[iperev]

Stacked PR 17 — base: #71 (docs/open-source-qualification). Do not merge yet. Review only the top commit.

Context

CI-061 (ROADMAP, open) asks for residual proof-integrity qualification. Checking the current source found three gaps:

• The final-image zlib inventory (L8) omitted /usr/lib64 and a real libz.so, and counted the repaired library twice through /lib.
• The runtime qualification's local repair admission (L10) ran as inline Python without -I, with every rejection written as assert.
• The workflow's migration-head literal (CICD-14) was not tied to the Alembic head.

Grype analyzer/database binding, cost-hint provenance, and the consumed-input versus assigned-command projection are already present.

What changed

• docker/runtime/verify.py: zlib-only inventory (provisional owner decision, 2026-10-11) over independent and alias roots, including /usr/lib64. It admits an exact libz.so, identifies copies by resolved path, and rejects both an extra copy of the repaired version and a missing repaired copy. The script body now runs from main().
• scripts/release_repair_admission.py: new admit_local_qualification function and CLI. It takes its import and source root from its own location, reads bounded strict JSON, and raises explicit causes. runtime-image-qualification.yml calls it with python -I -B.
• A test pins runtime-image-qualification.yml's literal head to the single Alembic head.
• New and updated tests, and a Proofkit route for test_runtime_zlib_inventory.py with the refreshed route digest.
• Regenerated self-CI artifacts: .ci-coordinator/* and both runtime-entrypoint-disposition.v1.json copies.
• Owner doc text in runtime-base-qualification.md, and the ROADMAP CI-061 row (still open).

Expected result

• Native runs reject omitted or double-counted zlib copies.
• Rejection does not change under PYTHONOPTIMIZE, -O, PYTHONPATH or the working directory.
• Adding a new migration fails fast until the workflow literal is updated.
• Image construction pins, base and interpreter inputs, repair-policy inputs and docker/runtime/security/* are unchanged.
• The rebuilt application layer and final image digest do change: the regenerated backend/src/.../runtime-entrypoint-disposition.v1.json is packaged through Dockerfile:58,101 and docker/runtime/application_layer.py:51-52.

Non-claims:

• No native, container or mutation witness has run.
• CI-061 is not closed.
• No change to release-workflow PYTHONPATH invocations.
• No mutation portfolios.
• No other libraries, and no static or embedded zlib copies.
• No repair-policy or construction-pin change.
• No exploit is claimed.

Provisional decisions:

• Zlib-only L8 scope (provisional owner decision, 2026-10-11).
• CICD-14: keep the literal and add an equality test rather than deriving it in the workflow.

Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.