[joshavant]

Three checked-in stores can add AAA Certificate Services trust to affected TLS chains: WPT certifi, webkitcorepy bootstrap, and the conditional libwebrtc TLS roots. Build/CI Node pins also predate the incident fix.

Remove only the incident-related AAA root from each existing CA subset, regenerate ssl_roots.h with the existing generator, select certifi 2026.10.19 for AutoInstall, and advance Node 24/26 selections to 24.22.1/26.12.1. Preserve the remaining curated roots and the separate DTLS fingerprint contract. Keep the existing cstddef include reproducible in the generator.

Validation: All three repaired PEM/root selections reject all twelve offline incident chains; the generated 35-root header compiles with C++ warnings treated as errors. Through the actual AutoInstall._request entry point, baseline bundle accepts 6/12, fixed default accepts 0/12, and ordinary GitHub HTTPS is 200. Node release qualification covers all eight SPKIs and the affected explicit CA modes. YAML parsing, actionlint, and git diff --check pass.

Remaining scope: AutoInstall creates a system-default SSL context and then adds the selected bundle: an unfixed OS store can still reintroduce affected roots. Explicit old AUTOINSTALL_CA_CERT_PATH remains affected (6/12 accepted in the production entry-point probe) and requires operator CA-file repair. WPT browser acquisition, actual WebRTC/TURN TLS, all native build variants and published JSC artifacts remain to be qualified. The JSCOnly Bun configuration disables WebRTC; this source table does not establish an active Bun DTLS path. Removing AAA root trust also removes chains that depend solely on that anchor.

No release, tag, image publication or deployment was performed. Future merges require separate permission.

The PR checks exposed an additional change-caused failure: artifact admission compared every recipe path to the original upstream baseline, so both native build jobs stopped before building when they encountered the two reviewed Node ARG updates. Pin the exact reviewed recipe tree identity in the existing source owner and record it in artifact provenance. Keep the original engine comparison BASE and baseline archive identities, reject any other recipe bytes or modes, and retain dirty-source, paired Bun/native qualification and release authorization checks. The recipe identity supports squash merges without requiring the review commit in future checkout history.

Repair validation: the real-Git regression fails with the original source gate and passes with this repair. All 16 release/source-contract tests and four JSC result tests pass in an isolated Linux ARM64 VM; source bytes match the committed candidate. Rejection controls cover unreviewed recipe content, directory descendants, executable mode changes and dirty tracked source. Independent P0–P2 review is scoped clean. Native Linux x86_64 builds, macOS cross-build and paired Bun qualification remain required PR CI and are not claimed by this local proof. The follow-up changes two owner files (+60/−4, including 50 regression-test lines); it adds no override or baseline exception.

The musl toolchain also upgrades the normal Alpine3.23 CA bundle to 20261020-r0 before build tools run. The real image-reference producer invalidates all six musl lane cache references; other image identities stay unchanged. The same seven recipe entries are attested at the newly reviewed recipe commit, with the original engine comparison base and all gates retained. The two source/build jobs fetch complete history so their strict ancestry and provenance checks work beyond the existing nineteen commits; a real workflow-driven Git/source-owner proof fails with the old depth16 and passes with depth0. Normal package/trust-data proof, sixteen source/release tests, four JSC-result checks, actionlint with repository config, and before/after image-reference checks passed. Native engine/paired-Bun builds remain CI gates; APK Node is used only for a local ICU transform and is not independently qualified here.

Focused validation at exact head f60f4fc331c4ef0c48fa491985ab8883f688908e: paired native build completed both baseline and candidate Bun binaries; all 46 file outcomes agree,45 pass and1 fails in each. Native Linux ARM64 regressions pass. The macOS artifact cross-build passes but is not native macOS execution.

The common fixture repair corrects the selected Node 26.12.1 identity and retains the saved-session peer host. All four resumption assertions and strict all-pass gate remain. Controlled official Node 26.3.0/26.12.1 cross-runs and exact source show the new session envelope is handled by public setSession but bypassed by the documented TLSSocket constructor session option. That upstream Node constructor regression remains the one failing qualification requirement. Both rebuilt Bun arms pass their Bun-side constructor case. The qualifier now collects both arms and their exit codes before enforcing the unchanged all-pass requirement; no exception or assertion weakening was added.16 source/release-contract tests,4 JSC-result tests, real Git common-patch application and fresh independent P0–P2 review pass.

Actual AutoInstall._request source proof on isolated Linux ARM64: default candidate accepts0/12 incident chains; exact-base bundle, explicit old CA and an isolated old OS-store fixture each accept6/12. All modes pass GitHub HTTPS, legitimate private CA and hostname-negative controls. Operator CA/OS-store repair remains required. Matching rebuilt base and candidate Python wheels both fail import because the existing package omits webkitcorepy._vendored, so this successful source-entry proof is not an installed-wheel claim.

Actual rebuilt paired Bun artifacts were also exercised through https/fetch in a full x86_64 UTM guest: candidateSHA256 5fb2b10b449a3415075c49a8e808dee463665bfd25650be01bea89f3c371fd8a; baseline a145d0064eeb16c9be8b1c0756ad435928d3ea64b344de5dbaad725646f1f549. Both accept6/12 incident chains; candidate explicit CA, secure context, fetch CA, extra CA and SSL_CERT_FILE modes do too. Every mode passes public/private HTTPS and hostname rejection controls. These frozen qualification binaries remain affected; changing the conditional WebRTC root table does not harden Bun's separate TLS owner. This is a retained security gap rather than an engine regression, and must not be presented as a hardened Bun release. Execution under CPU emulation does not establish native macOS/Windows coverage.

Recommendation: needs repair. The Node reference gate, hardened Bun qualification-runtime delivery and applicable native macOS/Windows/WebRTC-TURN product proof remain open. Additional long platform builds were deferred under the finite campaign cutoff. No publication, deployment, merge, auto-merge, or gate waiver occurred.