[drewstone]

The shipped runtime has ten vendor-fixable HIGH findings in npm and Kimi's Python packages, and its maintenance journal cannot accept a second image transaction after the first successful roll. Both image recipes now use a publisher-integrity-verified npm self-upgrade and the shared Kimi security overrides. The existing authenticated pool owner can roll the next immutable artifact from the current slot ID, appending completed receipts while retaining original adoption identities and stopped predecessors. Per-slot image bindings and OCI source labels let the existing host-security owner identify the actual shipped local image.

Independent source review passed. Exact9367486 passed frozen install, typecheck and the real Docker/authenticated HTTP journey on Beelink2 (gate beelink2-a2bb99ec5e50c9cddefb6c8842500c8b,209s): active jobs survive drain, another slot serves, two sequential immutable artifacts preserve volumes/private environment/resources, missing images leave the completed journal unchanged, stale intents refuse, and the real owner restarts and safely reconciles the latest receipt. Later changes only add OCI labels and recipe-specific isolated native-image proof; runtime/repeat fixture bytes remain identical.

Pre-merge image qualification remains pending the admitted 30-minute producer pass: both actual rebuilt images must have zero CRITICAL findings, eliminate the six targeted package names' vendor-fixable HIGHs, and pass real npm/Python/native/CLI checks including every targeted UV archive and the Kimi environment. Other HIGH findings remain reported for lane follow-through. No model calls or customer installs. The eight currently served runtime containers remain on the previous measured0C/84H artifact until the normal source deploy and individually drained admin-API roll.

Run ID: run_4b1d54cfdf2c05412b39044bf98511e1

[drewstone]

Parking this draft to free the lane WIP slot while the image producer waits for its admitted disk headroom. Branch fix/runtime-fixable-high at d4890a7 and all worktree/proof bytes are retained. Independent source review and the real Docker/authenticated HTTP/typecheck gate passed (beelink2-a2bb99ec5e50c9cddefb6c8842500c8b, 209s); the producer admission attempt exited75 before any build or scan. Reopen after actual rebuilt-image native and vulnerability qualification. The eight current runtime slots remain healthy on the previously measured artifact; this PR makes no new served-patch claim.