Prepare readable overlay context with the admitted legacy builder

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

.forgejo/workflows/purpose-overlay-image.yaml

@@ -45,6 +45,7 @@ jobs:
           echo "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62  ${BUILD_ROOT}/source/informed_decision/policy.py" | sha256sum -c -
           cp "${BUILD_ROOT}/source/informed_decision/policy.py" "${BUILD_ROOT}/overlay/policy.py"
           cp "${BUILD_ROOT}/source/deploy/purpose-overlay/Containerfile" "${BUILD_ROOT}/overlay/Containerfile"
+          chmod 0644 "${BUILD_ROOT}/overlay/policy.py" "${BUILD_ROOT}/overlay/Containerfile"
           wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin

deploy/purpose-overlay/Containerfile

@@ -4,4 +4,4 @@ LABEL org.opencontainers.image.revision="$SOURCE_REVISION" \
       org.opencontainers.image.base.digest="sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173" \
       social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" \
       social.coulomb.release.scope="INFD-WP-0009-T04/purpose-overlay-v1"
-COPY --chmod=0644 policy.py /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py
+COPY policy.py /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py

docs/evidence/2026-10-11-purpose-publication-preparation/publication-run-2-failure-and-legacy-refinement.json

@@ -0,0 +1,45 @@
+{
+  "observed_at": "2026-10-11T01:19:30.737909+00:00",
+  "proposal": "INFD-WP-0009-T04/purpose-overlay-v1",
+  "failed_source_revision": "acecad887378120b62bd3513b4f04e9fb5cea924",
+  "native_job": {
+    "task": 11483,
+    "run": 2,
+    "status": "failure",
+    "url": "https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/2"
+  },
+  "log_sha256": "d7e8b7a27a767a06d13e59d5eca6787d5cc4e8885702ed2fa01d478b665ea867",
+  "safe_error_excerpt": [
+    "2026-10-11T01:18:30.7527928Z DEPRECATED: The legacy builder is deprecated and will be removed in a future release.",
+    "2026-10-11T01:18:30.9218823Z the --chmod option requires BuildKit. Refer to https://docs.docker.com/go/buildkit/ to learn how to build images with BuildKit enabled",
+    "2026-10-11T01:18:30.9662014Z \ud83c\udfc1  Job failed"
+  ],
+  "failure": "Actual native runner falls back to legacy Docker builder; COPY --chmod is unsupported",
+  "publication_succeeded": false,
+  "refinement": "Plain COPY restored; explicit chmod0644 fixes permissions of both non-secret two-file context inputs before legacy-compatible build; no new builder/tooling capability",
+  "local_regression": {
+    "DOCKER_BUILDKIT": "0",
+    "legacy_build_passed": true,
+    "context_modes": [
+      "0644",
+      "0644"
+    ],
+    "installed_policy_mode": "0644",
+    "runtime_uid": 10001,
+    "runtime_gid": 10001,
+    "installed_policy_uid": 0,
+    "installed_policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
+    "installed_image_purpose_variants": 10,
+    "binding_forms_allowed": 2,
+    "advisory_or_malformed_refused": 8,
+    "workflow_bash_syntax_passed": true,
+    "synthetic_only": true,
+    "native_provider": false,
+    "local_image_config_short": "6cd74837e6aa",
+    "local_only": true,
+    "published": false
+  },
+  "limits": "Local legacy-builder checks establish compatibility on this workstation, not native publication success; actual native retry still required",
+  "native_workload_changed": false,
+  "native_backup_restore_executed": false
+}