[security] - Time-limit issue 1629 container findings and fix fixture suppression

[cgfixit]

Proposed changes

Closes #1629 as completed sweep triage with a temporary risk acceptance, not as an upstream library fix. The five reported CVEs still have no patched bookworm or trixie package. Add exact Debian package/version exceptions expiring 2026-11-01 to .trivyignore.yaml, record the verified dependency chains and review triggers in SECURITY.md, and move the existing DevSkim fixture suppression onto the offending URL line.

Invariant / Governance Impact: None of I1–I6 changes. No runtime, Dockerfile, dependency pin, authentication, graph, or telemetry behavior changes. The fixture's Python AST is unchanged. Human review is required for the scanner exceptions and SECURITY.md; suppression is not remediation.

Package	Installed version	Retaining parent	Fixed-in / chosen option
libgnutls30	3.7.9-2+deb12u7	apt	None in bookworm/trixie; expiring acceptance
libgssapi-krb5-2	1.20.1-2+deb12u5	libtirpc3, retained by libnsl2	None in bookworm/trixie; expiring acceptance
libkrb5-3, libk5crypto3, libkrb5support0	1.20.1-2+deb12u5	GSSAPI/krb5 dependency chain	None in bookworm/trixie; expiring acceptance

The pinned base contains neither curl nor libldap, so the issue's suggested purge does not address the findings. Python 3.12 ships its nis extension alongside libnsl/libtirpc. Both healthchecks already use Python/httpx. Debian records disputed upstream security classification for the GnuTLS trio and postponed bookworm fixes for the two distinct krb5 paths (KDC and GSS-API acceptor). Source links and re-review requirements are in SECURITY.md.

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Security (auth, privacy, injection, egress, redaction, or secrets)
• Invariant / Governance refinement (use this for changes that strengthen or evolve the 6 invariants, I6 isolation, or harness phases)
• Dependencies (added, removed, or bumped)
• CI / infrastructure (workflows, hooks, templates, or checkers)
• Refactor or tests (behavior-preserving, no new capability)
• Documentation update
• Other (none of the boxes above fit)

Scope: scanner configuration, accepted-risk documentation, and one non-network fixture annotation.

Benefits / why

• Gives the no-fix window a review deadline and exact package/version scope rather than relying on dismissed GitHub alerts.
• Corrects the ineffective preceding-line DevSkim annotation while retaining the HTTP refusal test.
• Preserves the digest-pinned image and avoids speculative package removal or a distro migration that offers no patch.

Risks to monitor

The vulnerable packages remain present. The exceptions expire on 2026-11-01 and need earlier review on base, native-library, authentication, or upstream-fix changes. The existing GitHub alerts were already dismissed before this work; no alert state is changed by this PR. Review scanner output, not only green job status. Remove exceptions when the findings disappear. Rollback is to revert the three-file change.

Local validation scanned the exact linux/amd64 base remotely; no Docker daemon is available here to build the complete application image. Final-image rebuild and Trivy/DevSkim hosted results remain required before closure. No UI behavior changes; Computer Use is inapplicable.

Checklist

• I have read docs/THREAT_MODEL.md, INVARIANTS.md and SECURITY.md (and any relevant Phase docs)
• This change preserves all 6 security invariants and I6 module isolation (explicit evidence or invariant matrix included for core changes)
• Full sandbox validation has been run (GROK_API_KEY=dummy pytest tests/ -q --tb=short, and bash .claude/skills/CyClaw-Sandbox/verify.sh for core RAG/agentic paths) and passes with no regressions
• No new external network dependencies or mandatory online LLM assumptions were introduced without explicit justification + offline fallback path
• For any agentic/fsconnect change: two-phase audit, quota enforcement, governed delete/trash, and write guards have been verified
• Relevant architecture docs or threat model notes have been updated if core behavior or topology changed
• Commit messages follow the title prefix convention above
• For large or complex changes: before/after invariant matrix + sandbox evidence is included in "Further comments" or linked

Full local suites were intentionally not run under the owner's targeted verification policy. There are no core behavior or agentic changes.

Further comments

Local verification (Python 3.12.13; Trivy 0.72.0; DevSkim 1.0.100+ea92e6f3cc):

• Trivy image --image-src remote --platform linux/amd64 --scanners vuln --pkg-types os --format json against the Dockerfile's exact sha256:54c85f3c47607a77f32adec749d3c81d1348bf25833671f512b26a9b6d778cb3: all 11 reported package findings reproduced with no fixed version.
• Same scan with candidate --ignorefile .trivyignore.yaml --show-suppressed: exactly those 11 become ignored; all 281 unrelated base findings remain. Expired and wrong-package-version control files restore all 292 baseline findings. These counts cover all severities and are not a clean-image claim.
• Exported base dpkg metadata confirms the package/version/parent table above.
• DevSkim on the single fixture with the workflow's DS162092 exclusion: baseline has one DS137138; candidate has zero findings. No global rule disabled.
• Direct calls to the HTTP-refusal fixture and mocked loopback digest control pass. Fixture AST equality confirms no test behavior changed.
• actionlint .github/workflows/trivy.yml .github/workflows/devskim.yml: pass. zizmor==1.28.0 --offline --min-severity=high on those workflows: pass (one existing suppression). Workflows unchanged.
• Targeted Ruff F/B/S: pass; invariant guard: 46 passed; doc-sync: zero drift; git diff --check: pass.

Hosted CI evidence will be reported separately from these local checks. The issue can close after this PR merges with successful final-image rebuild and scanner verification, as acceptance/triage completed through November 1. This does not claim upstream remediation.

Suggested merge order of open PRs

Independent, only open PR. Base: main@9a0cdc2fad705d4bc79b550377c453991a2effaf, refreshed 2026-10-13 after #1652 merged. Trial merge verified clean with git merge --no-commit --no-ff and abort in an isolated worktree on 2026-10-13. Candidate: 259df1431b06659d9524e123ae084922f5bd152e; affected local checks were rerun after rebase.

This PR · Blocked ⛔ (draft; hosted verification pending).
Impact: Expiring scanner exceptions and fixture annotation only.
Action: Review the acceptance, then merge after the image/scanner checks pass.

ELI5

The scanner reports libraries bundled with Python, and Debian has not shipped fixes for these five reports. This records exactly which package versions are temporarily accepted and makes that exception expire on November 1. It also fixes a scanner comment that was on the wrong line of a test. The libraries are still installed. Local scans prove the exceptions work, expire, and leave unrelated findings visible; the full application image still needs its hosted build and scan.

Last updated: 2026-10-13 16:07 ET

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T20:37:48.734209Z	259df14	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.