tegwick
e0359bcb6c
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade |
||
|---|---|---|
| .. | ||
| initial-7c6738b3 | ||
| base-image-config.json | ||
| base-trivy-full.json | ||
| candidate-admission.json | ||
| candidate-deployment.json | ||
| change_guard.py | ||
| check_installed.py | ||
| decision-packet.md | ||
| fresh-preflight-validation.json | ||
| image-config.json | ||
| image-manifest.json | ||
| inherited-vulnerability-follow-through.json | ||
| intake.json | ||
| lifecycle-commands.json | ||
| memo.json | ||
| native-backup-restore-protocol.md | ||
| native-preflight-initial-refusal.json | ||
| native-preflight-tracking-id-refusal.json | ||
| native-preflight.json | ||
| preflight-inputs.json | ||
| preflight.py | ||
| product-owner-review-validation.json | ||
| proposal.json | ||
| published-verification.json | ||
| README.md | ||
| registry-proof.json | ||
| review-refinement.json | ||
| rollback-admission.json | ||
| rollback-deployment.json | ||
| sbom.cdx.json | ||
| sealed-live-deployment.json | ||
| sealed-native-dependencies.json | ||
| security-summary.json | ||
| sqlite_readonly.py | ||
| test_change_guard.py | ||
| test_preflight_optimization.py | ||
| test_sqlite_readonly.py | ||
| trivy-full.json | ||
| validation.json | ||
| verify_registry.py | ||
Exact published purpose overlay and unapproved native release packet
Actual CI task11484/run3 at3e4bcb26 published immutable763c. The registry proof, installedUID/mode/purpose checks, full scan/SBOM and actualbase comparison are retained. The full scan contains1fixable inheritedMEDIUM,0HIGH/CRITICAL; see owner follow-through/T05. Legacy serialization differences are disclosed.
This stage prepares owner admission/service source candidates, protected native backup/restore protocol and20document offline-valid informed-decision memo. Native workload remains7f5/config6c. No native backup/export/restore, image change or human approval occurred. Initial failed CI/native preflight evidence remains in owner history. The original36path7c packet is fully archived and remains refinement-required, not approved. The amended gate adds pre-open stdlib readonlyschema5/integrity/count checks, explicitlocal/remote optimizationrefusal and actualCM/PVC UID/content/custody seals. The immutable original native capture stays sealed; future preflight requires unique output outside the sealed packet and owner source tree.
The memo's actual rawscan attachment plus hash-linked rawSBOM/base scan totalamended boundedpacketbytes (under256KiB); source/image receipt binds raw evidence filenames and hashes. Full owner source manifest includes all raw evidence and helper/tests. Source preparation or local checks do not approve native execution.