Skip to content

Commit c1300c1

Browse files
seathatflowsinourveinsseathatflowsinourveins
authored
fix: relock production dependencies and preserve captured evidence (#765)
### Scope Fix the newly reviewed advisories that blocked every required OSV check: target only fsspec 2026.6.0/multidict 6.9.1 in the OpenHands runtime lock, Mako 1.4.2 in the application Python lock, and source-map-js 1.2.2 in its pnpm lock. Preserve all other package pins and the original captured artifact bytes. The command center selected a dated source-backed exception for the frozen macOS input in its isolated config, and exclusion of both retired Lumibot lockchecks after the owner's confirmation. Each lock has native before/after evidence and its supported installation/qualification checks. No workflow or branch-protection setting changes. - Base: `ecfa112764c664d35377dd66b8cfcb67e5a94d60` (fetch confirmed current main). - Lane: `lane:foundation`. - Owned scope: three production locks, SDK pins/research/evidence, qualification and ruling receipts, bounded OSV configuration/inventory, existing binding/no-use guards and closure record. Evidence registry committed last. ## SOTA sources - [fsspec advisory GHSA-27vj-qcqg-25rc](GHSA-27vj-qcqg-25rc), [official 2026.6.0 release metadata](https://pypi.org/pypi/fsspec/2026.6.0/json), [maintainer tag](https://github.com/fsspec/filesystem_spec/tree/2026.6.0). - [multidict advisory GHSA-54p9-h82j-f925](GHSA-54p9-h82j-f925), [official 6.9.1 release](https://github.com/aio-libs/multidict/releases/tag/v6.9.1), [PyPI metadata](https://pypi.org/pypi/multidict/6.9.1/json). - [Mako advisory GHSA-5639-2j2p-m4mx](GHSA-5639-2j2p-m4mx), [maintainer release](https://github.com/sqlalchemy/mako/releases/tag/rel_1_4_2), [official metadata](https://pypi.org/pypi/Mako/1.4.2/json). - [source-map-js advisory GHSA-68fv-2mgg-jv7q](GHSA-68fv-2mgg-jv7q), [published 1.2.2 metadata](https://registry.npmjs.org/source-map-js/1.2.2), [maintainer fix PR79](7rulnik/source-map-js#79). - Dependent ranges: [Hugging Face Hub0.35.3](https://pypi.org/pypi/huggingface-hub/0.35.3/json), [aiohttp3.14.3](https://pypi.org/pypi/aiohttp/3.14.3/json), [yarl1.22.0](https://pypi.org/pypi/yarl/1.22.0/json), [Alembic1.20.0](https://pypi.org/pypi/alembic/1.20.0/json), [PostCSS8.5.23](https://registry.npmjs.org/postcss/8.5.23). Complete declared-parent checks include optional/null metadata handling; limitations remain explicit in receipts. - [#562 at74cc5468](#562): original builder/relock/hash/install/scan/guard pattern. Installed [uv0.12.22](https://github.com/astral-sh/uv/releases/tag/0.12.22) reproduces the accepted baseline byte for byte; #562's0.12.17 remains historical. - [#587 at798ac445](#587), [#252 atc96c2555](#252): bounded frontend qualification. [pnpm12.4.2 update parser](https://github.com/pnpm/pnpm/blob/9502f3c457717dae3a4ddbf4315a8c4aee16fdb4/pnpm/crates/cli/src/cli_args/update.rs) and [supported update docs](https://pnpm.io/cli/update): selective bare-name transitive update, no-save/lockfile-only; obsolete explicit-version/Infinity forms avoided. - Frozen config precedent [8fc8611](8fc8611) and the maintained closure at `docs/decisions/2026-09-22-github-automation-closure.md`. Indexed source offsets/reconstruction inspected at [source-map-js1.2.1](https://github.com/7rulnik/source-map-js/blob/428d49f6b1e1614f082b7706fa879a3d9c64f728/lib/source-map-consumer.js#L944). Dedicated input/digest/expiry guards retained. - Trial [#336 at20b52a5b](#336), existing captured XNYS exclusion precedent, and command-center ruling `task-ns2604-coop-20261006T003954Z`. The verified owner confirmation is a **report** row: `report-native-agent-stack-5f-20261006T0045Z-osv`, from `native-agent-stack-5f`, at `2026-10-06T00:41:23Z`, replying to `task-native-agent-stack-5f-20261006T004011Z`. Sanitized evidence: `evidence/receipts/osv-captured-lumibot-lockchecks-20261005.json`. No trial replay or new host-process census is claimed. ### Evidence-class table | Claim | Class | Actual result | | --- | --- | --- | | Published dependent ranges permit the fixes | source_review | Complete pinned metadata review; no caps/errors; exact parents linked above | | Targeted locks preserve other pins | local_integration | SDK byte-identical control; only two package blocks move. Mako only package block, native lock revision3→5 recorded. pnpm manager/importers unchanged; only source-map-js move | | Release identity and supported artifact hashes match | local_integration | Native hash checks0: fsspec2, multidict14, Mako2; universal wheels/sdist included | | Supported isolated/native qualification succeeds | local_integration | SDK178-package check/imports0; backend28-package check/import/render0; frontend frozen install/peers/typecheck/build0 | | Both required scan partitions pass locally | local_integration | Before:60ordinary/1frozen,5+1 unignored findings. After:58ordinary/1frozen, actual native exits0/0, zero unignored findings | | Binding/coverage/no-use guards remain effective | local_integration / synthetic |70 touched tests0; clean control0; all deliberate negative controls1 as expected | | Registry integrity | local_integration | validate.py0;69components/4profiles/212receipts/10309hashes; integrity only | | Hosted, image, provider and full API/browser acceptance | unknown | No claim; command-center exact-head cross-family read remains pending | ### Local commands run All heavy phases used nice19; scratch/cache and installs were isolated. Exact supported commands and sanitized actual returned output/hashes are retained in the three relock prefixes and linked receipts. ``` #562-pattern paired native uv control/targeted lock/check/export:0 native release hash checks:0 hashed SDK install / uv pip check / exact imports:0 targeted Mako lock/check; frozen/no-build sync; pip check; imports/render:0 pnpm12.4.2 update source-map-js --no-save --lockfile-only --ignore-scripts:0 pnpm install --frozen-lockfile --ignore-scripts; peers check; typecheck; build:0 python -m unittest tests.test_openhands_lock_binding tests.test_osv_lockfile_coverage tests.test_frozen_macos_variant_no_use 70 tests; latest final data-pin run6.936s; exit0 OSV2.6.0 ordinary scan:0; frozen scan:0 python3 scripts/validate.py:0,10309hashes component_matrix --write:0,32rows/zero flips new_host_grand_list --write:0,32layers/66winners git diff --check and git diff --cached --check:0 ``` ### Failed conditions The initial root-added UV_NO_CONFIG1 discarded the resolver's Linux workspace settings; the next copied formatter inserted two plus signs. Native lock/check/export succeeded in both, while the relock byte-comparison script failed. Neither candidate was adopted; both are disclosed separately. Test preflight rejected inside-checkout TMPDIR before execution; existing external lane cache was used. Intermediate stale receipt/unreviewed metadata-line guards failed before being corrected. Publication caught one private interpreter path in a negative-control trace; it was sanitized. Terminal progress whitespace was normalized and its capture hash rebound. No failure is promoted to a passing upstream test. ### Decision record `docs/decisions/2026-09-22-github-automation-closure.md`, "Four production relocks and preserved receipt inputs (2026-10-06)"; SDK research section and qualification/ruling receipts record alternatives, source/replay limits and overturn conditions. The macOS exception expires2026-12-24; its `.frozen` rename is a separate follow-up. Future use of captured trial dependencies requires a separately maintained/scanned qualification environment. ### Host evidence No evidence/hosts or platform-status flip. The native runtime imports/builds are local integration; source reviews, synthetic controls and hosted acceptance remain separate. Exact-head command-center review is requested. ### Checklist - [x] No workflow/action permission or branch-protection change. - [x] No credential value or authentication store read/printed/copied; no new required secret. - [x] No paid hosting, provider/model runtime call, deployment or restart. - [x] Peer-owned worktrees preserved; three captured locks remain byte-identical. - [x] Registry committed last; one lane:foundation label. - [x] Ordinary AND frozen native scans and touched tests passed before ready. - [ ] Command-center exact-head cross-family read and 5f landing; lane never merges. ## Dated input-binding repair (2026-10-06) The command-center exact-head read of67c6594d2 found two omitted downstream gates: both convergence records still resolved their original UV digest through the newly relocked live file, and the recipe ledger's PNPM current digest was stale. This amendment preserves trial evidence instead of attributing new dependencies to the original runs. - Retain ecfa112 UV/PNPM bytes and the two pre-amendment experiment snapshots byte-for-byte. - Change only each canonical record's UV input path; keep frozen digests, commands, observations, outputs and usage. Both records remain declared. - Append dated recipe supersession/current mappings and ordered path relocations; protect original/prior/superseded bytes and all non-path record bytes with the portability assertions. - Source: [#252 path-only relocation](https://github.com/seathatflowsinourveins/native-agent-stack/blob/c96c2555c2d84683d9e519623354c814aeb6a584/blueprints/convergence-practice/application-delivery/history/recipe-revisions.json#L121) and [#587 supersession](https://github.com/seathatflowsinourveins/native-agent-stack/blob/798ac445307e2cd8eba6e74d7722ac0e16da02c7/blueprints/convergence-practice/application-delivery/history/recipe-revisions.json#L99). - Dated decision/source receipt: `docs/decisions/2026-10-06-application-input-binding-amendment.md`, `evidence/receipts/pr765-bindings-amendment-20261006.json`. Before repair, all-recorded convergence exited1 (2invalid/32) and native-maintenance exited1 (29cases/one PNPM mismatch). Repaired focused checks: native-maintenance29passed; convergence/OSVcoverage/frozenMAC102passed. After main-registry refresh and full own-file re-registration, local validate0/10315hashes and all-recorded convergence0/32valid. Full local suite ran under A22's specific copied-fixture `install.sh --list` exception and exited1:10,343tests/2217.568s,18failures/18errors/905skips. Installer apply paths remain banned. Raw output is retained privately; known systemd parser (#767), missing calendar/mutation imports, PATH fixtures, token-canary fixtures and installed Windows Terminal type drift are recorded separately, never presented as a pass. Old reviewed head's hosted baseline was6/7 required contexts: validate failed, six others passed. Required acceptance is measured at the new pushed head; no workflow rerun loop or old local check is promoted into that acceptance. No production pin, recorded trial output, raw receipt, frozen macOS lock, captured trading lock or scanner exclusion changed in this repair.
1 parent ecfa112 commit c1300c1

59 files changed

Lines changed: 4865 additions & 97 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/osv-scanner-frozen-macos.toml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,8 @@
1414
id = "GHSA-vcvr-r3jv-pc5j"
1515
ignoreUntil = 2026-12-24
1616
reason = "next 16.2.0 through 16.3.5 (fixed in 16.3.6): the Node.js ImageResponse of next/og renders values that application code places into SVG content, attributes or styles, and attacker-controlled values there lead to remote code execution (GitHub advisory GHSA-vcvr-r3jv-pc5j, OSV record published 2026-09-30T14:48Z; the Edge implementation and applications that pass no such values are not affected, per the advisory). This config is applied only to the frozen macOS variant evidence/artifacts/macos-application-20260924/variant/pnpm-lock.yaml, which pins 16.3.5 and of which the repository keeps only package.json and this lock (two files, no application source). At 11227bfd, outside the artifact directory itself, git grep finds it only in the scan inventory, in the experiment record blueprints/convergence-practice/application-delivery/experiment-macos-20260924.json and in the evidence manifest (this change's tests, receipt and evidence name it too), and no workflow, script or recipe installs, builds or serves it, so no route can reach ImageResponse from anything this repository runs. The live Next/React recipe lock, blueprints/convergence-practice/application-delivery/pnpm-lock.yaml, pins 16.3.6, which the advisory does not affect, and is scanned under the other config, which has no exception for this advisory. The frozen lock cannot be bumped: its bytes are hash-bound evidence. Evidence: evidence/receipts/osv-urllib3-next-20260930.json."
17+
18+
[[IgnoredVulns]]
19+
id = "GHSA-68fv-2mgg-jv7q"
20+
ignoreUntil = 2026-12-24
21+
reason = """source-map-js 1.2.1 is affected; 1.2.2 fixes malicious indexed-source-map denial of service (upstream PR 79, cf7658058ceeaa8619d5ae0ec90be6905209d016). This exception applies only to evidence/artifacts/macos-application-20260924/variant/pnpm-lock.yaml, SHA256 f1c707b8295e85bd396e49b990de92dc82bc0d58eca1e4e4bef31262d9898cd2. Source review at native-agent-stack ecfa112764c664d35377dd66b8cfcb67e5a94d60 found current consumers that hash or scan the retained files, and no supported installer, build, server or replay route consuming this variant. Historical scratch execution is recorded; this does not qualify replay or manual installation. Remove this exception and re-review before any execution from these dependencies, whenever a consuming route is introduced, or at expiry. The maintained application lock remains under the ordinary scan without this exception. Evidence: evidence/receipts/osv-frozen-macos-source-map-js-20261005.json."""

‎.github/osv-scanner-lockfiles.json‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"description": "Every tracked dependency lockfile or manifest that security-scan.yml's osv-scanner job scans. A lockfile entry without a parser lets OSV-Scanner infer it from the file name; parser names the OSV-Scanner v2 extractor for names it cannot infer (--lockfile=<parser>:<path>). A covered_by_lockfile entry is a manifest OSV-Scanner v2.6.0 has no source extractor for; its sibling lockfile is scanned instead. A dependency_free entry is a package.json that declares no dependency and has no lockfile beside it, so nothing is scanned for it; it needs a reason and an evidence path. An excluded entry is a tracked lockfile deliberately left out of the scan; it needs a reason and an evidence path, and only a deliberately vulnerable test fixture qualifies. A lockfile entry that names a config is scanned in an invocation of its own under that config alone (an explicit --config applies to every input of one invocation), and every other entry together under .github/osv-scanner.toml; the tests bind each such config to its one lock. tests/test_osv_lockfile_coverage.py fails when a tracked lockfile or manifest is in none of the four lists.",
2+
"description": "Every tracked dependency lockfile or manifest that security-scan.yml's osv-scanner job scans. A lockfile entry without a parser lets OSV-Scanner infer it from the file name; parser names the OSV-Scanner v2 extractor for names it cannot infer (--lockfile=<parser>:<path>). A covered_by_lockfile entry is a manifest OSV-Scanner v2.6.0 has no source extractor for; its sibling lockfile is scanned instead. A dependency_free entry is a package.json that declares no dependency and has no lockfile beside it, so nothing is scanned for it; it needs a reason and an evidence path. An excluded entry is a tracked lockfile deliberately left out of the scan; it needs a reason and an evidence path, and a deliberately vulnerable test fixture or captured evidence lock that is not a live input qualifies. A lockfile entry that names a config is scanned in an invocation of its own under that config alone (an explicit --config applies to every input of one invocation), and every other entry together under .github/osv-scanner.toml; the tests bind each such config to its one lock. tests/test_osv_lockfile_coverage.py fails when a tracked lockfile or manifest is in none of the four lists.",
33
"lockfiles": [
44
{
55
"path": "examples/claude-runtime-sdk/worker.py.lock",
@@ -193,14 +193,6 @@
193193
"path": "blueprints/us-equities/engine-trials/spy-one-zero-20260926/ml4t-backtest/lockcheck/ml4t.lock",
194194
"parser": "requirements.txt"
195195
},
196-
{
197-
"path": "blueprints/us-equities/engine-trials/spy-one-zero-20260926/lumibot/lockcheck/lumibot.lock",
198-
"parser": "requirements.txt"
199-
},
200-
{
201-
"path": "blueprints/us-equities/engine-trials/spy-one-zero-20260926/lumibot/lockcheck/ibapi-build/build.lock",
202-
"parser": "requirements.txt"
203-
},
204196
{
205197
"path": "blueprints/us-equities/overfitting-controls/requirements-riskl-parity.lock",
206198
"parser": "requirements.txt"
@@ -299,6 +291,16 @@
299291
"path": "blueprints/us-equities/adaptive-paper/receipts/xnys-primary-20261005/engine-baseline.lock",
300292
"reason": "Captured evidence fixture of the XNYS-primary session-clock qualification (2026-10-05): the pre-change engine resolution, frozen as a receipt artifact to show the 20 baseline distributions stayed unchanged. It is not an install input; the active engine lock blueprints/us-equities/adaptive-paper/requirements-linux-x86_64-py312.lock is scanned.",
301293
"evidence": "blueprints/us-equities/adaptive-paper/receipts/xnys-primary-20261005/qualification.json"
294+
},
295+
{
296+
"path": "blueprints/us-equities/engine-trials/spy-one-zero-20260926/lumibot/lockcheck/lumibot.lock",
297+
"reason": "Captured evidence fixture of the preregistered 2026-09-26 SPY one_zero engine trial (#336, 20b52a5bbd132291dd6b7d49ae473789caa3362c; Lumibot 4.6.1 failed). It records that evaluated environment only. Owner native-agent-stack-5f confirmed at 2026-10-06T00:41:23Z, report-native-agent-stack-5f-20261006T0045Z-osv, that both lockchecks are not live inputs. Relocking would alter trial evidence. Before replay, adoption or a new consuming route, qualify a separately maintained environment and restore vulnerability scanning.",
298+
"evidence": "blueprints/us-equities/engine-trials/spy-one-zero-20260926/lumibot/receipt.json"
299+
},
300+
{
301+
"path": "blueprints/us-equities/engine-trials/spy-one-zero-20260926/lumibot/lockcheck/ibapi-build/build.lock",
302+
"reason": "Captured evidence fixture of the preregistered 2026-09-26 SPY one_zero engine trial (#336, 20b52a5bbd132291dd6b7d49ae473789caa3362c; Lumibot 4.6.1 failed). It records that evaluated environment only. Owner native-agent-stack-5f confirmed at 2026-10-06T00:41:23Z, report-native-agent-stack-5f-20261006T0045Z-osv, that both lockchecks are not live inputs. Relocking would alter trial evidence. Before replay, adoption or a new consuming route, qualify a separately maintained environment and restore vulnerability scanning.",
303+
"evidence": "blueprints/us-equities/engine-trials/spy-one-zero-20260926/lumibot/receipt.json"
302304
}
303305
]
304306
}

‎blueprints/convergence-practice/application-delivery/experiment-macos-20260924.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
"sha256": "ee4bc7d75e19f704d333f9cae23886456ad0bf265f3a526472a28224a6bc3d03"
5757
},
5858
{
59-
"path": "blueprints/convergence-practice/application-delivery/uv.lock",
59+
"path": "blueprints/convergence-practice/application-delivery/history/uv.lock.ecfa1127",
6060
"sha256": "552d8834e745d7c91daa15e47c5f6d0cd9063db18c98790d2f1af05038f7417d"
6161
},
6262
{

‎blueprints/convergence-practice/application-delivery/experiment.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
"sha256": "ee4bc7d75e19f704d333f9cae23886456ad0bf265f3a526472a28224a6bc3d03"
5353
},
5454
{
55-
"path": "blueprints/convergence-practice/application-delivery/uv.lock",
55+
"path": "blueprints/convergence-practice/application-delivery/history/uv.lock.ecfa1127",
5656
"sha256": "552d8834e745d7c91daa15e47c5f6d0cd9063db18c98790d2f1af05038f7417d"
5757
},
5858
{

0 commit comments

Comments
 (0)