# SEC-006 parser dependency verification

## Result

The libraries reached by untrusted CV upload parsing were upgraded to compatible fixed releases and locked with hashes for the Linux CPU image. The dependency-only package is implemented locally but is not production-verified because the local Docker Desktop daemon is unavailable.

## Fixed parser stack

- Python base: `3.12.10-slim-bookworm`
- FastAPI: `0.141.1`
- Starlette: `1.6.0`
- Pillow: `12.3.0`
- pypdf: `6.16.2`
- python-multipart: `0.0.32`
- Reproducible Linux CPU dependency set: `tools/summarizer/requirements-linux.lock`

The lock was generated for Python 3.12 on `x86_64-unknown-linux-gnu` with the PyTorch CPU index and contains hashes for every resolved package. A clean local environment installed the generated set with `--require-hashes` and imported the upgraded parser packages successfully.

## Advisory review

`pip-audit -r requirements.txt` reports no advisory for FastAPI, Starlette, Pillow, pypdf, PyMuPDF, python-docx, pytesseract or python-multipart. It reports 45 advisories across `torch==2.6.0` and `transformers==4.48.3`.

Those remaining findings belong to the model-loading stack rather than the CV file decoder paths remediated by SEC-006. They remain open under JT-017; this record does not accept or close them.

## Regression proof

- Python parser suite: 32/32 passed.
- Focused CV extraction/backend suite: 51/51 passed.
- Full backend suite: 719/719 passed.
- Generated boundary cases cover mismatched signatures, invalid text bytes, excessive PDF pages, excessive image pixels, excessive DOCX entries and sanitized unexpected parser failures.
- The API no longer performs local PDF, DOCX or image parsing when the sidecar returns no text. A bounded UTF-8 text/Markdown fallback remains.

## Remaining verification

`docker info` fails because `dockerDesktopLinuxEngine` is not running. When a daemon is available:

1. Build `tools/summarizer/Dockerfile` without changing the lock.
2. Start the image with the intended SEC-007 runtime restrictions.
3. Run health plus benign TXT, Markdown, PDF, DOCX and image extraction smoke tests.
4. Record the image digest and measured memory/CPU use before any production activation.