[HMarcusWH]

Manual review corrections: installed distributions and wheelhouse closure

Exact head: 5af6b28dbf479fa4a926adf077413a9186041838. The deep repository audit identified two P2 evidence gaps in the initial observer. Both are now source-repaired and covered by destructive tests:

• The complete installed Python inventory must equal the 12 attested wheel distributions and their exact versions parsed from actual .dist-info/METADATA and canonical filenames; venv-provided pip is the only permitted nonwheel distribution, still recorded but not independently approved.
• The entire staged wheelhouse is now closed to exactly 12 wheel archives, runtime-wheels.lock and wheel-attestation.json; extra .pth, .py, other files, directories, or symlinks fail.

Exact-head evidence: 201/201 RELEASE-1 unit/negative tests passed, scanner compatibility passed, and full real-image RELEASE-1 OCI integration passed at run 39162932833. The actual installed-image dependency report confirms installed_wheel_versions_verified=true, wheelhouse_closed=true, wheel_count=12, and installer_distribution_exceptions=1 (pip). LOCAL-1 and remaining workflow checks are verified separately; real-image green is not lock or distribution approval.

No authority upgrade: source-lock resolution and bootstrap CA version are not yet independently frozen; dependency_lock_approved=false, offline_candidate_qualified=false, public_bot_release=false, and artifact_distribution_authorized=false. Keep this PR draft until the full real-image verification and final review pass.

RELEASE-2A — candidate-only dependency inventory observation

Base main: 952a2c5cddff842efc5418f21e5987f51bcad6bf (merged PR #71).
Exact PR head: d781de2753a1710c1da81f1458a7ce097ea51cd7.
Draft / DO NOT MERGE until exact-head CI and review.

Objective

RELEASE-1 now independently validates an installed, offline-only three-engine OCI image, real SLSA/SPDX and packaged smoke/recovery evidence. Its remaining mechanical gates include os_lock and wheel_lock. This PR does not freeze those locks. It adds the missing source-bound observation of the exact installed Ubuntu and Python inventories and all 12 staged wheel binaries so independent repeated builds can be compared before a separate, reviewed lock-freeze PR.

Changes

• New scripts/observe-release-dependencies.py: bounded, canonical sorted OS dpkg-query records, installed pip freeze --all identities, actual wheel-by-wheel SHA256 and source/runtime lock reconciliation against the staged manifest and source attestation.
• Fail closed on file/symlink/path escapes, bad record syntax, missing/non-native OS packages, unpinned Python requirements, missing/excess wheels, SHA drift and inconsistent source/policy identities.
• RELEASE-1 runs the observer only after the independent installed-image OCI/smoke/aggregate gate, from the fresh exact-commit worktree. Retain the digest/count report in the existing safe diagnostic artifact allowlist. No wheel binaries or raw OCI/SBOM/provenance added to downloads.
• New negative unit tests and workflow source-closure/ordering regression tests; forward docs in docs/RELEASE_2A_DEPENDENCY_OBSERVATION.md and ROADMAP.

The historical green PR #71 run recorded 120 installed Ubuntu packages and 13 Python distributions; these are observations, not pre-approved pins. Acceptance of this PR means the observer operates correctly on fresh CI images, not that two separate builds are reproducible.

Non-grants

dependency_lock_approved = false
cross_run_reproducibility_qualified = false
offline_candidate_qualified = false
public_bot_release = false
artifact_distribution_authorized = false

Signed APT snapshot/base identity, controller/source licensing, publisher signature, destination host, live transport and operator approval remain independent and explicitly unqualified.

Required verification

• New fast RELEASE-1 negative contracts green at this exact head (201/201).
• Real scanner, full OCI and four packaged smoke jobs green (run 39162932833).
• Genuine installed OS/Python inventory and wheel attestation candidate report generated, with no release claims.
• All workflow groups actually triggered by the RELEASE-2A diff green; any path-scoped skipped families are not counted as independently rerun.
• Fresh independent code/security review and adjudication of actionable findings.

Next after this PR: independently compare repeated exact-source build observations and propose reviewed OS/wheel pins, without granting public release.

[HMarcusWH]

Independent code review — RELEASE-2A observer fixes

Reviewed source: 5af6b28dbf479fa4a926adf077413a9186041838.

I checked the source-bounded installed inventory parser, canonical wheel filename and ZIP .dist-info/METADATA decoder, duplicate distribution checks, per-wheel SHA256 attestation, exact staged-directory closure, installer-only pip exception, main policy source binding and new mutation tests. The original two P2 evidence gaps are source-repaired.

Real positive: RELEASE-1 run 39162932833 passed 201/201 fast contracts, scanner-compatibility and full installed-image OCI/recovery qualification. Its actual dependency observation reports 12 wheel versions exactly matched to installed packages, no unlisted wheelhouse content and one permitted venv-provided pip distribution.

Still no lock approval: This establishes one build's dependency integrity, not independently repeated exact-source/toolchain reproducibility. requirements.lock is generated dynamically, the initial CA bootstrap is not version-frozen, and corresponding-source/licensing, host, network and publication gates remain false.

Merge gate at review time: LOCAL-1 full-game campaign was still running. This COMMENT review is not final merge approval; retain the draft until all triggered workflows complete successfully and review remains current.

[HMarcusWH]

Final boarding — RELEASE-2A exact-head source/CI review

Reviewed 5af6b28dbf479fa4a926adf077413a9186041838 following the prior manual source review. All 5/5 workflows have completed successfully, including 201/201 release contracts, source-pinned Syft scanner, real full OCI and packaged smoke, local full-game qualification, baseline, merge gate, and publication-prohibition gate. No failed required job.

The real installed-image observation at run 39162932833 verifies installed_wheel_versions_verified=true, wheelhouse_closed=true, candidate_integrity_observed=true, 120 native packages, 13 installed Python distributions, and 12 attested wheel archives (plus the explicit venv-provided pip exception). Confirmed the observer remains a measurement-only source-attested verifier.

Decision: approved for CODE MERGE only at this exact SHA. Neither the observer nor merging it grants dependency-lock approval, reproducibility across independent exact-source builds, license compliance, artifact distribution, production host, public bot or live transport. offline_candidate_qualified=false and release_blocked=true remain binding.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-19T00:23:30.749941Z	5af6b28	Draft marked ready
🔒 Security Review	⚠️ Failed 2026-10-19T00:23:35.694959Z	5af6b28	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.