Complete RC6 supply chain gate

docs/CODEX_EXECUTION_LOG.md

@@ -10473,3 +10473,46 @@ Validation:
   console errors or warnings.
 - RC-3 is complete. RC-4 national and maritime coverage contracts are the
   active roadmap phase.
+
+## 2026-07-18 - Belgium/North Sea RC-6 supply-chain gate
+
+Implemented:
+
+- Replaced smoke-only automation with equivalent Gitea and GitHub release
+  workflows covering readiness, offline Alembic SQL, Compose resolution,
+  Python/npm audits, immutable image build, SPDX SBOM and container scan.
+- Added hash-pinned Linux/Python 3.11 runtime and CI locks with verified input
+  fingerprints. Optional PyTorch, torchvision and Ultralytics remain outside
+  the base and CI locks.
+- Added timeboxed, machine-validated Starlette advisory exceptions with
+  request-target and form-content compensating controls.
+- Replaced the final runtime `gosu` path with a minimal `setpriv` exec wrapper
+  and upgraded packaged setuptools/wheel metadata.
+- Fixed the Trivy policy wrapper so its generated ignore policy is mounted
+  read-only into the scanner. The policy pass excludes the shadowed Go
+  executable path only; the complete report preserves every base-layer
+  finding for review.
+
+Validation:
+
+- Local readiness passed backend compilation, 1,005 backend tests, the
+  124-route contract audit, Alembic head `202607160001`, frontend typecheck
+  and production build.
+- Python dependency policy passed with seven explicitly documented Starlette
+  aliases ignored through 2026-08-31; frontend npm audit reported zero
+  vulnerabilities.
+- Immutable AI image
+  `geointel-all-in-one:6a22fcd1f87fbf4921e16b1baa9367c6e24dc8a3-ai`
+  deployed healthy and passed live PostGIS 3.6 migration plus browser proxy
+  verification.
+- Tower retained `artifacts/geointel-ai-sbom.spdx.json` (25,653,538 bytes)
+  and the complete Trivy JSON report. The executable policy pass reported
+  zero reachable fixed HIGH/CRITICAL findings.
+- Direct runtime proof returned PostgreSQL UID `999` through the final
+  `/usr/local/bin/gosu` wrapper. Runtime packaging reports setuptools
+  `83.0.0` and wheel `0.47.0`.
+
+Decision:
+
+- RC-6 is complete. RC-7 critical API response typing and OpenAPI validation
+  is active.