coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Isolate tenant readback cache and prepare verified runtime release
Some checks failed
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m33s
Details
Account journey acceptance / journeys (push) Failing after 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 01:58:45 +02:00
parent c460e2b0df
commit 1bb7cacc98
10 changed files with 188 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

31
docs/evidence/2026-10-11-runtime-base-refresh.md Normal file
View file

@ -0,0 +1,31 @@
# Runtime base refresh — 2026-10-11
The exact source-bound application readback candidate failed its independent
scan with 88 HIGH and three CRITICAL OS findings. Preserve that scan and OCI
index bea54ccf in the managed runtime release record. This remediation changes
only the Containerfile's immutable official Python base index from d764629c
to a6e34c59. It preserves Python 3.12, updates patch 3.12.13 to 3.12.15, and
uses current Docker Official Image source commit
2a3b794c223ab067d122719541cdd54a068732a5 (3.12/slim-trixie). The native new
base contains perl-base 5.40.1-6+deb13u1, libc6 deb13u4 and OpenSSL 3.5.7.
Detailed registry/source, exact context, installed file hashes, dependency
snapshot and unfiltered scan are in
`rapp-user-engine/docs/evidence/2026-10-11-readback-base-refresh/`. All 47
copied application inputs and all 45 installed package files match the prior
source. Resolved Python package versions are unchanged. All 20 image readback
tests pass; all 323 source tests pass with 8 optional skips and accepted-v0.8
layer conformance passes. Native consumer acceptance remains USER-WP-0026-T03.
The refreshed scan has zero CRITICAL and 44 HIGH findings across 8 distinct
CVEs, all without a published fixed version in the fresh recorded database.
These findings remain visible; no severity reduction, ignore-unfixed option
or suppression was applied. This does not claim a vulnerability-free or
approved release. Clean accepted source commit, publication and independent
release review remain required, alongside exact scoped live rollout permission.
CI source preparation also replaces short-revision archive lookup with the
validated full 40-hex GITHUB_SHA and labels the built image with that exact
revision. Both workflow shell blocks pass bash syntax checks. This workflow
change is outside the local image runtime context and was not published or
executed; owner CI must produce a new publication receipt from a clean commit.