[HMarcusWH]

RELEASE-2B-2 — Signed Ubuntu provenance and pre-install SHA admission

Draft candidate; NOT merge-ready. Exact PR head: a03ebc5f4dd13cc58d611a93343443a8ccd503d6. Base: 1c54dfac5d8ae1d9d25b93a8d72b9efbc4ec0b50.

Implemented

• A single real release-dependencies stage inherited by release-application, with source-bound Ubuntu 20261001T000000Z and twelve hash-locked Python wheels.
• All 29 native .deb inputs (3 bootstrap + 26 runtime) now pass the committed exact SHA-256/version/architecture/filename gate before executing package installation scripts.
• Bootstrap and runtime installs run under RUN --network=none with local verified .deb operands and --no-download; no post-admission index update or package fetch.
• Complete 92-base, 94-bootstrap and 120-final Ubuntu inventories remain source-locked. Negative tests reject corrupt, missing, extra or symlink package candidates before APT is invoked.
• Independent source verifier reads actual signed InRelease files, confirms the Ubuntu GPG key, matches verified Packages.xz index hashes and sizes, parses single complete package stanzas and checks archive identity/hash/size.
• Run 39431452612 verified all 29/29 native package origin candidates from four signed indexes in noble-updates/main, noble-updates/universe, noble/main, noble/universe. The exact signed_origins are now committed to the candidate lock, along with bootstrap CA index provenance.
• Negative contracts include changed signed index/pocket fields, malformed Debian control stanzas, multiple aligned XZ streams, bad hashes, and bounded timeout failures.

Exact-head external CI blocker

RELEASE-2B-2 run 39432717090: source tests passed, while Ubuntu's pinned snapshot intermittently returned HTTP 500/502/503 and read timeouts from the same frozen URLs. Bootstrap/dependency builds fail closed on unavailable signed source evidence. The independent signed-origin recheck also refuses to pass if an essential signed suite is unavailable. Prior 29/29 evidence is NOT a substitute for final-head green CI.
Rerun failed exact-head jobs when signed Ubuntu snapshot retrieval is reliable, without changing sources or bypassing GPG/TLS/package SHA validation. Full RELEASE-1 OCI/SPDX/SLSA, packaged offline smoke and remaining exact-head gates are still required.

Explicit non-grants

ca_bootstrap_snapshot_locked=false, os_package_lock_complete=false, wheel_lock_complete=false, offline_candidate_qualified=false, artifact_distribution_authorized=false, public_bot_release=false. Provisional digest-pinned CA is candidate transport trust only; no public, license, host, credentials or live play authorization.

RELEASE-2B-3 still requires independent repeated builds/comparison. RELEASE-2B-4 is separate lock admission. Do not merge until the exact-head CI and review gates pass.

Candidate private signed-byte cache (October 20 implementation)

The signed Ubuntu snapshot service has repeatedly failed with HTTP 500/502/503 and read timeouts. PR #75 now includes scripts/prepare-release-native-bundle.py and source-bound ephemeral GitHub Actions cache orchestration in release-2b-native.yml and release-candidate.yml. It downloads only the committed Ubuntu snapshot 20261001T000000Z (no floating mirror), validates all four signed InRelease byte hashes/GPG, four signed Packages.xz hash/size records and all 29 exact .deb hashes/sizes before caching. Every cache hit is revalidated with the exact source-locked check, independently in the pinned Docker stage and in the Ubuntu gpgv step. Native installation remains RUN --network=none. Private cache is ephemeral CI transport, not RELEASE-2B-3 independent build evidence, artifact publication, third-party attestation, or lock approval.

At current head the fast native negative/source tests and RELEASE-1 contract tests have passed; raw signed-byte cache acquisition and full OCI CI are still in progress. Do not merge until exact-head tests complete successfully and review issues are resolved.

Verified cache and native dependency stage

Native workflow run 39461947766 is fully green at head b7b2c046d2aadd888b8496d3ec700a56de25dd05: source and negative contracts, independently verified private Ubuntu signed-byte cache (4 GPG releases, 4 signed Packages.xz indexes, exactly 29 signed native archives), actual offline CA bootstrap, and actual release-dependencies stage. Independent image-stage verification reports 92/94/120 native inventory, both pre-install SHA receipts true, 12 Python wheels PASS, source-native hash lock complete, public_bot_release=false, dependency_lock_approved=false. The cache was successfully saved under the source-lock-derived key, and restored in downstream jobs with independent revalidation.

Full RELEASE-1 OCI run 39461947843 has green source contract and scanner compatibility jobs; full OCI integration still running at the latest check. No merge until it finishes green and independent review clears the changed trust transport.

[HMarcusWH]

RELEASE-2B-2 implementation review handoff — exact head a03ebc5f4dd13cc58d611a93343443a8ccd503d6

Code fixes implemented for the two prior review findings:

1. Pre-execution integrity: all 3 bootstrap and 26 runtime native archives are checked against the committed SHA256/arch/version/filename manifest before apt-get install executes, under RUN --network=none; no post-admission apt-get update and no package downloads are permitted.
2. Independently authenticated provenance: run 39431452612 verified 29/29 package candidates through actual Ubuntu GPG-signed InRelease metadata, four exact Packages.xz indexes and complete archive records. Those 29 signed_origins and the CA source index digest are now committed. The source-index CI jobs no longer have discovery-only bypass mode.

Current external blocker: exact-head run 39432717090 source/negative tests PASS, while Ubuntu's dated snapshot has returned repeated HTTP 502/503 on required suites. A failed-jobs rerun at this exact SHA again produced HTTP 503. No unsigned/floating fallback, source-time drift or GPG/TLS/SHA bypass has been used. Full RELEASE-1 OCI and independent signed-origin source recheck must become green at this exact head before considering merge.

Review disposition: both previously identified code-path repairs are represented and independently source-tested, but this is not a green final release/build qualification, formal third-party review, lock approval, or public/live/host permission. Keep PR draft and unmerged until exact-head acquisition + full qualification pass.

[HMarcusWH]

RELEASE-2B-2 final exact-head source/CI inspection — prior actionable findings resolved.

Audited PR head b7b2c046d2aadd888b8496d3ec700a56de25dd05 against the RELEASE-2B implementation specification and GitHub CI. The 33 changed files are confined to native packaging/trust inputs, release CI, candidate policy, verifiers, tests and docs; no chess search/controller or live/public grants.

1. PRE-INSTALL NATIVE BYTES — resolved. deploy/release/preinstall-native-gate.sh checks source-locked SHA256, version, arch, filename and full 3+26 archive closure before both native installations. Docker executes both in RUN --network=none with --no-download. Negative corruption/symlink/missing/extra controls pass.
2. SIGNED INDEX PROVENANCE — resolved. qualification/release-os-packages.lock source-locks 29 signed package origins. The exact signed InRelease -> Packages.xz -> .deb source chain is independently recomputed using the digest-pinned Ubuntu keyring, raw archive/hash/size checks and complete Debian index control records. The private GitHub cache is only transport; exact cached bytes are reverified by the isolated source verifier and independently by the actual pinned Docker build. gpgv checks all four signed releases; no unsigned/floating fallback.
3. REAL DEPENDENCY IMAGE AND OCI — qualified as candidate. Exact-head native workflow 39461947766: 4/4 jobs PASS; 92/94/120 native inventories, both preinstall receipts, 29 package SHA identities and 12 Python wheels. Exact-head full OCI 39461947843: full RELEASE-1 contracts, scanner, signed-byte acquisition, actual offline image, SPDX/SLSA attestation and packaged R00/R02/R10 smoke all PASS. LOCAL-1, LC0, ONLINE-3A, controller, merge gate and publication prohibition PASS. No raw OCI is distributed via retained release artifacts.
4. AUTHORITY BOUNDARIES preserved. Source policies continue to refuse public_bot_release, live credentials, license/host promotion and OS/Python/wheel lock approval. The provisional CA trust bundle is digest- and byte-pinned and used only in the offline candidate; formal approved dependency-lock admission remains in separate RELEASE-2B-4. 2B-3 independent clean-build reproducibility remains unclaimed.

Verdict: no surviving actionable engineering findings within RELEASE-2B-2 scope; technically merge-ready. This is a second-pass review by the implementing assistant, not independent human/third-party sign-off or positive lock approval. The user explicitly authorized merge if ready. Do not deploy/publish.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T20:31:07.181412Z	b7b2c04	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-20T20:32:19.644715Z	b7b2c04	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.