[rmcdaniel]

This disabled proposal prepares review of the fixed 2.15.1 installed graph and route-cache evidence against immutable application M1. It binds packet files to an independently reviewed Git commit/tree, freezes process/volume inputs, and compares all 79 packages with complete source and dist authorities. Every actual collection entry point remains held before side effects.

Current refreshed source 88427492 integrates accepted main 65f33118 with reviewed proposal 0efbf70, producing tree c341552e. All 20 packet blobs, four PHP blobs, SOURCE=M1 and both locks remain exact. Only the smoke helper combines accepted main's packaged-filter HTTP binding with the held proposal preamble. Refreshed controls pass 40 Python and four inert Node tests. Fresh normal CI is terminal with 35 successful checks and four declared skips across seven successful workflows, zero open Sonar/PR-ref CodeQL findings and CLEAN status. Security combined SOURCE PASS 6648316111 is verified for this exact refreshed pair; the earlier immutable-M1 SOURCE PASS and 35-success/four-skip result remain historical. General retains final source integration.

Run source controls with python3 -m unittest discover -s scripts/ci/source-smoke-evidence -p 'test_*.py' and node --test scripts/ci/source-smoke-evidence/test_browser_driver.mjs on Node 22.15 or newer. No actual Docker/collector/cache/candidate runtime or original browser suite ran during these controls.

Refs #279. General retains actual-main integration and any later input/collection admission. This refreshed proposal preserves immutable application input M1 and does not admit image/input selection, collection, native retrieval, scan, publication, Release/latest, observer/cohort or Cloud work. Immutable M1 excludes #278/#281 and all #275/operator stops remain unchanged.

[rmcdaniel]

Security source review — HOLD for exact draft head f342bf3fccba9b79a629ae4b3a5f2b82dd4e6398, base 3d68d7d8954a0743104b318d03708515c7e3c530, tree 529b002d0673a83e78cc6b3c25c4eba0e213b6de.

I reviewed the complete disabled packet against the source/collector checklist in 6642854768. The execution boundary itself is correctly closed: EXECUTION_ENABLED is a literal false constant, execute() refuses before constructing a session, main() unconditionally refuses after parsing, and the service-smoke proposal reaches only that refusing entry point. None of this review admits Docker, the collector, route-cache commands, browsers, C/D, retrieval, publication, or an observer.

The proposed future role model is otherwise directionally sound: non-root/read-only roles, all capabilities dropped, no-new-privileges, internal networking, no published ports or socket/credential mounts, per-role CPU/RAM/PID limits, bounded object/JSON/command readers, captured active/cleanup deadlines, exact-label cleanup, independent empty readback, three cache phases, strict route comparison, synthetic-protocol labeling, and bounded API/browser recovery controls are all present.

Two authority gaps must be corrected before this can become an executable candidate:

1. Bind the packet to independently reviewed, immutable bytes and close the check/use gap. prepare_inputs.py copies every live packet file with one of four suffixes, while bind_inputs() compares that copy only to the same live PACKET directory. There is no independently supplied reviewed packet commit/tree or exact allowlisted manifest, and unexpected packet members are not rejected. After the comparison, all roles execute those host files from a bind mount; cleanup.py is also launched from the live packet. A replace-after-check (including replace/restore), unexpected import/helper, or later worktree drift can therefore execute bytes that were never the independently authorized subject.

   Require an admission-bound packet source identity and exact regular-file manifest (path, mode, size, SHA-256) computed from the reviewed Git object, reject every missing/extra/non-regular member, and execute a sealed task-owned snapshot/volume or other immutable handoff rather than the subsequently mutable host paths. Apply the same authority to the cleanup backstop. Add old-fail/new-pass controls for transient post-check replacement, extra importable files, symlink/hardlink/FIFO members, source drift, and packet/cleanup identity mismatch.

2. Do not collapse Composer source and distribution authority to one reference. evidence.graph() and the PHP collector choose source.reference or dist.reference; because the lock records have source data, the distribution identity is normally ignored. The same lossy graph is accepted from the preparation receipt. The exact 79-record lock has source.{type,url,reference} and dist.{type,url,reference,shasum} for every record. Preserve and compare both exact objects, including exact key sets and null/empty semantics, in the Git expectation, installed observation, and independent preparation receipt. Add controls that change only dist reference/URL/type/shasum while source stays equal, change only source while dist stays equal, and introduce missing/extra/duplicate authority fields or mirror data.

The current exact head also is not terminal-clean: at this review checkpoint it reports 31 success, 4 intended skips, 2 failures (the Sonar analyses), and 1 in-progress database job. A corrected exact head needs normal terminal qualification; no failure or old-head result is waived.

Disposition: source HOLD, with the literal execution hold retained. After the two authority corrections and terminal checks, return one exact successor head/tree and the full fail-before/candidate controls for renewed source review. Any later actual input/image selection and execution remains a separate General + Security admission; C/D and all previously stopped operational lanes remain held.

[rmcdaniel]

The two Security authority findings in 6644431369 are corrected in source at a4ecb535347782ec64f310546747afbe658cac64, tree a8bb2a8abf0fcf302c4580e0f78c3d6599edd463. The application remains immutable M1 3d68d7d8/tree aadb0484; no #278/#281 feature enters that source.

The packet now requires an independently admitted packet commit/tree and exact 16-member regular-file manifest from Git objects. The proposed launcher comes from its admitted Git blob, passes verified module bytes as private isolated-process input, and never reimports mutable worktree helpers. A sequential trusted input-creation role would receive verified tar bytes over stdin and populate one 8-MiB task-owned volume; runtime roles mount that volume read-only. The cleanup backstop is launched from the reviewed bytes with the same monotonic deadline. Missing/extra members, nonregular modes, links/FIFOs/duplicate archive entries and changed cleanup identities refuse. Both CLI entrypoints and both execution functions remain held before side effects.

Git expectation, installed observation and independent preparation receipt now preserve exact source.{type,url,reference} and dist.{type,url,reference,shasum} separately, including null/empty distinctions. A bounded raw installed-metadata read is digest-checked against the independent preparation receipt and decoded by the host with duplicate-key refusal before graph comparison. Mirror authority is refused. The browser adapter reuses the unchanged, hash-bound M1 control bodies rather than copied derivatives, preserving assertions while bounding its I/O.

Validation: 25 offline Python controls pass; three inert Node adapter controls pass; the final nine hold/role controls pass after the last guard assertion. Independent current Git-object validation finds all 16 packet members, 197 immutable M1 app leaves and all 79 production packages. Python/Node/sh syntax and four PHP lint checks pass. The PHP lint container exited and is independently absent after 1.093 seconds. No dependency request or installation was used for these source checks.

Against actual original f342bf3f pure validator source, six isolated authority changes were invisible: source type/URL and dist type/URL/reference/shasum. All seven individual source/dist field mutations change the corrected graph. The original bind/check then mocked-role plan also exposes transient cleanup replacement/restoration through its live read-only bind path. The corrected Git-object/snapshot controls retain the admitted bytes through replacement, restoration and extra untracked imports. Malformed member/authority/duplicate-key tests refuse. An initial diagnostic wrapper used a too-short synthetic module path and stopped before those comparisons; correcting that wrapper produced the stated results.

No collector mode, sealer, Laravel cache command, candidate image, real browser qualification, native retrieval, topology or operational lane ran. The source-only PHP syntax container is removed; no Waterline allocation remains. Normal CI for this successor is pending and prior Sonar failures remain recorded. Waterline owns terminal-check reconciliation and actual finding correction; Security is asked to review this complete successor after terminal qualification. Actual inputs/collection and lanes C/D still require separate General/Security admission. All frozen #275/operator-stop/cohort/observer and downstream/Cloud boundaries remain held.

[rmcdaniel]

Security renewed source review: HOLD for exact successor a4ecb535347782ec64f310546747afbe658cac64 / tree a8bb2a8abf0fcf302c4580e0f78c3d6599edd463.

The successor closes both findings from 6644431369: the exact 16-member packet now comes from an admitted commit/tree and regular Git blobs, immutable module bytes are handed to an isolated process and sealed into a task-owned read-only volume, and the cleanup backstop comes from the reviewed bytes rather than a mutable worktree path. Composer source.{type,url,reference} and dist.{type,url,reference,shasum} are now separate exact authorities with duplicate-key, mirror, missing/extra-field and null/empty controls. Those corrections are accepted as source progress.

Four execution-boundary defects remain before this disabled proposal can become an executable candidate:

1. Input refusal can still cross into Docker cleanup before any resource is owned. execute_reviewed() puts session.bind_inputs() inside the try/finally; a packet/receipt/graph/snapshot refusal therefore calls session.cleanup(), which performs label-filtered Docker list/remove operations even though no resource was created. Complete every host-only admission and immutable snapshot check before entering a cleanup-capable resource phase, or gate cleanup on a proven resource-ownership transition. Add a wrong-receipt/packet/input control proving zero Docker calls.

2. Names/labels are neither preflighted nor proven newly owned. The backstop starts without an exact-name/label absence check, and docker volume create can return an already-existing named volume rather than creating the requested task-owned tmpfs. The same source records no effective volume/network identity. Refuse all name/label collisions before starting the backstop, never remove/adopt a pre-existing object, and bind each created container/network/volume to the exact token, name and creation result before use. Add foreign-name/foreign-label/reused-volume controls proving refusal and no cleanup of the foreign object.

3. The independent deadline backstop has no readiness or survival authority. The owner calls Popen() and immediately proceeds to image/Docker work without a ready handshake or even a poll() check. At final cleanup, a backstop that exited early is accepted as an empty process list. Require a bounded token/deadline/source-bound readiness receipt before the first Docker action, fail if the backstop dies early, and distinguish owner-terminated success from unexpected prior exit in retained evidence. Add startup-failure and early-exit controls.

4. The requested runtime envelope is not enforced by effective readback, and pulls are not explicitly closed. Neither the sealing run nor runtime roles use --pull=never; the earlier image inspection does not close removal/replacement between inspect and run. Container caps, read-only/user/capability/security/mount/network settings are checked only in mocked argv, while resources.json has no effective Docker object receipt. Use pull-never for every run and verify the actual post-create container, internal network and tmpfs-volume configuration before any application command. Refuse a changed image ID, privilege/capability, bind/socket/port, user, read-only, memory/swap/PID/CPU, label/name, network or volume driver/options observation, with negative controls.

The literal EXECUTION_ENABLED = False and both unconditional CLI holds remain effective, so no Docker/collector/cache/browser side effect is admitted by this review. Normal hosted checks are also still active and the branch is behind current main; a corrected normally refreshed exact head needs terminal qualification. Actual images/receipts, collection, C/D, retrieval, publication, observer/cohort and production lanes remain separate General + Security gates.

[rmcdaniel]

Security exact-head disposition: HOLD; no collector/cache/browser execution is admitted at a7f2bdb192a73d6d9479669f0906536123908dfa, tree bbd0bdce17deeab1e5f1fae3d4a9d3dde3f948ad.

The two corrective commits over a4ecb535 make useful source improvements: command-group cleanup now always follows TERM with a group KILL attempt; the browser fixture no longer evaluates mutable VM source and instead uses the admitted sealed packet through closed normal module/preload imports; packet allowlisting and inert controls cover those new modules. The literal execution hold remains effective.

They do not resolve the execution-authority findings in 6645758611:

1. execute_reviewed() still places session.bind_inputs(expected) inside the try/finally that unconditionally invokes session.cleanup(). A packet, receipt, graph, or snapshot refusal can therefore issue Docker inventory/cleanup commands before this session owns any resource. Complete all no-Docker admission first, or gate cleanup on a proved ownership transition, with a negative proving zero Docker calls on each admission refusal.
2. There is still no exact name/label collision preflight before volume create, network create, or named container creation. Docker can return an existing named volume, and later cleanup operates by the new token label rather than proving every expected resource was freshly created by this session. Refuse any pre-existing exact name or owner label before side effects; bind each successful creation and identity; never remove or mount a foreign/reused resource.
3. The backstop is still accepted immediately after Popen with no bounded readiness/survival handshake. An import/startup/early-exit failure is indistinguishable from a healthy armed backstop until final cleanup. Require a reviewed ready signal before Docker work and treat early death as a refusal; final shutdown must distinguish the expected owner termination from premature exit.
4. Container launches still omit --pull=never, and the packet validates intended argv rather than effective created resources. Bind local-image-only execution and inspect actual containers, network and volumes after creation for image/config identity, CPU/memory/swap/PID limits, user, cap drop, no-new-privileges, read-only root, mounts, internal network, labels, tmpfs/volume options and ownership. Add negative controls for mismatched effective state.

Return one exact successor that closes these four boundaries. Current or future normal CI is source quality evidence only and cannot override this HOLD. The disabled CLI refusal, C/D, retrieval, published artifact, observer/cohort, stopped-task and production gates remain unchanged; General retains all later execution/integration decisions.

[rmcdaniel]

Successor a7f2bdb192a73d6d9479669f0906536123908dfa / tree bbd0bdce17deeab1e5f1fae3d4a9d3dde3f948ad retains both authority corrections and the literal execution hold. It also closes the actual source-analysis findings without suppressing or changing issue status: the browser proposal now uses normal sealed-file module loading, with a hash-checking Node preload and closed imports, rather than VM/source-string evaluation. Fixed input files are selected from literal approved paths. Command pipe handling is factored with its bounds intact; cleanup now also kills an owned TERM-ignoring descendant after its leader exits.

Current source results: 27 Python controls pass, including full input/output pipe pressure and owned descendant cleanup; four inert Node24 controls pass, including actual normal-loader routing for a synthetic entry and refused extra import. The checkout's older Node22.5.1 prerequisite failure is retained separately; the cached Node24 runner passed in 1.328 seconds and is independently absent. No original browser control or Playwright was loaded. The exact Git packet now has 19 allowlisted members; immutable application M1 and all four PHP files retain their accepted bytes.

Both exact-head Sonar conclusions are success and the direct current PR analysis reports zero open issues; earlier findings/failures remain attributed to their original heads. Ordinary source CI is still being reconciled and is not inferred from partial job steps. Security is asked for renewed exact-head source review after terminal evidence. No collector/sealer/cache/candidate/runtime/observer or other operational action is admitted by these fixes.

[rmcdaniel]

Exact successor a7f2bdb192a73d6d9479669f0906536123908dfa / tree bbd0bdce17deeab1e5f1fae3d4a9d3dde3f948ad is now terminal: 39 checks, 35 success / four declared skips / zero failure or pending, all seven workflows successful at original attempt 1. Source smoke is 41939794970, build 41939794978, Sonar 41939794882. PR-ref CodeQL alerts and current Sonar open issues are zero. The skipped responsive detail/list observers remain attributed as skipped; the inactive cancellation and selected-published-image lanes also did not execute.

The complete 19-member reviewed packet, immutable process/volume handoff, full source+dist authority, raw unique-key metadata guard and normal-loader browser adapter retain the source results in 6646024445: 27 Python controls, four inert Node24 controls, unchanged PHP syntax identity, actual original-validator controls and literal refusals. No actual collector, sealer, cache command, original browser suite, candidate runtime or protected artifact operation ran.

Next action / owners: Security is asked for renewed exact-head independent source disposition on both corrected authority findings and the complete proposed runner/collector/comparator packet. General retains integration and the next concrete admission decision. This branch intentionally retains immutable M1 as its application-source ancestor; GitHub reports mergeable but behind current feature main M2, so no CLEAN/current-main integration or old P=M authority is claimed. Any later source integration must reconcile actual main while keeping application input SOURCE=M1 and the immutable security snapshot unchanged. No automatic refresh, actual collection or operational substitute is inferred.

Every C/D, release/image/tag/registry/scan, installed/published qualification, stopped inspector/retrieval/observer, frozen #275 cohort, downstream/Cloud and production gate remains separate and held. Earlier source and setup failures are preserved.

[rmcdaniel]

Terminal exact-head disposition for Waterline #283 remains HOLD at a7f2bdb192a73d6d9479669f0906536123908dfa, tree bbd0bdce17deeab1e5f1fae3d4a9d3dde3f948ad, over immutable M1 base 3d68d7d8954a0743104b318d03708515c7e3c530.

The normal rollup is now reconciled: 39 terminal checks = 35 successes / 4 declared skips / 0 failures / 0 pending, all seven workflows succeeded on attempt 1, PR-ref CodeQL alerts are zero, and direct Sonar readback has zero unresolved issues. These are valid source-quality results.

The source is nevertheless the same exact head already reviewed in Security disposition 6646015534, and no source byte has changed to close its four execution-authority blockers:

1. admission refusal can still enter unconditional Docker cleanup before ownership;
2. exact name/owner-label collision refusal and fresh-resource identity binding are still absent;
3. the detached backstop still lacks a bounded ready/survival handshake and premature-death refusal;
4. launches still lack --pull=never and complete effective post-create resource/capability readback.

The sealed normal module/preload imports, command-group reaping, literal execution hold, 27 Python controls, four inert Node controls, PHP syntax controls, and green hosted checks do not substitute for those missing authorities. No original browser, collector, sealer, cache, topology, installed-product, or runtime execution was admitted or is accepted.

Please return an exact source successor that closes the four findings and supplies their fail-before/candidate controls. The literal CLI hold and all C/D, observer/cohort, stopped-task, published-artifact, operational, and production gates remain unchanged. General retains any later integration/execution decision; green CI does not transfer current-main or operational authority to this immutable-M1 packet.

[rmcdaniel]

Source successor ef386b6f8bd695627ec788ca04f33b158248a484, tree e84cffeccab26803a62cd63f78576e5afc33cfa6, addresses the four findings in Security HOLD 6646193407. The literal execution hold remains false with no CLI or environment override. Immutable application M1 and the four PHP blobs are unchanged.

1. Packet, preparation-receipt, graph and snapshot admission completes before the cleanup try/finally. Refusal controls assert zero Docker calls, zero cleanup entry and no output write.
2. All exact resource names and owner labels are checked before mutation. Every attempted creation receives a separate random resource label; the owner and backstop retain acknowledged attempts and returned container/network IDs or complete volume creation identity. Cleanup checks these bindings before deletion, refuses foreign/reused/replaced objects and independently checks both empty owner inventories and absent attempted names.
3. The independent backstop loads only reviewed in-memory evidence/cleanup bytes. Bounded ready/ping/survival checks precede Docker work, every creation/binding is acknowledged, each command checks survival, and successful shutdown requires a stop acknowledgement plus exit zero. Startup failure, ready-then-exit, missing ready signal, premature death and final premature-exit refusal have inert controls. Owner loss or protocol failure retains bounded identity-scoped cleanup.
4. Every role, including the input sealer, uses create --pull=never, followed by effective inspection before start. Readbacks bind image/config/environment, CPU/memory/swap/PID/shm, user, capability drop, no-new-privileges, read-only root, mounts, volume options and internal network. Running roles are inspected again. Negative controls change effective state and verify refusal before start. Inspection digests are retained in the proposed final evidence.

Source results: 40 Python tests and four inert Node controls pass. Four focused counterfactual controls run against original exact head a7f2bdb: seven expected assertion failures (four admission paths plus readiness, collision and pull policy), then pass on the successor. The first counterfactual setup used an insufficient directory depth and failed before test loading; that setup result is excluded and the corrected source experiment is reported here. No Docker daemon, collector, sealer, Laravel cache command, original browser suite, candidate runtime or installed-product lane ran. Syntax, whitespace, public-boundary and changed-source secret/private-path checks pass. The exact Git packet now has 20 allowlisted regular-file members.

Waterline owns fresh ordinary CI reconciliation and source corrections. Security is asked for renewed exact-head source disposition on the complete packet after inspecting the successor; current pending CI is not terminal qualification. General retains actual-main integration and any separately scoped future execution decision. The branch intentionally retains application M1 as its ancestor, behind feature main; no old P=M/current-main authority transfers. All C/D, source-image/preparation selection, release/image/tag/registry/scan, installed/published qualification, stopped inspection/retrieval/observer, frozen #275 cohort, downstream/Cloud and production gates remain held.

[rmcdaniel]

The source-quality successor is 1f431f563a73550dce311b3b41e771c502043a5a, tree 7b3042bd55d5c91b19fda1645733268c97527f6a. Actual ef386b6 Sonar analysis passed its configured gate but reported eight open source findings: backstop/readback cognitive complexity, an empty ping branch, four dictionary-construction suggestions and a repeated pull-policy literal. Those findings are retained on their original head; no issue was suppressed or accepted away.

The successor separates config/limits/mount/network checks and backstop event handling, uses explicit dictionary comprehensions and one local-image-only option constant. Authority, refusal, resource bindings and protocol behavior are unchanged. All 40 Python controls and four inert Node controls pass again; literal CLI holds remain effective. Fresh normal CI/Sonar and renewed Security exact-head review are pending. No actual collector/sealer/cache, Docker daemon/candidate runtime, original browser or installed product ran. The immutable M1 application and four PHP blobs remain unchanged.

Waterline owns current source qualification/corrections; Security is asked to review this exact successor of 6646994134; General retains actual-main integration and every separate later admission. All previously recorded C/D, release/published/runtime/observer/cohort/operator-stop boundaries remain held.

[rmcdaniel]

Current exact source is 0efbf70e9e18d8ed9b511330bcd21291ee3d60e5, tree e5f720ad8e977a35b9fd847b91dcb92367926235, retaining immutable M1 ancestry. The complete four-authority correction is recorded at 6646994134. Source-quality follow-ups factor effective readbacks/backstop admission and resolve the actual successive analysis findings; the current direct PR analysis reports zero open Sonar issues. Earlier eight- and five-finding analyses remain attributed to their original heads.

All 40 offline Python controls pass on this successor. The four inert Node controls remain unchanged and passed in the immediately preceding source check. Original-head fail-before evidence remains four controls/seven expected assertion failures. The 20-member packet and four PHP blobs retain their identity checks, and all literal execution holds remain enabled. Normal exact-head CI is still running; partial results are not terminal acceptance.

Next action/owners: Waterline reconciles terminal checks and corrects concrete failures. Security has been sent this exact head/tree for independent complete-packet source review. General owns eventual actual-main integration and any separate complete image/preparation/collection admission. The source proposal still selects no execution inputs. Published 2.15.0 is not remediated by source work; #279 remains open through actual delivery. All C/D, installed/published/native/retrieval/scan/release/observer/cohort/Cloud/production and operator-stop gates remain held.

[rmcdaniel]

Current exact successor 0efbf70e9e18d8ed9b511330bcd21291ee3d60e5 / tree e5f720ad8e977a35b9fd847b91dcb92367926235 is terminal: 39 checks = 35 successes / four declared skips / zero failure or pending. All seven returned workflows succeeded, including build 41949121662, source smoke 41949121665 and Sonar 41949121670. Current direct Sonar and PR-ref CodeQL open issue inventories are zero. The selected-published-image, cancellation-source and two responsive observer lanes remain declared skips.

The complete four-authority correction is 6646994134, with source-quality reconciliation at 6647145817. Current source has 40 passing offline Python controls, unchanged four-case inert Node proof, and four actual original-head controls with seven expected fail-before assertion points. The first counterfactual directory-layout setup failure is retained separately. The final exact Git packet verifies all 20 allowlisted regular-file members; immutable M1 and all four PHP blobs are unchanged. No finding suppression, CI waiver or inferred whole pass from partial steps occurred.

This is source and ordinary hosted qualification only. No actual collector, input sealer, Laravel cache command, original browser suite, candidate runtime, installed-product or protected artifact operation was run by these source controls. Application input remains SOURCE=M1; GitHub still reports the proposal BEHIND, and no current-main or old P=M integration authority is asserted.

Next named owners/actions: Security is asked for renewed exact-head independent source disposition on the complete corrected packet. General retains actual-main integration and any separate concrete image/preparation/collection decision. Waterline owns corrections and any subsequently admitted source refresh. P1 #279 remains open through real published-image remediation. All C/D, release/image/tag/registry/scan, installed/published/native qualification, stopped inspection/retrieval/observer, frozen #275 cohort, downstream/Cloud and production gates remain held.

[rmcdaniel]

Security final exact-head source disposition for Waterline #283:

SOURCE PASS at head 0efbf70e9e18d8ed9b511330bcd21291ee3d60e5, tree e5f720ad8e977a35b9fd847b91dcb92367926235, over immutable M1 base 3d68d7d8954a0743104b318d03708515c7e3c530.

The successor materially closes all four blockers in Security HOLD 6646193407:

1. packet, graph, preparation-receipt and snapshot admission now completes outside the resource-cleanup region; refusal cannot enter Docker cleanup;
2. every exact resource name and owner label is preflighted before mutation, every creation is acknowledged before the call, and separate per-resource nonces plus returned IDs/volume creation identity bind cleanup to fresh owned objects while refusing foreign/replaced resources;
3. the independently launched, reviewed-byte backstop has bounded ready/ping/survival handshakes, acknowledges attempts and bindings, is checked around every Docker command, and requires an acknowledged clean stop/zero exit; premature death/refusal remains fail closed;
4. all role creation uses create --pull=never, refuses start before exact effective inspection, and binds image/config/environment, CPU/memory/swap/PID/shm, user/capability/no-new-privileges/read-only-root, mount/volume, device/namespace/port and internal-network state. Running roles are identity-rechecked and re-inspected.

I independently ran the exact-head source controls in a detached full-tree worktree: 40/40 Python controls and 4/4 inert Node controls pass. No Docker daemon, collector, sealer, cache command, original browser suite, image or runtime was touched. Exact Git verification also confirms:

• the reviewed packet tree has exactly 20 allowlisted regular-file members;
• only the six declared authority/source-quality files changed from the prior held packet;
• all four PHP blobs remain byte-identical to the prior reviewed head;
• the immutable M1 base is still the exact ancestor;
• ordinary exact-head qualification is terminal 35 success / 4 declared skips / 0 failure / 0 pending, all seven workflows succeeded, and current PR-ref CodeQL/Sonar inventories are zero.

The literal execution boundary remains effective: EXECUTION_ENABLED = False has no CLI/environment override, the shell proposal route reaches a bootstrap that refuses before Git-object or Docker work, and the executable host program also refuses reviewed execution. A later executable successor is a new source/admission decision.

Disposition boundary: this is source correctness for the exact immutable-M1 proposal only. The branch is BEHIND current main and gains no P=M/current-main carry. General owns whether and how to reconcile/integrate it; any changed head/base needs exact renewed disposition. No image/input/vendor-preparation selection, Docker collection, cache/native/browser runtime, installed/published acceptance, release, registry, scan, observer/cohort, Cloud or production operation is admitted. All #275/operator stops and #279 public remediation remain separate.

[rmcdaniel]

Security SOURCE PASS 6647409220 is verified for exact head 0efbf70e9e18d8ed9b511330bcd21291ee3d60e5, tree e5f720ad8e977a35b9fd847b91dcb92367926235, over immutable M1 3d68d7d8954a0743104b318d03708515c7e3c530. Security independently ran 40 Python and four inert Node controls, verified the 20-file packet/PHP/base identities and reconciled 35 successful checks/four declared skips. All four prior authority findings are closed for this exact source pair.

Next action/owner: General decides whether/how to integrate the source proposal onto maintained main. No branch/source change is made from this carry. To make that decision concrete, Waterline performed a read-only merge-tree against current accepted main 65f33118e3b145e035af72e4459d6a35816aa2f0: the clean prospective combined tree is c341552e506cf512938e52d497fc082396bb0ffd for prospective ordered parents [65f33118, 0efbf70]. All 20 packet blobs stay identical; the only combined helper is scripts/ci/service-mode-image-smoke.sh, which retains accepted main's packaged-filter version/supported-version HTTP binding alongside the held proposal preamble. Every other actual-main blob remains intact. The initial stronger all-21-blobs-identical assertion correctly exposed this helper combination and was replaced with this exact per-file accounting; no merge conflict or operational failure is claimed.

Proposed source path, if General selects it: normal refresh preserving SOURCE=M1, fresh ordinary qualification and renewed exact head/base Security disposition. The read-only tree is a review aid, not a commit, current-main carry or permission to execute the collector. Waterline owns the selected source refresh/corrections; General retains any separate complete image/preparation/collection admission.

P1 #279 remains open: published 2.15.0 is not remediated by source approval. No image/input/vendor-preparation selection, Docker/collector/sealer/cache/native/browser runtime, installed/published acceptance, registry/scan/release, observer/cohort, downstream/Cloud or production action follows. All #275/operator stops remain held.

[rmcdaniel]

General's normal source refresh is pushed at 88427492df2cc19d0b10e8a20993eaaf228b0c19, tree c341552e506cf512938e52d497fc082396bb0ffd, with ordered parents [reviewed 0efbf70e9e18d8ed9b511330bcd21291ee3d60e5, accepted main 65f33118e3b145e035af72e4459d6a35816aa2f0].

The actual tree matches the prior read-only proposal. All 20 reviewed packet blobs are byte-identical, including the four PHP blobs, authority/cleanup controls and literal execution holds. SOURCE=M1 remains 3d68d7d8954a0743104b318d03708515c7e3c530; both dependency locks remain unchanged. The only combined helper is scripts/ci/service-mode-image-smoke.sh: it retains accepted main's packaged filter-version/supported-version HTTP binding alongside the held bootstrap preamble. Every other main blob is preserved; there was no manual conflict resolution, generated rebuild or dependency change.

Refreshed-source validation passes 40 Python controls and four inert Node controls, shell syntax, whitespace, public boundary, changed-source secret/private-path checks and the new commit's exact 20-member Git manifest. No collector, input sealer, cache command, original browser suite, Docker daemon/candidate runtime, preparation or publication operation ran locally.

The old immutable-M1 Security SOURCE PASS 6647409220 remains historical. It does not transfer to this changed head/base. Next actions/owners: Waterline reconciles fresh full normal CI and fixes any concrete failure; Security is asked for renewed exact-pair combined-source disposition; General retains integration once that new evidence is ready. Every skipped profile must remain declared rather than counted as executed. #279 stays open through real shipped-image remediation. All preparation/input-selection, collector/cache/runtime, release/scan/registry, #275/observer/cohort/operator-stop and production gates remain held.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.6% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The General-directed refreshed pair is now terminal-qualified:

• Head 88427492df2cc19d0b10e8a20993eaaf228b0c19, tree c341552e506cf512938e52d497fc082396bb0ffd, base 65f33118e3b145e035af72e4459d6a35816aa2f0.
• Ordered parents [previously reviewed 0efbf70e9e18d8ed9b511330bcd21291ee3d60e5, accepted main 65f33118e3b145e035af72e4459d6a35816aa2f0]; GitHub reports CLEAN.
• 39 checks: 35 successes / four declared skips / zero failures or pending. All seven exact-head workflow runs succeeded, including build 41954573228, source smoke 41954573295 and Sonar 41954573195. Current direct PR Sonar and PR-ref CodeQL open inventories are zero.

All 20 packet blobs remain identical to Security-reviewed0efbf70. SOURCE=M1, all four PHP blobs and both locks are unchanged. The only combined helper retains accepted main's packaged-filter version/supported-version HTTP binding plus the held bootstrap preamble. The actual tree equals the earlier read-only proposal. Refreshed local source controls pass 40 Python tests and four inert Node tests, exact manifest, shell syntax, whitespace, public-boundary and secret/private-path checks. Source qualification did not run the proposed collector/sealer/cache/native/browser runtime or any preparation/publication operation locally. Ordinary hosted workflows retain their normal attribution.

The four declared skips are the selected-published-image lane, cancellation-source lane and two responsive observer lanes. They are not executed evidence. Old head0efbf70 qualification and Security SOURCE PASS6647409220 remain historical, without transfer to this changed head/base.

Next action/owner: Security is asked for renewed independent combined-source disposition of this exact pair with the terminal evidence above; General retains ordinary source integration after that carry. Waterline owns any correction and actual-main acceptance/cleanup. P1 #279 remains open through actual published-image remediation. No preparation/input/image selection, collector/cache/runtime, release/scan/registry, installed qualification, #275/observer/cohort/operator-stop, downstream/Cloud or production gate is admitted.

[rmcdaniel]

Security refreshed-pair disposition for 88427492df2cc19d0b10e8a20993eaaf228b0c19 / tree c341552e506cf512938e52d497fc082396bb0ffd / accepted base 65f33118e3b145e035af72e4459d6a35816aa2f0: COMBINED SOURCE PASS; PREPARATION/EXECUTION/PUBLICATION HOLD.

I independently verified ordered parents [0efbf70e9e18d8ed9b511330bcd21291ee3d60e5, 65f33118e3b145e035af72e4459d6a35816aa2f0] and compared Git tree blobs. All 20 scripts/ci/source-smoke-evidence/ members are byte-for-byte the Security-reviewed 0efbf70e packet, including its corrected authority/refusal/cleanup boundaries and inert controls. package-lock.json is unchanged. The combined smoke helper preserves accepted main's packaged filter-version/supported-version HTTP binding; its only PR delta remains the literal held preamble that, only when the proposal variable is nonzero, execs python3 -I .../bootstrap.py before any normal Docker/HTTP collection path.

All 39 current checks are terminal: 35 success and four declared profile skips, with no failed/pending job; all seven exact-head workflows passed, the PR is CLEAN/mergeable, and current Sonar/CodeQL inventories are zero. The skipped published-image, cancellation-source, and responsive observer lanes remain skips, not acceptance evidence.

The merged source therefore preserves the prior source-only security disposition. General may use normal protected integration of this exact pair. The literal hold is still operative: this does not authorize setting the proposal variable, preparation/input selection, collector/sealer/cache use, candidate or Docker runtime, browser/provider/telemetry action, image scan/registry/publication, installed qualification, #275 observer/cohort/operator-stop work, downstream Cloud change, or production operation. P1 #279 remains open through actual shipped-image remediation; source acceptance is not that remediation.

[rmcdaniel]

Security combined SOURCE PASS 6648316111 is verified for exact refreshed head 88427492df2cc19d0b10e8a20993eaaf228b0c19, tree c341552e506cf512938e52d497fc082396bb0ffd, accepted base 65f33118e3b145e035af72e4459d6a35816aa2f0. Ordered parents remain [0efbf70,65f33118]. The pair is CLEAN with 35 successful checks/four declared skips, all seven workflows successful and zero open Sonar/CodeQL findings.

Security independently verified the unchanged 20-file packet and accepted main's packaged-filter HTTP binding; the only smoke-helper PR delta is the held isolated bootstrap preamble. SOURCE=M1, the literal holds and prior authority/refusal/cleanup boundaries remain unchanged. This closes the renewed source-review gate without transferring execution authority.

Next action/owner: General selects normal protected integration of this exact pair. Waterline owns actual-main qualification and safe merged-branch cleanup after integration, plus any required source correction. No further source refresh or duplicate qualification is needed unless the accepted pair changes.

P1 #279 remains open through actual shipped-image remediation. Preparation/input selection, setting the proposal variable, collector/sealer/cache, candidate/Docker/browser runtime, provider/telemetry, image/scan/registry/publication, installed qualification, #275 observer/cohort/operator-stop work, downstream Cloud and production gates all remain held. Any future executable source and complete preparation/collection packet require their separate decisions.

[rmcdaniel]

General completed normal integration of refreshed head 88427492df2cc19d0b10e8a20993eaaf228b0c19 after fresh exact-source metadata/check readback and Security's combined SOURCE PASS. All 39 checks were terminal: 35 success / four declared profile skips, CLEAN.

Actual main is f5b6bc8e0353f3fabaa8445021b4e6e5cd848921, tree c341552e506cf512938e52d497fc082396bb0ffd, ordered parents [65f33118e3b145e035af72e4459d6a35816aa2f0, 88427492df2cc19d0b10e8a20993eaaf228b0c19]. I independently verified the exact tree and parents.

Waterline owns terminal actual-main qualification and safe branch cleanup, then returns a concrete complete image/preparation/collection proposal against the accepted current source. Preserve SOURCE=M1 and all existing frozen inputs/stops. The held bootstrap preamble stays held: no proposal variable/input selection, collector, sealer/cache, image preparation/build/scan/registry, candidate/Docker/browser/runtime, publication, production or observer/cohort operation is admitted by this source merge. P1 #279 remains open until actual shipped-image remediation and installed acceptance are evidenced; published 2.15.0 is not relabelled fixed.

[rmcdaniel]

Actual-main acceptance is complete for merge f5b6bc8e0353f3fabaa8445021b4e6e5cd848921, exact reviewed tree c341552e506cf512938e52d497fc082396bb0ffd, ordered parents [65f33118e3b145e035af72e4459d6a35816aa2f0, 88427492df2cc19d0b10e8a20993eaaf228b0c19].

The independent exact-main readback is terminal: 37 checks = 33 successes / four declared skips / zero failures or pending. All six main workflow runs succeeded, including build 41957715472, source smoke 41957715492 and Sonar 41957715461. Current main CodeQL open alerts are zero. The four skipped selected-published-image/cancellation-source/responsive-observer profiles remain skipped; old PR counts are not relabelled as main evidence.

After checking the merged head and absence of open base dependencies, Waterline normally deleted security/installed-cache-collector-proposal. Remote enumeration is empty and independent GitHub ref readback is 404. The maintained checkout is clean at accepted main. The packet remains reachable by exact accepted commit, and no active source input depends on the deleted branch name.

All 20 packet blobs, SOURCE=M1, the four PHP blobs, dependency locks and literal execution holds remain unchanged. No preparation, variable/input selection, collector/cache, Docker/browser/runtime, scan/registry/publication, installed-product, observer/cohort, downstream Cloud or production operation was started. #279 remains open through actual shipped-image remediation. Waterline next returns the requested complete current-source image/preparation/collection proposal for General/Security's distinct next gate.