fix: pin model revisions and quarantine MariaDB CI routing

2026-10-25 07:40:52 +01:00
parent f17dba2ec0
commit 22ef8d003c
15 changed files with 21964 additions and 5 deletions
@@ -0,0 +1,16 @@
+# P9-SEC-02 — model/cache and CI qualification
+
+Baseline: `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8`; branch `fix/p9-model-cache-and-ci-qualification`; date25October2026. The user's P9-SEC-02 mission is the authority. Preserve historical acceptance reports, main, production resources, existing routes and all57 preservation groups.
+
+- SEC-M01: verify baseline evidence and individually assess the remaining44 advisory groups, retaining original109/previous65 accounting and current exact-pin sources.
+- SEC-M02: trace actual model/OCR/cache owners; select the smallest trusted, licensed, immutable nonproduction artifacts that adequately test compatibility. Existing caches are read-only inputs, never disposable stores. No production/Ollama access or large unnecessary download.
+- SEC-M03: qualify compatible patched dependencies with real CPU loading/processing, integrity/offline/failure/resource tests, exact locks and parser/sidecar regressions. Record full-model versus small-fixture scope separately.
+- CI-M01: inspect hosted metadata/configuration read-only; preserve guards; document operator-owned isolated-runner prerequisites when live execution cannot be verified.
+- REG-M01: run applicable full source-bound regressions serially; separate native discovery, contract, MariaDB, model, PDF, security and human outcomes. Never add focused reruns to full totals.
+- P9-M01: publish dated acceptance, individual gate verdicts, owner blockers, checkpoint commits and verified normal pushes. No merge/deployment/CV-UX/CV-IMPORT/Phase10 implementation.
+
+Every new validation branch leaves a negative test or bounded assert self-check. No formal security risk is accepted for the owner. Any unqualified production-only condition remains a separate release gate.
+
+Ruling: reuse the verified clean dedicated development checkout and create the user-named branch fromf17dba2; no second checkout is needed for isolation from main. Cost if wrong: concurrent edits would require stopping and preserving the other owner's work.
+
+Historical baseline counts are evidence to verify, not newly executed tests. Raw new evidence belongs in `.artifacts/p9-sec-02/`; each attempt gets a fresh output directory.