test: qualify immutable models and Phase 9 regression

2026-10-25 13:43:50 +01:00
parent 30e251a593
commit b48f25c4ff
33 changed files with 67462 additions and 6 deletions
@@ -38,3 +38,7 @@ Exact installed queries cover63 distributions/126 requests, zero advisory record
 Original109 groups remain traceable as65 previous repairs plus44 individual follow-ups. The [current source assessment](advisory-current-scope.md) supports ten explicitly scoped non-applicability dispositions (unshipped/unused conversion, alternate architectures, export archive loader and the disputed numeric chain); it does not claim those upstream flaws globally fixed. Full final dispositions and Phase9 gates are reconciled after broad regression.

 Full trained DistilBART, semantic quality, GPU, production cache ownership/migration, real device/provider/manual acceptance and live filesystem/recovery state remain unqualified. The source Dockerfile still has mutable base/apt/bootstrap inputs: this measured immutable local image is retained, while a future rebuild must record its actual identities and requalify. Production digest/supply-chain pinning and release approval remain separate gates. The bounded worker deadline/parser cancellation controls do not establish application-level cancellation of in-flight full-model inference.
+
+The trained-checkpoint successor is reported separately in the final validation/addendum; the preceding sentence records the earlier small-fixture checkpoint boundary. Native Windows unit execution on the retained old virtualenv is predecessor/tooling evidence only. That old graph is not patched-service qualification and must not be used to claim safe untrusted-document processing. Use the exact qualified Linux image and hash locks for the supported tested service. No native virtualenv or production installation was deleted, reset or silently relabelled as updated.
+
+Final25October successor: the configured trained checkpoint passes real CPU loading/generation and offline repository-cache/API contracts under the patched graph. The six current runtime lanes also pass with positive bounded cleanup evidence. All109 original advisory groups have individual dispositions (99 fixed/version-verified,10 narrowly not affected); the additional pytest group is fixed. The final63-distribution scan has0records and the retained vendor PyPI404, so scan coverage remains INCOMPLETE and the independently scoped security decision is CONDITIONAL PASS. Full-image/stdlib/native advisory coverage, old native virtualenvs, semantic/GPU/production qualification are not granted by that decision.