fix: relock production dependencies and preserve captured evidence - #765

### Scope

Patch the live application recipe's sharp 0.35.4 dependency to the first fixed release 0.35.5 for GHSA-wq5f-xc86-pv6w. Its required Sharp/@img family moves with it; the captured macOS lock stays byte-identical under one file-scoped exception expiring 2026-12-24.

- Base commit: `0d5e6506434fab598dee861c749a22e628beb75a`.
- Lane: `lane:foundation`.
- Owned paths: live application pnpm lock, retained prior lock and recipe history, bounded qualification outputs, dedicated frozen-macOS exception, its coverage test, dated decision, qualification receipt and evidence registry.
- `.github/osv-scanner.toml` and `.github/osv-scanner-lockfiles.json` are byte-identical to the base. The frozen variant retains SHA-256 `f1c707b8295e85bd396e49b990de92dc82bc0d58eca1e4e4bef31262d9898cd2`.

## SOTA sources

- [Sharp maintainer advisory GHSA-wq5f-xc86-pv6w](GHSA-wq5f-xc86-pv6w), published 2026-10-06T13:43:57Z: affected `<0.35.5`, first patched `0.35.5`, librsvg CVE-2026-96889.
- [Sharp v0.35.5 release](https://github.com/lovell/sharp/releases/tag/v0.35.5), published 2026-09-27T13:44:22Z, `lovell/sharp@51a990faa26ade5586a4934ac9673c98d8893326`; [sharp-libvips v1.3.4](https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4) supplies librsvg 2.63.2.
- [pnpm supported targeted update](https://pnpm.io/cli/update) and [frozen-lockfile installation](https://pnpm.io/cli/install), read 2026-10-06; installed pinned pnpm 12.4.2 help/error rejects a versioned selector on an indirect dependency. Published latest and the resulting resolved version were independently checked as exactly 0.35.5; no override or package.json edit was needed.
- [Next 16.3.8 published metadata](https://registry.npmjs.org/next/16.3.8): its `optionalDependencies.sharp` range `^0.35.4` permits 0.35.5. This is the lock's only direct dependent on sharp. All 27 replacement resolution integrity values match published npm metadata; 67 unrelated package entries, importers and the pnpm manager document remain unchanged.
- [Sharp source at the prior pin](https://github.com/lovell/sharp/blob/7f1a0a22cc285fe180766f4935d50b55af6e8432/src/common.cc#L323), `src/common.cc:323,506,596`, and `src/pipeline.cc:48`: SVG file/buffer input can reach librsvg. Exception justification rests on the retained variant having no supported installer/build/server/replay consumer found in scoped source review, with removal before any manual replay or new consuming route; the macOS label is not itself a reachability exemption.
- Repository conventions: `native-agent-stack@0d5e650:blueprints/convergence-practice/application-delivery/Makefile:3-5,27-32`, `README.md:170-180`; [#765](#765), [#587](#587) and [#252](#252) retain prior bytes/qualifications and append supersessions. Original full-stack receipts and canonical experiment records remain untouched.

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| First patched release, dependent range and SVG reachability | source_review | Maintainer advisory/release, pinned source and published npm metadata above |
| Exact frozen install, peers, typecheck, production build, loaded sharp/librsvg versions | local_integration | `relock-2026-10-06-sharp.*.txt`; `evidence/receipts/sharp-0355-qualification-20261006.json` |
| Frozen byte identity, retained old live lock and bounded family-only changes | local_integration | Hash/source comparisons and recipe revision ledger; 27 replacements / 67 unrelated unchanged |
| Repository integrity and declared-record consistency | local_integration | Validator, 32 convergence records and 96 touched tests pass; these do not establish upstream or live application acceptance |
| Advisory present for sharp 0.35.4 and absent for 0.35.5 | source_review | Supported OSV version-query API; this is not a native scanner or full-inventory scan |
| Complete application/API/browser qualification | local_integration, failed | `make verify` exits 2 on 12 dedicated-PostgreSQL setup errors; browser attempt exits 1 on occupied configured port 18080, with no browser case executed |
| Required hosted OSV and other CI checks | pending | Must be observed at this PR's head; no local scanner executable was found in the inspected locations |

### Local commands run

Frontend commands below ran in the live application directory, using the recipe's pinned pnpm 12.4.2 through Corepack, task-private cache/store/state/temp paths and a public-registry-only npmrc; heavy commands ran one at a time at nice 19. `relock-2026-10-06-sharp.sh.txt` records the supported replay pattern. Worktree/state path prefixes are sanitized in public outputs.

```text
corepack pnpm update sharp --no-save --lockfile-only --ignore-scripts
exit 0; exact resolved sharp 0.35.5 checked
corepack pnpm install --frozen-lockfile --ignore-scripts
exit 0
corepack pnpm peers check
exit 0
corepack pnpm typecheck
exit 0
corepack pnpm build
exit 0
node -e 'const r=require("module").createRequire(require.resolve("next/package.json"));const s=r("sharp");console.log(JSON.stringify({sharp:s.versions.sharp,vips:s.versions.vips,rsvg:s.versions.rsvg}));if(s.versions.sharp!=="0.35.5"||s.versions.rsvg!=="2.63.2")process.exit(1)'
exit 0; sharp 0.35.5, vips 8.18.7, rsvg 2.63.2
nice -n 19 python3 scripts/validate.py
exit 0; 69 components, 4 profiles, 214 receipts, 10,345 hashed files
nice -n 19 python3 scripts/validate_convergence.py --all-recorded --json
exit 0; all 32 records valid
nice -n 19 python3 -m unittest tests.test_osv_lockfile_coverage tests.test_frozen_macos_variant_no_use tests.test_native_maintenance
exit 0; 96 tests, repeated after the new files were staged
git diff --check
exit 0
git diff --cached --check
exit 0 after explicit output whitespace sanitization
```

### Failed attempts and acceptance limits

- `pnpm update [email protected] --no-save --lockfile-only --ignore-scripts` exits 1 with `ERR_PNPM_UPDATE_VERSION_ON_INDIRECT_DEP`, before mutation. The supported unversioned indirect update resolves exactly the independently verified first patch; no override is added.
- A single-document PyYAML read exits 1 because pnpm 12 stores two YAML documents; upstream `safe_load_all` corrects the comparison.
- First `make verify` exits 2 because pnpm is not on PATH. Supported Corepack enable creates only task-private shims. The second unchanged run passes schema/type/build checks on supported Python 3.13.16, then exits 2 on 12 PostgreSQL connection-timeout setup errors. The full actual failed log is retained privately and its decisive counts/cause in the public receipt. No PostgreSQL build, container/image pull or global installer was introduced.
- Separate unchanged `pnpm test:e2e` exits 1 because port 18080 is occupied and Playwright's recipe refuses reuse. No other owner's service was stopped and no test was relaxed. Full-stack acceptance remains unfinished.
- Initial staged diff checking found three trailing build-progress spaces. They were trimmed with that sanitization explicitly recorded, their hashes re-registered and the check repeated. Actual private output remains retained.
- Native full-inventory OSV execution and unchanged upstream tests are unclaimed. The database's zero finding for the fixed version does not replace the required hosted scanner verdict.

### Decision record

`docs/decisions/2026-10-06-sharp-live-relock-frozen-variant.md` records the targeted patch, rejected broad-ignore/historical-rewrite alternatives and evidence boundaries. Remove or re-review the frozen exception before replay, a new consumer, changed bytes or 2026-12-24. Registry is committed last. Independent bounded source/scope critic accepted this separation; co-op GPT micro-check and command-center exact-head ACK are requested. PR stays draft for that read; 5f owns landing.

### Host evidence

No `evidence/hosts/` change or platform-status claim.

- [ ] Host-receipt validation: not applicable.
- [ ] Command-center exact-head review requested; no platform status flip.

### Checklist

- [x] No workflow/action change; existing pinned actions and permissions stay untouched.
- [x] No secrets are printed, logged or committed; no new required secret.
- [x] No paid hosting or billing surface.
- [x] Peer-owned paths, services and worktrees preserved.
- [x] Frozen evidence remains byte-identical; registry last; no merge or settings change.

### Review follow-up — 2026-10-06

The co-op relays CC item `task-ns2604-coop-20261006T170124Z`, ruling 2: accept the disclosed browser gap for this urgent security landing conditional on a fresh frozen install/frontend build and restoration of the unrelated Mako JSON escape spelling. Both fresh frontend commands passed. `make postgres-init` exits 2 (inner 127) because the recipe's `.runtime/postgresql/18.6/bin/initdb` is missing. The recipe's `postgres-install` source-build target was not run under the upstream-never-rebuild and park rules. Playwright fixes both service and base URLs to port 18080, held by the local alert service; the service is untouched. No new browser cases ran.

Source: `native-agent-stack@4f32d59:blueprints/convergence-practice/application-delivery/Makefile:3-5,27-32,34-58` and `playwright.config.ts:8-16`; original Mako row at base `0d5e6506`. Full sanitized argv, return codes, actual outputs and classes are in `evidence/receipts/sharp-review-followup-20261006.json` and `relock-2026-10-06-sharp.review-*.txt`. Actual returned output remains privately durable; public progress whitespace/EOF normalization is explicit. The original qualification receipt and production/frozen locks stay byte-identical to the reviewed head.

```text
pnpm 12.4.2 install --frozen-lockfile (task-private cache/store/state/public-registry config)
exit 0; lock current, resolution skipped, 26ms
NEXT_TELEMETRY_DISABLED=1 pnpm build
exit 0; Next 16.3.8 production build
make postgres-init
exit 2; missing .runtime/postgresql/18.6/bin/initdb, inner 127
nice -n 19 python3 -m unittest tests.test_osv_lockfile_coverage tests.test_frozen_macos_variant_no_use tests.test_native_maintenance
exit 0; 96 tests, 8.999s
nice -n 19 python3 scripts/validate.py
exit 0; 69 components, 4 profiles, 214 receipts, 10,349 hashed files
```

Both original literal Mako `\u2192` spellings now exactly match the base row; parsed values are unchanged. Dated unfinished follow-up after the tools window: qualify the dedicated test DB through an upstream-supported release path and run the unchanged browser recipe in an isolated network namespace if no supported port override exists. Frontend build is not a browser/image-response or exploit test. Independent bounded source critic accepts the repair and separation. New-head co-op micro-check/CC ACK and hosted checks still required; registry is committed last. No broad ignore, alert-service takeover, source build, host configuration or merge.

### Scope

After #765's squash merge, use mainline revisions for its preserved-record and validator source references. Attribute the binding-amendment decision to the command center that ruled on it.

- Base commit: `c1300c15b42f1a6643f3dc4172f40c01d99abdcd` (#765's landed squash).
- Lane: `lane:foundation`.
- Owned paths: application-delivery `history/recipe-revisions.json`, `docs/decisions/2026-10-06-application-input-binding-amendment.md`, `evidence/receipts/pr765-bindings-amendment-20261006.json`, and the evidence registry last.
- Exactly six content-line replacements. The receipt's historical `base_revision` and the decision's historical review-head reference remain. Original snapshots, canonical experiments, archived locks, measured outputs and production pins retain their bytes.

## SOTA sources

- [Mainline application experiment at ecfa112](https://github.com/seathatflowsinourveins/native-agent-stack/blob/ecfa112764c664d35377dd66b8cfcb67e5a94d60/blueprints/convergence-practice/application-delivery/experiment.json): byte-identical to the preserved pre-amendment record, SHA `9372ee1635b6c818ca31fc3d73d33802d85293218bcea7467c4fc5aebbd43ec9`, 11,094 bytes.
- [Original macOS record at 67666d6](https://github.com/seathatflowsinourveins/native-agent-stack/blob/67666d6e3b790131a9b4a86f6e6b933e26fe305d/blueprints/convergence-practice/application-delivery/experiment-macos-20260924.json): byte-identical to its preserved snapshot, SHA `eb2ceb9c57ed3f11125a5091a85bf19dcb10e364dfb2b67d8c1b444970b300f3`, 25,990 bytes.
- `native-agent-stack@ecfa112:blueprints/convergence-practice/application-delivery/test_portability.py:101-131`, `scripts/validate_convergence.py:60-71,203-243`, and `blueprints/convergence-practice/contract.schema.json:6`. Their entire files equal the previous source pin. The decision's cited guard-test ranges also match at ecfa112.
- [Git squash semantics](https://git-scm.com/docs/git-merge#Documentation/git-merge.txt---squash), read 2026-10-06. Native ancestry checks distinguish branch-only revision `67c6594d2` from the two retained mainline revisions.
- Command-center ruling `task-ns2604-coop-20261006T100349Z`, relayed as PR765-FOLLOWUP, assigns these exact pin corrections and command-center-only attribution.
- `native-agent-stack@c1300c1:docs/lanes.md:96-128` supplies the registry-last protocol.

### Evidence-class table

| Claim | Evidence class | Command / observation |
| --- | --- | --- |
| Replacement pins are ancestors of current main | source_review / structural validation | Native `git merge-base --is-ancestor`: both replacement pins exit 0; old branch pin control exits 1 |
| Four archived inputs retain exact source bytes; cited code/ranges match | structural validation | Native Git blobs compared byte-for-byte with retained files; SHA-256 and lengths observed independently by root and source critic |
| Portability and recorded contracts retain consistency | local_integration / structural validation | Existing maintenance tests and convergence validator below |
| Manifest integrity | structural validation | `scripts/validate.py`, 10,315 hashed files |
| Upstream tests, new application/provider execution and new-head hosted acceptance | not_run / not_observed | No new execution or acceptance claim; original returned results are preserved |

### Local commands run

```sh
git merge-base --is-ancestor ecfa112 c1300c1
# exit 0
git merge-base --is-ancestor 67666d6 c1300c1
# exit 0
git merge-base --is-ancestor 67c6594 c1300c1
# exit 1, discriminating non-mainline control

# External TMPDIR; nice 19.
python3 -m unittest -v tests.test_native_maintenance
# exit 0; 29 tests in 0.078s, OK
nice -n 19 python3 scripts/validate_convergence.py --all-recorded --root . --json
# exit 0; 32 records, valid=true, zero invalid
nice -n 19 python3 scripts/validate.py
# exit 0; 69 components, four profiles, 212 receipts, 10315 hashed files
git diff --check
# exit 0
```

No full suite was rerun for these source-reference edits. #765's failed local full-suite result remains in its receipt, separate from its accepted hosted run. The four retained blob comparisons and receipt non-source-field comparison passed without altering data. The source completeness critic accepted the six-line diff and three-file registry scope.

### Decision record

`docs/decisions/2026-10-06-application-input-binding-amendment.md` retains its alternatives and hash/path overturn conditions; only source attribution and the responsible decision-maker change.

### Host evidence

No host-receipt, platform-status, installer or host configuration changes. Request the co-op's exact-head GPT micro-check and command-center ACK; keep this PR a draft. #765's accepted branch is untouched.

### Checklist

- [x] No workflow changes; action pin and permissions requirements are not applicable.
- [x] No credentials read, printed or committed; no new required secret.
- [x] No paid hosting, subscription or billing surface.
- [x] Peer-owned files/worktrees and historical evidence preserved.
- [x] Evidence registry is the last commit.

### FIX-782 same-day correction (2026-10-06)

Same-day correction at the command center’s direction (FIX-782, CC item 220640Z; final no-rewrite scope 230116Z): the portability-test reference is now c1300c1:blueprints/convergence-practice/application-delivery/test_portability.py:100-143, superseding this description’s earlier ecfa112 reference/whole-file-equality statement and extending the initial six-line follow-up with the returned six-test run (exit 0), with no recorded observation altered.