Complete RC6 supply chain gate

CHANGELOG.md

@@ -19,6 +19,11 @@
   dependency audits, a digest-pinned container scan and an SPDX SBOM.
 - Added a hashed Linux/Python 3.11 GIS/dev lock with an enforced input
   fingerprint while keeping PyTorch and Ultralytics out of base CI.
+- Completed live SBOM and vulnerability-policy evidence for the configured AI
+  image. The final runtime replaces the Postgres base image's Go `gosu`
+  executable with an audited `setpriv` wrapper; the complete report still
+  retains the shadowed base-layer findings while the executable policy gate
+  reports zero reachable fixed HIGH/CRITICAL vulnerabilities.
 - Folded fresh-install, upgrade, rollback and runtime proof into RC-5 and
   RC-11 instead of creating a separate RC-12 phase.
 - Added a read-only release-evidence manifest command with Git, migration,

docs/CODEX_EXECUTION_LOG.md

@@ -10473,3 +10473,46 @@ Validation:
   console errors or warnings.
 - RC-3 is complete. RC-4 national and maritime coverage contracts are the
   active roadmap phase.
+
+## 2026-07-18 - Belgium/North Sea RC-6 supply-chain gate
+
+Implemented:
+
+- Replaced smoke-only automation with equivalent Gitea and GitHub release
+  workflows covering readiness, offline Alembic SQL, Compose resolution,
+  Python/npm audits, immutable image build, SPDX SBOM and container scan.
+- Added hash-pinned Linux/Python 3.11 runtime and CI locks with verified input
+  fingerprints. Optional PyTorch, torchvision and Ultralytics remain outside
+  the base and CI locks.
+- Added timeboxed, machine-validated Starlette advisory exceptions with
+  request-target and form-content compensating controls.
+- Replaced the final runtime `gosu` path with a minimal `setpriv` exec wrapper
+  and upgraded packaged setuptools/wheel metadata.
+- Fixed the Trivy policy wrapper so its generated ignore policy is mounted
+  read-only into the scanner. The policy pass excludes the shadowed Go
+  executable path only; the complete report preserves every base-layer
+  finding for review.
+
+Validation:
+
+- Local readiness passed backend compilation, 1,005 backend tests, the
+  124-route contract audit, Alembic head `202607160001`, frontend typecheck
+  and production build.
+- Python dependency policy passed with seven explicitly documented Starlette
+  aliases ignored through 2026-08-31; frontend npm audit reported zero
+  vulnerabilities.
+- Immutable AI image
+  `geointel-all-in-one:6a22fcd1f87fbf4921e16b1baa9367c6e24dc8a3-ai`
+  deployed healthy and passed live PostGIS 3.6 migration plus browser proxy
+  verification.
+- Tower retained `artifacts/geointel-ai-sbom.spdx.json` (25,653,538 bytes)
+  and the complete Trivy JSON report. The executable policy pass reported
+  zero reachable fixed HIGH/CRITICAL findings.
+- Direct runtime proof returned PostgreSQL UID `999` through the final
+  `/usr/local/bin/gosu` wrapper. Runtime packaging reports setuptools
+  `83.0.0` and wheel `0.47.0`.
+
+Decision:
+
+- RC-6 is complete. RC-7 critical API response typing and OpenAPI validation
+  is active.

docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md

@@ -149,8 +149,8 @@ editions and licences must still pass source-specific probes before activation.
 | RC-3 | complete | temporal detection/QA correctness and observability |
 | RC-4 | complete | national/maritime scope and provider coverage contracts |
 | RC-5 | complete | deployment, secrets, configuration, fresh install and rollback |
-| RC-6 | in progress | complete CI, dependency and supply-chain gates |
-| RC-7 | pending | critical API envelope typing and contract validation |
+| RC-6 | complete | complete CI, dependency and supply-chain gates |
+| RC-7 | in progress | critical API envelope typing and contract validation |
 | RC-8 | pending | frontend and browser E2E release journeys |
 | RC-9 | pending | loading, accessibility and performance hardening |
 | RC-10 | pending | retention, cleanup and national data operations |
@@ -376,6 +376,17 @@ are aligned, and all operator-owned settings are editable in Unraid.
 
 ## RC-6 - CI and supply-chain gates
 
+**State: complete.** Equivalent Gitea and GitHub workflows now enforce the
+complete readiness gate, offline migrations, Compose resolution, dependency
+audits, immutable container build, SPDX SBOM and Trivy policy. Linux/Python
+3.11 runtime and CI locks are hash-pinned and optional AI dependencies remain
+separate. The live AI image passed the container policy with zero reachable
+fixed HIGH/CRITICAL findings; its complete report and 25.7 MB SBOM are retained
+on Tower. The report deliberately preserves two timeboxed Starlette findings
+and fifteen shadowed base-layer `gosu` findings. Runtime evidence proves that
+the final `gosu` path is the audited `setpriv` wrapper running as PostgreSQL
+UID 999.
+
 ### Work
 
 - make CI run backend compile/tests, frontend typecheck/build, readiness,

docs/TODO.md

@@ -24,7 +24,7 @@ maritieme zones.
   Wallonie, Brussel en de Belgische Noordzee via golden areas operationaliseren.
 - [x] RC-5: secrets/configuratie/uploadlimieten/immutable deploy en rollback
   bewijzen.
-- [ ] RC-6: volledige CI, dependency-audit, containerscan en SBOM toevoegen.
+- [x] RC-6: volledige CI, dependency-audit, containerscan en SBOM toevoegen.
 - [ ] RC-7: kritieke API-routes concrete responsemodellen geven.
 - [ ] RC-8: echte frontend- en browser-E2E-releaseflows toevoegen.
 - [ ] RC-9: loading, toegankelijkheid, widescreen/mobile en performance afronden.