Publish final runtime pins with lock-bound native acceptance - #873

…HSA-494j) (#1265)

* Pin aiohttp 3.14.4 in three available runtime locks

Regenerate the memory and example locks through uv and reproduce the OpenHands worker frozen export. Move yarl to 1.25.1 as required by aiohttp 3.14.4. Refresh inventory and evidence digest bindings.

The trading lock remains at aiohttp 3.14.3: its exact Python 3.12.3 interpreter is unavailable, and no new installation is authorized. This is a partial repair and re-pins no trading plan.

* Re-pin the trading-2604 runtime lock to aiohttp 3.14.4

GHSA-2g87-pp6c-29x5, GHSA-5wr8-gcqf-gqf3 and GHSA-494j-54xm-rwp3 affect
aiohttp <=3.14.3 and are fixed in 3.14.4. The trading-2604 lock was the last
scanned lock at 3.14.3.

Lock delta (aiohttp only):
- Relock: UV_PYTHON_DOWNLOADS=never uv lock --python <uv-managed CPython
  3.12.3> --upgrade-package aiohttp==3.14.4, uv 0.13.1.
- aiohttp 3.14.3 -> 3.14.4 (sdist and wheels, 18 -> 19 wheels; dependencies
  unchanged). yarl stays 1.25.1. 192 entries before and after; the other 191
  entries and the `revision = 5` header are byte-identical.
- Lock sha256 f451ef979cdb1ae3686a30df1c883c257402b32753478c1f9c686c057e9c3989
  -> a1413f202937aa05625bad34b35d4ad75c9ab637805c3747abc4fb8b0f85634a
  (308332 -> 308625 bytes). The manifest aa370e42 is unchanged.
- uv lock --check passes under uv 0.13.1 and under the installer's pinned
  uv 0.12.17 (`uv --no-config lock --check`, release archive verified against
  validate.yml's SHA256). A relock with uv 0.12.17 resolves the same packages
  but rewrites the header to `revision = 3`, so it was not used.

Bindings refreshed:
- install-trading-2604.sh: lock_hash -> a1413f20. Following #873 (a484989),
  the October 8 published pair f451/aa370e42 becomes one more recorded
  migration input and inverse record (published_lock_hash /
  published_project_hash, a sixth column of the existing-file check), never
  acceptance. Completion marker no-dvc-r4 and sync vector (8b8aa38e) are
  unchanged, as in #873.
- accept-trading-2604.sh:15 and adaptive-paper/scheduled_trial.sh:54 require
  a1413f20, so a runtime still at f451 is refused.
- tests/test_scheduled_trial.py scratch acceptance fixture lock_hash.
  tests/test_trading_2604_lock.py derives every hash from the bytes and pins
  none, so it is unchanged.
- runtime-2604/README.md: current-lock statements. The 24/24 native acceptance
  is bound to f451 and does not transfer; acceptance of a1413f20 is pending
  and runs under the North Star plan's C05.
- .github/osv-scanner-lockfiles.json trading entry sha256.
- adaptive-paper/source-hashes.json (scheduled_trial.sh, test_scheduled_trial.py).
- catalogs/landscape/final-stack.json, regenerated by
  scripts/final_stack.py --write (sources hash of the lock only).
- manifests/evidence.json entries of every changed file.

Retained f451 bytes: tests/test_receipt_sha256_key_custody requires every
receipt *_sha256 to hash a tracked file. The October 8 final-lock and 24/24
receipts bind f451, so its bytes are retained byte-identical (git show
30ab2e3) as evidence/artifacts/trading-2604-aiohttp-repin-20261020/
published-f451-trading-2604-runtime.lock, an excluded evidence fixture in the
osv inventory (not an install input; the active lock is scanned), following the
engine-baseline.lock exclusion precedent.

Records left unchanged (they record what was true then):
event-anchored-ranking/*, catalyst-provenance/README.md,
catalogs/convergence-practice/sources/starred-protected-20261011.json,
catalogs/convergence-practice/starred-convergence-20261010.json,
evidence/artifacts/runtime-final-lock-binding-20261008/*,
evidence/receipts/runtime-final-lock-binding-20261008.json,
evidence/receipts/runtime-final-native-24-acceptance-20261008.json,
catalogs/north-star/readiness.json (receipt values),
catalogs/us-equities/catalog-refresh-20261009.{json,md},
catalogs/us-equities/runtime-target.json#/final_native_acceptance.
Stale current claims left for the catalog assembler, as #873 routed catalog
reconciliation: runtime-target.json#/current_runtime and data-research.md:175.

Checks (python -B, scratch CPython 3.12.3 venv from .github/requirements-ci.txt
with --require-hashes):
- tests.test_trading_2604_lock tests.test_osv_lockfile_coverage
  tests.test_wsl_retrieval.RetiredRunnerTests: 78 tests, OK.
- 25 related modules (scheduled_trial, trading_2604_source_acceptance,
  runtime_directory_identity, install_claude_profile, final_stack,
  receipt_sha256_key_custody, frozen_evidence_reporting, adaptive_paper_*,
  lane_b_r3_*, local_pages_*, trading_gates_bindings and others reading the
  changed files): 814 tests: 727 pass, 86 skipped,
  1 failure. The failure,
  test_gitleaks_config...test_repository_pre_commit_refuses_old_fixture_commit...,
  fails identically at base 14df31f with no change applied (its scratch-repo
  pre-commit hook run reports no "leaks found" on this host); it touches none
  of the changed files.
- Scratch probe of the installer's locked-project block only (no uv, sync,
  Docker or host path): an existing f451 lock is admitted and replaced with
  a1413f20 (rc 0); an unknown lock is refused with exit 73.
- scripts/evidence_manifest.py --check, scripts/validate.py,
  scripts/final_stack.py --check: pass. git diff --check: clean.
- osv-scanner 2.6.0 (sha256 ca69b3d3 verified), ordinary group as
  security-scan.yml builds it: 60 inputs, No issues found, rc 0.

No install-trading-2604.sh, accept-trading-2604.sh or scheduled_trial.sh run;
no host state, broker or paper contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Retain the pre-bump OpenHands example lock for its 2026-09-30 frozen record

Commit 1 moved examples/openhands-native-capabilities/requirements.lock to
aiohttp 3.14.4. The convergence record
evidence/artifacts/native-runtime-role-resolution-20260930/experiment.json
froze that lock's earlier bytes as frozen_inputs.sources[3] (sha256 16e1a44e...),
so hosted validate-shard-0 failed in `scripts/validate_convergence.py
--all-recorded` with "record.frozen_inputs.sources[3]: SHA-256 mismatch".

This follows ecea286 (#628), which kept the frozen inputs of the OmniRoute
records the same way. The lock's bytes at 30ab2e3 are retained, byte for byte,
as evidence/artifacts/aiohttp-3.14.4-relock-20261020/historical/examples/
openhands-native-capabilities/requirements.lock.source.txt. The record's single
reference now points there with its sha256 unchanged. The copy is listed as an
excluded evidence fixture in .github/osv-scanner-lockfiles.json, with its reason
and the record as evidence, like the f451 fixture in commit 2 (the repository's
pre-push registry test requires that listing). manifests/evidence.json refreshes
the record's and the inventory's entries and registers the retained copy. No
measurement, verdict or other field of the record changes.

Checks, run with python3 -B in a scratch CPython 3.12.3 venv built from
.github/requirements-ci.txt with --require-hashes:
- scripts/validate_convergence.py --all-recorded: 33 records, all valid;
- scripts/validate.py: passed (71 components, 12,328 hashed files, 243 receipts);
- scripts/evidence_manifest.py --check: passed (12,328 files);
- unittest of test_osv_lockfile_coverage (61 tests, OK after the listing),
  test_convergence_contract, test_evidence_manifest,
  test_osv_lockfile_coverage, test_receipt_sha256_key_custody,
  test_research_convergence_practice and test_sota_convergence: 271 tests, OK.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Rename the retained example lock so dependency review does not read it as a manifest

At f662439 the required dependency-review check failed. GitHub's dependency
graph parsed the retained copy from commit 3, whose basename began with
"requirements" and ended in ".txt", as a pip manifest. It then reported its
aiohttp 3.14.3 as a newly added vulnerable dependency (GHSA-2g87-pp6c-29x5 and
GHSA-5wr8-gcqf-gqf3, high). The copy is an evidence fixture, not an install
input.

The copy is renamed to .../historical/examples/openhands-native-capabilities/
pinned-at-30ab2e3a.source.txt. Its bytes are unchanged (sha256 16e1a44e...). Like
ecea286's worker.py.lock.source.txt, the name matches no lockfile or manifest
pattern. The record's single reference moves with it.

Because the new name is not a lockfile candidate, tests.test_osv_lockfile_coverage
refuses an exclusion for it ("is excluded but is not a tracked lockfile"). The
exclusion commit 3 added is therefore removed, and .github/osv-scanner-lockfiles.json
is byte-identical to 3449e04 again. manifests/evidence.json unregisters the old
path, registers the new one, and refreshes the record's and the inventory's
entries. No dependency-review allowance or OSV ignore is added.

Checks on this head, run with python3 -B in a scratch CPython 3.12.3 venv built
from .github/requirements-ci.txt with --require-hashes:
- scripts/validate_convergence.py --all-recorded: 33 records, all valid;
- scripts/validate.py: passed (71 components, 12,328 hashed files, 243 receipts);
- scripts/evidence_manifest.py --check: passed;
- unittest of test_osv_lockfile_coverage, test_convergence_contract,
  test_evidence_manifest, test_receipt_sha256_key_custody,
  test_research_convergence_practice and test_sota_convergence: OK.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Test the trading-2604 installer's admission of the published f451 lock

The native Codex review of a6cb6b8 (P2) and the GPT review's L2 asked for a committed regression
test of the migration input that commit 2 added to install-trading-2604.sh: an install still at
the October 8 published lock f451ef97 must be admitted and moved to the current lock, never
accepted as current. All 13 lock and vector tests passed with that admission removed.

tests/test_trading_2604_migration.py runs only the installer's hash definitions and its
step=locked-project admission and copy block, verbatim, against a temporary project (no uv, sync,
network or host-runtime command), and checks:
- the retained fixture is byte-for-byte the published lock the installer names;
- the published lock is admitted and replaced by the current lock;
- the current lock passes unchanged;
- an unknown lock is refused with exit 73 and left in place;
- with the published admission line removed (the reviewer's mutant), the published lock is refused.

It is a new module: tests/test_trading_2604_lock.py is hash-bound by the 2026-10-08 record
evidence/artifacts/runtime-final-lock-binding-20261008/legacy-migration-source-repair.json and stays
unchanged.

Checks: the new module, test_trading_2604_lock, test_scheduled_trial and test_osv_lockfile_coverage
pass; scripts/validate.py passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>

* Bump certifi to 2026.10.19 (GHSA-6q48-6c7w-9gw2)

GHSA-6q48-6c7w-9gw2 (published 2026-10-20 19:35Z): certifi >= 2019.03.09,
< 2026.10.19 bundles emSign ECC Root CA - G3, whose intermediates had
compromised keys. certifi 2026.10.19 drops that root and keeps the
unaffected emSign roots. #1262's required osv-scanner context fails on it
across every lock below.

Lock delta (certifi only, following #1265's method):
- certifi 2026.7.22 -> 2026.10.19 in every lock that pinned it: the
  adaptive-paper engine lock, the trading-2604 runtime uv.lock, the memory
  native-qualification uv.lock, the OpenHands worker lock and pins, the
  adoption SDK lock and constraints, portfolio-risk, catalyst-provenance,
  sim-crosscheck-hftbacktest, deepagents-omniroute,
  openhands-native-capabilities, mlx-smoke and the macOS e2e evidence lock.
- Hashes from PyPI's JSON for 2026.10.19, each file downloaded and checked:
  wheel 42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b,
  sdist 035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae.
  No other package line changes in any lock.
- adaptive-paper engine lock sha256
  645544edbd13e7ff2434d5459e981ec0a2506c944e30d47844b4f3c57f602db8 ->
  8e08849c3370b905b7993a75e2f356920d45cdba81d64709a71fa3ff6263cb2d.
- trading-2604 runtime lock a1413f20... -> 2df71327...; the published a1413f20
  becomes one more recorded migration input in install-trading-2604.sh, as
  #873 and #1265 did, never acceptance; accept-trading-2604.sh and
  adaptive-paper/scheduled_trial.sh require the new hash.

Bindings refreshed: .github/osv-scanner-lockfiles.json (per-lock sha256 and
the retained fixtures as excluded evidence), adaptive-paper/source-hashes.json
(scheduled_trial.sh, test_scheduled_trial.py), tests/test_scheduled_trial.py,
tests/test_trading_2604_migration.py, runtime-2604/README.md, the convergence
records' frozen inputs re-pointed to the retained copies,
catalogs/landscape/final-stack.json (sources hash of the trading-2604 lock
only), and manifests/evidence.json for every changed and added file.

Retained bytes: each pre-bump lock is kept byte-identical (git show
da55495) under evidence/artifacts/certifi-2026.10.19-repin-20261020/
historical/ as published-<hash>-<name>, an excluded evidence fixture in the
osv inventory (not an install input; the active lock is scanned), with
repin.json as the record.

Checks (python -B, scratch venv from .github/requirements-ci.txt with
--require-hashes):
- scripts/validate_convergence.py --all-recorded: 33 records, all valid;
- scripts/validate.py: passed;
- scripts/evidence_manifest.py --check: passed (12,342 files);
- scripts/final_stack.py --check: passed;
- unittest of test_trading_2604_lock, test_trading_2604_migration,
  test_scheduled_trial, test_osv_lockfile_coverage,
  test_receipt_sha256_key_custody, test_convergence_contract,
  test_evidence_manifest, test_research_convergence_practice and
  test_sota_convergence: 310 tests, OK;
- git diff --check: clean.
osv-scanner was not run locally (not installed); the required context runs it.

No install, accept or trial script was run; no host state, broker or paper
contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bind the SDK lock's certifi relock to its qualification (validate-shard-5)

The certifi bump changes adoption/sdk/requirements-linux-x86_64-py313.lock,
which tests/test_adoption_contract.py binds two ways: every non-SDK pin must
equal the supply-chain receipt's historical inventory (certifi 2026.7.22), and
the runtime-sdk-20261003 qualification receipt's lock_sha256 (3a17fa09) must
equal the current lock. Both failed at 1328f12, in
test_lock_matches_accepted_inventory_and_all_pins_have_hashes and
test_sdk_upgrade_keeps_independent_inventory_and_client_guards (validate-shard-5);
both pass at da55495. The ignore route does not apply: .github/osv-scanner.toml
allows an ignore only for unreachable code, and certifi's bundle is reachable
from any HTTPS client in this SDK environment.

The relock is recorded instead of silently re-baselined, in the shape of
IGNORE_ALLOWED_LOCKS in tests/test_osv_lockfile_coverage.py:
- SDK_SECURITY_RELOCKS names certifi 2026.7.22 -> 2026.10.19 and
  GHSA-6q48-6c7w-9gw2 (GHSA-6q48-6c7w-9gw2,
  first patched version 2026.10.19). The inventory guard applies exactly that
  move, and only from the inventory's own version.
- SDK_QUALIFIED_LOCK is the retained pre-bump lock (this PR's evidence
  fixture, byte-identical to da55495). When the receipt's lock_sha256 is not
  the current lock's, it must be that fixture's, and the current lock may
  differ from it only in the relocked blocks; the preamble and every other
  block must be byte-identical.
- The historical receipts stay unedited. A re-qualification of the SDK pair
  records the new lock and inventory and empties the table.

New regression test:
test_relocked_lock_differs_from_the_qualified_lock_only_in_recorded_relocks.
It keeps every version, changes one charset-normalizer hash in the current
lock and then in the qualified fixture, and requires the two new guards to
refuse each. The existing duckdb and openai-codex-cli-bin drift cases still
fail on their own guards. manifests/evidence.json carries the test file's new
hash.

Local, in a requirements-ci venv:
- tests.test_adoption_contract, test_osv_lockfile_coverage and
  test_evidence_manifest: 80 tests, OK;
- scripts/validate.py: rc 0; evidence_manifest --check: passed (12,342 files);
  final_stack --check: passed; git diff --check: clean.

validate_shards.py run --shard 5 --shards 8 at 1328f12 also failed locally in
test_adoption_launchd and test_codex_job_lane_hardening. Those failures come
from the checkout location: mise installs [email protected] there, and GitHub's
attestation API refused it with a 403 rate limit. In clean worktrees of
1328f12 and of da55495, the same three modules give the same result (1
pre-existing error, test_claude_usage_sampler). test_runtime_boot needs PyYAML,
which this venv lacks, on both commits.

No install, accept or trial script was run; no host state, broker or paper
contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bind the SDK relock to repin.json, reproduce the mlx lock, restore three modes

Both families' checks of 1328f12 (AMEND, agreed):

1. HIGH (Claude D1, GPT P2a): the adoption SDK lock contract.
   The contract now admits exactly the move evidence/artifacts/
   certifi-2026.10.19-repin-20261020/repin.json records for
   adoption/sdk/requirements-linux-x86_64-py313.lock:
   - certifi 2026.7.22 -> 2026.10.19, GHSA-6q48-6c7w-9gw2;
   - prior 3a17fa09... (the retained qualified lock, which the
     runtime-sdk-20261003 receipt names) -> current 9ee41e37....
   It also requires the record's "Prior native acceptance does not
   transfer". The dated receipts (the 09-19 supply-chain inventory and the
   10-03 SDK qualification) are unedited. The inventory guard and the
   client mutation guard both stay (the duckdb and openai-codex-cli-bin
   cases). The regression test
   test_relocked_lock_differs_from_the_qualified_lock_only_in_recorded_relocks
   now refuses four version-preserving mutations, each by its own guard:
   a lock hash, a qualified-fixture hash, the record's current sha256 and
   the record's no-transfer sentence.

2. GPT P2b: tools/mlx-smoke/requirements.lock.txt did not reproduce under
   hardware-profile-smoke.yml's --exclude-newer 2026-09-23T00:00:00Z.
   The step adds --exclude-newer-package certifi=2026-10-20T02:30:00Z. That
   is uv 0.12.17's own per-package override (crates/uv-cli/src/lib.rs:
   7158-7177, PACKAGE=DATE, flattened into pip compile through
   ResolverArgs:7486 and PipCompileArgs:1642, at tag 0.12.17). certifi
   2026.10.19's files reached PyPI at 2026-10-20T02:24:15Z and 02:24:16Z,
   and no later release exists. Every other pin keeps the original cutoff.
   Reproduced locally with the pinned uv 0.12.17 (x86_64 release archive,
   sha256 fa82fd8d..., equal to its published .sha256) and the step's exact
   arguments: diff -u against the committed lock is empty.

3. MEDIUM (Claude D2, GPT P3): mode 100755 restored on
   adaptive-paper/scheduled_trial.sh, runtime-2604/accept-trading-2604.sh
   and runtime-2604/install-trading-2604.sh, with no content change (blobs
   afe6305, ed1b600 and 412c571, unchanged).

manifests/evidence.json carries the new hashes of the test and the
workflow. No lock byte changes; the engine lock stays 8e08849c.

Local, in a requirements-ci venv:
- scripts/validate.py: rc 0;
- evidence_manifest --check: passed (12,342 files);
- final_stack --check: passed;
- validate_convergence --all-recorded: 33 records valid;
- test_adoption_contract, test_osv_lockfile_coverage, test_evidence_manifest,
  test_workflow_hardening, test_workflow_security_coverage,
  test_scheduled_trial and test_trading_2604_migration: 234 tests, OK
  (13 skipped);
- git diff --check: clean.
Shard 5 (validate_shards.py run --shard 5 --shards 8) at 710733d, in a
clean worktree: 2,304 tests, 0 failures. Its 2 errors are local only and
the same on da55495: test_claude_usage_sampler, and test_runtime_boot,
which needs PyYAML.

No install, accept or trial script was run; no host state, broker or paper
contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Pin Pillow 13.0.0 on reviewed certifi 2026.10.19 head

Stack the five native Pillow relocks on #1266 accepted head eb898b5,
carrying its reviewed certifi pins unchanged. Only Pillow package entries
move. Preserve exactly the two reviewed trading certifi timestamp strings
under the wave builder decision; both pinned uv versions accept the lock
offline.

Reproduce the worker certifi export byte for byte before reapplying the
unchanged scratch-only Pillow override, rule-6 turn-back and F18 scope.
Retain each accepted intermediate input once; reuse #1266 reviewed history
and relocate only frozen receipt paths, never their digests or acceptance.
Refresh all live binders and add real predecessor-admission regression.

Checks: 901 tests, 873 pass and 28 optional skips; publication validation,
all 33 convergence records, evidence manifest, final-stack, trading gates,
shell syntax and whitespace pass. Local osv-scanner is unavailable; normal
exact-head hosted checks and both-family reviews remain required.

Sources and compatibility evidence: evidence/artifacts/
pillow-13-repin-20261020/RESEARCH.md and worker research.md, 2026-10-21.
No destination-host, image, grader, model, broker or paper acceptance.

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>