Skip to content

I0920 — The image's dependencies are known and its advisories are policy

Record what the production image contains, obtain a dependency audit and a vulnerability verdict, and state a severity and fix-availability policy so that the gate is meaningful rather than permanently red.

BLOCKED wave 4 · p2 · implementation profile · parallel safe

Part of fly-deployment — A deployment is a projection of the repository model, and a reachable URL is its evidence.

Blocked. This issue cannot start until I0909 is done. The status is derived from that, not declared.

Objective

Record what the production image contains, obtain a dependency audit and a vulnerability verdict, and state a severity and fix-availability policy so that the gate is meaningful rather than permanently red.

Why

An image of unknown contents cannot be reasoned about after a disclosure. A scanner wired to fail on every advisory in every database is turned off within a week, which is worse than no scanner.

Current state

No image, no inventory, no scan and no policy exist.

Desired state

The package inventory and the dependency audit are obtained by the same verification that runs everything else, and the policy states which findings block and which are recorded.

Scope

  • .ai/repo/policy.yaml
  • .github/workflows/validate.yml

Out of scope

  • A security dashboard or a vulnerability database of our own
  • Failing the build on advisories with no available fix and no exploitable path

Dependencies

What waits on this

Acceptance criteria

  • The runtime package inventory of the image is obtained and recorded
  • A dependency audit runs and its verdict is part of the gate
  • The severity and fix-availability policy is declared as data, not as prose, and the gate reads it
  • Where the repository's practice supports it, a bill of materials is produced alongside the image
  • External workflow actions are pinned to immutable references according to the repository's convention

Validation

  • bash test/run.sh
  • majordomus deploy doctor

Evidence required

  • dependency_audit
  • package_inventory
  • severity_policy
  • actions_pinned

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A policy that blocks on everything is a policy nobody keeps. The threshold has to be stated where it can be reviewed rather than buried in a workflow.

Timeline

started
—
verified
—
completed
—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0920.yaml. Read it back with majordomus plan show I0920.