[rmcdaniel]

Addresses #325. The issue stays open through actual-main acceptance.

The production app and queue worker inherit root, and three installer downloads omit explicit HTTPS restrictions. This runs the application as www-data, prepares its writable home/browser/video state, constrains those downloads, and requires wheels for the unchanged policy-parser dependency. The explicit local screenshot-output tool preserves its existing host-bind authority.

Production and Python worker builds now bind matching immutable Bookworm parents and the accepted central preflight before APT. The Python worker keeps its parent's pip offline until authenticated local wheels are installed and the maintained-client/trust checks pass. Published tuples and dependency locks are unchanged. The concrete input/follower packet and General's ordinary unpublished CI decision retain their exact boundaries. The manual publisher stays unchanged.

Validation before PR: 67 focused source tests, workflow/Compose YAML and shell syntax, source identity/lock comparisons, and branch Public Boundary pass. Existing native production smoke will prove actual app/worker UID, storage and mounted-video writes, browser launch and workflows. The first Python bootstrap and actual runtime results remain pending. Central parent catalog #330 has source review plus green PR/main checks; its arm64 metadata is not an installed Python result.

The complete 27-key Sonar disposition distinguishes these five hardening locations from 22 contextual reports. No scanner state, profile or exclusion changes are included.

[rmcdaniel]

Original head 5286966 produced real outcomes. These are retained separately from the current correction, not relabeled as a whole-PR pass.

• First Python profile/producer executed successfully on Linux/amd64: polyglot validation 42184077604 / job 127780152886 is SUCCESS. BuildKit resolved exact official parent index 935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df. Before network use, actual Debian 12 APT/libapt both read back 2.6.2. Actual exported system trust has 148 certificates, blocked=0/0, SHA256 e9c7b63ee2623386e9b0a3ee32f499d01a8ea23dc83b8383ddff9f8e749543b7. The unchanged authenticated neutral producer returned pip 26.2.2+sample.1, urllib3 2.8.0, setuptools 84.2.1, 478 RECORD entries. Offline local-wheel install and effective-client/CA guards precede SDK requests; all three final CA checks passed. The documented service-mode example completed, and the project's containers/network were removed in the successful cleanup. This is executed amd64 evidence, with no executed arm64 Python claim.
• Production smoke is NONPASS on both native architectures: actual app and worker booted as UID 33, mounted storage/video write checks and installed APT/Node trust checks passed, then the unchanged Brotli verifier refused an unreadable leftover PHP build-source file. The verifier's refusal remains real. Both jobs ran their always cleanup. Browser/workflow completion is not claimed for this original smoke result.
• Application test jobs are NONPASS on PHP 8.4 and 8.5: each passed 193 tests but failed one existing source contract that still searched for literal curl -fsSL after the HTTPS-option change. Both microservice jobs and image security source checks passed.
• Central policy and Sonar are NONPASS: central's exact parser command accepts the separate --only-binary :all: spelling, while the new source used the equivalent equals spelling. Sonar identified the predictable bootstrap temporary directory and three source-style/test findings. Neither required result was bypassed or changed.

The normal incremental correction is 32bd4c5e1bcf3189f332f8810b789c59c365c342, tree d3e3487a46042c7331f4152b6a548229def9013d:

• Use central's already accepted wheel-only spelling without changing the dependency or central validator. Local central policy validation now passes.
• Remove extracted PHP build sources using the official docker-php-source delete after extension compilation. The full existing Brotli verifier remains unchanged and must pass as the non-root runtime user.
• Keep the trust adapter's state under a private image-owned directory with mode 0700, and select that same exported environment in both build layers. The accepted central exporter/guard, authenticated wheel producer, patch, tool inputs and effective-client guard remain unchanged.
• Update the existing curl-order contract to find the installer URL while the focused protocol tests enforce both HTTPS restrictions. Split the reported test assertion/exception call and use the existing Bash conditional convention.
• Print actual loaded Python/pip/urllib3/setuptools versions after the effective-client guard so current-head evidence names the executing clients explicitly.

All 67 focused source checks, workflow YAML, shell syntax, central policy validation, diff and secret/private-boundary checks pass locally. Current-head hosted CI is running normally. Existing superseded jobs retain their original results or ordinary concurrency cancellation status. No publisher, image push, tuple/lock change, guard weakening or manual retry was used. Sample-app owns current-head, actual-main and cleanup follow-through on this PR.

[sonarqubecloud]

Quality Gate passed

Issues
14 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The corrected 32bd4c5 now has real production and Python runtime evidence. Whole-PR and main acceptance remain pending the other original checks.

Both native production jobs in smoke 42184759095 are SUCCESS:

Executed platform	Job	App / worker UID	Fixed APT pair	Deterministic workflows and cleanup
linux/amd64	127782342974	33 / 33	apt/libapt 2.6.2	All passed; app/worker/database/cache containers, three volumes and network removed
linux/arm64	127782343170	33 / 33	apt/libapt 2.6.2	All passed; same complete cleanup

Each completed the actual application-storage and mounted-video write/unlink probe without temporary-directory fallback, Node/PHP/Composer trust checks, the unchanged full Brotli verifier, browser launch and the embedded sample workflow script. Loaded PHP is 8.4.27, Composer 2.11.0 and Node 22.23.4; both Node default stores have 116 roots/blocked=0, and PHP inspected 299 stores/blocked=0. The PR's actual checkout/image revision is GitHub's synthetic merge b374aadb706eecd6d27746b5f163afa9793ec1bd, correctly checked against the workflow's expected revision, rather than misattributed as the source head. These images were local to the jobs and not published.

Corrected Python/polyglot 42184759209 / job 127782344113 is also SUCCESS. It executes exact parent 935c on amd64 with APT/libapt 2.6.2 and actual clean system bundle SHA256 e9c7b63ee2623386e9b0a3ee32f499d01a8ea23dc83b8383ddff9f8e749543b7 (148 certificates). After authenticated local-wheel bootstrap and the effective guard, direct loaded-module readback reports Python 3.12.16 / pip 26.2.2+sample.1 / urllib3 2.8.0 / setuptools 84.2.1. Final system, pip-vendored and SDK certifi stores pass, the documented service-mode example completes, and all owned Compose containers/network are removed. This remains an amd64 Python result, separate from arm64 metadata.

Both PHP application and microservice versions, source image-security tests, central action policy and Sonar are green on this exact source head. Remaining devcontainer/SDK recovery and timer checks are still running. Sample-app owns their terminal outcome, protected integration and actual-main follow-through; earlier NONPASSs remain preserved at 6680199752. No guard, profile, finding state, tuple/lock, publisher or registry output changed.

[rmcdaniel]

Normal protected integration completed at e2c6bfa4c2401f6763787edb403618e3288c7f05 on 2026-11-06 at 08:22:50Z. Exact source head 32bd4c5 had 36 successful checks, one existing neutral CodeQL rollup and no pending/failing checks. All current required contexts were green, base was accepted 2ecc, and merge used the exact-head guard without bypassing branch protection.

The last original SDK timer job completed SUCCESS at 08:21:15Z; activity recovery also passed. The native/Python runtime and cleanup receipt remains 6680295398. Earlier failures remain separately attributed in 6680199752.

Sample-app owns the automatic actual-main runs now starting on e2c6bfa and remote-branch cleanup. #325 remains open until complete main acceptance. No new public publisher, registry write, tuple/lock update or production effect follows from source integration.

[rmcdaniel]

General completed inherited #326 actual-main acceptance after the operator switched the Sample App agent off. Normal mergee2c6bfa4c2401f6763787edb403618e3288c7f05 preserves reviewed treed3e3487a46042c7331f4152b6a548229def9013d. All29 actual-main checks and all16 original workflows succeeded on attempt1. The pre-merge36 successful checks and original refusals/corrections remain in the integration record.

Main smoke original42187256537 independently boots both linux/amd64 and linux/arm64 application/worker processes as UID33, proves writable storage/mounted video output, passes the maintained trust/Brotli verifier and browser/sample workflows, then removes its exact containers, volumes and networks. Main polyglot42187256497 executes the matching immutable official Python parent with the accepted offline fixed-wheel/CA predecessor before SDK requests, completes the example and removes its owned stack. No arm64 Python execution is inferred from catalog metadata.

The HTTPS-only installer restrictions, wheel-only unchanged PyYAML and non-root production behavior are accepted. Tuples/locks, explicit local screenshot-output authority and strict verification guards remain intact. All historical failures remain attributed. Existing manual publisher318/run42129323146 remains the latest publication; no new image publication or production deployment was selected.

The exact merged remote branch is absent by both Git and REST404; its local branch is removed, and the retained General source checkout is clean/detached at the accepted merge. No local runtime resource was created for this follow-through. General owns the bounded main-log diagnostic copies through Nov7 09:45UTC. This completes #325 source/runtime/main criteria; it does not qualify unrelated installed helpers or authorize another publisher run.