fix: pin model revisions and quarantine MariaDB CI routing

2026-10-25 07:40:52 +01:00
parent f17dba2ec0
commit 22ef8d003c
15 changed files with 21964 additions and 5 deletions
@@ -0,0 +1,15 @@
+# P9-SEC-02 progress ledger
+
+25October2026: clean checkout and origin verified atf17dba2; main5f835e54 unchanged; dedicated requested branch created. Read prior acceptance and Python remediation; none of the historical test counts are claimed fresh.
+
+SEC-M01 / SEC-M02 investigation in progress. CI-M01 is an independent read-only assessment. No dependency/application change yet.
+
+SEC-M01: all44 remaining groups individually researched;109=65+44 retained. Research dispositions are provisional until runtime/version evidence is integrated. Official sources and hashes preserved, including rate-limit failures.
+
+SEC-M02: pinned licensed tokenizer/metadata and two locally generated BART state formats prepared with manifests. No large model download or live cache access. Five integrity-negative unit checks PASS. Full DistilBART remains absent and no semantic/full-size/GPU claim is made.
+
+CI-M01: read-only assessment complete; hosted BLOCKED/current isolation UNVERIFIED. Safe repository quarantine selects a unique dedicated label, removes broad PR preparation and retains unconditional exit1. Workflow tests RED3/1 then GREEN4/4; existing mocked runner guards5/5 PASS. No host/deployment changes.
+
+SEC-M03 in progress: candidate55-package CPU lock resolves;110 exact advisory requests report0 records with the known exact-vendor PyPI404 retained. Both real offline BART serialization profiles PASS, including summary/auth/repeat-cache contract. Complete Linux suite initially52PASS/7FAIL because harness supplied an empty Ollama URL; retained predecessor. Corrected isolated loopback fixture passes59/59 with one documented Starlette/httpx deprecation. Current production requirements are not yet replaced by this candidate.
+
+Shared loader pin repair: new unit test failed missing immutable revision, then complete native Windows suite59/59 PASS. Tokenizer/model now share immutable revision, deny remote code and request weights_only. Same model identity, no deployment or output-quality acceptance.