policy-nexus/docs/evidence/2026-10-11-runtime-release-verification

PolicyNexus runtime release verification — 2026-10-11

Owner workplan: PNEX-WP-0005. Historical finished PNEX-WP-0004 is preserved. This packet verifies a published candidate; it does not activate hosting or record a new human approval.

Native task 11467 / run 78 succeeded at b64a0c52ec. The immutable image is sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06. Published receipts contain exact image/publication/inventory/source-set/raw-lock pins. The raw source-lock was directly observed in registry layers and installed container files; its schema, exact deterministic serializer, source config and all repository revisions agree with the image labels and installed inventory. All 73 document source hashes match their exact Git commits and paths. Independent HTTP checks verify all 73 canonical pages and all 72 prior immutable page hashes, existing headers, health, unknown 404, ETag 304 and the legacy 308 redirect. Native nginx-t and image-default UID/GID 101 pass with read-only root and writable /tmp. All 52 owner tests independently pass with POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources.

The full pinned scan and CycloneDX SBOM cover 70 packages with zero findings; no severity or unfixed findings were suppressed. Scanner 0.74 and its 2026-10-10 DB are pinned in receipts. Its bundled EOL list does not know Alpine 3.24; this warning remains recorded. Vulnerability coverage is demonstrated by the same scanner finding the unfixed tiff/zlib issues in the official base, then removing those findings after exact package fixes. Zero findings describes this scan and its database, not an assertion that every security property is complete.

Runtime changes: Nginx 1.27.5 → 1.30.5; Alpine 3.21.3 → 3.24.2; official full stable Alpine index15c994d10d6d78658721c3bcafff14cb281fba2a4bdf9d5ba92c416a472516e3; exact tiff 4.7.2-r0 and zlib 1.3.2-r1 updates. Old/new Nginx configure flags match; the full optional module set and owner nginx.conf are retained. Upstream source is pinned at 588b4cbc.

The previous b955 artifact, its source/history checks, full 159 fixable findings (2 CRITICAL / 39 HIGH / 76 MEDIUM / 42 LOW) and SBOM remain in previous-b955. Native run 76's CI fixture failure is retained in trial receipts. Local preparation separately records the sandbox build-metadata failure and the corrected explicit Containerfile invocation; none is relabeled a clean published candidate.

The evidence manifest hashes every retained artifact. No tokens, credential values or raw CI logs were captured. No Helm or ArgoCD hosting change occurred.

The image was executed locally for container HTTP/configuration checks. Registry layer readback itself did not execute code; native hosting remained unchanged.