test: prepare phase 9 requalification harness and blocker register

docs/redesign/phase-9/p9-requal-01/SECURITY.md

@@ -10,6 +10,16 @@ or proof of application reachability. No production package, service or image wa
 | P9-REQUAL-SEC01 | MimeKit4.17.0 resolves Pkcs8.0.1; high and moderate denial-of-service advisories | Direct Pkcs8.0.2 security floor, preserving supported8.x API; refresh API and both test-project locks | Live API NuGet graph reports no vulnerable packages |
 | P9-REQUAL-SEC02 | Next16.3.8 matches critical/high advisories | Pin Next and matching ESLint config16.4.1; matching Next compiler/environment packages change together | Live npm policy passes, zero reported vulnerabilities |
 | P9-REQUAL-SEC03 | Dev-only ESLint hooks chain resolves Zod4.5.4 | Override4.6.6, within existing compatible4.x range | Live npm policy passes; no exception bypass |
+| P9-REQUAL-SEC04 | Sidecar Linux hash lock contains reported advisories across eight packages, including upload parsers and ML dependencies | No broad parser/ML transition attempted; separately validated remediation required | OPEN; exact-pin advisory coverage also INCOMPLETE |
+
+The additional [Python review](PYTHON_SECURITY.md) queries all49 exact Linux lock pins. Its
+[machine-readable evidence](python-advisories.json) records98 queries,97 successful responses and
+one PyPI404 for the vendor-local `torch==2.6.0+cpu` release; the exact OSV query succeeds. The249
+provider records group into109 sets of published aliases across eight packages. These are not109
+independent CVEs or reproduced exploits. Published records include critical/high labels. The
+untrusted-upload path reaches the PDF/image libraries; existing limits do not close these findings.
+Major parser/ML compatibility, model integrity and complete release validation are separate work.
+The sidecar source, hash lock and configured model remain unchanged. Overall security is **OPEN**.
 
 The current static export does not run the Next server's image optimizer, Server Actions or
 `use cache`. Existing Sharp0.35.5 also satisfies the published image-optimizer workaround. Those
@@ -33,7 +43,7 @@ are retained as superseded evidence rather than added to these totals.
 
 Existing offline supply-chain/evaluator/browser-runtime/ingress/SMTP/dependency-policy/extension
 guards pass. Tracked-secret scanning and SBOM generation pass. Those checks are narrower than an
-application security certification. The inherited temporary dev-advisory policy expires on
+application security certification or a clean Python advisory gate. The inherited temporary dev-advisory policy expires on
 1November2026UTC; it was neither broadened nor extended, and the current npm audit uses no exception.
 Production still requires independent ingress, deployed identity, storage/recovery, provider,
 monitoring and human release qualifications.