[scarmuega]

Refreshes the controller image's trust anchors and adds a guard against regressing them.

• Dockerfile: after installing ca-certificates, fail the build unless it is at least 20250419~deb12u2, so a stale mirror or a cached layer cannot ship an older store.
• controller.yml: add workflow_dispatch so the image can be rebuilt on demand.
• scripts/check-trust-floor.sh (POSIX sh, no network): reads operator/Cargo.lock and fails on webpki-roots / webpki-root-certs 1.x below 1.0.10 or rustls-webpki 0.103.x below 0.103.16. A pre-release of the floor version counts as below it; build metadata is ignored. Only resolved [[package]] entries are checked, so [[patch.unused]] and other sections are ignored. Older lines (webpki-roots 0.x, rustls-webpki 0.101/0.102) print a warning. Runs in its own trust-floor job of the Clippy workflow on PRs and main, separate from clippy.
• scripts/test-check-trust-floor.sh: runs the check against synthetic lockfiles (floor, above, below, pre-release, build metadata, unused patch, other sections). Runs before the check in the same job.

rustls-webpki is already at 0.101.7, the latest release of its line, so Cargo.lock is unchanged.

No change to operator behaviour.

Checks

• cargo build --locked (operator): passes.
• Trust-floor check: passes with a warning for rustls-webpki 0.101.7.
• scripts/test-check-trust-floor.sh: all 12 cases pass under sh and dash. Three of them fail against the previous version of the script (the two pre-release cases and the unused-patch case).
• cargo fmt --check: clean.
• cargo clippy -- -D warnings: fails on two existing lints in untouched code (src/lib.rs, src/controller.rs). The Clippy workflow on main is already red for the same reason.

🤖 Generated with Claude Code

[scarmuega]

QA review record

Pass 2 (later pass) at 2779e6f

Diff in scope: the rework e6697e2...67ba6e4 (3 files, +95/−10, small; test script included), plus QA's own test-only fix 2779e6f.
Outcome: blocked on two founder rulings about red checks this diff does not cause. No confirmed finding is open.

Lenses run: correctness+state, conformance+test adequacy, fresh eyes, and a checker for pass-1 findings, each an independent reviewer, plus one independent refuter. QA's fix commit got its own hunt and refute pass. Security, observability, compatibility, persistence and dependencies were skipped because nothing triggered them. Independence and coverage were not degraded.

Pass-1 findings

1. Pre-release at the floor treated as the release: fixed (1.0.10-rc.1 and 0.103.16-alpha.1 now fail; build metadata containing - still passes).
2. name/version matched outside [[package]]: fixed.
3. Floor step hidden in the red lint job: fixed (separate trust-floor job).
4. workflow_dispatch has no ref guard: still open, plausible. The plan prescribes this shape; listed for founder review.

Confirmed in this pass (all fixed by QA in 2779e6f, test-only)

• The test script checked only exit codes, so the warning for older lines could disappear unnoticed. It now asserts the warning lines.
• No test checked that a failure names the crate and version. It now asserts both error lines.
• The section-header case put [metadata] before any package. A new case puts a header after a package.

Each of the three mutants now fails the suite. The fix review found nothing.

Plausible

• A CRLF lockfile slips past the check (the name keeps \r). This predates the rework. Cargo writes LF, CI checks out LF, and there is no .gitattributes. A sub(/\r$/, "") would settle it.

Refuted: 1. rustls-webpki 0.100.x gets no warning, but the plan lists exactly 0.101/0.102 as the warn lines.

Checks at 2779e6f

• trust-floor passes in CI (14/14 cases; warns on rustls-webpki 0.101.7). It also passes under BSD awk, mawk, sh and dash.
• lint fails on two existing lints in operator code this PR does not touch (operator/src/lib.rs:5, operator/src/controller.rs:121). It has been red on main since at least 2026-03.
• Validate controller fails with "controller not executed" (kind integration test, untouched). It has been red on main since at least 2026-03.
• main has no branch protection.