[Portfolio] Atlas.WM v4.0.1 security and determinism

[cesaremcasa]

Parent: cesaremcasa/Mycellium-Lab#4

Deliver Atlas.WM v4.0.1 through focused PRs:

• dependency reachability, CPU/GPU lock strategy, version alignment, checkpoint compatibility;
• green security CI, pinned Actions, deterministic canaries and metric comparison;
• release ledger, protected main, verified GitHub Release.

Exit: all CI/canaries green and no unjustified known vulnerability.

[cesaremcasa]

PR 1 submitted

Draft PR: #57
Reviewed candidate SHA: e1c880993ba9b8d5ba53c416be78ed6905b17dd9

Coder evidence:

• version aligned at 4.0.1
• canonical locks and SBOM regenerated
• real legacy safetensors compatibility test
• 188 tests passed
• Ruff, mypy, Bandit, pickle checks and reproducibility checks passed
• pip-audit: zero vulnerabilities
• remote Lint, Type check, Test and Security jobs green

Independent Sol review is in progress. No scientific code/results/canaries were intentionally changed.

[cesaremcasa]

Blocking SBOM finding remediated

New candidate SHA: f3a8db5f6514ef749d419d48be41a7b48c78f274

Remediation:

• SBOM generated only from pyproject.toml + requirements.lock
• no environment/venv package discovery
• no timestamps/random IDs/absolute paths
• forbidden path test and byte-for-byte determinism test
• 117 lock-derived components

Evidence:

• 195 tests passed
• two generations byte-identical and match tracked SBOM
• Ruff, mypy, Bandit, pickle gate, JSON, uv lock and pip-audit passed
• remote Lint/Type/Test/Security green

All earlier approvals are invalid because the SHA changed. Independent Sol re-review is in progress.

[cesaremcasa]

PR 1 accepted and merged

• PR: fix(deps): align v4.0.1 metadata and audit locks #57
• Reviewed head: f3a8db5f6514ef749d419d48be41a7b48c78f274
• Reviewer: PASS; prior SBOM finding remediated
• Squash merge: 044eef34286f1f4d168a2c70aa942ed5c7c8ede1
• Merge constrained with --match-head-commit

Post-merge main CI verification is in progress. PR 2 will start only after main is green.

[cesaremcasa]

PR 2 submitted

Draft PR: #58
Candidate SHA: 64a2985c0662bd3946c3e73beccd1ebde01f5eaa

Coder evidence:

• Actions pinned by verified SHA
• least-privilege permissions and no persisted credentials
• Python/uv pinned and locked sync
• real chaos/train canary paths with clean-worktree gates
• 198 tests; 14 contract/canary tests
• chaos 200×150 passed
• full CI 4/4 green

Independent Sol review is in progress.

[cesaremcasa]

PR 2 review: FAIL

Reviewed SHA: 64a2985c0662bd3946c3e73beccd1ebde01f5eaa

Blocking supply-chain finding:

• the CI contract scans only *.yml and step-level uses;
• a mutable action in an *.yaml file or a job-level reusable workflow @main bypasses the pinning gate.

Remediation assigned:

• cover .yml and .yaml;
• structurally validate job- and step-level uses against an explicit allowlist and 40-char SHA;
• reject continue-on-error and shell failure masking;
• add adversarial fixtures/tests.

No merge occurred.

[cesaremcasa]

PR 2 CI-contract finding remediated

New candidate SHA: 39f4f5b7196b9f49b598a007a3be9c58d1bfed88

Contract now covers:

• .yml and .yaml;
• step- and job-level uses;
• explicit allowlist and 40-char immutable SHA;
• read-only permissions, environment/cache/schedule/command structure;
• continue-on-error and shell failure masking;
• terminal mandatory clean gates.

203 tests, 19 contract/canary tests, chaos 200×150 and all remote jobs passed. Final re-review is in progress.

[cesaremcasa]

PR 2 second review: FAIL

Reviewed SHA: 39f4f5b7196b9f49b598a007a3be9c58d1bfed88

Remaining bypasses:

• job-level permissions can override contents to write;
• a second mutable setup-python/setup-uv can run after the validated first setup;
• terminal clean gate can be skipped with if:false.

Remediation assigned: validate effective per-job permissions, require exactly one pinned runtime setup of each type, and require an unconditional terminal clean gate. No merge occurred.

[cesaremcasa]

PR 2 final CI-contract remediation

New candidate SHA: 8fb6b6f852b4810aaf20c542f63b7098c74ae988

Contract now enforces:

• effective per-job read-only permissions;
• exactly one setup-python and setup-uv;
• unconditional terminal clean gate;
• every prior .yaml/reusable/mutable/masking bypass.

207 tests, 23 contract/canary tests, chaos 200×150 and remote 4/4 CI passed. Final re-review is in progress.

[cesaremcasa]

PR 2 third review: FAIL

Reviewed SHA: 8fb6b6f852b4810aaf20c542f63b7098c74ae988

Remaining bypass:

• a masked locked sync (|| :) followed by an unlocked sync passes because the contract searches for a substring.

Remediation assigned:

• exactly one unconditional install step per job;
• exact normalized command uv sync --locked --extra dev;
• reject every other uv/pip installation command and custom condition/shell;
• add adversarial fallback fixtures.

No merge occurred.

[cesaremcasa]

PR 2 exact-install remediation

New candidate SHA: ff3493b89bd58bb92924c32568a6c97076bdf0b6

Each job now requires exactly one unconditional one-line uv sync --locked --extra dev step and rejects fallback operators, extra uv/pip installs, conditions and custom shells.

212 tests, 28 contract/canary tests, chaos and remote 4/4 CI passed. Review is retargeted to the new SHA.