[echoomegaprime]

Objective

Staging, production, and rollback readiness polling could stall inside curl after PR24 increased the polling window. This integrates main and the PR20 repair into the PR23 security candidate, validates the timeout before deployment side effects, and bounds each HTTP request by the remaining elapsed-time budget.

The release policy required authentic CI and CodeQL checks, but the existing job was named test and no CodeQL workflow existed. The substantive validation job now publishes CI; a real Python CodeQL workflow extracts, analyzes, uploads, and processes results. Both workflows check out and assert the exact candidate SHA. Evidence artifacts and CodeQL analysis carry that identity. Official Actions use supported v7/v4 runtimes on the tested Ubuntu 24.04 runner.

Package deployments now require cryptography>=50.0.0, matching the patched image dependency. The regression test remains separate from the stdlib-only certification journey.

Stacked on #23, whose head and existing non-draft review state are unchanged. This PR remains draft.

Evidence

• Final head: 424fc76fa09d9a83fcbe0d2ec12dc62ef97859c9.
• CI run 37128321404: success, exact candidate checkout, 704 tests passed, 80.11% coverage. P1 verification, P6 acceptance (12/12), and P7 acceptance passed.
• CodeQL run 37128321535: success, exact candidate analysis, 43 rules, zero findings. SARIF upload and processing completed; authentic GitHub Actions and GitHub Advanced Security checks both succeeded.
• Verification artifact is named for the full candidate SHA.
• Local combined suite before the additional package-policy test: 700 passed, 3 Windows skips. Final dependency/readiness/attestation checks: 57 passed; final test relocation: 7 passed.
• python -S scripts/certforge_journey.py: 18 passed without third-party stubs. Built wheel metadata requires cryptography>=50.0.0.
• Bash syntax, actionlint, diff validation, changed-file gitleaks, and independent reviews passed. Fresh build preflight passed 25/25 on this head.
• Negative cases include malformed/zero/negative/overflowing timeouts, slow cold start, stalled probes, exhausted deadlines, immediate health, all three callers, and vulnerable package versions.

Security and release impact

• No secrets, private evidence, customer data, or personal information are included.
• Verdict behavior remains deterministic and fail closed.
• Public contract and documentation changes are included where applicable.
• Staging-first deployment and rollback implications are documented.
• Unrelated repository history and license boundaries are preserved.

Listener ownership checks, signed readiness, failure-log retention, rollback gates, and intentionally vulnerable acceptance fixtures remain intact. The HTTP polling deadline excludes existing service-manager/listener subprocesses and the separate bounded diagnostic probe.

The earlier GitHub CLI workflow-scope denial is resolved through explicit owner approval and GitHub's official consent flow. The prepared workflow changes are now published and verified. No alternate credential route was used for the denied action.

Remaining gates

Neither new candidate head currently has a Release Sentinel or CertForge check. Passing CI and CodeQL does not establish signed production readiness. Current production SHA, independently signed production E2E, and new exact-SHA CertForge/GitHub App certification remain unverified. The Forge connector still requires reauthentication; that boundary was not bypassed.

PR24 reports historical successful staging/production smoke for d8ad9fd, superseding PR23's older 'not deployed' statement. That evidence does not certify this candidate. Main's observed branch-protection/ruleset enforcement gap was not changed.

No merge, deployment, production smoke, production rollback, signing, or repository security-setting change was performed.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.