[rmcdaniel]

Image decoder correction

Refs #271 and durable-workflow/.github#237.

Normally merged at 922e0c54b5086823de44cf76a9f9aa4066ac920b, exact
qualified tree 23bec5e4910f05972fc870cb0a453431685abbb2. All 28 final
candidate checks pass, including native production image smoke on amd64/arm64,
devcontainer qualification, all existing affected consumers and Sonar. The
current issue API reports zero OPEN/CONFIRMED. Remote head deletion and absence
are verified. Separate publisher 39872797679 now passes all six jobs,
including actual anonymous published-image acceptance on native amd64/arm64
and promotion to both public main channels. The current index is
sha256:3047c6f9945b27471a396dc4e145809be975967ac67b3533b019a5a253291b21.
Full immutable tag and architecture evidence are recorded on #271. Fresh main
CI remains separate from candidate and published-image qualification.

Current source is 82547b344da0909403aaf17e246d4cf75c6d8d75, whole tree
23bec5e4910f05972fc870cb0a453431685abbb2. The retrieved prior 31f1e60
development-image log establishes a role error: unprivileged readiness invoked
the complete filesystem inventory and refused a root-owned PHP C source file.
The correction keeps the full guard in the root image build and explicitly
runs it as root during image qualification. Developer readiness remains
unprivileged. No inventory root, permission check or decoder guard is removed.
The new role regression fails on the parent and passes after correction;
the focused selection passes 9 tests / 56 assertions, with shell syntax clean.
Fresh exact-head image and normal checks remain pending.

The previous source added dedicated verification exceptions and const data
after reviewing Sonar. Two tag-plus-digest warnings have specific accepted
dispositions: the readable release label does not override the immutable digest.
No global rule or threshold changed. Fresh analysis remains required before
claiming those source findings closed.

Previous 3c347a4 corrected a package-stage defect. Source review found that the new package stages
called the existing CA verifier without the Composer archive it requires.
A new regression fails on d669 and passes after copying the pinned archive and
supplying its path in both stages. Nine focused image contracts now pass,
70 assertions including the separate devcontainer trust test. The full test
selection needs Debian's dpkg; an Alpine-only tool attempt lacked it and is not
a qualification result. Fresh normal checks remain required.

The first d669 amd64 image job failed during its build. Hosted log download
timed out, so that job's exact cause is still unestablished. The separately
proved builder defect above is not claimed as a log-confirmed diagnosis.

Build the upstream CVE-2026-111497 correction as a same-base Bookworm Debian
backport. Bind the signed source artifacts, vendored fix and exact patched
decoder/header bytes. Keep the honest 1.0.9 upstream metadata and a local
revision superseded by the next vendor update.

Both production and development images install the paired runtime/development
packages before network clients run. Their final guards check the installed
package, stray decoder copies, dynamic consumers and a benign fixed marker plus
ordinary valid-data round trip. Existing Node checks remain independent. Native
production smoke and devcontainer qualification run the actual final guard.

Local component verification has built and installed the amd64 packages, checked
their ownership and version ordering, and passed valid-data decoding. The
unpatched runtime refuses the marker. Separate controls refuse a stray decoder
and an unexpected package revision. Focused image contracts pass 7 tests /
49 assertions. The first final marker check used the newer branch's string and
failed; the corrected verifier uses the 1.0 branch's actual BLOCK_SWITCH name.

Full images, native arm64/amd64 qualification and publication remain required.
The earlier main publisher was cancelled before mutable-channel promotion and
does not qualify this source. No tag is moved and no SDK/package pin changes.
No malformed decoder input or upstream security corpus is used.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
11 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud