---
id: USER-WP-ADHOC-2026-10-11
type: workplan
title: "Prepare readback runtime base and journey CI gates"
domain: communication
repo: user-engine
status: finished
flavor: implementation
owner: codex
topic_slug: user-engine
created: "2026-10-11"
updated: "2026-10-11"
state_hub_workstream_id: "1aac634c-f321-5bf6-b178-4544d7854e8e"
---

## Refresh immutable Python patch base and verify exact application preservation

```task
id: USER-WP-ADHOC-2026-10-11-T01
status: done
priority: high
state_hub_task_id: "68979c68-6ab7-5675-9961-ddbb31a4c88d"
```

Replace only the Containerfile base digest with the current official Python 3.12
index; retain exact application bytes and resolved Python dependency versions.
The bounded local candidate removes all 3 CRITICAL and 44 of 88 HIGH OS findings.
Retain remaining 44 unfixed HIGH findings in the unfiltered fresh scan. Exact
source/image/provenance checks and 20 image / 323 source tests pass. Evidence:
`docs/evidence/2026-10-11-runtime-base-refresh.md`. This source remediation
finishes no deployment: USER-WP-0026-T03 and USER-WP-0028-T02 retain native
consumer acceptance, clean source commit/publication and scoped rollout gates.

## Repair actual missing-dependency journey CI setup

```task
id: USER-WP-ADHOC-2026-10-11-T02
status: done
priority: high
```

Correct native failed task 11448 for exact source 1bb7cacc: install project
runtime dependencies and pinned pytest, run the full pytest suite including
v0.8 regressions, preserve layer and mapped-journey gates. A clean-container
rehearsal passes 317 tests with 20 optional skips and all 66 mapped journey tests
with no skips; external journey acceptance remains incomplete. Evidence:
`docs/evidence/2026-10-11-journey-ci-repair/REVIEW.md`. This task completes
source repair and bounded verification; exact new native CI execution, release
risk disposition and real workload acceptance remain USER-WP-0026-T03 /
USER-WP-0028-T02. No runtime build input, live policy or image is changed.

## Independently review exact one-app supervised catalogue maintenance source

```task
id: USER-WP-ADHOC-2026-10-11-T03
status: done
priority: high
```

Dedicated User Engine owner source review under INTENT Engine/PIP and protected
mutation boundaries. Exact nine-file candidate manifest SHA256
0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7
reviewed independently. All 21 current catalogue checks pass on a disposable
network-none PostgreSQL fixture and installed f239 runtime dependency image,
both limited to 512Mi/1CPU. Formal source-only agreement and retained failed
preparation history: docs/reviews/2026-10-11-catalogue-maintenance-owner-agreement.md
and docs/evidence/2026-10-11-one-app-catalogue-executor/owner-final-postgres-receipt.json.
No founder approval, active waiver, native invocation, credential access or live
write is created. USER-WP-0026-T03 and USER-WP-0028-T02 remain unmet.