Keep overlay module readable by the inherited service user

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/evidence/2026-10-11-purpose-publication-preparation/publication-run-1-failure-and-mode-refinement.json

@@ -0,0 +1,38 @@
+{
+  "observed_at": "2026-10-11T01:17:34.808990+00:00",
+  "proposal": "INFD-WP-0009-T04/purpose-overlay-v1",
+  "failed_source_revision": "f66de505b301c03d2fddfa90fd18a53347c62858",
+  "native_job": {
+    "task": 11482,
+    "run": 1,
+    "status": "failure",
+    "url": "https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/1"
+  },
+  "log_sha256": "ffc84bedba4dfc4df64a77cb6d52403ad54258bcd53267fd24cfc35f343e2519",
+  "safe_error_excerpt": [
+    "2026-10-11T01:15:12.9474490Z PermissionError: [Errno 13] Permission denied: '/opt/venv/lib/python3.12/site-packages/informed_decision/policy.py'",
+    "2026-10-11T01:15:13.1707722Z \ud83c\udfc1  Job failed",
+    "2026-10-11T01:15:13.1708584Z Job 'publish-candidate' failed"
+  ],
+  "failure": "CI umask077 creates root-owned mode0600 copied policy module; inherited runtime UID10001 cannot read it",
+  "publication_succeeded": false,
+  "refinement": "COPY --chmod=0644 explicitly sets non-secret source-module readability; no user/config/source-content/dependency/base changes",
+  "local_regression": {
+    "context_policy_mode": "0600",
+    "installed_policy_mode": "0644",
+    "runtime_uid": 10001,
+    "runtime_gid": 10001,
+    "installed_policy_uid": 0,
+    "installed_policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
+    "installed_image_purpose_variants": 10,
+    "binding_forms_allowed": 2,
+    "advisory_or_malformed_refused": 8,
+    "synthetic_only": true,
+    "native_provider": false,
+    "image_index": "sha256:f3d8e478c4e25b0c24a7df1b598a1e415946445d6940600b062b9804b85abf8d",
+    "local_only": true,
+    "published": false
+  },
+  "native_workload_changed": false,
+  "native_backup_restore_executed": false
+}