[mvalancy]

Problem and change

The self-host Bookworm image retains 228 OS package/advisory entries despite its clean npm inventory. This candidate updates its three Node stages to one pinned Node 22/Trixie slim manifest and applies available runtime package updates while retaining glibc, UID 1000, native SQLite, auth-data storage and API/MCP behavior.

Refs #209 and #193. Depends on #213: this branch includes its reviewed layout-recovery source. Integrate #213 first; the additional change set is exactly the five runtime/triage paths shown by git diff 168b984 HEAD. No registry publication, main promotion or deployment is included.

Evidence and remaining findings

• Initial owned trial: 88→79 OS packages and 228→162 advisory entries;1 critical→0, with 43 high / 58 medium / 60 low / 1 unknown remaining. All 162 remain affected/deferred without an available fixed package version in the dated scan. npm remains 377 packages / 0 findings.
• Complete baseline 228 + candidate 162 entry CSV joins every row to Debian’s primary tracker snapshot. Compared by source-package/advisory pair, 34 disappear and 6 new pairs appear. New OS SQLite and gcc14 findings remain explicit; no unsupported reachability exemption is claimed.
• Real owned baseline→candidate→replacement→rollback stages pass API, CAPTCHA, compiled MCP stdio and independent Neo4j readback while preserving one SQLite account on the same auth-data volume. Candidate UID 1000, native binding, package inventory and missing-production-secret rejection pass. Owned containers/volume/graphs were cleaned up.
• Optional immutable-baseline mode extends the existing runtime harness; the normal two-stage CI contract is preserved. Earlier CSV CRLF formatting failure was retained, then corrected to LF.
• docs/quality/SELF_HOST_OS_TRIAGE_2026-10-28.md records image/scanner/database/primary-source hashes, full inventory, newly reported advisories and rollback limits. Initial local evidence predates the composed commit; exact-head build and the real four-stage contract now also pass. The final image’s config and root filesystem are identical to the scanned trial, with a new build attestation/reference. CI remains pending.

Candidate 53c124c39fd0e8495f26e27a981ad06557805878. The composed frozen source has cleared independent agent review: all 390 CSV rows match both scans and the primary tracker, the pinned remote digest matches, and the default/rollback/failure-cleanup paths were checked. This is review evidence, not a GitHub non-author approval. Full CI and final dev CI remain required. Linux/amd64 evidence does not establish arm64 behavior. This is a base-maintenance proposal with residual findings, not full image-security clearance.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Exact-source53c124c integration evidence is complete:

• Independent review and renewed live-base composition review are clear. Live dev ed963219a0ecec9c750a1d06909b0da027dc221a contains the reviewed layout source168b984. Its raw full diff to53c124c is exactly the five previously reviewed runtime/triage paths. git merge-tree produces fe1a54bc68148a2c5955c0d350784218c348d5f6, identical to the source tree.
• CI40615332205 and Comprehensive40615332419 passed for exact source53c124c. Actual jobs include build/types/lint/security, unit suites/both Node versions, real Neo4j, installer and all image contracts. Main/nightly production-stack acceptance is inapplicable here, not counted as a pass.
• Uploaded strict reports pass smoke6/new-user42/LOD2/layout9/routes7/mobile27/perf3 with zero failures/warnings/skips, no timeout/nonzero exit/evidence errors and matching clean source fingerprints. The tested PR merge 84ecc9556a81cab72827e90b29e1f8e2c9b79f57 has the same complete candidate tree, verified via the Git commit API.
• The committed local image sha256:d772e0193cb0d3f65a89555e071354d8accf3fd59b66127e50003fe7826de91a passes real baseline→upgrade→replacement→rollback recovery. Its config/root filesystem equal the scanned trial. Independent review checked those Docker objects and retained results.
• CI self-host config sha256:6185a9b83637c023335c56419fcce6033ee9035707c261449fe8af14176214a1 records79 Debian packages/162 OS findings and377 npm packages/0 findings. API/generic each record28 Alpine packages/0 OS and377 npm/0 findings. The162 self-host entries remain unresolved; this maintenance change is not security clearance.

I will perform the authorized dev-only native administrative merge with an exact-head match, verify its actual parents/tree and wait for final dev CI before closeout. Main, registry/release/deployment and protection changes are excluded. Independent agent review is not a GitHub non-author approval.

[mvalancy]

Native admin integration under the standing dev-only authorization completed at 77899e98a081e725ae8ddc15b6566cc50c9a584f. Verified actual parents: live base ed963219a0ecec9c750a1d06909b0da027dc221a and reviewed source 53c124c39fd0e8495f26e27a981ad06557805878. Complete tree fe1a54bc68148a2c5955c0d350784218c348d5f6 equals the reviewed and CI-tested source composition. Main remains 775362eace0723c57b7ba3c7936645c9d0d36cb4; no publication/deployment/protection changes.

Post-merge Comprehensive 40618347395 succeeded. Final-head CI 40618347427 is still running; #181/#209 remain open pending its actual results. The intermediate #213 dev CI was cancelled by the newer dev push, not accepted as a pass. Both source PR CI runs passed before their native merges. This is an administrative merge with independent agent review, not a non-author GitHub approval.

The self-host image still has the explicitly inventoried 162 unresolved OS entries; this maintenance/triage change does not claim full-image clearance.

[mvalancy]

Resolved the defined triage/base-maintenance scope through independently reviewed #214. The pinned Debian13 Trixie Node22 base preserves glibc/nativeSQLite, UID1000 and actual auth-volume recovery. All390 baseline/candidate package-advisory rows are inventoried with primary Debian status/provenance; the local real baseline→candidate→replacement→rollback contract passed on one owned volume.

Final aggregate dev acceptance passed at 77899e98a081e725ae8ddc15b6566cc50c9a584f: CI40618347427 and Comprehensive40618347395. Actual downloaded browser reports confirm smoke6, new-user42, semanticLOD2, layout-recovery9, routes7, mobile27 and performance3, all zero failures/warnings/skips, exit0, no timeout/evidence errors, and matching clean fingerprints on this exact dev SHA. Browser artifact.

All applicable quality/build/unit/security, realNeo4j/MCP, three runtime-image, effects/showcase, supported Node22.18/24 and installer/config jobs passed. Main/nightly production-stack job was inapplicable and skipped, not claimed as passed. Native dev parents/tree were verified before closeout; main remains775362e. No release/deployment/protection changes. The intermediate ed963 dev CI was cancelled by the newer aggregate push and was not counted as success.

The final dev self-host image is sha256:d12b3572c64cc38af843c5e5da904b7e3db3ba00036f4ab92fe709a9492a0ae0; its full advisory identity/version/status/severity/fix inventory matches the reviewed candidate. It reports79 OS packages/162 findings and377 npm packages/zero findings. Final API/generic images each report28 OS/377npm packages with zero findings and pass real runtime contracts. Self-host artifact.

**Residual risk remains:**162 unresolved OS entries (0critical/43high/58medium/60low/1unknown;160affected/2deferred, no available fixed versions in the retained scan). New gcc14/systemSQLite advisories are explicitly catalogued, not waived. This is triage and maintained-base improvement, not full-image clearance, arm64 runtime acceptance, or deployment authorization. Restoring the old image also restores its old findings. The canonical CSV/validation ledger carries the remaining inventory for subsequent maintenance.