fix(containers): bind provenance to pinned bases

.github/workflows/docker-publish.yml

@@ -32,18 +32,21 @@ jobs:
           - component: backend
             image: ai_email_client-backend
             dockerfile: Dockerfile
+            base_dockerfile: Dockerfile
             context: .
             build_args: |
               BUILDKIT_INLINE_CACHE=1
           - component: naruon
             image: naruon
             dockerfile: Dockerfile
+            base_dockerfile: Dockerfile
             context: .
             build_args: |
               BUILDKIT_INLINE_CACHE=1
           - component: frontend
             image: ai_email_client-frontend
             dockerfile: frontend/Dockerfile
+            base_dockerfile: frontend/Dockerfile
             context: .
             build_args: |
               BUILDKIT_INLINE_CACHE=1
@@ -64,9 +67,28 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
+      - name: Resolve pinned Ollama base manifest
+        if: matrix.component == 'naruon'
+        run: |
+          base_image="$(awk 'toupper($1) == "FROM" { print $2; exit }' Dockerfile.ollama)"
+          if ! printf '%s\n' "$base_image" | grep -Eq '^ollama/ollama@sha256:[0-9a-f]{64}$'; then
+            printf '::error file=Dockerfile.ollama,line=1::Expected an exact ollama/ollama sha256 base pin; found %s\n' "$base_image"
+            exit 1
+          fi
+          printf 'Resolving pinned Ollama base manifest: %s\n' "$base_image"
+          manifest_output="$(docker buildx imagetools inspect "$base_image")"
+          printf '%s\n' "$manifest_output"
+          for platform in linux/amd64 linux/arm64; do
+            if ! printf '%s\n' "$manifest_output" | grep -Eq "^[[:space:]]*Platform:[[:space:]]+${platform}[[:space:]]*$"; then
+              printf '::error file=Dockerfile.ollama,line=1::Pinned Ollama manifest is missing %s\n' "$platform"
+              exit 1
+            fi
+          done
+
       - name: Prepare OCI annotation values
         id: oci
         env:
+          BASE_DOCKERFILE: ${{ matrix.base_dockerfile }}
           GIT_REF_NAME: ${{ github.ref_name }}
           IMAGE_COMPONENT: ${{ matrix.component }}
           IMAGE_NAME: ${{ matrix.image }}
@@ -76,24 +98,29 @@ jobs:
           version="$(cat VERSION)"
           created="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
           vendor="${REPOSITORY%%/*}"
+          base_reference="$(awk 'toupper($1) == "FROM" { print $2; exit }' "$BASE_DOCKERFILE")"
+          if ! printf '%s\n' "$base_reference" | grep -Eq '^[A-Za-z0-9._/-]+:[A-Za-z0-9._-]+@sha256:[0-9a-f]{64}$'; then
+            printf '::error file=%s,line=1::Expected an exact tagged sha256 base pin; found %s\n' "$BASE_DOCKERFILE" "$base_reference"
+            exit 1
+          fi
+          base_digest="${base_reference##*@}"
+          base_repository="${base_reference%@*}"
+          case "$base_repository" in
+            */*) base_name="$base_reference" ;;
+            *) base_name="docker.io/library/$base_reference" ;;
+          esac
           case "$IMAGE_COMPONENT" in
             frontend)
               title="naruon frontend"
               description="Naruon Next.js frontend runtime image"
-              base_digest="sha256:191ef878ecb351d68b78219593de18bd8942afd59af59f29960dc4b24805a3f1"
-              base_name="docker.io/library/node:26-slim@${base_digest}"
               ;;
             backend)
               title="naruon backend"
               description="Naruon FastAPI backend runtime image"
-              base_digest="sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061"
-              base_name="docker.io/library/python:3.14-slim@${base_digest}"
               ;;
             *)
               title="naruon"
               description="Naruon combined FastAPI and Next.js runtime image"
-              base_digest="sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061"
-              base_name="docker.io/library/python:3.14-slim@${base_digest}"
               ;;
           esac
           {
@@ -158,18 +185,21 @@ jobs:
           - component: backend
             image: ai_email_client-backend
             dockerfile: Dockerfile
+            base_dockerfile: Dockerfile
             context: .
             build_args: |
               BUILDKIT_INLINE_CACHE=1
           - component: naruon
             image: naruon
             dockerfile: Dockerfile
+            base_dockerfile: Dockerfile
             context: .
             build_args: |
               BUILDKIT_INLINE_CACHE=1
           - component: frontend
             image: ai_email_client-frontend
             dockerfile: frontend/Dockerfile
+            base_dockerfile: frontend/Dockerfile
             context: .
             build_args: |
               BUILDKIT_INLINE_CACHE=1
@@ -204,6 +234,7 @@ jobs:
       - name: Prepare OCI annotation values
         id: oci
         env:
+          BASE_DOCKERFILE: ${{ matrix.base_dockerfile }}
           GIT_REF_NAME: ${{ github.ref_name }}
           IMAGE_COMPONENT: ${{ matrix.component }}
           IMAGE_NAME: ${{ matrix.image }}
@@ -214,24 +245,29 @@ jobs:
           version="${VERSION_VALUE:-$(cat VERSION)}"
           created="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
           vendor="${REPOSITORY%%/*}"
+          base_reference="$(awk 'toupper($1) == "FROM" { print $2; exit }' "$BASE_DOCKERFILE")"
+          if ! printf '%s\n' "$base_reference" | grep -Eq '^[A-Za-z0-9._/-]+:[A-Za-z0-9._-]+@sha256:[0-9a-f]{64}$'; then
+            printf '::error file=%s,line=1::Expected an exact tagged sha256 base pin; found %s\n' "$BASE_DOCKERFILE" "$base_reference"
+            exit 1
+          fi
+          base_digest="${base_reference##*@}"
+          base_repository="${base_reference%@*}"
+          case "$base_repository" in
+            */*) base_name="$base_reference" ;;
+            *) base_name="docker.io/library/$base_reference" ;;
+          esac
           case "$IMAGE_COMPONENT" in
             frontend)
               title="naruon frontend"
               description="Naruon Next.js frontend runtime image"
-              base_digest="sha256:191ef878ecb351d68b78219593de18bd8942afd59af59f29960dc4b24805a3f1"
-              base_name="docker.io/library/node:26-slim@${base_digest}"
               ;;
             backend)
               title="naruon backend"
               description="Naruon FastAPI backend runtime image"
-              base_digest="sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061"
-              base_name="docker.io/library/python:3.14-slim@${base_digest}"
               ;;
             *)
               title="naruon"
               description="Naruon combined FastAPI and Next.js runtime image"
-              base_digest="sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061"
-              base_name="docker.io/library/python:3.14-slim@${base_digest}"
               ;;
           esac
           {

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: Backend runtime for local Compose and backend-only deployments
-FROM python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1 AS backend-runtime
+FROM python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 AS backend-runtime
 WORKDIR /app
 
 ENV PYTHONDONTWRITEBYTECODE=1
@@ -25,7 +25,7 @@ EXPOSE 8000
 CMD ["python", "scripts/start_backend.py", "--host", "0.0.0.0", "--port", "8000"]
 
 # Stage 2: Build Frontend
-FROM node:26-slim@sha256:ffc78385a788964bb3cbab5e434ff79a10bdc25b8ae6db03fe5fe6cb14053c09 AS frontend-builder
+FROM node:26-slim@sha256:715e55e4b84e4bb0ff48e49b398a848f08e55daed8eb6a0ea1839ae53bc57583 AS frontend-builder
 WORKDIR /app
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 ENV PNPM_VERSION=11.5.3
@@ -63,8 +63,13 @@ ARG OCI_IMAGE_LICENSES="LicenseRef-Naruon-Proprietary"
 ARG OCI_IMAGE_REF_NAME=""
 ARG OCI_IMAGE_TITLE="naruon"
 ARG OCI_IMAGE_DESCRIPTION="Naruon combined FastAPI and Next.js runtime image"
-ARG OCI_IMAGE_BASE_DIGEST="sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061"
-ARG OCI_IMAGE_BASE_NAME="docker.io/library/python:3.14-slim@sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061"
+ARG OCI_IMAGE_BASE_DIGEST="sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6"
+ARG OCI_IMAGE_BASE_NAME="docker.io/library/python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6"
+
+# Defaults keep local builds provenance-complete. The publishing workflow derives
+# and overrides both values from the exact first FROM instruction, while
+# repository governance tests prevent the reviewed defaults from drifting.
+RUN test -n "$OCI_IMAGE_BASE_DIGEST" && test -n "$OCI_IMAGE_BASE_NAME"
 
 LABEL org.opencontainers.image.created="${OCI_IMAGE_CREATED}" \
       org.opencontainers.image.authors="${OCI_IMAGE_AUTHORS}" \

Dockerfile.ollama

@@ -1,4 +1,4 @@
-FROM ollama/ollama@sha256:509fdf54e23bd50d87af646cb51c0a7a203d6a83cc4d6695b3b08c5be1c62c0a
+FROM ollama/ollama@sha256:6345fbc18bd73a1e16404be681dbc6fd291a027cab43ed541abe78c4c81051b0
 
 ENV OLLAMA_MODELS=/usr/share/ollama/.ollama/models
 

backend/tests/test_container_dependency_pin_contract.py

@@ -0,0 +1,146 @@
+"""Regression contracts for container and release dependency security pins.
+
+The container-provenance process depends on repository tests, not prose alone,
+to keep independently versioned Python and JavaScript toolchains on the exact
+reviewed security floor. These checks parse source manifests, hash-locked Python
+artifacts, and the generated pnpm lock so a direct pin cannot drift away from the
+resolved artifact graph or pass through an incidental substring match.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+import yaml
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+_HASH_PATTERN = re.compile(r"--hash=sha256:([0-9a-f]{64})")
+_EXACT_PIN_PATTERN = re.compile(r"^([A-Za-z0-9_.-]+)==([^\\\s]+)")
+
+
+def read_repo_text(relative_path: str) -> str:
+    """Return one required repository file as UTF-8 text."""
+    path = REPO_ROOT / relative_path
+    assert path.is_file(), f"required pin contract file is missing: {relative_path}"
+    return path.read_text(encoding="utf-8")
+
+
+def exact_requirement_pins(requirements_text: str) -> dict[str, str]:
+    """Parse exact direct requirement pins by normalized package name."""
+    pins: dict[str, str] = {}
+    for raw_line in requirements_text.splitlines():
+        match = _EXACT_PIN_PATTERN.match(raw_line.strip())
+        if match is None:
+            continue
+        package_name, version = match.groups()
+        pins[package_name.lower().replace("_", "-")] = version
+    return pins
+
+
+def hashed_requirement_records(requirements_text: str) -> dict[str, frozenset[str]]:
+    """Parse each exact requirement record and its complete SHA-256 hash set."""
+    records: dict[str, frozenset[str]] = {}
+    current_pin: str | None = None
+    current_hashes: set[str] = set()
+
+    def finish_record() -> None:
+        """Persist one complete requirement record before starting the next."""
+        nonlocal current_pin, current_hashes
+        if current_pin is None:
+            return
+        assert current_hashes, f"hash-locked requirement has no hashes: {current_pin}"
+        records[current_pin] = frozenset(current_hashes)
+        current_pin = None
+        current_hashes = set()
+
+    for raw_line in requirements_text.splitlines():
+        stripped = raw_line.strip()
+        pin_match = _EXACT_PIN_PATTERN.match(stripped)
+        if pin_match is not None and not raw_line.startswith((" ", "\t")):
+            finish_record()
+            package_name, version = pin_match.groups()
+            current_pin = f"{package_name.lower().replace('_', '-')}=={version}"
+            continue
+        hash_match = _HASH_PATTERN.search(stripped)
+        if hash_match is not None:
+            assert current_pin is not None, "orphaned SHA-256 hash in requirements lock"
+            current_hashes.add(hash_match.group(1))
+    finish_record()
+    return records
+
+
+def importer_resolution(importer_section: dict[str, object], group: str, name: str) -> dict[str, str]:
+    """Return one structurally parsed pnpm root-importer dependency resolution."""
+    dependencies = importer_section[group]
+    assert isinstance(dependencies, dict)
+    resolution = dependencies[name]
+    assert isinstance(resolution, dict)
+    assert isinstance(resolution.get("specifier"), str)
+    assert isinstance(resolution.get("version"), str)
+    return resolution
+
+
+def test_container_provenance_dependency_pins_match_reviewed_manifests() -> None:
+    """Keep backend, Strix, and frontend dependency floors reviewable together."""
+    backend_pins = exact_requirement_pins(read_repo_text("backend/requirements.txt"))
+    backend_records = hashed_requirement_records(
+        read_repo_text("backend/requirements-hashes.txt")
+    )
+    strix_pins = exact_requirement_pins(read_repo_text("requirements-strix-ci.txt"))
+    strix_records = hashed_requirement_records(
+        read_repo_text("requirements-strix-ci-hashes.txt")
+    )
+    frontend_package = json.loads(read_repo_text("frontend/package.json"))
+    frontend_lock = yaml.safe_load(read_repo_text("frontend/pnpm-lock.yaml"))
+
+    assert backend_pins["cryptography"] == "50.0.0"
+    assert backend_pins["protobuf"] == "7.35.1"
+    assert "cryptography==50.0.0" in backend_records
+    assert "protobuf==7.35.1" in backend_records
+    assert all(
+        re.fullmatch(r"[0-9a-f]{64}", digest)
+        for pin in ("cryptography==50.0.0", "protobuf==7.35.1")
+        for digest in backend_records[pin]
+    )
+
+    assert strix_pins["cryptography"] == "50.0.0"
+    assert strix_pins["protobuf"] == "6.33.6"
+    assert "cryptography==50.0.0" in strix_records
+    assert "protobuf==6.33.6" in strix_records
+    assert all(
+        re.fullmatch(r"[0-9a-f]{64}", digest)
+        for pin in ("cryptography==50.0.0", "protobuf==6.33.6")
+        for digest in strix_records[pin]
+    )
+
+    root_importer = frontend_lock["importers"]["."]
+    postcss_resolution = importer_resolution(
+        root_importer, "devDependencies", "postcss"
+    )
+    jsdom_resolution = importer_resolution(root_importer, "devDependencies", "jsdom")
+    assert postcss_resolution == {"specifier": "8.5.24", "version": "8.5.24"}
+    assert jsdom_resolution == {"specifier": "^30.0.1", "version": "30.0.1"}
+
+    assert frontend_package["devDependencies"]["postcss"] == "8.5.24"
+    assert frontend_package["devDependencies"]["jsdom"] == "^30.0.1"
+    assert frontend_package["overrides"]["postcss"] == "8.5.24"
+    assert frontend_package["overrides"]["brace-expansion"] == "5.0.9"
+    assert frontend_package["overrides"]["undici"] == "8.9.0"
+
+    assert frontend_lock["overrides"] == {
+        **frontend_lock["overrides"],
+        "postcss": "8.5.24",
+        "brace-expansion": "5.0.9",
+        "undici": "8.9.0",
+    }
+    package_records = frontend_lock["packages"]
+    for exact_lock_entry in (
+        "postcss@8.5.24",
+        "jsdom@30.0.1",
+        "brace-expansion@5.0.9",
+        "undici@8.9.0",
+    ):
+        assert exact_lock_entry in package_records