Bump certifi to 2026.10.19 (GHSA-6q48-6c7w-9gw2) - #1266

Stack the five native Pillow relocks on #1266 accepted head eb898b5,
carrying its reviewed certifi pins unchanged. Only Pillow package entries
move. Preserve exactly the two reviewed trading certifi timestamp strings
under the wave builder decision; both pinned uv versions accept the lock
offline.

Reproduce the worker certifi export byte for byte before reapplying the
unchanged scratch-only Pillow override, rule-6 turn-back and F18 scope.
Retain each accepted intermediate input once; reuse #1266 reviewed history
and relocate only frozen receipt paths, never their digests or acceptance.
Refresh all live binders and add real predecessor-admission regression.

Checks: 901 tests, 873 pass and 28 optional skips; publication validation,
all 33 convergence records, evidence manifest, final-stack, trading gates,
shell syntax and whitespace pass. Local osv-scanner is unavailable; normal
exact-head hosted checks and both-family reviews remain required.

Sources and compatibility evidence: evidence/artifacts/
pillow-13-repin-20261020/RESEARCH.md and worker research.md, 2026-10-21.
No destination-host, image, grader, model, broker or paper acceptance.

* Bump certifi to 2026.10.19 (GHSA-6q48-6c7w-9gw2)

GHSA-6q48-6c7w-9gw2 (published 2026-10-20 19:35Z): certifi >= 2019.03.09,
< 2026.10.19 bundles emSign ECC Root CA - G3, whose intermediates had
compromised keys. certifi 2026.10.19 drops that root and keeps the
unaffected emSign roots. #1262's required osv-scanner context fails on it
across every lock below.

Lock delta (certifi only, following #1265's method):
- certifi 2026.7.22 -> 2026.10.19 in every lock that pinned it: the
  adaptive-paper engine lock, the trading-2604 runtime uv.lock, the memory
  native-qualification uv.lock, the OpenHands worker lock and pins, the
  adoption SDK lock and constraints, portfolio-risk, catalyst-provenance,
  sim-crosscheck-hftbacktest, deepagents-omniroute,
  openhands-native-capabilities, mlx-smoke and the macOS e2e evidence lock.
- Hashes from PyPI's JSON for 2026.10.19, each file downloaded and checked:
  wheel 42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b,
  sdist 035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae.
  No other package line changes in any lock.
- adaptive-paper engine lock sha256
  645544edbd13e7ff2434d5459e981ec0a2506c944e30d47844b4f3c57f602db8 ->
  8e08849c3370b905b7993a75e2f356920d45cdba81d64709a71fa3ff6263cb2d.
- trading-2604 runtime lock a1413f20... -> 2df71327...; the published a1413f20
  becomes one more recorded migration input in install-trading-2604.sh, as
  #873 and #1265 did, never acceptance; accept-trading-2604.sh and
  adaptive-paper/scheduled_trial.sh require the new hash.

Bindings refreshed: .github/osv-scanner-lockfiles.json (per-lock sha256 and
the retained fixtures as excluded evidence), adaptive-paper/source-hashes.json
(scheduled_trial.sh, test_scheduled_trial.py), tests/test_scheduled_trial.py,
tests/test_trading_2604_migration.py, runtime-2604/README.md, the convergence
records' frozen inputs re-pointed to the retained copies,
catalogs/landscape/final-stack.json (sources hash of the trading-2604 lock
only), and manifests/evidence.json for every changed and added file.

Retained bytes: each pre-bump lock is kept byte-identical (git show
da55495) under evidence/artifacts/certifi-2026.10.19-repin-20261020/
historical/ as published-<hash>-<name>, an excluded evidence fixture in the
osv inventory (not an install input; the active lock is scanned), with
repin.json as the record.

Checks (python -B, scratch venv from .github/requirements-ci.txt with
--require-hashes):
- scripts/validate_convergence.py --all-recorded: 33 records, all valid;
- scripts/validate.py: passed;
- scripts/evidence_manifest.py --check: passed (12,342 files);
- scripts/final_stack.py --check: passed;
- unittest of test_trading_2604_lock, test_trading_2604_migration,
  test_scheduled_trial, test_osv_lockfile_coverage,
  test_receipt_sha256_key_custody, test_convergence_contract,
  test_evidence_manifest, test_research_convergence_practice and
  test_sota_convergence: 310 tests, OK;
- git diff --check: clean.
osv-scanner was not run locally (not installed); the required context runs it.

No install, accept or trial script was run; no host state, broker or paper
contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bind the SDK lock's certifi relock to its qualification (validate-shard-5)

The certifi bump changes adoption/sdk/requirements-linux-x86_64-py313.lock,
which tests/test_adoption_contract.py binds two ways: every non-SDK pin must
equal the supply-chain receipt's historical inventory (certifi 2026.7.22), and
the runtime-sdk-20261003 qualification receipt's lock_sha256 (3a17fa09) must
equal the current lock. Both failed at 1328f12, in
test_lock_matches_accepted_inventory_and_all_pins_have_hashes and
test_sdk_upgrade_keeps_independent_inventory_and_client_guards (validate-shard-5);
both pass at da55495. The ignore route does not apply: .github/osv-scanner.toml
allows an ignore only for unreachable code, and certifi's bundle is reachable
from any HTTPS client in this SDK environment.

The relock is recorded instead of silently re-baselined, in the shape of
IGNORE_ALLOWED_LOCKS in tests/test_osv_lockfile_coverage.py:
- SDK_SECURITY_RELOCKS names certifi 2026.7.22 -> 2026.10.19 and
  GHSA-6q48-6c7w-9gw2 (GHSA-6q48-6c7w-9gw2,
  first patched version 2026.10.19). The inventory guard applies exactly that
  move, and only from the inventory's own version.
- SDK_QUALIFIED_LOCK is the retained pre-bump lock (this PR's evidence
  fixture, byte-identical to da55495). When the receipt's lock_sha256 is not
  the current lock's, it must be that fixture's, and the current lock may
  differ from it only in the relocked blocks; the preamble and every other
  block must be byte-identical.
- The historical receipts stay unedited. A re-qualification of the SDK pair
  records the new lock and inventory and empties the table.

New regression test:
test_relocked_lock_differs_from_the_qualified_lock_only_in_recorded_relocks.
It keeps every version, changes one charset-normalizer hash in the current
lock and then in the qualified fixture, and requires the two new guards to
refuse each. The existing duckdb and openai-codex-cli-bin drift cases still
fail on their own guards. manifests/evidence.json carries the test file's new
hash.

Local, in a requirements-ci venv:
- tests.test_adoption_contract, test_osv_lockfile_coverage and
  test_evidence_manifest: 80 tests, OK;
- scripts/validate.py: rc 0; evidence_manifest --check: passed (12,342 files);
  final_stack --check: passed; git diff --check: clean.

validate_shards.py run --shard 5 --shards 8 at 1328f12 also failed locally in
test_adoption_launchd and test_codex_job_lane_hardening. Those failures come
from the checkout location: mise installs [email protected] there, and GitHub's
attestation API refused it with a 403 rate limit. In clean worktrees of
1328f12 and of da55495, the same three modules give the same result (1
pre-existing error, test_claude_usage_sampler). test_runtime_boot needs PyYAML,
which this venv lacks, on both commits.

No install, accept or trial script was run; no host state, broker or paper
contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bind the SDK relock to repin.json, reproduce the mlx lock, restore three modes

Both families' checks of 1328f12 (AMEND, agreed):

1. HIGH (Claude D1, GPT P2a): the adoption SDK lock contract.
   The contract now admits exactly the move evidence/artifacts/
   certifi-2026.10.19-repin-20261020/repin.json records for
   adoption/sdk/requirements-linux-x86_64-py313.lock:
   - certifi 2026.7.22 -> 2026.10.19, GHSA-6q48-6c7w-9gw2;
   - prior 3a17fa09... (the retained qualified lock, which the
     runtime-sdk-20261003 receipt names) -> current 9ee41e37....
   It also requires the record's "Prior native acceptance does not
   transfer". The dated receipts (the 09-19 supply-chain inventory and the
   10-03 SDK qualification) are unedited. The inventory guard and the
   client mutation guard both stay (the duckdb and openai-codex-cli-bin
   cases). The regression test
   test_relocked_lock_differs_from_the_qualified_lock_only_in_recorded_relocks
   now refuses four version-preserving mutations, each by its own guard:
   a lock hash, a qualified-fixture hash, the record's current sha256 and
   the record's no-transfer sentence.

2. GPT P2b: tools/mlx-smoke/requirements.lock.txt did not reproduce under
   hardware-profile-smoke.yml's --exclude-newer 2026-09-23T00:00:00Z.
   The step adds --exclude-newer-package certifi=2026-10-20T02:30:00Z. That
   is uv 0.12.17's own per-package override (crates/uv-cli/src/lib.rs:
   7158-7177, PACKAGE=DATE, flattened into pip compile through
   ResolverArgs:7486 and PipCompileArgs:1642, at tag 0.12.17). certifi
   2026.10.19's files reached PyPI at 2026-10-20T02:24:15Z and 02:24:16Z,
   and no later release exists. Every other pin keeps the original cutoff.
   Reproduced locally with the pinned uv 0.12.17 (x86_64 release archive,
   sha256 fa82fd8d..., equal to its published .sha256) and the step's exact
   arguments: diff -u against the committed lock is empty.

3. MEDIUM (Claude D2, GPT P3): mode 100755 restored on
   adaptive-paper/scheduled_trial.sh, runtime-2604/accept-trading-2604.sh
   and runtime-2604/install-trading-2604.sh, with no content change (blobs
   afe6305, ed1b600 and 412c571, unchanged).

manifests/evidence.json carries the new hashes of the test and the
workflow. No lock byte changes; the engine lock stays 8e08849c.

Local, in a requirements-ci venv:
- scripts/validate.py: rc 0;
- evidence_manifest --check: passed (12,342 files);
- final_stack --check: passed;
- validate_convergence --all-recorded: 33 records valid;
- test_adoption_contract, test_osv_lockfile_coverage, test_evidence_manifest,
  test_workflow_hardening, test_workflow_security_coverage,
  test_scheduled_trial and test_trading_2604_migration: 234 tests, OK
  (13 skipped);
- git diff --check: clean.
Shard 5 (validate_shards.py run --shard 5 --shards 8) at 710733d, in a
clean worktree: 2,304 tests, 0 failures. Its 2 errors are local only and
the same on da55495: test_claude_usage_sampler, and test_runtime_boot,
which needs PyYAML.

No install, accept or trial script was run; no host state, broker or paper
contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Pin Pillow 13.0.0 on reviewed certifi 2026.10.19 head

Stack the five native Pillow relocks on #1266 accepted head eb898b5,
carrying its reviewed certifi pins unchanged. Only Pillow package entries
move. Preserve exactly the two reviewed trading certifi timestamp strings
under the wave builder decision; both pinned uv versions accept the lock
offline.

Reproduce the worker certifi export byte for byte before reapplying the
unchanged scratch-only Pillow override, rule-6 turn-back and F18 scope.
Retain each accepted intermediate input once; reuse #1266 reviewed history
and relocate only frozen receipt paths, never their digests or acceptance.
Refresh all live binders and add real predecessor-admission regression.

Checks: 901 tests, 873 pass and 28 optional skips; publication validation,
all 33 convergence records, evidence manifest, final-stack, trading gates,
shell syntax and whitespace pass. Local osv-scanner is unavailable; normal
exact-head hosted checks and both-family reviews remain required.

Sources and compatibility evidence: evidence/artifacts/
pillow-13-repin-20261020/RESEARCH.md and worker research.md, 2026-10-21.
No destination-host, image, grader, model, broker or paper acceptance.

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>