cesnimda
17 lines
2.2 KiB
Markdown
17 lines
2.2 KiB
Markdown
# P9-SEC-02 — model/cache and CI qualification
|
|
|
|
Baseline: `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8`; branch `fix/p9-model-cache-and-ci-qualification`; date25October2026. The user's P9-SEC-02 mission is the authority. Preserve historical acceptance reports, main, production resources, existing routes and all57 preservation groups.
|
|
|
|
- SEC-M01: verify baseline evidence and individually assess the remaining44 advisory groups, retaining original109/previous65 accounting and current exact-pin sources.
|
|
- SEC-M02: trace actual model/OCR/cache owners; select the smallest trusted, licensed, immutable nonproduction artifacts that adequately test compatibility. Existing caches are read-only inputs, never disposable stores. No production/Ollama access or large unnecessary download.
|
|
- SEC-M03: qualify compatible patched dependencies with real CPU loading/processing, integrity/offline/failure/resource tests, exact locks and parser/sidecar regressions. Record full-model versus small-fixture scope separately.
|
|
- CI-M01: inspect hosted metadata/configuration read-only; preserve guards; document operator-owned isolated-runner prerequisites when live execution cannot be verified.
|
|
- REG-M01: run applicable full source-bound regressions serially; separate native discovery, contract, MariaDB, model, PDF, security and human outcomes. Never add focused reruns to full totals.
|
|
- P9-M01: publish dated acceptance, individual gate verdicts, owner blockers, checkpoint commits and verified normal pushes. No merge/deployment/CV-UX/CV-IMPORT/Phase10 implementation.
|
|
|
|
Every new validation branch leaves a negative test or bounded assert self-check. No formal security risk is accepted for the owner. Any unqualified production-only condition remains a separate release gate.
|
|
|
|
Ruling: reuse the verified clean dedicated development checkout and create the user-named branch fromf17dba2; no second checkout is needed for isolation from main. Cost if wrong: concurrent edits would require stopping and preserving the other owner's work.
|
|
|
|
Historical baseline counts are evidence to verify, not newly executed tests. Raw new evidence belongs in `.artifacts/p9-sec-02/`; each attempt gets a fresh output directory.
|