-1.3.10-arm64",
+      "stack": "bun",
+      "platform": "linux/arm64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/bun-arm64@sha256:3194bbf094cdd0ee8a92b43f782f3ab1cad195dafc3eb9dcea66e4c2d2795733",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "bun": "1.3.10",
+        "cso-preparation": "1.0.0"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:f4e3a814c9121d98016bf19c590b4821741aec3904917e14bbf7f40d26a03253",
+        "provenanceDigest": "sha256:003a5e1a85412907b9c7ce9198ebe6a09bda8d457ecff60ae6ccc91d78ad0775",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "python-3.13.4-uv-0.8.0-amd64",
+      "stack": "python",
+      "platform": "linux/amd64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/python-amd64@sha256:93d17316a0bd53721904ef1d4b3259421248f1ee73b8ace14f4e323090f6e107",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "cso-preparation": "1.0.0",
+        "python": "3.13.4",
+        "uv": "0.8.0"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:0ae2eef050f0d4e68b4702fe29e2e8e325f4fa83500d9accc86f10a4825de947",
+        "provenanceDigest": "sha256:47b91e8706c764b4b1ca82dc96a90b131cf15882fca41b9fa2e45824bf2a5699",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "python-3.13.4-uv-0.8.0-arm64",
+      "stack": "python",
+      "platform": "linux/arm64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/python-arm64@sha256:69fbc13c7395c0f10fd02ebb648a41d6bcd20b801a8369a4073433a64720eafb",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "cso-preparation": "1.0.0",
+        "python": "3.13.4",
+        "uv": "0.8.0"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:c7da1793dda06b71b7705dbb1b4ca7f44d994a843aacea7e7b9df3210df4f29c",
+        "provenanceDigest": "sha256:5cb118f89b3422d1e4e009f0e004ea27e39f7b19d5a5d7090513da5b2c1f7abe",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "rails-ruby-3.4.4-amd64",
+      "stack": "rails",
+      "platform": "linux/amd64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/rails-amd64@sha256:11e35903d9d53a9965fd5cb03d898275db41512b152443a12c433a36e6e1ee69",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "bundler": "2.6.7",
+        "cso-preparation": "1.0.0",
+        "ruby": "3.4.4"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:74da76f47df2ba2f2bee0b829fb4e1c220dc859c211e5c51d2e17e2b6d3c9cb2",
+        "provenanceDigest": "sha256:183ec989bc6a22f36348177a46cb81aea7156cb6625af82b2f6d2672eade768c",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "rails-ruby-3.4.4-arm64",
+      "stack": "rails",
+      "platform": "linux/arm64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/rails-arm64@sha256:2210c1aec0a8226cd2aafa9a6238f95fc07a2c840129e85aff6d70d6cec6ddce",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "bundler": "2.6.7",
+        "cso-preparation": "1.0.0",
+        "ruby": "3.4.4"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "application",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:3a115e5a520e0baf0828600f03bcd068709e8a48fa6dd1b11e677c9ef9a1c9d9",
+        "provenanceDigest": "sha256:6e64dd8ccec1dc673baff97364bc4d7264580d351cee0513671904d870ce0525",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "positiveNegativeAssertionsPassed": true,
+        "heldOutRepairPassed": true
+      }
+    },
+    {
+      "id": "postgresql-17.2-amd64",
+      "stack": "postgresql",
+      "platform": "linux/amd64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/postgresql-amd64@sha256:006442609a277af34656366320866e3d6eb26e4c9241e2313c4856519628eab4",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "postgresql": "17.2"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "postgresql",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:5b7699536fdeb0f473eee0952e4e9f1b37050c099b9b5076eb1781d854977d6f",
+        "provenanceDigest": "sha256:337bb19b9aa7c6be3f6658f8f0ec4b84238ba69f7be006184f129b44e76b9b71",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "multiDatabasePassed": true,
+        "readinessPassed": true
+      }
+    },
+    {
+      "id": "postgresql-17.2-arm64",
+      "stack": "postgresql",
+      "platform": "linux/arm64",
+      "state": "qualified",
+      "image": "ghcr.io/garrytan/gstack/cso-staging/postgresql-arm64@sha256:9df877dabc0ea9d05beb7947c10dc3000617c1e5162e95b83dd9618ad3d16f7a",
+      "entrypoint": "/opt/cso/entrypoint",
+      "helperAbi": 3,
+      "versions": {
+        "postgresql": "17.2"
+      },
+      "policyVersion": "cso-isolation-v1",
+      "qualifiedAt": "2026-10-21T20:57:28.000Z",
+      "qualification": {
+        "kind": "postgresql",
+        "sourceCommit": "133cb360842d0a7cf88fc1d10dcb624f2b7b841f",
+        "workflow": "https://github.com/garrytan/gstack/actions/runs/39674065531",
+        "sbomDigest": "sha256:2b319e83d0b74def00dea625e24c886a71f7fea828327eb6cb4dfd8f7e777aa8",
+        "provenanceDigest": "sha256:cf27a88b3b1351aec9182e2b3509bd7e83b6046d1e9f1ea8d46054d30acbeeaf",
+        "verifiedProvenance": true,
+        "containmentPassed": true,
+        "coldStartPassed": true,
+        "multiDatabasePassed": true,
+        "readinessPassed": true
+      }
+    }
+  ]
 }