maintenance: bind fixture reads and refresh artifact action pins

.github/workflows/alpha-topology.yml

@@ -2131,7 +2131,7 @@ jobs:
 
       - name: Upload closed transaction TEST evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'transaction-abci' && env.VOLPAROSSA_ALPHA_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |
@@ -2153,7 +2153,7 @@ jobs:
 
       - name: Upload closed protected quote refusal evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'protected-quote' && env.VOLPAROSSA_ALPHA_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |
@@ -2164,7 +2164,7 @@ jobs:
 
       - name: Upload bounded topology diagnostics
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO != 'agent-private-conversation' && env.VOLPAROSSA_ALPHA_SCENARIO != 'agent-native-coding' && env.VOLPAROSSA_ALPHA_SCENARIO != 'transaction-abci' && env.VOLPAROSSA_ALPHA_SCENARIO != 'protected-quote'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: ${{ env.VOLPAROSSA_ALPHA_OUTPUT }}
@@ -2173,7 +2173,7 @@ jobs:
 
       - name: Upload bounded private conversation fixture evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'agent-private-conversation'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |
@@ -2202,7 +2202,7 @@ jobs:
 
       - name: Upload bounded native coding fixture evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'agent-native-coding'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |

.github/workflows/dns-cache-proof.yml

@@ -128,7 +128,7 @@ jobs:
 
       - name: Upload exact-source public wire and bounded collector evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dns-cache-builtin-root-${{ github.run_id }}
           path: ${{ env.VOLPAROSSA_DNS_PROOF_OUTPUT }}

.github/workflows/helper-boundary-evidence.yml

@@ -658,7 +658,7 @@ jobs:
           steps.vm_proof.outputs.exit_code == '0' &&
           steps.host_validation.outcome == 'success' &&
           steps.verify_kvm_state.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: helper-boundary-evidence-${{ github.sha }}
           path: |
@@ -679,7 +679,7 @@ jobs:
           steps.host_validation.outcome != 'success' ||
           steps.verify_kvm_state.outcome != 'success') &&
           steps.retained_artifacts.outputs.diagnostics_any == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: helper-boundary-diagnostics-${{ github.sha }}
           path: |
@@ -697,7 +697,7 @@ jobs:
           steps.vm_proof.outputs.exit_code == '0' &&
           steps.host_validation.outcome == 'success' &&
           steps.verify_kvm_state.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: helper-restart-exact-present-evidence-${{ github.sha }}
           path: |

.github/workflows/native-cpu-contract.yml

@@ -166,7 +166,7 @@ jobs:
           ) 2>&1 | tee build/native-contract/source-check.log
       - name: Retain original source-only reports and logs, including failures
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-source-${{ matrix.mode }}-${{ github.sha }}
           path: |

.github/workflows/native-session-diagnostics.yml

@@ -118,9 +118,12 @@ jobs:
           test "$GITHUB_ACTIONS" = true
           test "$RUNNER_ENVIRONMENT" = github-hosted
           test "$(dpkg --print-architecture)" = amd64
+          # Same Noble security compiler/library family as Quality (2026-10-20).
           sudo -n apt-get update
           sudo -n apt-get install --yes --no-install-recommends \
-            protobuf-compiler=3.21.12-8.2ubuntu0.3
+            protobuf-compiler=3.21.12-8.2ubuntu0.4 \
+            libprotoc32t64=3.21.12-8.2ubuntu0.4 \
+            libprotobuf32t64=3.21.12-8.2ubuntu0.4
           test "$(protoc --version)" = 'libprotoc 3.21.12'
 
       - name: Check the closed Python collector contracts
@@ -261,7 +264,7 @@ jobs:
 
       - name: Preserve only source, inventory and original check evidence including failures
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-session-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}
           retention-days: 14

.github/workflows/protected-compute-admission.yml

@@ -100,7 +100,7 @@ jobs:
         run: python3 -B tests/integration/protected-compute-quote.py receipt
       - name: Retain only bounded public source lock and test evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-core-evidence-${{ github.sha }}
           retention-days: 14
@@ -123,7 +123,7 @@ jobs:
             ${{ runner.temp }}/volparossa-protected-compute-admission/evidence/clippy.log
       - name: Retain bounded guest software evidence
         if: always() && (github.ref == 'refs/heads/feature/protected-compute-guest' || github.ref == 'refs/heads/feature/protected-compute-quote-exchange')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-guest-software-${{ github.sha }}
           retention-days: 14
@@ -134,7 +134,7 @@ jobs:
             ${{ runner.temp }}/volparossa-protected-compute-admission/guest-evidence/report.json
       - name: Retain bounded quote software evidence
         if: always() && github.ref == 'refs/heads/feature/protected-compute-quote-exchange'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-quote-software-${{ github.sha }}
           retention-days: 14

.github/workflows/protected-compute-verifier.yml

@@ -97,7 +97,7 @@ jobs:
             "$VERIFIER_SOURCE" build/protected-compute-verifier/evidence "${statuses[0]}" "${statuses[1]}"
       - name: Retain original public fixture evidence only
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-public-fixtures-${{ github.sha }}
           retention-days: 14

.github/workflows/quality.yml

@@ -58,10 +58,13 @@ jobs:
           test "$RUNNER_ENVIRONMENT" = github-hosted
           test "$(dpkg --print-architecture)" = amd64
           # Official Noble security package; signed apt metadata authenticates it.
-          # https://packages.ubuntu.com/noble/amd64/protobuf-compiler
+          # Compiler and library family from Noble security, published 2026-10-20.
+          # https://security.ubuntu.com/ubuntu/dists/noble-security/universe/binary-amd64/Packages.xz
           sudo apt-get update
           sudo apt-get install --yes --no-install-recommends \
-            protobuf-compiler=3.21.12-8.2ubuntu0.3
+            protobuf-compiler=3.21.12-8.2ubuntu0.4 \
+            libprotoc32t64=3.21.12-8.2ubuntu0.4 \
+            libprotobuf32t64=3.21.12-8.2ubuntu0.4
           test "$(protoc --version)" = 'libprotoc 3.21.12'
 
       - name: Verify original ABCI schemas and inert fixture contracts
@@ -82,7 +85,7 @@ jobs:
           sh -n tests/integration/content-provider-pressure-smoke.sh
           node --version
           node -e 'if (Number(process.versions.node.split(".")[0]) < 22) process.exit(1)'
-          node --test tests/integration/test-weather-source-observer.mjs
+          node --test tests/integration/test-weather-source-observer.mjs tests/integration/test-descriptor-reads.mjs
           python3 -B tests/integration/test-weather-products-delivery.py
           python3 -B tests/integration/test-weather-products-hosted-wiring.py
           python3 -B tests/integration/test-weather-overmorrow-hosted-wiring.py
@@ -182,7 +185,7 @@ jobs:
 
       - name: Preserve failed standalone lock reconciliation
         if: ${{ failure() && steps.fetch-dependencies.outputs.backport_lock_diagnostic == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: backport-lock-diagnostic-${{ github.run_id }}
           path: |

.github/workflows/storage-lock-lifecycle.yml

@@ -79,9 +79,12 @@ jobs:
           test "$GITHUB_ACTIONS" = true
           test "$RUNNER_ENVIRONMENT" = github-hosted
           test "$(dpkg --print-architecture)" = amd64
+          # Same Noble security compiler/library family as Quality (2026-10-20).
           sudo -n apt-get update
           sudo -n apt-get install --yes --no-install-recommends \
-            protobuf-compiler=3.21.12-8.2ubuntu0.3
+            protobuf-compiler=3.21.12-8.2ubuntu0.4 \
+            libprotoc32t64=3.21.12-8.2ubuntu0.4 \
+            libprotobuf32t64=3.21.12-8.2ubuntu0.4
           test "$(protoc --version)" = 'libprotoc 3.21.12'
 
       - name: Check out unchanged locking plus only the three regressions
@@ -182,7 +185,7 @@ jobs:
 
       - name: Retain only regression observations and logs
         if: always() && steps.scope.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: storage-lock-lifecycle-${{ github.run_id }}-${{ github.run_attempt }}
           path: |

.github/workflows/weather-android-delivery.yml

@@ -372,7 +372,7 @@ jobs:
             --manifest "$WEATHER_MANIFEST" --kvm-cleanup "$WEATHER_INPUTS/kvm-cleanup.json"
       - name: Upload only closed evidence and pinned-input provenance
         if: always() && env.WEATHER_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-android-delivery-${{ github.sha }}
           retention-days: 14

.github/workflows/weather-decoder-abi.yml

@@ -115,7 +115,7 @@ jobs:
             --expected-commit "$GITHUB_SHA"
       - name: Retain bounded ABI results only
         if: always() && env.VOLPAROSSA_ABI_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-decoder-debian13-${{ github.sha }}
           retention-days: 14

.github/workflows/weather-overmorrow-delivery.yml

@@ -302,7 +302,7 @@ jobs:
           PY
       - name: Retain bounded original evidence, never the input bundle or profiles
         if: always() && env.WEATHER_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-overmorrow-delivery-${{ github.sha }}
           retention-days: 14

.github/workflows/weather-products-delivery.yml

@@ -269,7 +269,7 @@ jobs:
           PY
       - name: Retain bounded original evidence, never the input bundle or profiles
         if: always() && env.WEATHER_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-products-delivery-${{ github.sha }}
           retention-days: 14

scripts/test-diagnose-backport-lock.py

@@ -228,7 +228,7 @@ def test_harness_failure_preserved_after_diagnostic_success_or_failure(self):
     def test_failure_only_exact_artifact_allowlist(self):
         step = workflow_step("Preserve failed standalone lock reconciliation")
         self.assertIn("        if: ${{ failure() && steps.fetch-dependencies.outputs.backport_lock_diagnostic == 'true' }}", step)
-        self.assertIn("        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1", step)
+        self.assertIn("        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2", step)
         start = step.index("          path: |") + 1
         paths = []
         for line in step[start:]:

tests/integration/agent-private-task-code.cjs

@@ -14,6 +14,22 @@ function save(name, value) {
   assert(Buffer.byteLength(data) <= 65536);
   fs.writeFileSync(path.join(root, name), data, { flag: 'wx', mode: 0o600 });
 }
+function readPrivateInput(file) {
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+  try {
+    const info = fs.fstatSync(fd);
+    assert(info.isFile() && info.uid === process.getuid() && (info.mode & 0o7777) === 0o600 && info.size <= 65536);
+    const bytes = Buffer.alloc(info.size + 1); let size = 0;
+    while (size < bytes.length) {
+      const count = fs.readSync(fd, bytes, size, bytes.length - size, size);
+      if (count === 0) break;
+      size += count;
+    }
+    const after = fs.fstatSync(fd);
+    assert(size === info.size && ['size', 'mtimeMs', 'mode', 'uid', 'gid'].every(key => info[key] === after[key]));
+    return bytes.subarray(0, size);
+  } finally { fs.closeSync(fd); }
+}
 async function main() {
   assert.equal(root, '/home/vpci/private-code');
   assert.equal(process.getuid(), process.geteuid());
@@ -22,9 +38,7 @@ async function main() {
   assert.notEqual(fs.readlinkSync('/proc/self/ns/net'), parentNetwork);
   assert(Object.keys(os.networkInterfaces()).every(name => name === 'lo'));
   const { PrivateCompute } = require(path.join(root, 'src/private-compute.cjs'));
-  const info = fs.lstatSync(inputPath);
-  assert(info.isFile() && info.uid === process.getuid() && (info.mode & 0o7777) === 0o600 && info.size <= 65536);
-  const input = JSON.parse(fs.readFileSync(inputPath, 'utf8'));
+  const input = JSON.parse(readPrivateInput(inputPath));
   assert.equal(input.version, 1);
   assert.equal(input.visibility, 'private_local');
   assert.equal(input.question, 'What string does testIdentifier return? Answer with only the string.');

tests/integration/cloud-private-file-sdk.mjs

@@ -3,7 +3,8 @@
 import assert from 'node:assert/strict';
 import { createHash, randomBytes } from 'node:crypto';
 import { spawn } from 'node:child_process';
-import { lstat, readFile, realpath, mkdir, readdir, writeFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { open, lstat, readFile, realpath, mkdir, readdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
@@ -52,10 +53,21 @@ async function privateJSON(file, value) {
   await writeFile(file, JSON.stringify(value) + '\n', { flag: 'wx', mode: 0o600 });
 }
 async function publicBytes(file) {
-  const info = await lstat(file);
-  insist(info.isFile() && info.uid === 0 && !(info.mode & 0o222)
-    && info.size <= 2 * 1024 ** 2 && await realpath(file) === file);
-  return readFile(file);
+  insist(await realpath(file) === file);
+  const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const info = await handle.stat();
+    insist(info.isFile() && info.uid === 0 && !(info.mode & 0o222) && info.size <= 2 * 1024 ** 2);
+    const bytes = Buffer.alloc(info.size + 1); let size = 0;
+    while (size < bytes.length) {
+      const { bytesRead } = await handle.read(bytes, size, bytes.length - size, size);
+      if (bytesRead === 0) break;
+      size += bytesRead;
+    }
+    const after = await handle.stat();
+    insist(size === info.size && ['size', 'mtimeMs', 'mode', 'uid', 'gid'].every(key => info[key] === after[key]));
+    return bytes.subarray(0, size);
+  } finally { await handle.close(); }
 }
 async function sdkProvenance() {
   const bytes = await publicBytes(`${SDK}/receipt.json`);