erikleblansch · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026
diff --git a/.github/workflows/alpha-topology.yml b/.github/workflows/alpha-topology.yml
@@ -2131,7 +2131,7 @@ jobs:
 
       - name: Upload closed transaction TEST evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'transaction-abci' && env.VOLPAROSSA_ALPHA_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |
@@ -2153,7 +2153,7 @@ jobs:
 
       - name: Upload closed protected quote refusal evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'protected-quote' && env.VOLPAROSSA_ALPHA_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |
@@ -2164,7 +2164,7 @@ jobs:
 
       - name: Upload bounded topology diagnostics
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO != 'agent-private-conversation' && env.VOLPAROSSA_ALPHA_SCENARIO != 'agent-native-coding' && env.VOLPAROSSA_ALPHA_SCENARIO != 'transaction-abci' && env.VOLPAROSSA_ALPHA_SCENARIO != 'protected-quote'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: ${{ env.VOLPAROSSA_ALPHA_OUTPUT }}
@@ -2173,7 +2173,7 @@ jobs:
 
       - name: Upload bounded private conversation fixture evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'agent-private-conversation'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |
@@ -2202,7 +2202,7 @@ jobs:
 
       - name: Upload bounded native coding fixture evidence
         if: always() && env.VOLPAROSSA_ALPHA_SCENARIO == 'agent-native-coding'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: alpha-production-helper-topology-${{ github.run_id }}
           path: |

diff --git a/.github/workflows/dns-cache-proof.yml b/.github/workflows/dns-cache-proof.yml
@@ -128,7 +128,7 @@ jobs:
 
       - name: Upload exact-source public wire and bounded collector evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dns-cache-builtin-root-${{ github.run_id }}
           path: ${{ env.VOLPAROSSA_DNS_PROOF_OUTPUT }}

diff --git a/.github/workflows/helper-boundary-evidence.yml b/.github/workflows/helper-boundary-evidence.yml
@@ -658,7 +658,7 @@ jobs:
           steps.vm_proof.outputs.exit_code == '0' &&
           steps.host_validation.outcome == 'success' &&
           steps.verify_kvm_state.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: helper-boundary-evidence-${{ github.sha }}
           path: |
@@ -679,7 +679,7 @@ jobs:
           steps.host_validation.outcome != 'success' ||
           steps.verify_kvm_state.outcome != 'success') &&
           steps.retained_artifacts.outputs.diagnostics_any == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: helper-boundary-diagnostics-${{ github.sha }}
           path: |
@@ -697,7 +697,7 @@ jobs:
           steps.vm_proof.outputs.exit_code == '0' &&
           steps.host_validation.outcome == 'success' &&
           steps.verify_kvm_state.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: helper-restart-exact-present-evidence-${{ github.sha }}
           path: |

diff --git a/.github/workflows/native-cpu-contract.yml b/.github/workflows/native-cpu-contract.yml
@@ -166,7 +166,7 @@ jobs:
           ) 2>&1 | tee build/native-contract/source-check.log
       - name: Retain original source-only reports and logs, including failures
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-source-${{ matrix.mode }}-${{ github.sha }}
           path: |

diff --git a/.github/workflows/native-session-diagnostics.yml b/.github/workflows/native-session-diagnostics.yml
@@ -118,9 +118,12 @@ jobs:
           test "$GITHUB_ACTIONS" = true
           test "$RUNNER_ENVIRONMENT" = github-hosted
           test "$(dpkg --print-architecture)" = amd64
+          # Same Noble security compiler/library family as Quality (2026-10-20).
           sudo -n apt-get update
           sudo -n apt-get install --yes --no-install-recommends \
-            protobuf-compiler=3.21.12-8.2ubuntu0.3
+            protobuf-compiler=3.21.12-8.2ubuntu0.4 \
+            libprotoc32t64=3.21.12-8.2ubuntu0.4 \
+            libprotobuf32t64=3.21.12-8.2ubuntu0.4
           test "$(protoc --version)" = 'libprotoc 3.21.12'
 
       - name: Check the closed Python collector contracts
@@ -261,7 +264,7 @@ jobs:
 
       - name: Preserve only source, inventory and original check evidence including failures
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-session-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}
           retention-days: 14

diff --git a/.github/workflows/protected-compute-admission.yml b/.github/workflows/protected-compute-admission.yml
@@ -100,7 +100,7 @@ jobs:
         run: python3 -B tests/integration/protected-compute-quote.py receipt
       - name: Retain only bounded public source lock and test evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-core-evidence-${{ github.sha }}
           retention-days: 14
@@ -123,7 +123,7 @@ jobs:
             ${{ runner.temp }}/volparossa-protected-compute-admission/evidence/clippy.log
       - name: Retain bounded guest software evidence
         if: always() && (github.ref == 'refs/heads/feature/protected-compute-guest' || github.ref == 'refs/heads/feature/protected-compute-quote-exchange')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-guest-software-${{ github.sha }}
           retention-days: 14
@@ -134,7 +134,7 @@ jobs:
             ${{ runner.temp }}/volparossa-protected-compute-admission/guest-evidence/report.json
       - name: Retain bounded quote software evidence
         if: always() && github.ref == 'refs/heads/feature/protected-compute-quote-exchange'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-quote-software-${{ github.sha }}
           retention-days: 14

diff --git a/.github/workflows/protected-compute-verifier.yml b/.github/workflows/protected-compute-verifier.yml
@@ -97,7 +97,7 @@ jobs:
             "$VERIFIER_SOURCE" build/protected-compute-verifier/evidence "${statuses[0]}" "${statuses[1]}"
       - name: Retain original public fixture evidence only
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: protected-compute-public-fixtures-${{ github.sha }}
           retention-days: 14

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
@@ -58,10 +58,13 @@ jobs:
           test "$RUNNER_ENVIRONMENT" = github-hosted
           test "$(dpkg --print-architecture)" = amd64
           # Official Noble security package; signed apt metadata authenticates it.
-          # https://packages.ubuntu.com/noble/amd64/protobuf-compiler
+          # Compiler and library family from Noble security, published 2026-10-20.
+          # https://security.ubuntu.com/ubuntu/dists/noble-security/universe/binary-amd64/Packages.xz
           sudo apt-get update
           sudo apt-get install --yes --no-install-recommends \
-            protobuf-compiler=3.21.12-8.2ubuntu0.3
+            protobuf-compiler=3.21.12-8.2ubuntu0.4 \
+            libprotoc32t64=3.21.12-8.2ubuntu0.4 \
+            libprotobuf32t64=3.21.12-8.2ubuntu0.4
           test "$(protoc --version)" = 'libprotoc 3.21.12'
 
       - name: Verify original ABCI schemas and inert fixture contracts
@@ -82,7 +85,7 @@ jobs:
           sh -n tests/integration/content-provider-pressure-smoke.sh
           node --version
           node -e 'if (Number(process.versions.node.split(".")[0]) < 22) process.exit(1)'
-          node --test tests/integration/test-weather-source-observer.mjs
+          node --test tests/integration/test-weather-source-observer.mjs tests/integration/test-descriptor-reads.mjs
           python3 -B tests/integration/test-weather-products-delivery.py
           python3 -B tests/integration/test-weather-products-hosted-wiring.py
           python3 -B tests/integration/test-weather-overmorrow-hosted-wiring.py
@@ -182,7 +185,7 @@ jobs:
 
       - name: Preserve failed standalone lock reconciliation
         if: ${{ failure() && steps.fetch-dependencies.outputs.backport_lock_diagnostic == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: backport-lock-diagnostic-${{ github.run_id }}
           path: |

diff --git a/.github/workflows/storage-lock-lifecycle.yml b/.github/workflows/storage-lock-lifecycle.yml
@@ -79,9 +79,12 @@ jobs:
           test "$GITHUB_ACTIONS" = true
           test "$RUNNER_ENVIRONMENT" = github-hosted
           test "$(dpkg --print-architecture)" = amd64
+          # Same Noble security compiler/library family as Quality (2026-10-20).
           sudo -n apt-get update
           sudo -n apt-get install --yes --no-install-recommends \
-            protobuf-compiler=3.21.12-8.2ubuntu0.3
+            protobuf-compiler=3.21.12-8.2ubuntu0.4 \
+            libprotoc32t64=3.21.12-8.2ubuntu0.4 \
+            libprotobuf32t64=3.21.12-8.2ubuntu0.4
           test "$(protoc --version)" = 'libprotoc 3.21.12'
 
       - name: Check out unchanged locking plus only the three regressions
@@ -182,7 +185,7 @@ jobs:
 
       - name: Retain only regression observations and logs
         if: always() && steps.scope.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: storage-lock-lifecycle-${{ github.run_id }}-${{ github.run_attempt }}
           path: |

diff --git a/.github/workflows/weather-android-delivery.yml b/.github/workflows/weather-android-delivery.yml
@@ -372,7 +372,7 @@ jobs:
             --manifest "$WEATHER_MANIFEST" --kvm-cleanup "$WEATHER_INPUTS/kvm-cleanup.json"
       - name: Upload only closed evidence and pinned-input provenance
         if: always() && env.WEATHER_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-android-delivery-${{ github.sha }}
           retention-days: 14

diff --git a/.github/workflows/weather-decoder-abi.yml b/.github/workflows/weather-decoder-abi.yml
@@ -115,7 +115,7 @@ jobs:
             --expected-commit "$GITHUB_SHA"
       - name: Retain bounded ABI results only
         if: always() && env.VOLPAROSSA_ABI_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-decoder-debian13-${{ github.sha }}
           retention-days: 14

diff --git a/.github/workflows/weather-overmorrow-delivery.yml b/.github/workflows/weather-overmorrow-delivery.yml
@@ -302,7 +302,7 @@ jobs:
           PY
       - name: Retain bounded original evidence, never the input bundle or profiles
         if: always() && env.WEATHER_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-overmorrow-delivery-${{ github.sha }}
           retention-days: 14

diff --git a/.github/workflows/weather-products-delivery.yml b/.github/workflows/weather-products-delivery.yml
@@ -269,7 +269,7 @@ jobs:
           PY
       - name: Retain bounded original evidence, never the input bundle or profiles
         if: always() && env.WEATHER_OUTPUT != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: weather-products-delivery-${{ github.sha }}
           retention-days: 14

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -40,7 +40,7 @@ futures = "0.3.31"
 getrandom = "0.4.3"
 hex = { version = "0.4.3", features = ["serde"] }
 hkdf = "0.12.4"
-hpke = { version = "=0.14.0", default-features = false, features = ["alloc", "chacha", "x25519"] }
+hpke = { version = "=0.14.1", default-features = false, features = ["alloc", "chacha", "x25519"] }
 h3 = "=0.0.8"
 h3-quinn = "=0.0.10"
 hickory-proto = "0.25.2"

diff --git a/THIRD_PARTY_LICENSES.md b/THIRD_PARTY_LICENSES.md
@@ -920,7 +920,7 @@ The package does not depend on or start the standalone Unbound daemon.
 | serde, serde_json, serde_yaml, prost | configuration and wire encoding | MIT or Apache-2.0/MIT |
 | rust-libp2p and Quinn | decentralised control plane and QUIC | MIT |
 | rustls, ring, ed25519-dalek, x25519-dalek, Argon2 | transport, identity, and key protection | mixed permissive licenses; inspect every resolved crate |
-| `hpke` 0.14.0 (`rust-hpke`) | RFC 9180 route-credential sealing, exact crates.io pin in `Cargo.lock` | MIT/Apache-2.0; upstream `https://github.com/rozbb/rust-hpke` |
+| `hpke` 0.14.1 (`rust-hpke`) | RFC 9180 route-credential sealing, exact crates.io pin in `Cargo.lock` | MIT/Apache-2.0; upstream `https://github.com/rozbb/rust-hpke` |
 | rusqlite and SQLite bundle | bounded local peer/session state | MIT for wrapper; SQLite is public domain |
 | rtnetlink, netlink-sys, wireguard-uapi, nix, libc | Linux networking and OS boundary | mixed permissive licenses; inspect every resolved crate |
 

diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
diff --git a/scripts/test-diagnose-backport-lock.py b/scripts/test-diagnose-backport-lock.py
@@ -228,7 +228,7 @@ def test_harness_failure_preserved_after_diagnostic_success_or_failure(self):
     def test_failure_only_exact_artifact_allowlist(self):
         step = workflow_step("Preserve failed standalone lock reconciliation")
         self.assertIn("        if: ${{ failure() && steps.fetch-dependencies.outputs.backport_lock_diagnostic == 'true' }}", step)
-        self.assertIn("        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1", step)
+        self.assertIn("        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2", step)
         start = step.index("          path: |") + 1
         paths = []
         for line in step[start:]:

diff --git a/tests/helper/test-helper-boundary-vm-contract.sh b/tests/helper/test-helper-boundary-vm-contract.sh
@@ -2263,7 +2263,7 @@ for exact_workflow_text in \
     '"$proof_mode_flag"' \
     '--expected-source-ref "$SELECTED_REF"' \
     'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' \
-    'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' \
+    'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' \
     'persist-credentials: false' \
     'ref: ${{ github.ref }}' \
     'test "$(git symbolic-ref --quiet --short HEAD)" = main' \

diff --git a/tests/integration/agent-private-task-code.cjs b/tests/integration/agent-private-task-code.cjs
@@ -14,6 +14,22 @@ function save(name, value) {
   assert(Buffer.byteLength(data) <= 65536);
   fs.writeFileSync(path.join(root, name), data, { flag: 'wx', mode: 0o600 });
 }
+function readPrivateInput(file) {
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+  try {
+    const info = fs.fstatSync(fd);
+    assert(info.isFile() && info.uid === process.getuid() && (info.mode & 0o7777) === 0o600 && info.size <= 65536);
+    const bytes = Buffer.alloc(info.size + 1); let size = 0;
+    while (size < bytes.length) {
+      const count = fs.readSync(fd, bytes, size, bytes.length - size, size);
+      if (count === 0) break;
+      size += count;
+    }
+    const after = fs.fstatSync(fd);
+    assert(size === info.size && ['size', 'mtimeMs', 'mode', 'uid', 'gid'].every(key => info[key] === after[key]));
+    return bytes.subarray(0, size);
+  } finally { fs.closeSync(fd); }
+}
 async function main() {
   assert.equal(root, '/home/vpci/private-code');
   assert.equal(process.getuid(), process.geteuid());
@@ -22,9 +38,7 @@ async function main() {
   assert.notEqual(fs.readlinkSync('/proc/self/ns/net'), parentNetwork);
   assert(Object.keys(os.networkInterfaces()).every(name => name === 'lo'));
   const { PrivateCompute } = require(path.join(root, 'src/private-compute.cjs'));
-  const info = fs.lstatSync(inputPath);
-  assert(info.isFile() && info.uid === process.getuid() && (info.mode & 0o7777) === 0o600 && info.size <= 65536);
-  const input = JSON.parse(fs.readFileSync(inputPath, 'utf8'));
+  const input = JSON.parse(readPrivateInput(inputPath));
   assert.equal(input.version, 1);
   assert.equal(input.visibility, 'private_local');
   assert.equal(input.question, 'What string does testIdentifier return? Answer with only the string.');