FEATURE-ci-freebsd-readelf-format: Mark task complete

Author: etr

specs/tasks/FEATURE-ci-freebsd-readelf-format.md

@@ -1,6 +1,6 @@
 # FEATURE-ci-freebsd-readelf-format
 
-Status: In Progress.
+Status: Complete (local validation/finalization; native CI pending).
 Base: local v3 `e56a14f0f6748209ac39c1319bc1c894529ab2a4`.
 Plan: primary `.groundwork-plans/FEATURE-ci-freebsd-readelf-format-plan.md`.
 Journal: primary `.debug/ci-7880-freebsd-readelf-6x0vi2k0/journal.md`.
@@ -15,7 +15,7 @@ assessments remain closed. Scope is the ELF needed-format parser and its tests.
 - [x] Record meaningful RED through the real inspector with exact native stdout and all seven expected names.
 - [x] Make the minimal parser repair with GNU compatibility and strict malformed/noise controls.
 - [x] Verify affected suite, direct consumer/failure evidence contracts, real local GNU ELF, Python compilation and diff checks.
-- [ ] Caller Groundwork validation/finalization.
+- [x] Caller Groundwork validation/finalization.
 - [ ] Native FreeBSD post-fix package/archive checks: CI/v3 PR owned, incomplete; not a local acceptance gate.
 
 No runtime leaves, whitelists, loader/policy relaxation, inspector retries or new
@@ -47,5 +47,12 @@ Logs, source hashes, local GNU graph/commands and limits are retained in primary
 `.debug/ci-7880-freebsd-readelf-6x0vi2k0/implementation/`. One mistyped recovery
 test selector failed at discovery; its log is retained separately, the exact
 existing selector was then used and passed. No subsystem failure was observed.
-Caller Groundwork validation/finalization remains pending. Native FreeBSD
+Caller Groundwork validation passed and local finalization is recorded below. Native FreeBSD
 post-fix package/archive checks remain CI/v3 PR owned and incomplete.
+
+Groundwork validation `ea1324dc403a04447c1cce7f522e9740` sealed PASS for
+`1172ebdcdc41fbec480f6fe3805b75d238b09eb1`: one iteration, nine independent
+approvals, zero fixes and one approved unworked finding persisted by the helper.
+The helper report is retained unread for separately owned work. Native FreeBSD
+post-fix package/archive validation remains incomplete and CI/v3 PR owned.
+Prior failed receipts and closed uncertainty remain preserved.

specs/unworked_review_issues/feature-ci-freebsd-readelf-format_validation_ea1324dc403a04447c1cce7f522e9740.md

@@ -0,0 +1,11 @@
+# Unworked Review Issues
+
+**Run:** 2026-10-23 23:56:07
+**Task:** FEATURE-ci-freebsd-readelf-format
+**Total:** 1 (0 critical, 1 major, 0 minor)
+
+## Major
+
+1. [ ] **security-reviewer** | `scripts/audit-v3-installed-package.py:206` | input-validation
+   The new whitespace-excluding name pattern silently drops a recognized NEEDED entry whenever another entry matches. A bounded real-inspector probe with GNU rows for libc.so.6 and libunexpected name.so returns only libc.so.6, whereas the original parser raises missing resolution for libunexpected name.so. The omitted library is never visited, hashed or checked by graph_violations. This violates the accepted fail-closed recursive graph requirement and can conceal an undeclared runtime dependency (CWE-20).
+   *Recommendation:* Fail closed when a recognized NEEDED row cannot be completely parsed or resolved; unsupported names need not be accepted, but must not disappear from an otherwise successful inspection. Add a mixed valid/unsupported NEEDED regression verifying rejection rather than a partial dependency list.