cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: publish PDF remediation and Phase 9 qualification evidence

Browse Source
This commit is contained in:
cesnimda
2026-10-25 03:26:38 +01:00
parent b313e20bad
commit f17dba2ec0
34 changed files with 61077 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/redesign/phase-9/p9-remed-02/COMMANDS.md
+6
View File
@@ -17,6 +17,8 @@ The existing oracle checks actual independently rendered page images, extracted
Final local packaging image0d1cb44 has the same render-DLL SHA256 as qualified image98ccb723; only the standalone provenance manifest was completed. See raw image-lineage.json. These are local image identities, not asserted pullable registry manifest references. No image was pushed or deployed.
The separate long-skill producer uses `rtk proxy python docs/redesign/phase-9/p9-remed-02/linux-run.py representative-linux` in a fresh output directory. Then run `rtk proxy python docs/redesign/phase-9/p9-remed-02/representative/proof.py .artifacts/p9-remed-02/representative-linux`. The versioned proof command preserves the exact two-case corpus, records inputs before invoking the unchanged PDF oracle, verifies post-run hashes and content/header-footer assertions, and binds the retained result/report. It refuses to overwrite completed proof. Reconciliation requires that producer manifest and checks current hashes again. These two fixtures are separate from the original24 and ordinary362.
## Regression and security
Reuse [the full lane commands](../p9-requal-01/COMMANDS.md) with new `.artifacts/p9-remed-02/` outputs. Run backend and real provider tests before browser servers to avoid apphost locks. Finish frontend/type/lint/build before serial browser discovery and four zero-retry shards, then the six separate contracts, RD21/diagnostic/volume and isolated MariaDB browser/workload lanes. Do not add focused RED/GREEN checks to full totals. The first95/3 shard remains a failed predecessor, not accepted final execution.
@@ -24,3 +26,7 @@ Reuse [the full lane commands](../p9-requal-01/COMMANDS.md) with new `.artifacts
Python exact lock/patch commands and actual startup/parser limits are in [security remediation](security/REMEDIATION.md); all109 advisory dispositions remain in its inventory. No model download or inference is part of these commands. Existing security helpers, tracked-secret scan and SBOM are separate from advisory closure.
Remove only the owned disposable database service after all lanes, with the same Compose file/project/profile and `rm --stop --force mariadb-test`. Never use `down -v`, prune development data, expose a host daemon in a job or connect tests to production. Hosted execution remains blocked pending the [operator plan](CI_ISOLATION.md).
## Exact qualified renderer replay
The local-only [capsule manifest](renderer-capsule.json) records a377384960-byte image archive with SHA256 `9b98865b14305f97d13502f785fb88129e205229f42e8a6c8980f74f5664fba5`. Before loading, verify that hash, then use `rtk proxy docker image load --input .artifacts/p9-remed-02/renderer-capsule/qualified-renderer.tar` only in an isolated qualification engine. Both local tags resolve to imageID `sha256:0d1cb44ba8f71d54de77459915a7052b894191cfeb75aa32f0c1e7ffdc21fda6`. This is not a pullable registry manifest. The archive is ignored/local, never uploaded; obtain the retained approved artifact from its owner or rebuild and requalify. The complete Debian package/locale inventory is [retained](renderer-runtime-inventory.txt); fonts have their separate immutable source/hash manifest. Existing Dockerfile base/apt inputs float: a source rebuild must record its actual new runtime identity and repeat qualification. No production engine or data is involved.