fix: pin model revisions and quarantine MariaDB CI routing

docs/redesign/phase-9/p9-sec-02/ADVISORY_RESEARCH.md

@@ -0,0 +1,81 @@
+# P9-SEC-02 advisory research
+
+Read-only source assessment; **no runtime compatibility or production acceptance claimed**. All44 remaining groups are assessed individually in [advisory-research.json](advisory-research.json). The JSON retains original alias IDs, affected ranges, fixed events, severity/vector, refreshed primary evidence, installed paths/hashes, input reachability, mitigation/residual, compatibility risks and required tests. Root qualification owns final dispositions.
+
+## Accounting
+
+109 original alias groups =65 previously removed +44 researched here (filelock3, torch19, Transformers22). The earlier249→99 provider-record counts are retained and are not distinct vulnerability counts. This lane adds zero runtime/model qualification passes. No owner acceptance.
+
+## Minimal candidate graph and compatibility gates
+
+- filelock4.2.1 addresses all three published filelock ranges. Qualify native and soft fallback lock ownership, contention/stale markers and finite timeouts on Windows and Linux; shared writable cache permissions are not established here.
+- torch2.13.0+cpu is the smallest published all-fixable-record bound because JIT CVE-2025-3000 remains affected through2.12.1. The vendor CPU index advertises cp312 Windows amd64 and manylinux_2_28 x86_64 wheels. Use those CPU identities, not the PyPI generic Linux wheel that requires CUDA13. Actual wheel/import/inference qualification is pending.
+- Transformers5.10.0 is the latest first-patched bound among these records (chat-template save traversal). Its base metadata requires huggingface-hub>=1.5,<2, tokenizers>=0.22,<=0.23, regex>=2025.10.22 and typer; current installed hub0.36.2/tokenizers0.21.4 cannot stay pinned. Resolve/hash the graph in isolation and preserve the65 prior remediations. Tagged5.10 source still has AutoModelForSeq2SeqLM and BART mapping; that is not import/inference proof.
+- These versions do not establish closure of all44: eight ZDI conversion/deserialization groups and torch.pt2 have no verified release fix. CVE-2025-55554 has a still-open vendor issue despite a provider2.9 fix event. Never claim a fully safe graph from maximum version arithmetic alone.
+
+Candidate metadata: [filelock](https://pypi.org/pypi/filelock/4.2.1/json), [torch](https://pypi.org/pypi/torch/2.13.0/json), [Transformers](https://pypi.org/pypi/transformers/5.10.0/json), [vendor CPU index](https://download.pytorch.org/whl/cpu/torch/).98 distinct source responses retained: first54-request vendor/security batch succeeded, then all44 OSV refreshes succeeded.12 repeated GitHub API requests hit rate limits; initial successful raw bodies remain, with captured-file mtime explicitly distinguished from HTTP retrieval timestamps. Exact URLs, hashes and repeat errors are in `.artifacts/p9-sec-02/advisory-research/refresh-index.json`.
+
+## Actual service path and limits
+
+`app.py:161` loads fixed-name AutoTokenizer/AutoModelForSeq2SeqLM, calls eval, then tokenizer truncation1024 → no_grad → generate with3 beams → decode. Installed Auto mappings select BartTokenizer/Fast and BartForConditionalGeneration for a BART config. BART layers are attention/linear/norm; dropout exists but eval disables training dropout. This differs from LSTM, CTC, image pooling, sparse graphs, JIT/Inductor, TensorFlow optimizers and conversion CLIs. The parser child handles uploads via pypdf/Pillow/Tesseract, not Donut/Transformers video/CTC.
+
+The actual serialized config/checkpoint remains a separate trust boundary: no immutable model revision or manifest is supplied by app.py; safetensors is not required. Installed Transformers load_state_dict493 reaches torch.load535 for non-safetensors files with weights_only=True. That flag does not protect torch2.6 from CVE-2026-24747. Do not dismiss loader risk just because app.py lacks a direct torch.load call. Fixed model name is not artifact integrity.
+
+Installed source fingerprints are preserved in `installed-source-matches.json`; no Python model modules were imported. Windows METADATA reports torch2.6.0 rather than locked2.6.0+cpu. Installed model tree has no conversion scripts and no LightGlue implementation; these facts qualify specific paths and do not clear the entire package. Current4.48.3 attention selection rejects arbitrary repository strings; CVE-2026-4372 still needs an introduction/fix or safe negative regression before a definitive exemption.
+
+## Individual alias groups
+
+Disposition is scoped to the current inspected service, and does not silently remove matching package records. “Fix available but blocked by compatibility” means qualification is pending, not that a failed compatibility test occurred. Published severities remain unchanged.
+
+| Group / all aliases | Vulnerable function and installed locator | Range → patch | Service reachability and residual | Disposition |
+| --- | --- | --- | --- | --- |
+| [CVE-2026-112940](https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8)<br>GHSA-v4x8-3wr5-3wq8 | ReadWriteLock SQLite database reopen and POSIX symlink/side-file handling<br>`tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py` | >= 3.20.4, <= 4.2.0 → 4.2.1 | SQLite-backed ReadWriteLock is a different lock type from Hub WeakFileLock; installed Hub _fixes.py constructs FileLock then SoftFileLock. Remote document text cannot choose lock type or database filename. No ReadWriteLock application import/call. Scoped service lock selection excludes this SQLite API; package remains in affected range. Reassess if reader/writer locks are introduced. | Not affected with evidence |
+| [CVE-2026-112913](https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5)<br>GHSA-9vhv-jxww-xfm5 | ReadWriteLock Windows SQLite -wal/-journal/-shm handling<br>`tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py` | >= 3.20.4, <= 4.2.0 → 4.2.1 | Requires local attacker-created SQLite side files in shared writable directory. Current cache helper uses native FileLock or SoftFileLock, not SQLite ReadWriteLock; parser has no filelock import. Service call graph excludes ReadWriteLock, not all uses of filelock. Cache directory permissions are not claimed verified. | Not affected with evidence |
+| [CVE-2026-112907](https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92)<br>GHSA-567q-5qvw-pf92 | SoftFileLock marker open/stale breaking on Windows oplock<br>`tools/summarizer/.venv/Lib/site-packages/filelock/_soft.py` | >= 3.22.0, <= 4.2.0 → 4.2.1 | Hub WeakFileLock fallback reaches SoftFileLock; filelock native lock can also fall back. Local user able to open cache marker can stall open beyond timeout. Cannot dismiss using HTTP request limits or parser child timeout. Upgrade filelock4.2.1; qualify native/fallback lock contention, stale marker and finite timeout on Windows and Linux. Existing source checks do not prove ACL isolation. | Fix available but blocked by compatibility |
+| [CVE-2025-3001](https://github.com/advisories/GHSA-qfhq-4f3w-5fph)<br>BIT-pytorch-2025-3001, GHSA-qfhq-4f3w-5fph, PYSEC-2025-195 | torch.lstm_cell / native LSTM cell tensor validation<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/rnn.py` | < 2.10.0 → 2.10.0 | Installed LSTMCell forwards to _VF.lstm_cell. BART decoder uses attention, linear and layer norms, not recurrent LSTMCell. Request text becomes bounded token IDs, not arbitrary tensor dimensions or Python graphs. BART architecture excludes LSTM operation; native wheel and future architectures remain vulnerable until patched. | Mitigated with residual risk |
+| [CVE-2025-3000](https://github.com/advisories/GHSA-rrmf-rvhw-rf47)<br>BIT-pytorch-2025-3000, GHSA-rrmf-rvhw-rf47, PYSEC-2025-194 | torch.jit.script compilation<br>`tools/summarizer/.venv/Lib/site-packages/torch/jit/_script.py` | <= 2.12.1 → 2.13.0 | Application does not call script or torch.compile; model loader creates Python BART class and generate uses eager no_grad. Text cannot submit Python source or choose a compiled graph. Third-party optional branches/native internals are not runtime qualified. 2.13.0 is current published first patch; synthetic eager tests alone cannot prove selected checkpoint inference compatibility. | Fix available but blocked by compatibility |
+| [CVE-2025-2999](https://github.com/advisories/GHSA-vgrw-7cvw-pwgx)<br>BIT-pytorch-2025-2999, GHSA-vgrw-7cvw-pwgx, PYSEC-2025-193 | torch.nn.utils.rnn.unpack_sequence<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/utils/rnn.py` | < 2.9.1 → 2.9.1 | BART accepts padded input_ids plus attention_mask and does not construct PackedSequence or unpack_sequence; malicious tensor metadata is not an HTTP input. Different RNN API; retain affected-package finding until patched or scoped owner decision. | Mitigated with residual risk |
+| [CVE-2025-2953](https://github.com/advisories/GHSA-3749-ghw9-m3mg)<br>BIT-pytorch-2025-2953, GHSA-3749-ghw9-m3mg, PYSEC-2025-191 | torch.mkldnn_max_pool2d<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | < 2.7.1-rc1 → 2.7.1-rc1 | Vendor names mkldnn_max_pool2d. BART attention/linear architecture contains no image/max-pooling layer. Raw image bytes go to separate OCR parser; they are not passed as model tensor graphs. No selected BART max-pooling path identified; local arbitrary Python remains outside HTTP boundary. | Mitigated with residual risk |
+| [CVE-2025-46148](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)<br>BIT-pytorch-2025-46148, PYSEC-2025-198 | nn.PairwiseDistance(p=2), eager/Inductor inconsistent result<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/distance.py` | Prior provider events → 2.7.0; exact ranges in JSON | Installed PairwiseDistance wrapper exists; BART/generate path does not compute pairwise distances. Vendor issue describes numeric correctness, not a demonstrated remotely supplied model graph. Architectural separation reduces service exposure; provider range and severity retained without claiming native safety. | Mitigated with residual risk |
+| [CVE-2025-46149](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)<br>BIT-pytorch-2025-46149, PYSEC-2025-199 | nn.Fold Inductor code generation assertion<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/fold.py` | Prior provider events → 2.7.0; exact ranges in JSON | Fold constructs image blocks; BART text inference has no Fold and does not call torch.compile or Inductor. Requires a different operation and compiler route; preserve scanner finding until package patch. | Mitigated with residual risk |
+| [CVE-2025-46150](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)<br>BIT-pytorch-2025-46150, PYSEC-2025-200 | FractionalMaxPool2d torch.compile correctness<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/pooling.py` | Prior provider events → 2.7.0; exact ranges in JSON | No FractionalMaxPool2d in selected BART layers; application performs eager eval generation without compilation. Model graph cannot be supplied through text; unqualified optional/native branches remain residual. | Mitigated with residual risk |
+| [CVE-2025-46152](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)<br>BIT-pytorch-2025-46152, PYSEC-2025-201 | bitwise_right_shift boundary shift in Inductor<br>`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/codegen/cpp.py` | Prior provider events → 2.7.0; exact ranges in JSON | Vendor issue concerns compiled out-of-range shift count. Application accepts text, no arbitrary shift operand/compiler graph; selected BART layer source has no bitwise_right_shift. Eager BART separation; not a claim that every installed tensor operation is fixed. | Mitigated with residual risk |
+| [CVE-2025-46153](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)<br>BIT-pytorch-2025-46153, PYSEC-2025-202 | bernoulli_p decomposition, fallback_random, Dropout1d/2d/3d<br>`tools/summarizer/.venv/Lib/site-packages/torch/_decomp/decompositions.py` | Prior provider events → 2.7.0; exact ranges in JSON | BART contains functional.dropout, so merely saying no dropout would be false. model.eval() disables training dropout; app does not enable Inductor fallback_random nor spatial Dropout1d/2d/3d. Vendor source points to Inductor fallback; old summary says before3.7.0 while range fixes2.7.0. Preserve discrepancy and use exact provider events, not guessed3.7 pin. | Mitigated with residual risk |
+| [CVE-2025-55551](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)<br>BIT-pytorch-2025-55551, PYSEC-2025-203 | torch.linalg.lu with slicing in Inductor/AOT<br>`tools/summarizer/.venv/Lib/site-packages/torch/linalg/__init__.py` | Prior provider events → 2.9.0; exact ranges in JSON | Vendor issue contrasts compiled/AOT and eager LU slicing. BART attention does not perform LU decomposition and application has no compile/AOT route. Published range includes2.6 though issue title mentions2.8; no suppression solely from version in prose. | Mitigated with residual risk |
+| [CVE-2025-55552](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)<br>BIT-pytorch-2025-55552, PYSEC-2025-204 | torch.rot90 and randn_like compiled graph<br>`tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py` | Prior provider events → 2.9.0; exact ranges in JSON | BART does not rotate image tensors or compile rot90/randn_like graphs. Text token IDs cannot select these APIs. Vendor issue is compiler/eager mismatch; package severity remains source-reported. | Mitigated with residual risk |
+| [CVE-2025-55553](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)<br>BIT-pytorch-2025-55553, PYSEC-2025-205 | proxy_tensor.py tracing .random_ syntax error<br>`tools/summarizer/.venv/Lib/site-packages/torch/fx/experimental/proxy_tensor.py` | Prior provider events → 2.7.1; exact ranges in JSON | Proxy tensor tracing/compiler route, not ordinary BART no_grad eager generation. Application exposes no graph tracing or caller-defined modules. No compiled tracing request boundary identified; changing execution mode needs new review. | Mitigated with residual risk |
+| [CVE-2025-55554](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)<br>BIT-pytorch-2025-55554, PYSEC-2025-206 | torch.nan_to_num then long edge-case numeric conversion<br>`tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py` | Prior provider events → 2.9.0; exact ranges in JSON | Selected BART source has no nan_to_num().long() chain. Vendor issue remains open despite provider2.9.0 fix event; report does not infer closed/resolved from version metadata. Provider patch claim conflicts with still-open vendor issue. Need fix-commit/reproducer confirmation before Fixed verified. | Unresolved |
+| [CVE-2025-55557](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)<br>BIT-pytorch-2025-55557, PYSEC-2025-207 | Inductor compiled cummin Triton NameError<br>`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py` | Prior provider events → 2.7.1; exact ranges in JSON | Selected BART attention and beam generation do not call compiled cummin; eager app supplies token text and uses CPU baseline rather than authored Triton kernels. Architectural reduction only; CPU and CUDA selection still require candidate qualification. | Mitigated with residual risk |
+| [CVE-2025-55558](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)<br>BIT-pytorch-2025-55558, PYSEC-2025-208 | Inductor Conv2d/hardshrink/view/mv compiler failure<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | Prior provider events → 2.7.1; exact ranges in JSON | Vendor issue reports CppCompileError while scanner summary calls buffer overflow. BART is text attention/linear model, lacks this Conv2d/hardshrink chain, and app does not compile. Retain source disagreement; no security downgrade justified merely by compiler error title. | Mitigated with residual risk |
+| [CVE-2025-55560](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)<br>BIT-pytorch-2025-55560, PYSEC-2025-209 | Inductor to_sparse/to_dense lowering<br>`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py` | Prior provider events → 2.7.1; exact ranges in JSON | BART does not create sparse model inputs and app does not enable Inductor. Sparse tensor graph cannot be submitted through summarize text. Package remains affected according to provider; graph separation is a mitigation, not patch proof. | Mitigated with residual risk |
+| [CVE-2026-4538](https://github.com/pytorch/pytorch/)<br>BIT-pytorch-2026-4538, PYSEC-2026-139 | torch.export.load .pt2 deserialization<br>`tools/summarizer/.venv/Lib/site-packages/torch/export/__init__.py` | Prior provider events → no published fix; exact ranges in JSON | Installed export.load API exists but Transformers load_state_dict uses safetensors or torch.load, not export.load. Neither app nor parser accepts .pt2 or model uploads. Fixed repository alone does not establish checkpoint integrity. No published fixed release in baseline ranges. Vendor PR176791 closed without merged_at; proposal requires explicit weights_only=True and cannot establish released patch. No export.load in service path. | No fix |
+| [CVE-2025-3730](https://github.com/advisories/GHSA-887c-mr87-cxwp)<br>BIT-pytorch-2025-3730, GHSA-887c-mr87-cxwp, PYSEC-2026-1970 | torch.nn.functional.ctc_loss / native LossCTC<br>`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | <= 2.7.1 → 2.8.0 | Vendor identifies CTC loss; service invokes BARTForConditionalGeneration.generate without labels, training or CTC. OCR uses Tesseract in parser child, not torch CTC. Specific alternate loss API, not generic model-resource bug. No inference/native compatibility PASS asserted. | Mitigated with residual risk |
+| [CVE-2026-24747](https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p)<br>BIT-pytorch-2026-24747, GHSA-63cw-57p8-fm3p, PYSEC-2026-1856, PYSEC-2026-2286 | torch.load(weights_only=True) unpickler memory corruption<br>`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py` | < 2.10.0 → 2.10.0 | Actual installed load_state_dict493 forwards non-safetensors checkpoints to torch.load535 with weights_only=True. app.from_pretrained does not require safetensors or pin revision; therefore malicious or compromised model/cache checkpoint can reach vulnerable loader even though no direct app torch.load exists. Upgrade torch>=2.10 minimum for this issue; full published graph needs2.13.0. Require immutable revision, actual artifact format/hashes and benign inference. weights_only=True is not sufficient mitigation on2.6. | Fix available but blocked by compatibility |
+| [CVE-2025-14929](https://osv.dev/vulnerability/PYSEC-2025-217)<br>PYSEC-2025-217 | X-CLIP checkpoint conversion unsafe deserialization<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/x_clip/convert_x_clip_original_pytorch_to_hf.py` | Prior provider events → no published fix; exact ranges in JSON | Installed wheel contains no *convert* files under transformers/models. BART auto model selection does not run X-CLIP conversion CLI; service accepts no checkpoint conversion arguments. Refreshed ZDI1144 still provides restriction mitigation, no patched version. Absent conversion script and fixed service route reduce exposure; no all-version package exemption. | No fix |
+| [CVE-2025-2099](https://github.com/advisories/GHSA-qq3j-4f4f-9583)<br>GHSA-qq3j-4f4f-9583, PYSEC-2025-40 | testing_utils.preprocess_string doctest ReDoS<br>`tools/summarizer/.venv/Lib/site-packages/transformers/testing_utils.py` | < 4.50.0 → 4.50.0 | Installed2593 preprocess_string processes Python/Markdown doctest contents. App tokenizer does not use testing_utils; CV text/Markdown uploads go through parser normalization, not doctest preparation. Different function/input ownership; use4.50.0 current GHSA first patch rather than ambiguous prior4.49 event. | Not affected with evidence |
+| [CVE-2025-14926](https://osv.dev/vulnerability/PYSEC-2025-214)<br>PYSEC-2025-214 | SEW conversion convert_config string eval<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/sew/convert_sew_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | Conversion script is absent from installed models tree; BART inference has no SEW conversion or checkpoint argument input. ZDI1147 refreshed report remains0-day with no release patch. Do not add conversion capability; arbitrary model files remain untrusted. | No fix |
+| [CVE-2025-14930](https://osv.dev/vulnerability/PYSEC-2025-218)<br>PYSEC-2025-218 | GLM4 weights parsing unsafe deserialization<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/glm4` | Prior provider events → no published fix; exact ranges in JSON | No glm4 directory in installed4.48.3; selected mapping is BART, not GLM4. Advisory version range broader than named architecture availability; no assumption newest release fixes this. ZDI1145 still has no fixed version. Keep identity check for actual config; upgrading can introduce new architecture code. | No fix |
+| [CVE-2025-14920](https://osv.dev/vulnerability/PYSEC-2025-211)<br>PYSEC-2025-211 | Perceiver model conversion/deserialization<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/perceiver` | Prior provider events → no published fix; exact ranges in JSON | Perceiver model package exists but no conversion scripts are installed. AutoModelForSeq2SeqLM maps bart to BartForConditionalGeneration; Perceiver has distinct model/configuration and tokenizer modules. No model upload endpoint. ZDI1150 no fix; actual Perceiver entry-point identity not published by ZDI beyond parsing. Treat family restriction as scoped mitigation rather than proven whole-package absence. | No fix |
+| [CVE-2025-14921](https://osv.dev/vulnerability/PYSEC-2025-212)<br>PYSEC-2025-212 | Transformer-XL tokenizer/model pickle deserialization<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py` | Prior provider events → no published fix; exact ranges in JSON | Installed TransfoXL tokenizer explicitly contains pickle.load and warns/deprecates unsafe loading. BartTokenizer/BartTokenizerFast map uses JSON vocab/merges and byte BPE; no Transformer-XL vocab accepted by service. ZDI1149 no fixed release; dangerous API does exist. Architecture selection and no vocab upload reduce reachability; trust actual config identity before stronger verdict. | No fix |
+| [CVE-2025-14924](https://osv.dev/vulnerability/PYSEC-2025-213)<br>PYSEC-2025-213 | megatron_gpt2 checkpoint conversion deserialization<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/megatron_gpt2/convert_megatron_gpt2_checkpoint.py` | Prior provider events → no published fix; exact ranges in JSON | Conversion scripts absent in installed models tree; selected BART loader uses standard load_state_dict, not Megatron conversion. General torch.load checkpoint risk tracked separately under24747. ZDI1141 says vendor declined changes; no patched version. Do not treat newer Transformers as closing this record without evidence. | No fix |
+| [CVE-2025-14927](https://osv.dev/vulnerability/PYSEC-2025-215)<br>PYSEC-2025-215 | SEW-D convert_config eval<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/sew_d/convert_sew_d_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | SEW-D conversion source absent from installed wheel. HTTP summarize does not expose conversion/config strings or select audio model families. ZDI1148 no fix; fixed model family is mitigation, not universal library safety. | No fix |
+| [CVE-2025-14928](https://osv.dev/vulnerability/PYSEC-2025-216)<br>PYSEC-2025-216 | HuBERT convert_config eval<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/hubert/convert_hubert_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | HuBERT conversion source absent from installed wheel; BART tokenizer/model path does not invoke audio conversion. ZDI1146 no release patch. Retain record rather than infer upgrade clears it. | No fix |
+| [CVE-2025-3933](https://github.com/advisories/GHSA-37mw-44qp-f5jm)<br>GHSA-37mw-44qp-f5jm, PYSEC-2026-1977 | DonutProcessor.token2json ReDoS<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/donut/processing_donut.py` | <= 4.51.3 → 4.52.1 | Actual Donut token2json regex exists in separate processor. Service document OCR invokes Tesseract/Pillow, never DonutProcessor; BART decode returns text without token2json. Explicit different document-processing owner avoids confusing OCR with Donut; installed affected API remains. | Mitigated with residual risk |
+| [CVE-2025-6638](https://github.com/advisories/GHSA-59p9-h35m-wg4g)<br>GHSA-59p9-h35m-wg4g, PYSEC-2026-1981 | MarianTokenizer.remove_language_code ReDoS<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/marian/tokenization_marian.py` | < 4.53.0 → 4.53.0 | Marian tokenizer removes language codes; BART maps to BartTokenizer/Fast with separate vocab/merges byte BPE. Request text cannot select Marian tokenizer. Architecture-specific tokenizer; validate actual model/tokenizer config before full Not affected claim. | Mitigated with residual risk |
+| [CVE-2025-3264](https://github.com/advisories/GHSA-jjph-296x-mrcr)<br>GHSA-jjph-296x-mrcr, PYSEC-2026-1985 | dynamic_module_utils.get_imports Python-source regex<br>`tools/summarizer/.venv/Lib/site-packages/transformers/dynamic_module_utils.py` | < 4.51.0 → 4.51.0 | Installed141 get_imports reads Python code. Auto factory540 executes dynamic module path only for has_remote_code and resolved trust_remote_code. Current app does not opt in, BART has local implementation; missing immutable artifact/config identity prevents universal dispatch proof. Fix4.51.0; upgrade candidate5.10.0. Explicitly deny remote code and qualify loader; do not conflate regex input with ordinary request text. | Fix available but blocked by compatibility |
+| [CVE-2025-1194](https://github.com/advisories/GHSA-fpwr-67px-3qhx)<br>GHSA-fpwr-67px-3qhx, PYSEC-2026-1984 | SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoS<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py` | < 4.50.0 → 4.50.0 | Named GPT-NeoX-Japanese tokenizer exists as separate implementation; selected BART tokenizer uses byte BPE, not SubWordJapaneseTokenizer. Text cannot select tokenizer class directly. Do not label all tokenization ReDoS reachable merely because service tokenizes; actual family/config still needs identity. | Mitigated with residual risk |
+| [CVE-2025-3777](https://github.com/advisories/GHSA-phhr-52qp-3mj4)<br>GHSA-phhr-52qp-3mj4, PYSEC-2026-1986 | image_utils video URL username validation<br>`tools/summarizer/.venv/Lib/site-packages/transformers/image_utils.py` | < 4.52.1 → 4.52.1 | Installed4.48.3 image_utils has load_image (HTTP image URL) but no load_video/YouTube helper; video_utils.py is absent. BART receives text only; uploaded image bytes handled by PIL/Tesseract in parser, never a Transformers media URL helper. No Transformers video/YouTube URL input route. CV text containing a URL is text, not automatically dereferenced by this helper. | Not affected with evidence |
+| [CVE-2025-6051](https://github.com/advisories/GHSA-rcv9-qm8p-9p6j)<br>GHSA-rcv9-qm8p-9p6j, PYSEC-2026-1988 | CLVP EnglishNormalizer.normalize_numbers ReDoS<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/clvp/number_normalizer.py` | < 4.53.0 → 4.53.0 | Actual normalize_numbers197 is CLVP text/audio normalizer; selected BART tokenizer has no EnglishNormalizer call. This is not generic normalize_text in parser_child.py. Keep distinct normalization owners and architecture scopes; model identity qualification remains needed. | Mitigated with residual risk |
+| [CVE-2025-6921](https://github.com/advisories/GHSA-4w7r-h757-3r74)<br>GHSA-4w7r-h757-3r74, PYSEC-2026-1980 | AdamWeightDecay._do_use_weight_decay user regex<br>`tools/summarizer/.venv/Lib/site-packages/transformers/optimization_tf.py` | < 4.53.0 → 4.53.0 | TensorFlow training optimizer branch. Service performs torch.no_grad model.eval generation; no optimizer, training patterns or TensorFlow model conversion requested. No optimizer input boundary or training invocation; tensor generation length controls do not constitute the mitigation. | Not affected with evidence |
+| [CVE-2025-3263](https://github.com/advisories/GHSA-q2wp-rjmx-x6x9)<br>GHSA-q2wp-rjmx-x6x9, PYSEC-2026-1987 | configuration_utils.get_configuration_file ReDoS<br>`tools/summarizer/.venv/Lib/site-packages/transformers/configuration_utils.py` | < 4.51.0 → 4.51.0 | Installed1134 function consumes configuration_files list from model config in shared from_pretrained path. Fixed repository name reduces caller control but unpinned upstream/cache config remains an input; token length does not bound config filename regex. Patch4.51.0; selected candidate5.10.0 needs actual loader/tokenizer/model compatibility and immutable artifact evidence. | Fix available but blocked by compatibility |
+| [CVE-2025-5197](https://github.com/advisories/GHSA-9356-575x-2w9m)<br>GHSA-9356-575x-2w9m, PYSEC-2026-1983 | convert_tf_weight_name_to_pt_weight_name ReDoS<br>`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_tf_pytorch_utils.py` | < 4.53.0 → 4.53.0 | Installed55 TF→PyTorch converter consumes tensor weight names; app default PyTorch from_pretrained does not request from_tf or TensorFlow conversion. Checkpoint download route does not automatically imply this conversion. Different converter; no user weight-name input. Reassess if cross-framework checkpoint conversion added. | Mitigated with residual risk |
+| [CVE-2026-1839](https://github.com/advisories/GHSA-69w3-r845-3855)<br>GHSA-69w3-r845-3855, PYSEC-2026-2288 | Trainer._load_rng_state unsafe torch.load<br>`tools/summarizer/.venv/Lib/site-packages/transformers/trainer.py` | < 5.0.0rc3 → 5.0.0rc3 | Installed3081 helper loads training rng_state checkpoint; app uses no Trainer, training resume or optimizer. GHSA text additionally limits exploit to torch below2.6; observed metadata2.6.0 does not satisfy that textual condition, although database Transformers range still matches. Both operation separation and vendor torch<2.6 precondition; this does not clear independent torch weights_only flaw24747. | Not affected with evidence |
+| [CVE-2026-4372](https://github.com/advisories/GHSA-29pf-2h5f-8g72)<br>GHSA-29pf-2h5f-8g72, PYSEC-2026-2289 | model initialization config attention-kernel code loading<br>`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py` | < 5.3.0 → 5.3.0 | Shared config attention field exists in4.48.3, but _autoset_attn_implementation1486 rejects non-eager/non-known attention values with ValueError1498. No Hub kernel download dispatch in that method. Vendor describes later kernel-repository execution via serialized field; broad <5.3 range needs version-specific confirmation. Strong source evidence of older allowlist differs from broad range; need negative runtime config test/patch-introduction evidence before scoped Not affected. Upgrade candidate fixes broad range but no compatibility pass here. | Unresolved |
+| [CVE-2026-5241](https://access.redhat.com/errata/RHSA-2026:34456)<br>GHSA-fgcw-684q-jj6r, PYSEC-2026-2290 | LightGlue nested AutoConfig remote-code override<br>`tools/summarizer/.venv/Lib/site-packages/transformers/models/lightglue` | < 5.5.0 → 5.5.0 | No LightGlue files/package in installed4.48.3; installed AutoModelForSeq2SeqLM maps BART and not LightGlue. Vendor report describes5.2.0 despite broad<5.5 range. Named vulnerable architecture absent from installed distribution; candidate5.10 >=5.5 patch. This does not clear shared model-load vulnerabilities. | Not affected with evidence |
+| [CVE-2026-9856](https://github.com/advisories/GHSA-xrqw-3rrv-vx5w)<br>GHSA-xrqw-3rrv-vx5w, PYSEC-2026-3929 | tokenizer/Processor save_pretrained chat_template traversal<br>`tools/summarizer/.venv/Lib/site-packages/transformers/tokenization_utils_base.py` | < 5.10.0 → 5.10.0 | save_pretrained exists, but application only from_pretrained, tokenizer call/decode, model.generate; no tokenizer/processor export or user save path. Cache download writes are Hub file_download, not save_pretrained. No named save path in service; retain broad installed-package advisory and require5.10 patch if export introduced. | Not affected with evidence |
+
+## Required qualification before a changed gate
+
+For filelock, exercise native/fallback locks, two contenders, stale marker handling and timeout on each supported platform. For torch/Transformers, qualify candidate wheel imports and dependency checks, actual BART tokenizer IDs/decode and benign selected-checkpoint generation, text truncation, resource behavior and safe unavailable-model503 behavior. Record immutable snapshot revision, format and hashes. Safe negative config/remote-code tests can establish behavior without executing malicious serialized payloads. A synthetic tiny BART test only proves that synthetic fixture.
+
+Refresh original aliases against the resolved lock, account for new advisories introduced by upgrades, preserve each no-fix/unresolved group and reconcile totals without adding duplicate aliases. A source-level scoped exemption needs reviewer acceptance; no package install, live provider call, production check or inference was performed in this research lane.

docs/redesign/phase-9/p9-sec-02/CI_ASSESSMENT.md

@@ -0,0 +1,59 @@
+# P9-SEC-02 hosted CI assessment — 25 October 2026
+
+## Repository quarantine checkpoint
+
+After the read-only assessment below, the primary agent changed only `.gitea/workflows/mariadb-integration.yml`: removed automatic pull-request preparation, selected the unique `jobtracker-mariadb-isolated` label and added the current qualification branch to push coverage. The unconditional first-step exit1, database guards, image pin and existing test architecture remain. No runner host, registration, privilege, socket, service, backup or deployment workflow changed. Four new workflow invariant tests failed3/passed1 before the change and pass4/4 afterward; the existing five mocked runner tests also pass. The unique label is a routing prerequisite, not proof of a safe matching host. Hosted CI remains BLOCKED and current isolation UNVERIFIED pending operator/runtime evidence. The source hashes below describe the earlier read-only snapshot, not a claim that the workflow was unmodified afterward.
+
+**Hosted MariaDB: BLOCKED. Current runner isolation: UNVERIFIED.** Current effective HostConfig is unknown. Historical run853 was unsafe for this database lane; that observation does not certify today's configuration. No hosted MariaDB test or private-service lifecycle was executed by this assessment.
+
+Baseline `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8`, branch `fix/p9-model-cache-and-ci-qualification`. Fresh metadata observation **2026-10-25T06:23:27.915835Z / 07:23:27 CET Europe/Paris**. The user authorized bounded read-only CI/API and official-source investigation. Existing Git credentials were used only in memory with redirects refused; no helper output, Authorization header or credential values were retained. Repository permission is not host permission.
+
+## Fresh metadata and boundaries
+
+| Observation | Result | Meaning |
+| --- | --- | --- |
+| Version/repository | HTTP200; Gitea1.26.0; admin/push/pull reported | Readable repository metadata; no infrastructure authority established |
+| Repository runners | HTTP200; runner3 `pi-runner-1`, offline, non-ephemeral, `ubuntu-latest`/`ubuntu-22.04` | Not the actual runner5 |
+| Instance runners and user | Both HTTP403 | Runner5 configuration, registration scope and host remain inaccessible |
+| Latest runs | Requested100; returned50 | Bounded window, not exhaustive history |
+| New visible runs | [855](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/855)/[854](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/854), main `5f835e54a9b74e6b71418422e28431b2af06453f`, success | Job metadata names `backup`, runner5 `Live-Runner`; these are not MariaDB tests |
+| Backup job times | Job1745 01:00:47–01:01:04UTC; job1744 00:01:21–00:01:38UTC,25October | Recent runner activity, not proof of its host boundary or production state |
+| Current task branch | Branch query returns0; none in latest50 | No accessible branch execution in the inspected window; filter support/exhaustive absence not certified |
+| Latest visible MariaDB run | Historical853/job1743 at3727a72, failure | Isolation guard failure before database execution, as established previously |
+
+Only metadata for these jobs was requested. Backup logs, secret endpoints, production hosts, daemon endpoints and runner host files were not accessed. Source workflow backup/deployment/maintenance jobs reference production SSH credentials and share `ubuntu-latest` with the blocked MariaDB workflow. Metadata now verifies that actual runner5 executes backup jobs. It does not establish host co-location, secret values or scopes, or job-to-job credential availability.
+
+## Historical runtime versus current unknown
+
+The [previous isolation report](../p9-remed-02/CI_ISOLATION.md) inspected24October run853: runner-reported v0.4.1, job image `node:20-bookworm`, merged **`NetworkMode:host` and `/var/run/docker.sock` bind**, `Privileged:false`, persistent tool cache. The guard exited1 before checkout/SDK/database work. Log SHA256 `448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134` identifies that historical evidence. The [earlier metadata refresh](../p9-remed-02/CI_REFRESH_2026-10-25.md) also did not inspect current HostConfig.
+
+This investigation downloaded no runtime logs and performed no live HostConfig inspection. Therefore historical exposure is **UNSAFE for the intended lane**, while today's isolation verdict is **UNVERIFIED**, rather than an assertion that current configuration is unchanged. No private-service success/failure/cancel/crash cleanup or cross-job leakage proof exists.
+
+## Source capability and preserved repository guards
+
+Fresh immutable upstream retrieval returned HTTP200 and matched all three previous source hashes:
+
+| Primary source | SHA256 | Relevant capability |
+| --- | --- | --- |
+| [Runner configuration at9aafec169b7ebf3d71df2b06780868fb552b435e](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml) | `e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa` | Lines86–115: automatic network, independent privilege/volume/options controls, `docker_host: "-"` to suppress socket mounting |
+| [Runner execution](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go) | `857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590` | Lines220–248 pass secrets and container settings, disable reuse and request automatic removal |
+| [act v0.261.10 engine](https://gitea.com/gitea/act/src/tag/v0.261.10/pkg/runner/run_context.go) | `45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c` | Lines116–121/309–401: generated network for services unless configured network overrides it, service DNS aliases, declared port bindings, normal cleanup attempts |
+
+The versioned Gitea documentation request returned403; no refreshed documentation contents are claimed. Pinned source proves supported capability, not installed binary identity, effective configuration, crash recovery or production egress separation. Services and runner-owned preparation precede workflow steps; an in-job guard cannot remove that exposure.
+
+Repository source review preserves the unconditional first-step exit1, existing branch filters, explicit failure rather than SQLite fallback, loopback TCP validation, generated schema ownership and cleanup failure propagation. The current task branch has no push trigger. Broad pull-request and manual triggers remain. Five existing Python guard tests passed with mocked subprocesses; their injected cleanup17/setup1 outputs are expected fixtures. Seven bounded source assertions passed. Neither check is a hosted or database test. Exact source hashes for eight relevant workflow/runner/fixture/Compose files are in [ci-assessment.json](ci-assessment.json).
+
+**Repository improvement proposal only:** consider removing the broad `pull_request` trigger while isolation is unverified, because the first failing step still allows runner preparation. This prevents an automatic event from preparing the known shared routing lane; manual triggering must remain operator-controlled. Review Gitea event behavior and dedicated routing before restoring it. No workflow or transport change was made here. A step-level bypass, adding Docker CLI, arbitrary remote endpoint exception, or routing to `ubuntu-latest` cannot safely close this gate.
+
+## Exact operator checklist before enabling execution
+
+1. On a **new dedicated nonproduction host/VM and daemon**, provide sanitized ownership, OS/image identity, runner binary version/hash and registration scope. Do not reconfigure Live-Runner under this task. Prove production workloads, data, secrets and management endpoints are absent and unreachable. Register a unique label such as `jobtracker-mariadb-isolated`; validate and pin the job image digest.
+2. Generate configuration for the chosen exact binary. For the reviewed source capability, use empty `container.network`, `container.docker_host: "-"`, `privileged:false`, `valid_volumes:[]`, and no options reintroducing mounts, devices, host networking or privilege. Start capacity1; disable shared cache until qualified; use disposable per-job state. Only the controller manages its dedicated daemon; jobs/services receive no daemon endpoint/socket or registration/config credentials.
+3. Prove effective **merged** job/service HostConfig, mounts, capabilities, network attachments, port bindings and resource limits. Establish explicit host firewall/egress and cross-job separation; a private Docker network alone does not deny production/LAN access. Review fork/PR trust, token permissions and secret scope without printing secrets. No production credentials may reach this lane.
+4. Qualify native service `mariadb`, exact `mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00`, linux/amd64, development-only credentials and disposable storage. Declare no published ports or persistent DB volumes. Require bounded image health/authenticated readiness and exact version checks; prove job DNS `mariadb:3306` and generated schema ownership.
+5. After infrastructure evidence, review workflow and fixture transport together: unique label, native service, preserved default loopback guard, strict CI-only service name `mariadb` and TCP3306. No arbitrary remote endpoint/self-attested isolation bypass. Retain startup migrations, independent persisted-state assertions, sanitized useful logs, native TRX, current exact test discovery and zero hidden retries/skips. Do not substitute historic test totals.
+6. Execute success, deliberate test failure, cancellation and interrupted-runner recovery. Retain job-scoped before/after resource inventories proving service/container/network/schema/data removal, no stale credentials/cache and no cross-job access. Document targeted orphan reclamation after daemon/runner failure without broad prune operations or production effects. Then execute and publish the actual hosted MariaDB lane at its exact source/image identities.
+
+Hosted PASS requires real MariaDB test execution **and** verified isolation/lifecycle evidence. Current owner action is infrastructure proof followed by reviewed repository enabling changes and actual execution. API success, backup success, labels, source examples, mocked guards and local MariaDB qualification do not satisfy it. Production release remains an independent gate.
+
+Raw bounded metadata, source bytes and manifests are retained under `.artifacts/p9-sec-02/ci/`; [ci-assessment.json](ci-assessment.json) records response and source hashes, actual permission failures, limitations and actions. No workflow dispatch, host mutation, Docker socket use, secret-value/log access, database operation or deployment occurred.

docs/redesign/phase-9/p9-sec-02/MODEL_CACHE.md

@@ -0,0 +1,23 @@
+# Model/cache qualification architecture and fixture identity
+
+Source baselinef17dba2,25October2026. Actual Python consumers are `AutoTokenizer` and `AutoModelForSeq2SeqLM` for fixed BART summarisation in `tools/summarizer/app.py:96`; they initialise lazily, or eagerly only under the existing environment flag. Document parsing uses pypdf/PyMuPDF/python-docx/Pillow and resource-bounded child processes. OCR uses the native Tesseract executable and its English traineddata, not a Transformers OCR model. No Python embedding/reranking/Docling model is implemented in this source. Ollama is an HTTP client boundary with its own separately managed model storage; no Ollama model/cache/server was accessed.
+
+The selected full repository `sshleifer/distilbart-cnn-12-6` advertises Apache-2.0 and immutable revision `a4f8f3ea906ed274767e9906dbaede7531d660ff`. Its1,222,317,369-byte PyTorch checkpoint has authoritative LFS SHA256 `3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea`. It was not available in the checked local user cache or existing local sidecar image. Local Docker context is desktop-linux; the only volume is the distinct MariaDB development volume. No production filesystem/cache was inspected. Old image contents are not approved current-runtime artifacts.
+
+## Small task-authorised fixtures
+
+[ARTIFACTS.json](model/ARTIFACTS.json) records two independently hashed, isolated fixtures. Their tokenizer/vocabulary/merges/model-card and reference configuration come from the immutable upstream revision. Every downloaded ordinary Git file is checked against the published Git blob identity, then pinned with SHA256. Only1,358,673 bytes of upstream metadata/tokenizer content were downloaded. No pretrained checkpoint or remote Python code was downloaded.
+
+Synthetic BART weights are generated locally with fixed seed73421 using the Apache-2.0 Transformers BART implementation: vocabulary50265, dimension16, one encoder/decoder layer, two heads,32-wide feed-forward layers and1024 positions. The842704 parameters are saved once as Safetensors and once as a known state dictionary. These files are approximately3.58MB each. The second format exercises the same PyTorch serialization family as the selected full checkpoint, with explicit `weights_only=True`. No third-party pickle or trained-weight licence is assumed. The actual tokenizer's Apache-2.0 declaration is preserved from its pinned card; no model weights are redistributed in Git.
+
+These are real native BART/tokenizer/generation artifacts, with deliberately untrained/random outputs. They establish the tested library/API/format/CPU compatibility scope. They do not establish full DistilBART output quality, production memory/latency, GPU compatibility, intended model semantics or C11/P5-13 acceptance. No owner approval of a production model or formal risk exception is implied by task-authorised test preparation.
+
+The committed manifest is the integrity authority, not an arbitrary cache-local JSON file. The verifier rejects missing/corrupt/linked/duplicate/traversal/unlisted artifacts before loading. The fixture mount is read-only; runtime networking is none, with explicit Hub/Transformers offline flags, private tmpfs cache and twoCPU/2GiB/128PID limits. Each container has an owned label, bounded parent deadline and removal verification. Replacing source/checkpoint identities requires a new manifest and qualification.
+
+The production model choice is unchanged. A minimal loader repair now pins tokenizer and weights to the same reviewed revision, denies remote code and explicitly requests restricted weights loading. Its new unit test failed for the missing revision before the repair; the complete native Windows suite passed59 cases afterward. That suite alone is not real-model evidence; Linux fixture inference is separate.
+
+## Cache ownership and supported transition
+
+filelock4 changes shared-cache lock protocols. All qualification caches are new isolated disposable directories with a single library generation. No production or developer cache was reset, rewritten or silently mixed with old lock participants. A later production rollout must stop old participants and explicitly select a separately prepared/verified cache or establish documented protocol migration compatibility. That operator action is separate from development fixture compatibility and remains withheld.
+
+Actual compatibility, negative/offline/cache contention/OCR results and any limitations are recorded separately as they execute. The full checkpoint remains absent; no large download was used to manufacture a qualification claim.

docs/redesign/phase-9/p9-sec-02/PLAN.md

@@ -0,0 +1,16 @@
+# P9-SEC-02 — model/cache and CI qualification
+
+Baseline: `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8`; branch `fix/p9-model-cache-and-ci-qualification`; date25October2026. The user's P9-SEC-02 mission is the authority. Preserve historical acceptance reports, main, production resources, existing routes and all57 preservation groups.
+
+- SEC-M01: verify baseline evidence and individually assess the remaining44 advisory groups, retaining original109/previous65 accounting and current exact-pin sources.
+- SEC-M02: trace actual model/OCR/cache owners; select the smallest trusted, licensed, immutable nonproduction artifacts that adequately test compatibility. Existing caches are read-only inputs, never disposable stores. No production/Ollama access or large unnecessary download.
+- SEC-M03: qualify compatible patched dependencies with real CPU loading/processing, integrity/offline/failure/resource tests, exact locks and parser/sidecar regressions. Record full-model versus small-fixture scope separately.
+- CI-M01: inspect hosted metadata/configuration read-only; preserve guards; document operator-owned isolated-runner prerequisites when live execution cannot be verified.
+- REG-M01: run applicable full source-bound regressions serially; separate native discovery, contract, MariaDB, model, PDF, security and human outcomes. Never add focused reruns to full totals.
+- P9-M01: publish dated acceptance, individual gate verdicts, owner blockers, checkpoint commits and verified normal pushes. No merge/deployment/CV-UX/CV-IMPORT/Phase10 implementation.
+
+Every new validation branch leaves a negative test or bounded assert self-check. No formal security risk is accepted for the owner. Any unqualified production-only condition remains a separate release gate.
+
+Ruling: reuse the verified clean dedicated development checkout and create the user-named branch fromf17dba2; no second checkout is needed for isolation from main. Cost if wrong: concurrent edits would require stopping and preserving the other owner's work.
+
+Historical baseline counts are evidence to verify, not newly executed tests. Raw new evidence belongs in `.artifacts/p9-sec-02/`; each attempt gets a fresh output directory.

docs/redesign/phase-9/p9-sec-02/PROGRESS.md

@@ -0,0 +1,15 @@
+# P9-SEC-02 progress ledger
+
+25October2026: clean checkout and origin verified atf17dba2; main5f835e54 unchanged; dedicated requested branch created. Read prior acceptance and Python remediation; none of the historical test counts are claimed fresh.
+
+SEC-M01 / SEC-M02 investigation in progress. CI-M01 is an independent read-only assessment. No dependency/application change yet.
+
+SEC-M01: all44 remaining groups individually researched;109=65+44 retained. Research dispositions are provisional until runtime/version evidence is integrated. Official sources and hashes preserved, including rate-limit failures.
+
+SEC-M02: pinned licensed tokenizer/metadata and two locally generated BART state formats prepared with manifests. No large model download or live cache access. Five integrity-negative unit checks PASS. Full DistilBART remains absent and no semantic/full-size/GPU claim is made.
+
+CI-M01: read-only assessment complete; hosted BLOCKED/current isolation UNVERIFIED. Safe repository quarantine selects a unique dedicated label, removes broad PR preparation and retains unconditional exit1. Workflow tests RED3/1 then GREEN4/4; existing mocked runner guards5/5 PASS. No host/deployment changes.
+
+SEC-M03 in progress: candidate55-package CPU lock resolves;110 exact advisory requests report0 records with the known exact-vendor PyPI404 retained. Both real offline BART serialization profiles PASS, including summary/auth/repeat-cache contract. Complete Linux suite initially52PASS/7FAIL because harness supplied an empty Ollama URL; retained predecessor. Corrected isolated loopback fixture passes59/59 with one documented Starlette/httpx deprecation. Current production requirements are not yet replaced by this candidate.
+
+Shared loader pin repair: new unit test failed missing immutable revision, then complete native Windows suite59/59 PASS. Tokenizer/model now share immutable revision, deny remote code and request weights_only. Same model identity, no deployment or output-quality acceptance.

docs/redesign/phase-9/p9-sec-02/ci-assessment.json

@@ -0,0 +1,344 @@
+{
+  "schemaVersion": 1,
+  "reportLocalDate": "2026-10-25",
+  "timezone": "Europe/Paris",
+  "observedUtc": "2026-10-25T06:23:27.915835+00:00",
+  "baselineCommit": "f17dba2ec06ea8f53c2785eaaebd25abc515ebf8",
+  "branch": "fix/p9-model-cache-and-ci-qualification",
+  "hostedVerdict": "BLOCKED",
+  "isolationVerdict": "UNVERIFIED",
+  "currentLiveHostConfig": "UNKNOWN; metadata cannot certify effective HostConfig",
+  "scope": "Bounded read-only CI API GET metadata and official pinned source retrieval; no runtime logs or host inspection",
+  "giteaVersion": {
+    "version": "1.26.0"
+  },
+  "repositoryPermissions": {
+    "admin": true,
+    "push": true,
+    "pull": true
+  },
+  "httpStatuses": {
+    "version": 200,
+    "repository": 200,
+    "repository-runners": 200,
+    "instance-runners": 403,
+    "user": 403,
+    "runs-latest100": 200,
+    "runs-branch-query": 200,
+    "jobs-855": 200,
+    "jobs-854": 200
+  },
+  "repositoryRunners": {
+    "runners": [
+      {
+        "id": 3,
+        "name": "pi-runner-1",
+        "status": "offline",
+        "busy": false,
+        "disabled": false,
+        "ephemeral": false,
+        "labels": [
+          {
+            "id": 0,
+            "name": "ubuntu-latest",
+            "type": "custom"
+          },
+          {
+            "id": 1,
+            "name": "ubuntu-22.04",
+            "type": "custom"
+          }
+        ]
+      }
+    ],
+    "total_count": 1
+  },
+  "observedLatestRunCount": 50,
+  "latestObservedRuns": [
+    {
+      "id": 855,
+      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
+      "head_branch": "main",
+      "status": "completed",
+      "conclusion": "success",
+      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/855",
+      "created_at": null,
+      "updated_at": null
+    },
+    {
+      "id": 854,
+      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
+      "head_branch": "main",
+      "status": "completed",
+      "conclusion": "success",
+      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/854",
+      "created_at": null,
+      "updated_at": null
+    },
+    {
+      "id": 853,
+      "head_sha": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
+      "head_branch": "fix/p9-ci-and-requalification",
+      "status": "completed",
+      "conclusion": "failure",
+      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/853",
+      "created_at": null,
+      "updated_at": null
+    },
+    {
+      "id": 852,
+      "head_sha": "7092697cb3e20a5f22e173648fd544de3de6c553",
+      "head_branch": "fix/p9-ci-and-requalification",
+      "status": "completed",
+      "conclusion": "failure",
+      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/852",
+      "created_at": null,
+      "updated_at": null
+    },
+    {
+      "id": 851,
+      "head_sha": "5ac11549b2caa27469aa9fb2b5b9ed402471a453",
+      "head_branch": "fix/p9-ci-and-requalification",
+      "status": "completed",
+      "conclusion": "failure",
+      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/851",
+      "created_at": null,
+      "updated_at": null
+    }
+  ],
+  "latestAccessibleJobs": [
+    {
+      "runId": 855,
+      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
+      "jobs": [
+        {
+          "id": 1745,
+          "name": "backup",
+          "status": "completed",
+          "conclusion": "success",
+          "runner_id": 5,
+          "runner_name": "Live-Runner",
+          "started_at": "2026-10-25T01:00:47Z",
+          "completed_at": "2026-10-25T01:01:04Z"
+        }
+      ]
+    },
+    {
+      "runId": 854,
+      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
+      "jobs": [
+        {
+          "id": 1744,
+          "name": "backup",
+          "status": "completed",
+          "conclusion": "success",
+          "runner_id": 5,
+          "runner_name": "Live-Runner",
+          "started_at": "2026-10-25T00:01:21Z",
+          "completed_at": "2026-10-25T00:01:38Z"
+        }
+      ]
+    }
+  ],
+  "taskBranchQuery": {
+    "observedCount": 0,
+    "allReturnedRowsMatchRequestedBranch": true,
+    "matchingRunIds": [],
+    "note": "An empty or ignored query is not proof of all historical branch executions."
+  },
+  "taskBranchRunsInLatestWindow": [],
+  "historicalRuntimeEvidence": {
+    "runId": 853,
+    "jobId": 1743,
+    "sourceCommit": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
+    "logSha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134",
+    "effectiveHostNetworking": true,
+    "effectiveDockerSocketBind": true,
+    "privileged": false,
+    "guardExitCode": 1,
+    "mariaDbExecuted": false,
+    "historicalIsolationVerdict": "UNSAFE for the proposed database lane"
+  },
+  "sourceCapability": {
+    "runnerVersionReportedHistorically": "v0.4.1",
+    "runnerSourceCommit": "9aafec169b7ebf3d71df2b06780868fb552b435e",
+    "actVersion": "v0.261.10",
+    "nativePrivateServicesSupportedInPinnedSource": true,
+    "installedBinaryMatched": false,
+    "sources": [
+      {
+        "name": "docs",
+        "url": "https://docs.gitea.com/1.26/usage/actions/act-runner/",
+        "httpStatus": 403,
+        "path": ".artifacts/p9-sec-02/ci/sources-20261025/docs.txt",
+        "bytes": 17,
+        "sha256": "2938e9f1284180959e33ab1718d0793a72ff6e4cdb8108c34dcd14e69446de5c"
+      },
+      {
+        "name": "config",
+        "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml",
+        "httpStatus": 200,
+        "path": ".artifacts/p9-sec-02/ci/sources-20261025/config.txt",
+        "bytes": 7511,
+        "sha256": "e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa"
+      },
+      {
+        "name": "runner",
+        "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go",
+        "httpStatus": 200,
+        "path": ".artifacts/p9-sec-02/ci/sources-20261025/runner.txt",
+        "bytes": 9299,
+        "sha256": "857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590"
+      },
+      {
+        "name": "engine",
+        "url": "https://gitea.com/gitea/act/raw/tag/v0.261.10/pkg/runner/run_context.go",
+        "httpStatus": 200,
+        "path": ".artifacts/p9-sec-02/ci/sources-20261025/engine.txt",
+        "bytes": 36451,
+        "sha256": "45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c"
+      }
+    ]
+  },
+  "repositoryGuardAssessment": {
+    "unconditionalFirstStepFailure": true,
+    "taskBranchPushTrigger": false,
+    "pullRequestAndManualTriggers": true,
+    "runnerPreparationOccursBeforeGuard": true,
+    "sharedUbuntuLatestRouting": true,
+    "defaultLoopbackAndGeneratedSchemasPreserved": true,
+    "sourceManifest": [
+      {
+        "path": ".gitea/workflows/mariadb-integration.yml",
+        "bytes": 1306,
+        "sha256": "f7579be39a4b4318567edf98ba8dff0d6991ceae96ae27b917e6847253b1f850"
+      },
+      {
+        "path": "scripts/mariadb-integration.py",
+        "bytes": 4570,
+        "sha256": "410cede3ca8794de99735a579ac626a34b6a56ee89c6ef63880d692153c7cd97"
+      },
+      {
+        "path": "scripts/test-mariadb-integration.py",
+        "bytes": 2938,
+        "sha256": "39aa5618724e74b859aceaf814bf08b9ea63a54205452805caa810a302441a80"
+      },
+      {
+        "path": "JobTrackerApi.MariaDb.Tests/MariaDbDatabase.cs",
+        "bytes": 6716,
+        "sha256": "1375d97093f686f77d511ef6d81ad2d62ecf329aa6e7bf53036cd6e199035e40"
+      },
+      {
+        "path": "docker-compose.database.yml",
+        "bytes": 1441,
+        "sha256": "bc4f0d19ef913f9e0f92540ed9a817e7bbf00d2f00ae80ed5b1acd43d55ba363"
+      },
+      {
+        "path": ".gitea/workflows/backup.yml",
+        "bytes": 1008,
+        "sha256": "9a6a7a9d49f88b6d9383a2d688ef64b14c53c451d1669ae6bda642780d291f75"
+      },
+      {
+        "path": ".gitea/workflows/ci-deploy.yml",
+        "bytes": 21659,
+        "sha256": "713a62a635b1f695c3e70d2484997fb3ce2a616bbaae3885f80c1be821cf98cf"
+      },
+      {
+        "path": ".gitea/workflows/maintenance.yml",
+        "bytes": 2343,
+        "sha256": "49fac8dde43531338fc713ac2a367ec9ca55379c94fcee44c1957dd861df54f9"
+      }
+    ]
+  },
+  "validation": {
+    "staticGuardAssertions": "PASS",
+    "offlinePythonGuardTests": {
+      "passed": 5,
+      "failed": 0,
+      "scope": "Mocked runner guard tests only; no Docker/service/database access",
+      "outputCaveat": "Expected injected cleanup failure17 and setup failure1 are test fixtures, not real service failures"
+    }
+  },
+  "unknowns": [
+    "Runner5 host/daemon ownership, installed binary identity, registration scope and current effective configuration",
+    "Production workload/credential/mount/egress separation",
+    "Job-token/fork/PR trust and secret scopes",
+    "Private service runtime, DNS and no published port/socket/host network/privilege",
+    "Cross-job/cache isolation and success/failure/cancel/crash recovery"
+  ],
+  "repositoryImprovementProposal": "Keep execution blocker. Optionally remove the broad pull_request event while isolation is unverified to prevent automatic runner preparation; review provider behavior and dedicated routing before re-enabling. No enabling transport change is justified before operator proof.",
+  "rawMetadataEvidence": [
+    {
+      "httpStatus": 200,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/version.json",
+      "bytes": 20,
+      "sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
+    },
+    {
+      "httpStatus": 200,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository.json",
+      "bytes": 2315,
+      "sha256": "cb29faeadc15e5761db1043edff1c9d810c43ffea38abc5e6cee8d410a20e94d"
+    },
+    {
+      "httpStatus": 200,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository-runners.json",
+      "bytes": 232,
+      "sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
+    },
+    {
+      "httpStatus": 403,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/instance-runners.json",
+      "bytes": 164,
+      "sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
+    },
+    {
+      "httpStatus": 403,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/user.json",
+      "bytes": 163,
+      "sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
+    },
+    {
+      "httpStatus": 200,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-latest100.json",
+      "bytes": 203780,
+      "sha256": "7c2ac0004b093f34f83804a9168f23af17c4036f79ed7ff48bcb30daa7822cf2"
+    },
+    {
+      "httpStatus": 200,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-branch-query.json",
+      "bytes": 36,
+      "sha256": "c88e581390a4c04eaddaf6dc1bafd07c56d33e594c62ad3498c7313043b39bbf"
+    },
+    {
+      "httpStatus": 200,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-855.json",
+      "bytes": 836,
+      "sha256": "8fddbb1014c708d1c088f45c874cffb2f1446d21d3412cda64e18917e94ed5c9"
+    },
+    {
+      "httpStatus": 200,
+      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-854.json",
+      "bytes": 836,
+      "sha256": "6b7e0849d1eeca72cc264984e00bd4ae2bbb576aa541f7c2e8f26b38e4348b05"
+    }
+  ],
+  "actions": {
+    "hostedJobsDispatched": false,
+    "newRuntimeLogsDownloaded": false,
+    "runnerOrHostChanged": false,
+    "workflowChanged": false,
+    "dockerSocketAccess": false,
+    "secretValuesReadOrRetained": false,
+    "productionAccess": false,
+    "deployment": false
+  },
+  "limits": [
+    "Latest request limit100 returned50; bounded window, not full history",
+    "Branch query0 and no latest-window match do not prove provider filter support or exhaustive absence",
+    "Instance runners and user403 despite repository admin/push/pull",
+    "Official docs HTTPS request403; capability rests on freshly fetched immutable primary source matching prior hashes",
+    "Backup success metadata is not MariaDB execution or isolation evidence"
+  ],
+  "documentation": "CI_ASSESSMENT.md"
+}

docs/redesign/phase-9/p9-sec-02/model/ARTIFACTS.json

@@ -0,0 +1,164 @@
+{
+  "safetensors": {
+    "schemaVersion": 1,
+    "observedUtc": "2026-10-25T06:29:24.469337+00:00",
+    "fixture": "jobjakt-p9-sec02-bart-cpu",
+    "scope": "Real BART weights/tokenizer/native CPU inference compatibility fixture. Random/untrained output is not production DistilBART inference, semantic quality, full-model memory/capacity or AI product qualification.",
+    "sourceRepository": "sshleifer/distilbart-cnn-12-6",
+    "sourceRevision": "a4f8f3ea906ed274767e9906dbaede7531d660ff",
+    "upstreamLicense": "Apache-2.0 verified in pinned model card",
+    "generation": {
+      "torch": "2.6.0",
+      "transformers": "4.48.3",
+      "parameters": 842704,
+      "seed": 73421,
+      "device": "cpu",
+      "kind": "Locally generated random-weight BART, not trained DistilBART or a quality fixture"
+    },
+    "files": [
+      {
+        "file": "README.md",
+        "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/README.md",
+        "gitBlobId": "ab24d89a622b44fba741e4383213ad300fc2345a",
+        "bytes": 1705,
+        "sha256": "e6114f9ddddd7aec5e9858b9849d1b53dc42b596420888b82fbf3f8defb64bf7",
+        "license": "Apache-2.0, pinned upstream model-card declaration"
+      },
+      {
+        "file": "reference-distilbart-config.json",
+        "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/config.json",
+        "gitBlobId": "fade82e22ec4f4b61f6f2eb3986ce4a64a8e23df",
+        "bytes": 1802,
+        "sha256": "028d72a28b90a369eff3f99ceb585fbd2ababf070e8577d72c315757a49b8917",
+        "license": "Apache-2.0, pinned upstream model-card declaration"
+      },
+      {
+        "file": "vocab.json",
+        "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/vocab.json",
+        "gitBlobId": "0a39732b2d8be8e493cab3da68b68cc3e28221de",
+        "bytes": 898822,
+        "sha256": "06b4d46c8e752d410213d9548eb27a54db70fda0319b6271fb8d59dead5e1cab",
+        "license": "Apache-2.0, pinned upstream model-card declaration"
+      },
+      {
+        "file": "merges.txt",
+        "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/merges.txt",
+        "gitBlobId": "226b0752cac7789c48f0cb3ec53eda48b7be36cc",
+        "bytes": 456318,
+        "sha256": "1ce1664773c50f3e0cc8842619a93edc4624525b728b188a9e0be33b7726adc5",
+        "license": "Apache-2.0, pinned upstream model-card declaration"
+      },
+      {
+        "file": "tokenizer_config.json",
+        "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/tokenizer_config.json",
+        "gitBlobId": "be4d21d94f3b4687e5a54d84bf6ab46ed0f8defd",
+        "bytes": 26,
+        "sha256": "5e04eb606e3a1583530a42e36c2a6b6615c86f34fe77e44d9ddeb43ff940931f",
+        "license": "Apache-2.0, pinned upstream model-card declaration"
+      },
+      {
+        "file": "config.json",
+        "bytes": 1025,
+        "sha256": "563b819e93f153a49d6364d5c90878eec01ef78f99aae0d0c8c7ccce49e517a8",
+        "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights"
+      },
+      {
+        "file": "generation_config.json",
+        "bytes": 200,
+        "sha256": "fdf2a5aa742aa3bd7fcf78a14d9aae0c599e55610e7856a35a4e89a38fed50f7",
+        "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights"
+      },
+      {
+        "file": "model.safetensors",
+        "bytes": 3577252,
+        "sha256": "35ca2b5d2c6a28696cadd0fd7dfe483d499497e315db28dfa5a509bf13da7a68",
+        "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights"
+      },
+      {
+        "file": "generate.py",
+        "bytes": 850,
+        "sha256": "006cd1354c98e72ce9a7f1f57c5b3e3fd1cf16836dcb4508ca9f9930b4777fa5",
+        "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights"
+      }
+    ],
+    "downloadBytes": 1358673,
+    "weightBytes": 3577252,
+    "fullModelAbsent": true,
+    "fullModelRequiredWeightBytes": 1222317369,
+    "fullModelExpectedSha256": "3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea",
+    "cachePolicy": "Isolated package test cache only; never production/Ollama cache. Verify every file before loading; load offline/read-only; no floating revision."
+  },
+  "weights-only": {
+    "schemaVersion": 1,
+    "observedUtc": "2026-10-25T06:29:24.469337+00:00",
+    "fixture": "jobjakt-p9-sec02-bart-bin-cpu",
+    "scope": "Same locally generated synthetic BART state_dict in the selected production model serialization family, exercising real weights_only PyTorch loading. No third-party downloaded pickle; not full DistilBART/quality qualification.",
+    "sourceRepository": "sshleifer/distilbart-cnn-12-6",
+    "sourceRevision": "a4f8f3ea906ed274767e9906dbaede7531d660ff",
+    "upstreamLicense": "Apache-2.0 verified in pinned model card",
+    "generation": {
+      "torch": "2.6.0",
+      "transformers": "4.48.3",
+      "parameters": 842704,
+      "seed": 73421,
+      "device": "cpu",
+      "kind": "Locally generated random-weight BART, not trained DistilBART or a quality fixture"
+    },
+    "files": [
+      {
+        "file": "config.json",
+        "bytes": 1124,
+        "sha256": "b4f823ea324a93c355ae2ae2447bed10fcdb769070eff435f175a6738f7d3c34",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      },
+      {
+        "file": "generate-bin.py",
+        "bytes": 411,
+        "sha256": "5d1f53ea37cc199d876b27731a29dea74b4df7fed7151f67a49b848993517052",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      },
+      {
+        "file": "generation_config.json",
+        "bytes": 200,
+        "sha256": "fdf2a5aa742aa3bd7fcf78a14d9aae0c599e55610e7856a35a4e89a38fed50f7",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      },
+      {
+        "file": "merges.txt",
+        "bytes": 456318,
+        "sha256": "1ce1664773c50f3e0cc8842619a93edc4624525b728b188a9e0be33b7726adc5",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      },
+      {
+        "file": "pytorch_model.bin",
+        "bytes": 3588356,
+        "sha256": "95d578c5706c9256a2f299a4288c0cdcae0fd303fa27e4474c34300f51f195cd",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      },
+      {
+        "file": "README.md",
+        "bytes": 1705,
+        "sha256": "e6114f9ddddd7aec5e9858b9849d1b53dc42b596420888b82fbf3f8defb64bf7",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      },
+      {
+        "file": "tokenizer_config.json",
+        "bytes": 26,
+        "sha256": "5e04eb606e3a1583530a42e36c2a6b6615c86f34fe77e44d9ddeb43ff940931f",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      },
+      {
+        "file": "vocab.json",
+        "bytes": 898822,
+        "sha256": "06b4d46c8e752d410213d9548eb27a54db70fda0319b6271fb8d59dead5e1cab",
+        "source": "Copied verified tokenizer/config or locally generated synthetic state_dict"
+      }
+    ],
+    "downloadBytes": 1358673,
+    "weightBytes": 3588356,
+    "fullModelAbsent": true,
+    "fullModelRequiredWeightBytes": 1222317369,
+    "fullModelExpectedSha256": "3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea",
+    "cachePolicy": "Isolated package test cache only; never production/Ollama cache. Verify every file before loading; load offline/read-only; no floating revision."
+  }
+}

docs/redesign/phase-9/p9-sec-02/model/probe.py

@@ -0,0 +1,49 @@
+"""Actual offline CPU inference; synthetic weights test compatibility, never quality."""
+from pathlib import Path
+import importlib.metadata
+import json
+import os
+import resource
+import sys
+import time
+from verify import verify_fixture
+
+HERE = Path(__file__).resolve().parent
+manifests = json.loads((HERE / 'ARTIFACTS.json').read_text())
+kind = sys.argv[1]
+fixture = verify_fixture(Path(sys.argv[2]), manifests[kind])
+assert os.environ['HF_HUB_OFFLINE'] == os.environ['TRANSFORMERS_OFFLINE'] == '1'
+os.environ.pop('AI_SERVICE_SKIP_MODEL_LOAD', None)
+os.environ.pop('AI_SERVICE_EAGER_MODEL_LOAD', None)
+os.environ['AI_SERVICE_TOKEN'] = 'p9-local-qualification-only'
+sys.path.insert(0, '/app')
+import torch
+import app
+from fastapi.testclient import TestClient
+
+torch.set_num_threads(1)
+started = time.monotonic()
+# Only this isolated qualification process selects synthetic weights; no inference is mocked.
+app.MODEL_NAME = str(fixture)
+assert app._ensure_runtime_loaded(), app.MODEL_LOAD_ERROR
+assert app.model.__class__.__name__ == 'BartForConditionalGeneration'
+assert str(app.device) == 'cpu' and not app.GPU_AVAILABLE
+text = 'Åse Østby builds accessible Python and C# applications for reliable Norwegian career workflows.'
+encoded = app.tokenizer(text, return_tensors='pt')
+assert app.tokenizer.decode(encoded.input_ids[0], skip_special_tokens=True) == text
+summary = app._model_summarize(text, 24, 8)
+assert isinstance(summary, str) and summary
+client = TestClient(app.app)
+assert client.get('/health').json()['model_loaded'] is True
+assert client.post('/summarize', json={'text': text}).status_code == 401
+headers = {'X-Ai-Service-Token': 'p9-local-qualification-only'}
+body = {'text': text, 'max_length': 24, 'min_length': 8}
+first = client.post('/summarize', json=body, headers=headers)
+second = client.post('/summarize', json=body, headers=headers)
+assert first.status_code == second.status_code == 200, first.text
+assert first.json()['cached'] is False and second.json()['cached'] is True
+assert first.json()['summary'] == second.json()['summary']
+verify_fixture(fixture, manifests[kind])
+elapsed = time.monotonic() - started
+assert elapsed < 60
+print(json.dumps({'status': 'PASS', 'kind': kind, 'scope': 'Real synthetic BART/tokenizer/native CPU generation plus sidecar summary/auth/cache contract; no full DistilBART or semantic-quality claim.', 'modelClass': app.model.__class__.__name__, 'device': str(app.device), 'cudaAvailable': torch.cuda.is_available(), 'seconds': elapsed, 'maxRssKiB': resource.getrusage(resource.RUSAGE_SELF).ru_maxrss, 'versions': {name: importlib.metadata.version(name) for name in ['torch','transformers','filelock','huggingface-hub','tokenizers','safetensors']}, 'summary': summary, 'cacheRepeatedRead': True, 'fixtureUnchanged': True}), flush=True)

docs/redesign/phase-9/p9-sec-02/model/test_verify.py

@@ -0,0 +1,40 @@
+from pathlib import Path
+import copy
+import hashlib
+import tempfile
+import unittest
+from verify import verify_fixture
+
+
+class ArtifactIntegrity(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.directory = Path(self.temp.name)
+        (self.directory / 'model.safetensors').write_bytes(b'known fixture')
+        self.manifest = {'files': [{'file': 'model.safetensors', 'bytes': 13, 'sha256': hashlib.sha256(b'known fixture').hexdigest()}]}
+
+    def test_accepts_exact_known_content(self):
+        self.assertEqual(verify_fixture(self.directory, self.manifest), self.directory.resolve())
+
+    def test_rejects_same_size_corruption(self):
+        (self.directory / 'model.safetensors').write_bytes(b'wrong fixture')
+        with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest)
+
+    def test_rejects_missing_weight(self):
+        (self.directory / 'model.safetensors').unlink()
+        with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest)
+
+    def test_rejects_traversal_and_duplicate_identity(self):
+        for value in ['../model.safetensors', '/model.safetensors']:
+            manifest = copy.deepcopy(self.manifest); manifest['files'][0]['file'] = value
+            with self.assertRaises(ValueError): verify_fixture(self.directory, manifest)
+        self.manifest['files'] *= 2
+        with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest)
+
+    def test_rejects_unlisted_model_code(self):
+        (self.directory / 'modeling_unreviewed.py').write_text('raise RuntimeError()')
+        with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest)
+
+
+if __name__ == '__main__': unittest.main()

docs/redesign/phase-9/p9-sec-02/model/verify.py

@@ -0,0 +1,21 @@
+"""Verify committed qualification identities before loading an isolated model fixture."""
+from pathlib import Path
+import hashlib
+
+
+def verify_fixture(directory, manifest):
+    directory = Path(directory).resolve()
+    expected = set()
+    for entry in manifest['files']:
+        name = entry['file']
+        if Path(name).name != name or name in ('.', '..'):
+            raise ValueError('Artifact name escapes fixture directory.')
+        file = directory / name
+        if name in expected or file.is_symlink() or not file.is_file():
+            raise ValueError('Missing, duplicate or linked model artifact: ' + name)
+        expected.add(name)
+        if file.stat().st_size != entry['bytes'] or hashlib.sha256(file.read_bytes()).hexdigest() != entry['sha256']:
+            raise ValueError('Model artifact integrity mismatch: ' + name)
+    if not expected or {p.name for p in directory.iterdir()} - expected - {'manifest.json', 'generation.log'}:
+        raise ValueError('Unexpected artifact or empty manifest.')
+    return directory