jobtrackingapp/docs/redesign/phase-9/p9-sec-02/ACCEPTANCE_ADDENDUM_2026-10-25.md

# P9-SEC-02 — Python model/cache and CI requalification

25October2026. **Phase9 CONDITIONAL GO for the qualified development scope. Production NO-GO.** The original model/cache security uncertainty now has actual trained-model and individual advisory evidence. Hosted automation, scanner coverage, human/provider qualification and production release retain their explicit limits. CV-UX-01 implementation and Phase10 remain withheld under their independent entry requirements.

## Baseline and publication identity

This branch, `fix/p9-model-cache-and-ci-qualification`, begins at `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8` and contains the RD21 repair history. The historical1130backend/935frontend/362browser/35MariaDB/58sidecar/PDF24 results were verified as historical evidence; the results below come from new executions.

Application/dependency source was frozen at `30e251a593849649173badd45ffd7615cda1f85e`. The validated test/harness/evidence checkpoint is **`b48f25c4ff3a579ae0961dd9bd95510aef6b048a`**, normally pushed and directly verified equal to its remote with a clean working tree. The final documentation commit is the Git commit containing this addendum; [publication.json](publication.json) and the retained final receipt describe its post-push verification. Main remains `5f835e54a9b74e6b71418422e28431b2af06453f` at the recorded checks. No force push, main merge or deployment occurred.

[validation.json](validation.json) binds1099 primary source/build inputs and75 selected helper inputs, with documented pre-execution helper amendments and one declared browser-fixture successor. Current runtime qualification separately binds20 model/application/lock inputs. There is no undeclared runtime/helper drift. A Git metadata change is not represented as a rebuilt application artifact.

The Linux PDF capsule retains API source checkpoint `e80815f8df94d26f7d35b8249b4e6e1a65922df3`; its API source/resources are unchanged at30e251a. The actual local image is `sha256:0d1cb44ba8f71d54de77459915a7052b894191cfeb75aa32f0c1e7ffdc21fda6`, with observed API DLL SHA256 `a70d69c5006674950f8aac74f899a28b07ca02adda100c7a5cbdb3c4c00153f5`. [Source lineage](api-source-lineage.json) records this separately from native Windows build identity and diagnostic health labels.

## Dependency security and109-group disposition

The exact application lock changes49→55 packages while retaining41 old pins. The bounded changes are filelock4.2.1, Torch2.13.0+cpu, Transformers5.10.0, huggingface-hub1.33.0, tokenizers0.22.2 and sympy1.14.0, plus their required graph changes. The61-package test lock preserves all55 runtime versions and adds6 exact extras. Actual installed qualification has63 distributions, including2 separately inventoried bootstrap tools. Every55 application wheel hash was verified; the CPU wheel came from the official vendor index. [Dependency evidence](DEPENDENCY_REMEDIATION.md) preserves resolution/build attempts and exact identities.

[DISPOSITIONS.json](DISPOSITIONS.json) and its [table](DISPOSITIONS.md) retain every original group, alias, package/version, affected-range source, function/call path, untrusted-input reachability, mitigation, fix, compatibility limit, confidence, remaining severity and disposition:

| Accounting | Groups |
| --- | ---: |
| Original baseline |109 |
| Addressed before this mission |65 |
| Individually assessed follow-ups |44 |
| Additional follow-ups fixed/version-verified |34 |
| Follow-ups narrowly not affected in the supported path |10 |
| Current original dispositions |99 fixed/version-verified +10 scoped not affected |
| Newly found pytest group, outside original109 |1, fixed at9.0.3 |

The ten scoped exclusions concern conversion/alternate architectures, the unused export archive loader and the disputed numeric chain. [Current source analysis](advisory-current-scope.md) documents their actual absence from the pinned BART/default-generation/text/parser path. Unsafe upstream APIs can remain elsewhere; no global upstream fix or exploit-test coverage is invented. Model choice is a source constant, remote code is denied, the revision is immutable and weights use restricted loading. No material residual security risk was accepted on the owner's behalf.

The separate pytest CVE-2025-71176/GHSA-6w46-j5rx-g56g/PYSEC-2026-1845 alias group was discovered during installed-environment assessment. It is a test-only dependency, patched to9.0.3 and qualified in the actual59-case Linux suite. It is not concealed inside the original109 count.

The final installed scan made126 exact OSV/PyPI queries for63 distributions and found **0 advisory records**. PyPI returned404 for the vendor-local `torch==2.13.0+cpu` version. The raw scan therefore remains **INCOMPLETE**, with that one unavailable response retained. Exact OSV, official CPU wheel identity, vendor fixed ranges and current source/real-model evidence supplement that gap. The independent package-security decision is **CONDITIONAL PASS** within this supported graph; this is not a clean two-provider, whole-image/stdlib/native or deployed-production security verdict. The old native Windows virtualenv is retained tooling/predecessor evidence and is not qualified for untrusted service processing.

## Immutable artifacts and real processing

[MODEL_CACHE.md](MODEL_CACHE.md) traces actual consumers: BART tokenizer/sequence-to-sequence summarisation; pypdf/PyMuPDF/python-docx/Pillow child parsing; native Tesseract English OCR. No implemented Python embedding/reranking/Docling model was assumed. Ollama-managed storage is separate and was not accessed or changed.

The actual configured Apache-2.0 `sshleifer/distilbart-cnn-12-6` checkpoint is pinned at revision **`a4f8f3ea906ed274767e9906dbaede7531d660ff`**. Its **1,222,317,369bytes** matched SHA256 **`3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea`** before loading. [The artifact manifest](full-model/ARTIFACTS.json) retains all required file hashes/provenance and licence evidence. The small random-weight fixture was insufficient to establish compatibility of the original1024-wide,12/6-layer,50264-vocabulary trained tensors/configuration; this one necessary download occurred only in a new nonproduction local cache with checked storage/memory.

The source-built Python runtime and exact test layer are identified in [RUNTIME.json](model/RUNTIME.json): Python3.12.10, Debian12, actual CPU graph and native package inventory. Six successor lanes pass: sidecar59, real Safetensors BART, real restricted state-dictionary BART,9 integrity/lock cases, native parser/OCR plus actual HTTP startup, and exact installed inventory/pip-check. Missing/corrupt/linked artifacts are rejected before loading; Linux native/soft/Hub locks have finite cross-process contention/release checks. Windows filelock4.2 native/soft contention has separate finite evidence, without ACL/oplock or shared-cache migration claims.

The original **trained** model also passes actual default repository/revision loading through a private offline Hub snapshot cache, tokenizer initialization, Norwegian character round trip,1024-token truncation, finite logits, generation, authentication and repeat-cache API behaviour. Its nonroot/read-only/network-none process had4CPU/8GiB/128PID/300-second limits, completed the probe in **27.72seconds**, and measured **2858928KiB peakRSS**, about2.73GiB. Exit0 and a successful bounded daemon query establish container removal. No inference was mocked in these dedicated probes.

The original legacy generation flag emits a retained compatibility warning. [GENERATION_WARNING.json](full-model/GENERATION_WARNING.json) records actual5.10 source assigning the expected forced-BOS0 value for backward compatibility. Original config bytes and warnings are preserved. This does not grant semantic/C11 acceptance.

Tesseract5.3.0 actually processes synthetic PNG/image-PDF data. The packaged English traineddata is4113088bytes with hash/licence/provenance in [OCR_ARTIFACT.json](model/OCR_ARTIFACT.json) and its retained Apache-2.0 notice. Text/DOCX/PDF extraction preserves synthetic Norwegian/C# content. The59-case suite includes actual parser-child deadline/capacity release and descendant termination. Full-model HTTP request preemption, GPU/driver behaviour, product semantic quality, mixed-generation shared-cache migration and production capacity remain unqualified. No production cache, CV or filesystem was used.

## Hosted CI and isolation

[CI_ASSESSMENT.md](CI_ASSESSMENT.md) preserves Gitea1.26.0, act_runner0.4.1 source/capability analysis, historical nonprivileged node job with host networking/socket configuration, unavailable Docker CLI, current permission failures and operator actions. Historical setup or source examples do not prove current isolation.

The repository uses the unique `jobtracker-mariadb-isolated` label, trusted branch pushes, no broad PR trigger and the first unconditional withholding guard. No daemon socket, DinD, privileged access, production credentials or arbitrary remote database endpoint was added. Four workflow guards and existing runner guards are mocked/source checks only.

The12:32UTC read-only refresh records runs856/857 at22ef8d0/30e251a queued, runner IDs0, with no assigned runner or database execution. Current effective HostConfig, private network, trust/secret boundaries, persistent-state policy, egress and success/failure/cancel/crash cleanup remain unverified. **Hosted MariaDB BLOCKED; runner isolation UNVERIFIED;0 hosted MariaDB cases.** The exact six-step operator handoff requires a dedicated nonproduction runner/daemon, private native service, no published DB port/persistent DB volume/job socket, restricted trust/secrets/egress, and actual execution plus cleanup proof. Production deployment runners remain untouched.

## Fresh regression and retained failures

| Lane | Actual final outcome |
| --- | --- |
| Backend |1130passed;0failed/0skipped |
| Frontend |935passed across105suites; exact baseline multiset plus existing declared regression |
| Ordinary browser |362passed, discovery reconciled across98/87/88/89 serial shards |
| Six separate browser-contract lanes |23passed:2AI,2auth,9rate,6ingress,1PDF admission,3preferences |
| RD21 browser companion |6passed |
| Diagnostics /33-route matrix |18passed |
| Volume / RD21 volume |3passed +3passed, separate lanes |
| Real MariaDB integration |35passed against12.2.2;0failed/0skipped |
| MariaDB browser recovery / independent HTTP observations |1passed +2passed |
| Python sidecar |59passed in the actual patched Linux test layer |
| Dedicated model/cache/parser/inventory |All6runtime lanes and actual trained-model probe pass; details above |
| Windows PDF |24/24fixtures,60pages:16/36-page fidelity +8/24-page settings |
| Linux PDF |24/24fixtures,60pages;5browser producer cases |
| Supplemental Linux documents |2passed,2+8pages; separate from original24 |
| Sustained real MariaDB |900.01seconds,250applications,2paced readers,3382reads/0failures,20navigations/0failures |
| Types / lint / production frontend build |PASS |
| Existing security helpers |12commands pass, including SBOM, tracked-secret scan, bounded ingress/runner/extension checks and locked npm/NuGet review |
| Additional qualification guard units |20passed; a focused3-case collector successor check is retained separately and not added |
| Final Python advisory scan |0records across63distributions/126queries; coverage INCOMPLETE for1known vendor PyPI404 |
| Hosted MariaDB |BLOCKED;0executed |

The paced workload preserves exact before/after data, including Career Profile/history. Read latency is p5024.08ms/p9533.41ms/p9945.19ms/max240.46ms. Twenty-four browser/host telemetry samples record sampled JS heap15.4–151.0MiB and at least10.56GiB host free memory. No competing model/build/render/browser qualification workload ran during its measurement window. These are finite observations, with no leak-free, concurrency-capacity or production SLA claim.

No accepted execution hides retries/skips. The failed original ordinary shard3 (87PASS/1FAIL) is preserved. Its trace shows URL change preceding actual destination commit/unmount; the fixture promised a post-disposal callback. Two destination/disposal prerequisites were added, preserving every read-count/sender/origin/owner assertion. Its complete88-case successor passes with identical discovery; focused/predecessor totals are not added to362.

The first Linux attempt completed startup/migrations but executed0browser cases because a new readiness token conflicted with the unchanged historical config guard. The successor restores that guard token while separately pinning the actual image/API source; original oracle/reference bytes remain unchanged. All24fixtures and2supplements pass afterward. An unpublished collector dry run also exposed an inherited historical-PDF path; fresh-root negative guards now reject it. The original dry run is retained.

Independent review identified an Important cleanup-proof error: failed `docker inspect` could be mistaken for absence. The minimal helper now requires a successful bounded positive daemon absence query; unavailable/timeout/present cases fail or remain UNKNOWN. Negative guard proof and all6actual model successor cleanup checks pass. Earlier inference evidence is retained; its old cleanup claim is superseded. Subsequent fixture/reporting changes received targeted root review and guard checks, without inventing a second independent review.

Normal [reconciliation](reconciliation-outcome.json) intentionally exits1 for `python-advisories:INCOMPLETE` and `hosted-mariadb:BLOCKED`. `localFunctionalComplete:true`; `automationComplete:false`; no runtime/helper drift. A successful collect-only command means collection succeeded, not unrestricted acceptance.

## Preservation, human work and independent entry decisions

The [64-finding register](FINDINGS.md) preserves original exact criteria/sources, severity, dependency, owner, closure requirement and independent A/B/C/D/E gate effects. The [57-group/33-route register](PRESERVATION.md) retains **56PARTIAL and C11DEFERRED**. No whole capability is promoted because a focused or automated case passes. Canonical Career Profile, revisions, tenant/owner boundaries, null-as-inherit overrides and frozen document bytes remain required.

All M09-01–10 owner cards remain **NOT TESTED**. [MANUAL_ACCEPTANCE.md](MANUAL_ACCEPTANCE.md) links exact reproducible human/device/provider cards and prioritises reader/keyboard/contrast/zoom, physical devices, Bokmål, printing and provider recovery evidence. Automated axe and PDF inspection do not establish full human accessibility/physical printing acceptance. C11/P5-13 semantics/withholding, provider sandboxes and release requirements remain independent. Duplicate reminder reads and creation-intent idempotency retain their documented debt/contract status and are not folded into RD21 stale-write closure.

| Independent gate | Decision | Basis / remaining condition |
| --- | --- | --- |
| Python Dependency Security |CONDITIONAL PASS |All109 original groups and additional pytest group dispositioned; actual patched graph/models pass; known vendor query gap explicitly supplemented and retained |
| Model/Cache Compatibility |PASS |Actual supported CPU graph, immutable trained/small artifacts, offline cache and parser/OCR contracts; stated exclusions remain |
| Hosted MariaDB CI |BLOCKED |Operator-owned dedicated isolation and actual hosted execution/teardown evidence absent |
| Hosted Runner Isolation |UNVERIFIED |Current effective host/job/service/secret/lifecycle boundaries unavailable |
| RD21 |RESOLVED |Original tested save/revision/concurrency/atomic/recovery scope remains satisfied in real MariaDB; creation idempotency separate |
| Linux PDF Fidelity |PASS |Original24 plus supplemental2 pass with unchanged oracle/content/layout rules |
| Phase9 |CONDITIONAL GO |Mandatory local functional qualification and scoped security disposition complete; automation/provider/manual/release qualifications remain explicit |
| CV-UX-01 Readiness |NO-GO for implementation |No approved standalone CV-UX scope/entry artifact established; REQUEST:456 requires a separate feature issue/dependency decision |
| Phase10 Readiness |NO-GO |Candidate-specific unused-route/caller, affected-test and functionality-inventory cleanup proof remains unestablished |
| Production |NO-GO |Task restrictions and independent live infrastructure/security/recovery/provider/human gates |

The Phase9 conditional decision is grounded in REQUEST:246–252 (genuine unfinished human checks may carry into release gates),426–439 (individual disposition and no PARTIAL→PASS invention),581–598 (independent development/Phase10/production decisions), and this mission's explicit operator-blocked CI handoff. It permits scoped development qualification while retaining incomplete automation; it is not an infrastructure or security exception granted for the owner. Unrelated production-only requirements do not independently veto safe, separately scoped CV design planning.

CV-UX implementation requires its own approved issue, scope, entry/acceptance criteria and affected preservation obligations under REQUEST:456; no specific CV-UX carry-forward authority was found. No CV work starts in this task. Phase10 separately requires IMPLEMENTATION_PLAN:164–170 candidate-specific route non-use, passing affected tests and satisfied functionality inventory. A Phase9 decision alone grants no deletion eligibility or next-phase start.

Production remains withheld for previously reported filesystem/checksum integrity, independent off-disk backup/restore/rollback, deployed identity/configuration/ingress/security/monitoring, exact image/version policy, native/full-image review, model/cache migration, resource limits and provider/human acceptance. Existing production cache/participants, MariaDB, Ollama/Qwen and storage were not inspected or modified. No SQLite retirement, database-version change, live restart or deployment occurred.

## Cleanup, next action and publication

[cleanup.json](cleanup.json) records zero generated schemas before removal, positive absence of owned model/API containers, and removal of only the exact owned tmpfs MariaDB service. Both database log streams and hashes are retained. The stopped persistent development container/state/mounts and development volume metadata are unchanged; unrelated containers/volumes remain untouched. Verified model fixtures/capsules remain in their separate local test cache for replay.

**Next development action:** obtain an approved standalone CV-UX-01 scope/entry issue that explicitly carries the relevant preservation and manual qualifications; safe design planning can be considered independently of production recovery. Implementation stays withheld until that entry decision. In parallel, the infrastructure operator can execute the concrete dedicated-runner checklist and prove actual hosted35-case execution/isolation/cleanup at the current discovery, followed by owner human/provider cards. Requalify any changed runtime/model/image rather than copying these results forward.

Checkpoints: `22ef8d0` loader/CI guard work; `30e251a` exact dependency/source-runtime qualification; `b48f25c` immutable trained-model, final regression, fixture/harness and machine acceptance evidence. [REPRODUCE.md](REPRODUCE.md) records development replay prerequisites/commands. Final publication verifies normal remote equality, clean tree, baseline/RD21 ancestry and unchanged main. No merge, deployment or next workstream is authorised by this addendum.