Runtime worker: GPT Researcher on GPT-6 via OmniRoute (recipe, round 2) - #426

…s, owned resources)

GPT-6 (astra, max) round-2 build: DeepResearch-Bench-II at b38f360 (uv sync, frozen task 12, unchanged scoring); check.py validates transport only.
Gateway calls omit temperature, carry a stable x-omniroute-session and a fresh
Idempotency-Key per logical call, and accept only configurable GPT-6 max routes.
Loopback-only ports in 3730-3799, owned rw-gpt-researcher- resource names and labels,
literal-name cleanup. Not installed, not run: host E2E and A/B remain open.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…nd both gateway arms

GPT-6 repair builder (effort max) against the Claude review (R1-R7) and the
security review (S1, S8):
- streamed-report retry fixed (websocket=None, native logging); judge budget
  and batching per DRB-II; arm-specific base URLs with an independent control
  judge route;
- engines-on accepts exactly sharedgw/gpt-6-astra-max (one slash);
  two-slash slugs are refused;
- dispatch.sh start/wait/result with deterministic artifacts and distinct
  exit classes; worker and judge phases split, with entry-gateway correlation
  capture and separate compression accounting;
- security: model execution tools, context-mode fetching and indexing removed
  from the worker's MCP surface; per-run scratch and HOME; grader installed
  with uv --locked --no-build --no-install-project.
Declined: a new container runtime for this CLI/stdio recipe (residual:
native scraping's DNS-rebinding/redirect exposure, documented).

Repository registry fixes: the OSV inventory lists the four requirement
locks; requirements.in/.lock join IGNORE_ALLOWED_LOCKS for nltk
GHSA-8mgp-746c-j5xp (no affected API is called by GPT Researcher or its nltk
callers); blind_checkout classifies fixed/declined as labels.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…e macOS run dir

osv-scanner (run 36350481372) reported 242 advisories, all from
gpt-researcher/requirements.in: its lower bounds (aiohttp>=3.12.0) are read as
installed versions. The input spec now sits in covered_by_lockfile, pointing at
requirements.lock, which is resolved from it (research.md, "Lock resolution"),
as main already does for requirements-macos-arm64-py312.in. It leaves the nltk
allowlist because it is no longer scanned. The allowlist comment now names the
advisory's APIs as OSV lists them (PerceptronTagger.save_to_json).

validate-macos (run 36350481386) failed test_model_cannot_execute_fetch_or_index_host_files:
server_config resolves run_dir (mcp_proxy.py:109), and macOS temp dirs sit under the
/var -> /private/var symlink. The test now resolves run_dir too.

Checks: osv-scanner 2.6.0 (sha256-verified release binary) with the workflow's
scan command: exit 0, "No issues found". The worker module passes 27 tests with a
plain or a symlinked TMPDIR; the symlinked run failed before the fix.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…receipt for the runtime lock (static scan, not reached)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…0.3 for GHSA-8mgp-746c-j5xp only, bound to its sha256 and reachability receipt

The #441 allowlist mapping replaces this branch's earlier set entry, whose comment the review found stale (the #336 condition, 'PerceptronTagger save/load', no evidence path). The setuptools advisory is not exempted.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>