fix: qualify patched Python model and cache dependencies

2026-10-25 08:18:21 +01:00
parent 22ef8d003c
commit 30e251a593
25 changed files with 4180 additions and 240 deletions
@@ -13,3 +13,9 @@ CI-M01: read-only assessment complete; hosted BLOCKED/current isolation UNVERIFI
 SEC-M03 in progress: candidate55-package CPU lock resolves;110 exact advisory requests report0 records with the known exact-vendor PyPI404 retained. Both real offline BART serialization profiles PASS, including summary/auth/repeat-cache contract. Complete Linux suite initially52PASS/7FAIL because harness supplied an empty Ollama URL; retained predecessor. Corrected isolated loopback fixture passes59/59 with one documented Starlette/httpx deprecation. Current production requirements are not yet replaced by this candidate.

 Shared loader pin repair: new unit test failed missing immutable revision, then complete native Windows suite59/59 PASS. Tokenizer/model now share immutable revision, deny remote code and request weights_only. Same model identity, no deployment or output-quality acceptance.
+
+SEC-M03 checkpoint: six bounded application/transitive version updates applied;49→55 exact runtime pins,41 old pins unchanged,55 wheel hashes verified. Added61-pin Linux test lock preserving all55 runtime versions. New test-only pytest advisory discovered outside original109; pin9.0.3 repairs its published range. Actual63-distribution rescan has0records,1retained exact CPU vendor PyPI404. Both actual model formats (including1024-token/finite-logit tests),59 sidecar cases,9 cache failures/lock cases,5 parser/OCR children plus actual HTTP startup and full inventory PASS on the rebuilt source runtime plus exact test extras. No inference mocked; no full trained/GPU/semantic claim.
+
+Build preservation repair: the real source build initially included stale virtualenv directories. Cancelled only its owned Docker/buildx client tree; retained failed/cancelled evidence. `.venv*` context exclusion yields602.86kB and actual image contains no virtualenv directory. No filesystem repair, cache deletion, Docker service restart or production change. Dependency files receive narrow LF attributes for stable Windows/Linux lock identities.
+
+REG-M01 broad regression remains pending; previous1130/935/362/35/PDF24 counts remain historical until successor execution. Final acceptance and109-group final disposition table are not inferred from a zero-match scan.