# P9-SEC-02 — Python model/cache and CI requalification
25October2026. **Phase9 CONDITIONAL GO for the qualified development scope. Production NO-GO.** The original model/cache security uncertainty now has actual trained-model and individual advisory evidence. Hosted automation, scanner coverage, human/provider qualification and production release retain their explicit limits. CV-UX-01 implementation and Phase10 remain withheld under their independent entry requirements.
## Baseline and publication identity
This branch, `fix/p9-model-cache-and-ci-qualification`, begins at `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8` and contains the RD21 repair history. The historical1130backend/935frontend/362browser/35MariaDB/58sidecar/PDF24 results were verified as historical evidence; the results below come from new executions.
Application/dependency source was frozen at `30e251a593849649173badd45ffd7615cda1f85e`. The validated test/harness/evidence checkpoint is **`b48f25c4ff3a579ae0961dd9bd95510aef6b048a`**, normally pushed and directly verified equal to its remote with a clean working tree. The final documentation commit is the Git commit containing this addendum; [publication.json](publication.json) and the retained final receipt describe its post-push verification. Main remains `5f835e54a9b74e6b71418422e28431b2af06453f` at the recorded checks. No force push, main merge or deployment occurred.
[validation.json](validation.json) binds1099 primary source/build inputs and75 selected helper inputs, with documented pre-execution helper amendments and one declared browser-fixture successor. Current runtime qualification separately binds20 model/application/lock inputs. There is no undeclared runtime/helper drift. A Git metadata change is not represented as a rebuilt application artifact.
The Linux PDF capsule retains API source checkpoint `e80815f8df94d26f7d35b8249b4e6e1a65922df3`; its API source/resources are unchanged at30e251a. The actual local image is `sha256:0d1cb44ba8f71d54de77459915a7052b894191cfeb75aa32f0c1e7ffdc21fda6`, with observed API DLL SHA256 `a70d69c5006674950f8aac74f899a28b07ca02adda100c7a5cbdb3c4c00153f5`. [Source lineage](api-source-lineage.json) records this separately from native Windows build identity and diagnostic health labels.
## Dependency security and109-group disposition
The exact application lock changes49→55 packages while retaining41 old pins. The bounded changes are filelock4.2.1, Torch2.13.0+cpu, Transformers5.10.0, huggingface-hub1.33.0, tokenizers0.22.2 and sympy1.14.0, plus their required graph changes. The61-package test lock preserves all55 runtime versions and adds6 exact extras. Actual installed qualification has63 distributions, including2 separately inventoried bootstrap tools. Every55 application wheel hash was verified; the CPU wheel came from the official vendor index. [Dependency evidence](DEPENDENCY_REMEDIATION.md) preserves resolution/build attempts and exact identities.
[DISPOSITIONS.json](DISPOSITIONS.json) and its [table](DISPOSITIONS.md) retain every original group, alias, package/version, affected-range source, function/call path, untrusted-input reachability, mitigation, fix, compatibility limit, confidence, remaining severity and disposition:
The ten scoped exclusions concern conversion/alternate architectures, the unused export archive loader and the disputed numeric chain. [Current source analysis](advisory-current-scope.md) documents their actual absence from the pinned BART/default-generation/text/parser path. Unsafe upstream APIs can remain elsewhere; no global upstream fix or exploit-test coverage is invented. Model choice is a source constant, remote code is denied, the revision is immutable and weights use restricted loading. No material residual security risk was accepted on the owner's behalf.
The separate pytest CVE-2025-71176/GHSA-6w46-j5rx-g56g/PYSEC-2026-1845 alias group was discovered during installed-environment assessment. It is a test-only dependency, patched to9.0.3 and qualified in the actual59-case Linux suite. It is not concealed inside the original109 count.
The final installed scan made126 exact OSV/PyPI queries for63 distributions and found **0 advisory records**. PyPI returned404 for the vendor-local `torch==2.13.0+cpu` version. The raw scan therefore remains **INCOMPLETE**, with that one unavailable response retained. Exact OSV, official CPU wheel identity, vendor fixed ranges and current source/real-model evidence supplement that gap. The independent package-security decision is **CONDITIONAL PASS** within this supported graph; this is not a clean two-provider, whole-image/stdlib/native or deployed-production security verdict. The old native Windows virtualenv is retained tooling/predecessor evidence and is not qualified for untrusted service processing.
## Immutable artifacts and real processing
[MODEL_CACHE.md](MODEL_CACHE.md) traces actual consumers: BART tokenizer/sequence-to-sequence summarisation; pypdf/PyMuPDF/python-docx/Pillow child parsing; native Tesseract English OCR. No implemented Python embedding/reranking/Docling model was assumed. Ollama-managed storage is separate and was not accessed or changed.
The actual configured Apache-2.0 `sshleifer/distilbart-cnn-12-6` checkpoint is pinned at revision **`a4f8f3ea906ed274767e9906dbaede7531d660ff`**. Its **1,222,317,369bytes** matched SHA256 **`3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea`** before loading. [The artifact manifest](full-model/ARTIFACTS.json) retains all required file hashes/provenance and licence evidence. The small random-weight fixture was insufficient to establish compatibility of the original1024-wide,12/6-layer,50264-vocabulary trained tensors/configuration; this one necessary download occurred only in a new nonproduction local cache with checked storage/memory.
The source-built Python runtime and exact test layer are identified in [RUNTIME.json](model/RUNTIME.json): Python3.12.10, Debian12, actual CPU graph and native package inventory. Six successor lanes pass: sidecar59, real Safetensors BART, real restricted state-dictionary BART,9 integrity/lock cases, native parser/OCR plus actual HTTP startup, and exact installed inventory/pip-check. Missing/corrupt/linked artifacts are rejected before loading; Linux native/soft/Hub locks have finite cross-process contention/release checks. Windows filelock4.2 native/soft contention has separate finite evidence, without ACL/oplock or shared-cache migration claims.
The original **trained** model also passes actual default repository/revision loading through a private offline Hub snapshot cache, tokenizer initialization, Norwegian character round trip,1024-token truncation, finite logits, generation, authentication and repeat-cache API behaviour. Its nonroot/read-only/network-none process had4CPU/8GiB/128PID/300-second limits, completed the probe in **27.72seconds**, and measured **2858928KiB peakRSS**, about2.73GiB. Exit0 and a successful bounded daemon query establish container removal. No inference was mocked in these dedicated probes.
The original legacy generation flag emits a retained compatibility warning. [GENERATION_WARNING.json](full-model/GENERATION_WARNING.json) records actual5.10 source assigning the expected forced-BOS0 value for backward compatibility. Original config bytes and warnings are preserved. This does not grant semantic/C11 acceptance.
Tesseract5.3.0 actually processes synthetic PNG/image-PDF data. The packaged English traineddata is4113088bytes with hash/licence/provenance in [OCR_ARTIFACT.json](model/OCR_ARTIFACT.json) and its retained Apache-2.0 notice. Text/DOCX/PDF extraction preserves synthetic Norwegian/C# content. The59-case suite includes actual parser-child deadline/capacity release and descendant termination. Full-model HTTP request preemption, GPU/driver behaviour, product semantic quality, mixed-generation shared-cache migration and production capacity remain unqualified. No production cache, CV or filesystem was used.
## Hosted CI and isolation
[CI_ASSESSMENT.md](CI_ASSESSMENT.md) preserves Gitea1.26.0, act_runner0.4.1 source/capability analysis, historical nonprivileged node job with host networking/socket configuration, unavailable Docker CLI, current permission failures and operator actions. Historical setup or source examples do not prove current isolation.
The repository uses the unique `jobtracker-mariadb-isolated` label, trusted branch pushes, no broad PR trigger and the first unconditional withholding guard. No daemon socket, DinD, privileged access, production credentials or arbitrary remote database endpoint was added. Four workflow guards and existing runner guards are mocked/source checks only.
The12:32UTC read-only refresh records runs856/857 at22ef8d0/30e251a queued, runner IDs0, with no assigned runner or database execution. Current effective HostConfig, private network, trust/secret boundaries, persistent-state policy, egress and success/failure/cancel/crash cleanup remain unverified. **Hosted MariaDB BLOCKED; runner isolation UNVERIFIED;0 hosted MariaDB cases.** The exact six-step operator handoff requires a dedicated nonproduction runner/daemon, private native service, no published DB port/persistent DB volume/job socket, restricted trust/secrets/egress, and actual execution plus cleanup proof. Production deployment runners remain untouched.
The paced workload preserves exact before/after data, including Career Profile/history. Read latency is p5024.08ms/p9533.41ms/p9945.19ms/max240.46ms. Twenty-four browser/host telemetry samples record sampled JS heap15.4–151.0MiB and at least10.56GiB host free memory. No competing model/build/render/browser qualification workload ran during its measurement window. These are finite observations, with no leak-free, concurrency-capacity or production SLA claim.
No accepted execution hides retries/skips. The failed original ordinary shard3 (87PASS/1FAIL) is preserved. Its trace shows URL change preceding actual destination commit/unmount; the fixture promised a post-disposal callback. Two destination/disposal prerequisites were added, preserving every read-count/sender/origin/owner assertion. Its complete88-case successor passes with identical discovery; focused/predecessor totals are not added to362.
The first Linux attempt completed startup/migrations but executed0browser cases because a new readiness token conflicted with the unchanged historical config guard. The successor restores that guard token while separately pinning the actual image/API source; original oracle/reference bytes remain unchanged. All24fixtures and2supplements pass afterward. An unpublished collector dry run also exposed an inherited historical-PDF path; fresh-root negative guards now reject it. The original dry run is retained.
Independent review identified an Important cleanup-proof error: failed `docker inspect` could be mistaken for absence. The minimal helper now requires a successful bounded positive daemon absence query; unavailable/timeout/present cases fail or remain UNKNOWN. Negative guard proof and all6actual model successor cleanup checks pass. Earlier inference evidence is retained; its old cleanup claim is superseded. Subsequent fixture/reporting changes received targeted root review and guard checks, without inventing a second independent review.
Normal [reconciliation](reconciliation-outcome.json) intentionally exits1 for `python-advisories:INCOMPLETE` and `hosted-mariadb:BLOCKED`. `localFunctionalComplete:true`; `automationComplete:false`; no runtime/helper drift. A successful collect-only command means collection succeeded, not unrestricted acceptance.
## Preservation, human work and independent entry decisions
The [64-finding register](FINDINGS.md) preserves original exact criteria/sources, severity, dependency, owner, closure requirement and independent A/B/C/D/E gate effects. The [57-group/33-route register](PRESERVATION.md) retains **56PARTIAL and C11DEFERRED**. No whole capability is promoted because a focused or automated case passes. Canonical Career Profile, revisions, tenant/owner boundaries, null-as-inherit overrides and frozen document bytes remain required.
All M09-01–10 owner cards remain **NOT TESTED**. [MANUAL_ACCEPTANCE.md](MANUAL_ACCEPTANCE.md) links exact reproducible human/device/provider cards and prioritises reader/keyboard/contrast/zoom, physical devices, Bokmål, printing and provider recovery evidence. Automated axe and PDF inspection do not establish full human accessibility/physical printing acceptance. C11/P5-13 semantics/withholding, provider sandboxes and release requirements remain independent. Duplicate reminder reads and creation-intent idempotency retain their documented debt/contract status and are not folded into RD21 stale-write closure.
| Python Dependency Security |CONDITIONAL PASS |All109 original groups and additional pytest group dispositioned; actual patched graph/models pass; known vendor query gap explicitly supplemented and retained |
| Model/Cache Compatibility |PASS |Actual supported CPU graph, immutable trained/small artifacts, offline cache and parser/OCR contracts; stated exclusions remain |
| Hosted MariaDB CI |BLOCKED |Operator-owned dedicated isolation and actual hosted execution/teardown evidence absent |
| Production |NO-GO |Task restrictions and independent live infrastructure/security/recovery/provider/human gates |
The Phase9 conditional decision is grounded in REQUEST:246–252 (genuine unfinished human checks may carry into release gates),426–439 (individual disposition and no PARTIAL→PASS invention),581–598 (independent development/Phase10/production decisions), and this mission's explicit operator-blocked CI handoff. It permits scoped development qualification while retaining incomplete automation; it is not an infrastructure or security exception granted for the owner. Unrelated production-only requirements do not independently veto safe, separately scoped CV design planning.
CV-UX implementation requires its own approved issue, scope, entry/acceptance criteria and affected preservation obligations under REQUEST:456; no specific CV-UX carry-forward authority was found. No CV work starts in this task. Phase10 separately requires IMPLEMENTATION_PLAN:164–170 candidate-specific route non-use, passing affected tests and satisfied functionality inventory. A Phase9 decision alone grants no deletion eligibility or next-phase start.
Production remains withheld for previously reported filesystem/checksum integrity, independent off-disk backup/restore/rollback, deployed identity/configuration/ingress/security/monitoring, exact image/version policy, native/full-image review, model/cache migration, resource limits and provider/human acceptance. Existing production cache/participants, MariaDB, Ollama/Qwen and storage were not inspected or modified. No SQLite retirement, database-version change, live restart or deployment occurred.
## Cleanup, next action and publication
[cleanup.json](cleanup.json) records zero generated schemas before removal, positive absence of owned model/API containers, and removal of only the exact owned tmpfs MariaDB service. Both database log streams and hashes are retained. The stopped persistent development container/state/mounts and development volume metadata are unchanged; unrelated containers/volumes remain untouched. Verified model fixtures/capsules remain in their separate local test cache for replay.
**Next development action:** obtain an approved standalone CV-UX-01 scope/entry issue that explicitly carries the relevant preservation and manual qualifications; safe design planning can be considered independently of production recovery. Implementation stays withheld until that entry decision. In parallel, the infrastructure operator can execute the concrete dedicated-runner checklist and prove actual hosted35-case execution/isolation/cleanup at the current discovery, followed by owner human/provider cards. Requalify any changed runtime/model/image rather than copying these results forward.
Checkpoints: `22ef8d0` loader/CI guard work; `30e251a` exact dependency/source-runtime qualification; `b48f25c` immutable trained-model, final regression, fixture/harness and machine acceptance evidence. [REPRODUCE.md](REPRODUCE.md) records development replay prerequisites/commands. Final publication verifies normal remote equality, clean tree, baseline/RD21 ancestry and unchanged main. No merge, deployment or next workstream is authorised by this addendum.
@@ -19,3 +19,17 @@ SEC-M03 checkpoint: six bounded application/transitive version updates applied;4
Build preservation repair: the real source build initially included stale virtualenv directories. Cancelled only its owned Docker/buildx client tree; retained failed/cancelled evidence. `.venv*` context exclusion yields602.86kB and actual image contains no virtualenv directory. No filesystem repair, cache deletion, Docker service restart or production change. Dependency files receive narrow LF attributes for stable Windows/Linux lock identities.
Build preservation repair: the real source build initially included stale virtualenv directories. Cancelled only its owned Docker/buildx client tree; retained failed/cancelled evidence. `.venv*` context exclusion yields602.86kB and actual image contains no virtualenv directory. No filesystem repair, cache deletion, Docker service restart or production change. Dependency files receive narrow LF attributes for stable Windows/Linux lock identities.
REG-M01 broad regression remains pending; previous1130/935/362/35/PDF24 counts remain historical until successor execution. Final acceptance and109-group final disposition table are not inferred from a zero-match scan.
REG-M01 broad regression remains pending; previous1130/935/362/35/PDF24 counts remain historical until successor execution. Final acceptance and109-group final disposition table are not inferred from a zero-match scan.
## Final25October2026 successor
SEC-M01–03 complete within the stated CPU/application graph:109 original groups individually dispositioned99fixed/version-verified+10scoped not affected;1additional pytest group fixed. Real original trained DistilBART revision/hash, offline Hub cache,1024-token/generation/auth/cache contracts PASS; six actual source-runtime lanes PASS, including59sidecar cases. Official-size/hash-verified download is isolated/nonproduction, not an Ollama or model-choice change. Raw scan remains INCOMPLETE for the known vendor PyPI404;0records/63installed distributions/126queries supports conditional source-backed security qualification, not global image/deployed safety.
REG-M01 current local functional evidence complete:1130backend,935frontend,362ordinary browser,23separate contracts,6RD21 companions,18diagnostics,3+3volume,35real MariaDB,1MariaDB recovery+2HTTP,24PDF fixtures/60pages each Windows/Linux,2Linux supplements,types/lint/build and12security helpers PASS. Exclusive15minute workload:3382reads/0failures,20navigations/0failures,exactbefore/afterdata equality.20supplemental guard cases PASS;focused/predecessor executions are never added. All named raw attempts remain retained.
Independent review Important cleanup-proof issue repaired with successful bounded daemon queries and negative guards; all6model successor removals positively verified. Original87PASS/1FAIL browser shard retained; actual destination/disposal prerequisites preserve every original assertion and full88-case successor PASS. Initial Linux readiness-guard0-case failure retained; same image/source and unchanged oracle successor24/24PASS. Initial unpublished collector historical-path error retained; fresh-root guards reject it. These are QA fixture/evidence repairs, with no product API redesign.
CI-M01 remains BLOCKED/isolation UNVERIFIED. Final metadata856/857 shows queued/unassigned dedicated-label jobs,0hosted MariaDB cases. Operator-only isolation/egress/trust/lifecycle prerequisites remain exact actions in CI_ASSESSMENT.md; no socket, privilege, live runner or production changes occurred.
P9-M01: Phase9 CONDITIONAL GO for the bounded development scope; Python CONDITIONAL PASS; model/cache PASS; RD21 RESOLVED; LinuxPDFPASS. CV-UX implementation NO-GO until its own approved scope/entry issue; Phase10NO-GO until candidate-specific entry proof; productionNO-GO. All57groups/33routes retained,56PARTIAL/C11DEFERRED unchanged, human/provider cards NOT TESTED. Production-only gates do not independently veto separately scoped design planning. The dated addendum and machine verdicts are authoritative for this successor.
Published checkpoints22ef8d0/30e251a/b48f25c are normal pushes with verified equality. b48f25c was clean immediately after push. Final addendum/publication ledger receives a separate documentation commit and final post-push receipt; no main merge/deployment/next workstream. Owned tmpfs test service removed after zero generated schemas and both log streams were retained; persistent developer container/state/mounts/volume metadata unchanged.
"scope":"Linux PDF API image retains identical API source/resources. No native-Windows versus container DLL byte equality is asserted; build metadata may differ. Python/CI changes are separate owners.",
"testedArtifactPolicy":"Application/runtime source is30e251a with declared fixture/helper successors. Native compiled artifacts retain that measured source/build identity; Linux PDF image source is separately e80815f with unchanged API tree. Final documentation commits are not labelled rebuilt application artifacts.",
"boundaries":{
"forcePush":false,
"mergeMain":false,
"deployment":false,
"productionChanges":false,
"nextWorkstreamStarted":false
},
"finalDocumentationCommit":"Git commit containing ACCEPTANCE_ADDENDUM_2026-10-25.md and this ledger; its own hash cannot be embedded recursively.",
"meaning":"Normal aggregate correctly refuses full automation PASS for the retained scanner coverage gap and hosted infrastructure blocker; this is separate from conditional scoped development acceptance."
}
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
cesnimda