tegwick
bc6494cd1b
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade |
||
|---|---|---|
| .. | ||
| execution | ||
| execution-history/initial-653b68c3 | ||
| initial-7c6738b3 | ||
| initial-b1e3e66b | ||
| base-image-config.json | ||
| base-trivy-full.json | ||
| candidate-admission.json | ||
| candidate-deployment.json | ||
| change_guard.py | ||
| check_installed.py | ||
| combined-source-boundary-validation.json | ||
| decision-packet.md | ||
| execution-bundle.json | ||
| fresh-preflight-validation.json | ||
| image-config.json | ||
| image-manifest.json | ||
| inherited-vulnerability-follow-through.json | ||
| intake.json | ||
| lifecycle-commands.json | ||
| memo.json | ||
| native-backup-restore-protocol.md | ||
| native-preflight-initial-refusal.json | ||
| native-preflight-tracking-id-refusal.json | ||
| native-preflight.json | ||
| preflight-inputs.json | ||
| preflight.py | ||
| product-owner-review-validation.json | ||
| proposal.json | ||
| published-verification.json | ||
| README.md | ||
| registry-proof.json | ||
| review-refinement.json | ||
| rollback-admission.json | ||
| rollback-deployment.json | ||
| sbom.cdx.json | ||
| sealed-live-deployment.json | ||
| sealed-native-dependencies.json | ||
| security-summary.json | ||
| sqlite_readonly.py | ||
| test_change_guard.py | ||
| test_preflight_optimization.py | ||
| test_sqlite_readonly.py | ||
| trivy-full.json | ||
| validation.json | ||
| verify_registry.py | ||
Exact published purpose overlay and unapproved native release packet
Actual CI task11484/run3 at3e4bcb26 published immutable763c. The registry proof, installedUID/mode/purpose checks, full scan/SBOM and actualbase comparison are retained. The full scan contains1fixable inheritedMEDIUM,0HIGH/CRITICAL; see owner follow-through/T05. Legacy serialization differences are disclosed.
This stage prepares owner admission/service source candidates, protected native backup/restore protocol and20document offline-valid informed-decision memo. Native workload remains7f5/config6c. No native backup/export/restore, image change or human approval occurred. Initial failed CI/native preflight evidence remains in owner history. The original36path7c packet is fully archived and remains refinement-required, not approved. The amended gate adds pre-open stdlib readonlyschema5/integrity/count checks, explicitlocal/remote optimizationrefusal and actualCM/PVC UID/content/custody seals. The immutable original native capture stays sealed; future preflight requires unique output outside the sealed packet and owner source tree.
The memo directly attaches exact execution-bundle.json in place of the rawscan, with unchanged rawscan/SBOM/base scan hash-linked by published-verification.json; twenty documents remain under256KiB; source/image receipt binds raw evidence filenames and hashes. Full owner source manifest includes all raw evidence and helper/tests. Source preparation or local checks do not approve native execution.
The original78pathb1 packet is archived under initial-b1e3e66b with original manifest and exact source map. No previously recorded capture or product/Platform review is relabelled as review of this new packet. Exact23path mechanical helper review agreement is separate from founder approval. The all-phase deadline, isolated UID0 initializer, four Git blobs, rollback-verify and native_provider=false limitation are explicitly refined in the new decision packet/protocol.