Record Mac (macos-m5pro-20260924) application and data use receipts and the macOS pnpm 12.6.0 re-qualification - #201

… application receipts (#209)

#201 merged with one independent_session agree per receipt, recorded after the
reviewing session re-ran each command (reproducibility). agent-lab-e9's
independent review (workflow wf_f7021e8d-fd3, 28 agents, adversarially
verified; PR comment 5818957285) found blocking issues in all seven that
reproduction does not address: the running PostgreSQL server is never
observed; FastAPI ran in-process only; Next.js was built but never served;
React rendered from Next's bundled canary, not the pin; playwright-test has no
positive control; playwright-cli's assertion cannot fail; duckdb is recorded
under an id no winner uses. A standing non-self dissent withholds accepted
(docs/contributing-evidence.md section 5), so postgresql, fastapi, nextjs and
playwright-test move from derived accepted to not_established on macOS until
the receipts are re-recorded with the requested changes; a re-record replaces
these reviews.

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

A use receipt's independent agree now needs four points, the bar #185's
receipts met: the commands exercise the layer's role, a positive control
where a clean result proves nothing, retained commands behind every install
and pin claim, and a receipt bound to the winner's component_id and pin.
Re-running the commands alone is reproduce-only and is not an agree; a
failing point is recorded as needs_changes. The review's --ref states which
it did (reproduce-only or adequacy-checked). #201's receipts were agreed
after reproduction alone and are held at needs_changes by #209.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…, bound pin) in the evidence flow's step 8 (#210)

* State the use-review bar in the evidence flow's step 8

A use receipt's independent agree now needs four points, the bar #185's
receipts met: the commands exercise the layer's role, a positive control
where a clean result proves nothing, retained commands behind every install
and pin claim, and a receipt bound to the winner's component_id and pin.
Re-running the commands alone is reproduce-only and is not an agree; a
failing point is recorded as needs_changes. The review's --ref states which
it did (reproduce-only or adequacy-checked). #201's receipts were agreed
after reproduction alone and are held at needs_changes by #209.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Say that point 4 compares pins as pin_matches does (review of #210)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

…837)

### Scope

- What this PR changes: unblocks the required `osv-scanner` check, which fails on every pull request since six advisories published 2026-10-07 list `next` 16.3.5 in the frozen macOS application variant lock. Each advisory gets one dated exception (`ignoreUntil = 2026-12-24`) in `.github/osv-scanner-frozen-macos.toml`, the config `security-scan.yml` applies to that one digest-bound lock alone. The lock bytes, `.github/osv-scanner.toml` and `.github/osv-scanner-lockfiles.json` are unchanged; the maintained application lock already pins `next` 16.3.8.
- Base commit: `b16cb8cf7cb8e37bf0d0edb9924502beb3e6a276` (origin/main).
- Lane: `lane:foundation`.
- Owned paths touched: `.github/osv-scanner-frozen-macos.toml` (+30), `tests/test_osv_lockfile_coverage.py` (`FROZEN_LOCKS` advisories and evidence, +5/-2), `evidence/receipts/osv-frozen-macos-next-1638-20261007.json` (new, 230 lines), `manifests/evidence.json` (three entries via `host_receipts.register_file`, +9/-4).
- The frozen lock keeps SHA-256 `f1c707b8295e85bd396e49b990de92dc82bc0d58eca1e4e4bef31262d9898cd2`; no byte under `evidence/artifacts/macos-application-20260924/` changed.

The failure, from [run 37689576446](https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/37689576446) (pull_request, 2026-10-07T21:27:51Z): preflight `Ran 21 tests ... OK`, ordinary group `No issues found`, frozen group `Total 1 package affected by 6 known vulnerabilities (0 Critical, 1 High, 5 Medium, 0 Low, 0 Unknown)`, then `OSV primary exit codes: ordinary=0 frozen-macos=1`. The same workflow passed on the push to main at `b16cb8cf` ([run 37667431606](https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/37667431606), 18:31:00Z) and on a pull request at 20:37:00Z ([run 37683363803](https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/37683363803)); the lock's only commit is `67666d6e` (#201, 2026-09-24).

| Advisory (read with `gh api /advisories/<id>`) | Affected range containing 16.3.5 | First patched | Advisory's stated condition |
| --- | --- | --- | --- |
| [GHSA-39w2-rjm5-chcv](GHSA-39w2-rjm5-chcv) (CVE-2026-94486) | `>= 16.0.0, < 16.3.8` | 16.3.8 | only `next dev`: the dev server's MCP endpoint does not verify request origin |
| [GHSA-3w37-wq28-93x7](GHSA-3w37-wq28-93x7) (CVE-2026-94544) | `>= 16.3.0, < 16.3.8` | 16.3.8 | Cache Components or `experimental.useCache` with Draft Mode previews |
| [GHSA-4jqv-mc3x-m676](GHSA-4jqv-mc3x-m676) (CVE-2026-94543) | `>= 16.0.0, < 16.3.8` (also lists `>= 15.0.0, < 15.5.27`, which does not apply) | 16.3.8 | self-hosted Pages Router with SSG or ISR pages |
| [GHSA-cjq9-62q9-8jv4](GHSA-cjq9-62q9-8jv4) (CVE-2026-94483) | `>= 16.0.0, < 16.3.8` | 16.3.8 | Image Optimization SSRF through an allow-listed `images.remotePatterns` URL |
| [GHSA-f87g-xv8r-7p7x](GHSA-f87g-xv8r-7p7x) (CVE-2026-94485) | `>= 16.0.0, < 16.3.8` | 16.3.8 | App Router built with webpack: metadata image routes ignore `dynamicParams` |
| [GHSA-mcj8-r9mp-w47p](GHSA-mcj8-r9mp-w47p) (CVE-2026-94484) | `>= 16.0.0, < 16.3.8` (also lists `>= 15.0.0, < 15.5.27`, which does not apply) | 16.3.8 | root-level catch-all page with SSG or ISR routes |

Whether the captured application met any of these conditions is not established: the artifact keeps only `run-summary.json`, `package.json` and the lock, with no application source or Next.js configuration. Its `package.json` declares `"dev": "next dev ..."`, the only mode GHSA-39w2 affects. The exceptions rest on non-use, as for the three existing entries. Each reason names the range and fix with the advisory URL, the scope (the lock named in the file's header, with its SHA-256), the source review at `b16cb8cf` and the removal condition. No reason line names the artifact directory, so the no-use tripwire's pins are unchanged (the sharp entry's pattern).

`ignoreUntil` is 2026-12-24, the date of the three existing entries, of `REVIEW_DATE` in `tests/test_frozen_macos_variant_no_use.py` and of the closure decision's frozen-lock exception. It is within the 90-day bound `tests/test_osv_lockfile_coverage.py` enforces (2026-10-07 + 90 days = 2027-01-05).

### SOTA sources

- [OSV-Scanner v2.6.0 release](https://github.com/google/osv-scanner/releases/tag/v2.6.0), tag commit `google/osv-scanner@e840a6e8adb14b7777c78e26cfbf6e2abc1d1fc6`, published 2026-09-14T02:55:16Z. `osv-scanner_linux_amd64` SHA-256 `ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108` equals the workflow's `OSV_SCANNER_SHA256`, the release's `osv-scanner_SHA256SUMS` line and the release API asset digest. The binary reports `osv-scanner version: 2.6.0`, `commit: e840a6e8adb14b7777c78e26cfbf6e2abc1d1fc6`.
- [`docs/configuration.md` at v2.6.0](https://github.com/google/osv-scanner/blob/v2.6.0/docs/configuration.md): [line 23](https://github.com/google/osv-scanner/blob/v2.6.0/docs/configuration.md#L23) says `--config=/path/to/config.toml` "will apply `config.toml` to all files parsed", which is why the exception lives in the dedicated config the workflow applies to this lock alone. [Lines 27-44](https://github.com/google/osv-scanner/blob/v2.6.0/docs/configuration.md#L27-L44) define `[[IgnoredVulns]]` with `id`, optional `ignoreUntil` and `reason`, and state that ignoring an id also ignores its aliases.
- The six GitHub advisories, linked in the table above (GitHub global advisory database, read 2026-10-07T21:33:15Z), each referencing the fixed release [vercel/next.js v16.3.8](https://github.com/vercel/next.js/releases/tag/v16.3.8).
- Repository practice followed: `docs/decisions/2026-09-22-github-automation-closure.md`, section "urllib3 and PyJWT relock and a frozen macOS lock (2026-09-30)" (lines 325-371) and "Four production relocks and preserved receipt inputs (2026-10-06)" (lines 2028-2070); the frozen-lock parts of [#797](#797) (one appended entry, `FROZEN_LOCKS` advisories and evidence); the receipts `evidence/receipts/osv-frozen-macos-source-map-js-20261005.json` and `evidence/receipts/sharp-0355-qualification-20261006.json`. The no-consumer checks repeat the 2026-09-30 transcript (`blueprints/runtime-workers/openhands/evidence/relock-2026-09-30-urllib3.txt:185-214`).

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Each advisory's affected range, first patched version and stated condition | source_review | `gh api /advisories/<id>` for the six ids; receipt `advisory_records` |
| The failure comes from the new advisory records, not a repository change | source_review | Run 37689576446 log; passes 37667431606 (main at `b16cb8cf`) and 37683363803; the lock's single commit #201 |
| No supported installer, build, server or replay consumer of the variant at `b16cb8cf` | source_review | `git grep -l -F macos-application-20260924/variant/pnpm-lock b16cb8c -- . ':(exclude)evidence/artifacts/macos-application-20260924'`: 46 files, all scan configuration and checks, the experiment record and a retained copy, retained scan outputs, controls, reviews, path listings, receipts, the manifest and tests; none pairs the path with an install, build or serve command. `git grep -n -i pnpm b16cb8c -- .github/workflows`: one line, the frozen assignment check. Tripwire 10/10 at base. A direct-reference check only: indirect routes stay outside it (receipt `limits`) |
| Whether the captured application met each advisory's condition | not established | No application source or Next.js configuration is retained; `package.json` has a `next dev` script |
| Exceptions are confined to the frozen config and this lock | local_integration | Control: the frozen lock under `.github/osv-scanner.toml` exits 1 with all nine advisories; `FrozenScanTests` pass |
| The workflow's scan step exits 0 with the six filtered | local_integration | The step extracted from `security-scan.yml` and run by bash with the verified binary: `ordinary=0 frozen-macos=0`, `Filtered 9 vulnerabilities from output` |
| Hosted `osv-scanner` and the other required checks at this head | pending | To be observed on this PR |

### Local commands run

```
$ curl ... osv-scanner_linux_amd64 (v2.6.0) into a fresh scratch directory; printf '<OSV_SCANNER_SHA256 read from security-scan.yml>  <binary>' | sha256sum --check
<binary>: OK   (exit 0; also matches osv-scanner_SHA256SUMS and the release asset digest)
$ <binary> --version
osv-scanner version: 2.6.0 / osv-scalibr version: 0.5.2 / commit: e840a6e8adb14b7777c78e26cfbf6e2abc1d1fc6   (exit 0)

$ RUNNER_TEMP=<scratch>/runner WRITE_SARIF=false /usr/bin/bash --noprofile --norc -e -o pipefail <step extracted from security-scan.yml, 66 lines>
exit 0 (2026-10-07T21:45:58Z to 21:46:01Z, against the final config bytes, SHA-256 a00d1e2d...)
Ran 21 tests in 0.281s / OK
Filtered 4 vulnerabilities from output / No issues found                     (ordinary group)
GHSA-39w2-rjm5-chcv and 1 alias have been filtered out because: next 16.3.5 is in the advisory's affected range >= 16.0.0, < 16.3.8, ...
GHSA-3w37-wq28-93x7 and 1 alias have been filtered out because: next 16.3.5 is in the advisory's affected range >= 16.3.0, < 16.3.8, ...
GHSA-4jqv-mc3x-m676 and 1 alias have been filtered out because: ...
GHSA-cjq9-62q9-8jv4 and 1 alias have been filtered out because: ...
GHSA-f87g-xv8r-7p7x and 1 alias have been filtered out because: ...
GHSA-mcj8-r9mp-w47p and 1 alias have been filtered out because: ...
(GHSA-vcvr-r3jv-pc5j, GHSA-wq5f-xc86-pv6w and GHSA-68fv-2mgg-jv7q filtered as before)
Filtered 9 vulnerabilities from output / No issues found                     (frozen group)
OSV primary exit codes: ordinary=0 frozen-macos=0

$ <binary> scan source --config .github/osv-scanner.toml --no-resolve --lockfile=:evidence/artifacts/macos-application-20260924/variant/pnpm-lock.yaml   (control)
exit 1; Total 3 packages affected by 9 known vulnerabilities: the six next advisories (fixed 16.3.8), GHSA-vcvr-r3jv-pc5j, GHSA-wq5f-xc86-pv6w, GHSA-68fv-2mgg-jv7q

$ python3 -m unittest tests.test_osv_lockfile_coverage tests.test_frozen_macos_variant_no_use
exit 0; Ran 67 tests in 6.296s, OK
$ python3 scripts/evidence_manifest.py --check
exit 0; {"files": 10554, "status": "passed"}
$ python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 10554, "profiles": 4, "receipts": 226, "status": "passed"}
$ python3 -m unittest tests.test_agentsview_qualification tests.test_openhands_lock_binding tests.test_pin_holds tests.test_pre_push_gate tests.test_runtime_worker_openhands_resolver tests.test_sim_crosscheck_hftbacktest tests.test_workflow_hardening
exit 0; Ran 318 tests, OK (skipped=19)   (other modules that name these files)
$ git diff --check && git diff --cached --check
exit 0
```

At base, before the change: `python3 -m unittest tests.test_frozen_macos_variant_no_use` exited 0 (10 tests) and `tests.test_osv_lockfile_coverage` exited 0 (57 tests). An earlier local run of the same step, before the reasons' description of the 46 files was made more precise, also exited 0 with 9 filtered.

### Decision record

No new decision record: the change applies the existing one, `docs/decisions/2026-09-22-github-automation-closure.md`, section "urllib3 and PyJWT relock and a frozen macOS lock (2026-09-30)". Its alternatives (inventory exclusion, editing the hash-bound lock, a repo-wide ignore) and overturn (the frozen lock stops being kept, or an application built from it runs) still apply. Evidence: `evidence/receipts/osv-frozen-macos-next-1638-20261007.json`. Remove the six exceptions and re-review before manual installation, replay, a new consuming route, changed lock bytes or 2026-12-24.

Not covered here:
- Dependabot alerts come from GitHub's dependency graph, not OSV configs. If Dependabot raises alerts for these six advisories on the variant's `package.json` (as alert 16 did for GHSA-vcvr-r3jv-pc5j), they need their own decision.
- The frozen config's header still says "the advisory below" (singular). Its line is pinned by the tripwire and was left unchanged.
- The `.frozen` rename remains a separately tracked follow-up.

### Host evidence

Not applicable: no file under `evidence/hosts/` changes.

### Checklist

- [x] New/changed GitHub Actions are pinned to a full commit SHA with a version comment (n/a: no workflow or action changes).
- [x] New/changed workflows declare top-level `permissions: {}` (n/a: no workflow changes).
- [x] No secrets are printed, logged or committed; no new required secret was added.
- [x] No new paid hosting, subscription or billing surface was introduced.
- [x] Peer-owned untracked files and worktrees were preserved (work confined to this branch's own worktree).

🤖 Generated with [Claude Code](https://claude.com/claude-code)