diff --git a/manifests/image-matrix.json b/manifests/image-matrix.json
index 087c357..6583b6c 100644
--- a/manifests/image-matrix.json
+++ b/manifests/image-matrix.json
@@ -102,6 +102,17 @@
         "full_text": "compat-ok",
         "llm_request_count": 1
       }
+    },
+    {
+      "id": "upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f",
+      "version": "1.18.18",
+      "image": "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f",
+      "tag_provenance": "ghcr.io/anomalyco/opencode:1.18.18",
+      "consumers": [],
+      "profiles": ["ruby-rest-sse"],
+      "required_consumer_profiles": [],
+      "certification_scope": "shared-client-contract-only",
+      "certification_status": "pending"
     }
   ],
   "host_canary": [
diff --git a/manifests/upstream.json b/manifests/upstream.json
index baf7342..7085f6c 100644
--- a/manifests/upstream.json
+++ b/manifests/upstream.json
@@ -1,9 +1,9 @@
 {
   "repository": "anomalyco/opencode",
-  "release_tag": "v1.18.3",
-  "version": "1.18.3",
-  "published_at": "2026-07-16T15:34:33Z",
-  "release_url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.3",
-  "image": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
-  "observed_at": "2026-07-18T00:00:00Z"
+  "release_tag": "v1.18.18",
+  "version": "1.18.18",
+  "published_at": "2026-08-13T01:15:04Z",
+  "release_url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.18",
+  "image": "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f",
+  "observed_at": "2026-08-18T19:30:00Z"
 }
diff --git a/test/repository_test.rb b/test/repository_test.rb
index 27ca8d9..ec86b1a 100644
--- a/test/repository_test.rb
+++ b/test/repository_test.rb
@@ -49,21 +49,64 @@ class RepositoryTest < Minitest::Test
       assert_equal ["ruby-rest-sse"], target.fetch("profiles")
       assert_equal "shared-client-contract-only",
         target.fetch("certification_scope", "shared-client-contract-only")
-      assert_equal "certified", target.fetch("certification_status")
+      assert_includes %w[certified pending], target.fetch("certification_status")
+    end
+
+    certified_rows = targets.select { |target| target.fetch("certification_status") == "certified" }
+    assert_equal %w[upstream-1.16.1 upstream-1.17.18 upstream-1.18.3],
+      certified_rows.map { |target| target.fetch("id") }.sort
+    certified = certified_rows.to_h { |target| [target.fetch("id"), target] }
+
+    travelwolf = certified.fetch("upstream-1.16.1")
+    assert_equal "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
+      travelwolf.fetch("image")
+    assert_equal ["travelwolf"], travelwolf.fetch("consumers")
+    assert_equal ["rails-persisted-turn"], travelwolf.fetch("required_consumer_profiles")
+    assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766",
+      travelwolf.dig("current_certification", "client_commit")
+    assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json",
+      travelwolf.dig("current_certification", "evidence")
+
+    ajent_plugin = certified.fetch("upstream-1.17.18")
+    assert_equal "ghcr.io/anomalyco/opencode@sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97",
+      ajent_plugin.fetch("image")
+    assert_equal ["opencode-ajent"], ajent_plugin.fetch("consumers")
+    assert_equal ["plugin-ledger"], ajent_plugin.fetch("required_consumer_profiles")
+    assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766",
+      ajent_plugin.dig("current_certification", "client_commit")
+    assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json",
+      ajent_plugin.dig("current_certification", "evidence")
+
+    ajent_rails = certified.fetch("upstream-1.18.3")
+    assert_equal "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
+      ajent_rails.fetch("image")
+    assert_equal ["ajent-rails"], ajent_rails.fetch("consumers")
+    assert_equal ["rails-persisted-turn", "plugin-ledger"],
+      ajent_rails.fetch("required_consumer_profiles")
+    assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766",
+      ajent_rails.dig("current_certification", "client_commit")
+    assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json",
+      ajent_rails.dig("current_certification", "evidence")
+
+    certified.each_value do |target|
       current = target.fetch("current_certification")
       assert_equal "certified", current.fetch("status")
-      assert_match(/\A[0-9a-f]{40}\z/, current.fetch("client_commit"))
-      assert_match(/\A[0-9a-f]{40}\z/, current.fetch("rails_commit"))
+      assert_equal "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f", current.fetch("rails_commit")
       assert_equal current.fetch("expected_text"), current.fetch("full_text")
       assert_equal 1, current.fetch("llm_request_count")
       assert_path_exists File.join(ROOT, current.fetch("evidence"))
-      previous = target["previous_certification"]
-      next unless previous
+    end
 
-      assert_equal "certified", previous.fetch("status")
-      assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
-      assert_equal previous.fetch("expected_text"), previous.fetch("full_text")
-      assert_equal 1, previous.fetch("llm_request_count")
+    pending = targets.select { |target| target.fetch("certification_status") == "pending" }
+    assert_operator pending.length, :<=, 1
+    upstream_image = json("manifests/upstream.json").fetch("image")
+    assert_equal 1, targets.count { |target| target.fetch("image") == upstream_image }
+    pending.each do |target|
+      assert_equal upstream_image, target.fetch("image")
+      refute target.key?("current_certification")
+      refute target.key?("previous_certification")
+      assert_empty target.fetch("consumers")
+      assert_empty target.fetch("required_consumer_profiles")
     end
   end