@@ -0,0 +1,145 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+#
+# Slice 130: builds the hardened headless image from ci/ironbank/Dockerfile the way Iron Bank's
+# pipeline would (scripts/headless_image.sh stages every input from hardening_manifest.yaml and
+# checks its digest; the Dockerfile reaches no network), then checks the built image, never its
+# recipe (docs/regulated/headless-image.md):
+#
+#   the submission tree and the published build's base pins   mix trinity.ironbank.lint
+#   the image starts its runtime                              bin/headless eval, then start
+#   AC1 and AC6: user and layer contents                      mix trinity.image.inspect
+#   AC3 and AC4: vulnerability scan against justifications    grype, then mix trinity.image.findings
+#   AC5: STIG applicability statement                         scripts/stig_scan.sh, then mix trinity.image.stig
+#
+# Every check after the build runs and reports even when an earlier one fails, so one red check
+# does not hide the others; the job fails if any did. It runs when an input of the image or of the
+# checks changes, on demand, and daily, because new advisories appear against an image that has
+# not changed (Iron Bank rescans its images on a schedule for the same reason). Nothing is pushed:
+# publishing and signing the image is slice 131's.
+name: headless-image
+
+on:
+  push:
+    paths:
+      - ci/ironbank/**
+      - ci/headless/**
+      - scripts/headless_image.sh
+      - scripts/stig_scan.sh
+      - lib/mix/tasks/trinity.ironbank.lint.ex
+      - lib/mix/tasks/trinity.image.*.ex
+      - mix.exs
+      - mix.lock
+      - config/**
+      - .tool-versions
+      - .github/workflows/headless-image.yml
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    # Not measured on a runner yet: OTP from source took 40 s and the dependency compile, EXLA's C++
+    # included, about 155 s on a 32-core machine (slice 130 NOTES). The ceiling is generous until the
+    # first runs say otherwise.
+    timeout-minutes: 120
+    env:
+      IMAGE: trinity-headless:ci
+      # grype v0.119.0, pinned by digest: a scanner is code that reads the image and runs in CI, and
+      # a tag can be moved (slice 130 NOTES, D-130-6).
+      GRYPE: anchore/grype:v0.119.0@sha256:8c2c9234a345577a6d321a4753aa3ee1276d8975c8452d2344a56b57733ecad3
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
+        with:
+          version-file: .tool-versions
+          version-type: strict
+
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-image-${{ hashFiles('mix.lock') }}
+          restore-keys: ${{ runner.os }}-mix-image-
+
+      - name: Compile the checks
+        run: |
+          mix deps.get
+          mix compile
+
+      - name: The submission tree and the published build's base pins
+        run: mix trinity.ironbank.lint
+
+      - name: Build the image from staged, digest-checked resources
+        id: build
+        run: |
+          scripts/headless_image.sh build "$IMAGE"
+          docker image inspect "$IMAGE" --format 'id={{.Id}} size={{.Size}} user={{.Config.User}}'
+          echo "digest=$(docker image inspect "$IMAGE" --format '{{.Id}}')" >> "$GITHUB_OUTPUT"
+
+      # `bin/headless version` exits 0 without starting the VM (slice 130 NOTES, measurement 1), so
+      # this starts it: eval runs the runtime, and start must answer on its one port with a 401 for a
+      # request without the bearer.
+      - name: The image starts its runtime, read-only
+        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
+        run: |
+          docker run --rm --read-only --tmpfs /tmp "$IMAGE" /opt/trinity/bin/headless eval \
+            'IO.puts("otp=#{System.otp_release()} fips_provider=#{inspect(:crypto.info()[:fips_provider_available])} node=#{inspect(Node.self())}")'
+          cid=$(docker run -d --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges \
+            -p 127.0.0.1:4000:4000 -e TRINITY_MCP_SERVER_TOKEN=ci-token "$IMAGE")
+          for _ in $(seq 1 60); do
+            curl -s -o /dev/null http://127.0.0.1:4000/ && break
+            sleep 1
+          done
+          status=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:4000/mcp \
+            -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"ping"}')
+          docker logs "$cid" | tail -20
+          docker rm -f "$cid" >/dev/null
+          echo "POST /mcp without a bearer: $status"
+          test "$status" = 401
+
+      - name: "AC1 and AC6: the image's user and its layers"
+        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
+        run: mix trinity.image.inspect "$IMAGE"
+
+      - name: "AC3: scan the image, with no network at scan time"
+        id: scan
+        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
+        run: |
+          mkdir -p out/grype-db out/tmp
+          docker save "$IMAGE" -o out/image.tar
+          docker run --rm --user "$(id -u):$(id -g)" -v "$PWD/out:/s" -e GRYPE_DB_CACHE_DIR=/s/grype-db "$GRYPE" db update
+          docker run --rm --network none --user "$(id -u):$(id -g)" -v "$PWD/out:/s" \
+            -e TMPDIR=/s/tmp -e GRYPE_DB_CACHE_DIR=/s/grype-db \
+            -e GRYPE_DB_AUTO_UPDATE=false -e GRYPE_CHECK_FOR_APP_UPDATE=false \
+            "$GRYPE" docker-archive:/s/image.tar -o json --file /s/grype.json
+          rm -f out/image.tar
+
+      - name: "AC3 and AC4: findings against ci/headless/justifications.yaml"
+        if: ${{ !cancelled() && steps.scan.outcome == 'success' }}
+        run: mix trinity.image.findings --scan out/grype.json --out out/findings.csv
+
+      - name: "AC5: the STIG applicability statement"
+        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
+        run: |
+          scripts/stig_scan.sh "$IMAGE" out/stig
+          mix trinity.image.stig --results out/stig/stig-results.xml --out out/stig/stig-applicability.md \
+            --image "$IMAGE" --digest "${{ steps.build.outputs.digest }}"
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: ${{ !cancelled() }}
+        with:
+          name: headless-image-evidence
+          path: |
+            out/grype.json
+            out/findings.csv
+            out/stig/stig-results.xml
+            out/stig/stig-report.html
+            out/stig/stig-applicability.md
+          if-no-files-found: warn
@@ -22,6 +22,27 @@ evidence for each increment is retained by the maintainers and summarised here.
   tree, engineering rules consolidated into `docs/03-conventions.md`, and this changelog added as
   the public record of delivered work.
 
+## 2026-10-08
+
+### `slice/130`: the headless image, hardened, and checked as built
+
+The headless container is what a government program would actually run, and it was built to run
+rather than to be assessed: Debian, a package manager and `curl` in the final image, and an Erlang
+distribution listener on every interface whose cookie was baked into the image for anyone who
+pulled it. It is now built on UBI9 micro from one recipe, `ci/ironbank/Dockerfile`, which is laid
+out as an Iron Bank submission and reaches no network: every input arrives as a file with its
+digest. The image this project publishes is the same file built with its bases pinned by digest.
+
+What is claimed about the image is checked against the built image, never against its recipe. It
+runs as UID 10001 with a read-only root filesystem and distribution off. Its layers carry no
+package manager, compiler, shell history, documentation, SUID file or key material beyond what is
+allowed by name with a reason. A vulnerability scan fails on any High or Critical finding without a
+justification, and on a justification for something no longer found. Its STIG applicability
+statement is generated from OpenSCAP's evaluation of it, with every rule of the profile given a
+disposition. The scanner was chosen by measurement: of the two tried, only grype sees the Erlang
+runtime inside a release. The image is not in Iron Bank and this is not a compliance determination;
+`docs/regulated/headless-image.md` says what it is, how to check it, and what is still open.
+
 ## 2026-09-26
 
 ### `slice/128`: the checks that guard attribution now say what they check
 
@@ -75,6 +75,10 @@ never pin a version hex marks as retired or vulnerable.
 | `Tauri CLI` | **2.11.4** | 📐 `_build/_tauri/bin/cargo-tauri tauri --version` | Measured at Slice 001 line 3. Not on `PATH` and not pinned by any file in the tree: `ex_tauri` provisions it with `cargo install tauri-cli --version ^2 --root .` inside `_build/_tauri`, which is gitignored, so `cargo tauri --version` exits 101 on a fresh machine. 📐 rather than ✅ because nothing at this sha verifies it. The `^2` floats; 2.11.4 is what it resolved to on 2026-09-06. |
 | `Zig` | **0.16.0** | ✅ `.tool-versions` | Measured at Slice 001 line 3: burrito 1.6.0 compares Zig for **equality**, not a range (`@zig_version_expected` in `deps/burrito/lib/burrito.ex`), and exits 1 on any other version. `zig version` reports 0.16.0, exit 0. Installed through the asdf zig plugin, added this slice. Corrected 2026-09-06: this row previously read `version required by Burrito | ✅ .tool-versions` and that file carried no zig line. |
 | `FIPS leg base image (UBI9)` | **sha256:9295c5c688f487fa5cf27a734fa55ecd57aeb7dc0904ba537da4f42dfa1d0acb** | ✅ `ci/fips/Containerfile` | Added at Slice 003: the base of the FIPS build leg's image (docs/fips-leg.md), `registry.access.redhat.com/ubi9/ubi:latest` resolved by digest on 2026-09-20 (Red Hat Enterprise Linux release 9.8, `openssl-libs 3.5.8-1.el9_8`, `openssl-fips-provider-so 3.0.7-11.el9_8`). The image itself is OTP 28.5.0.5 built from source with `--enable-fips` against that OpenSSL, plus Elixir 1.20.4; the two archives are pinned by SHA-256 in the Containerfile and the image tag is `scripts/fips_image_tag.sh` over `.tool-versions` and the Containerfile. The FIPS provider the image runs is what the distribution ships and names; docs/fips-leg.md states what Trinity does and does not claim about it. |
+| `Headless image runtime base (UBI9 micro)` | **sha256:932aec77f5b86a5dba854a18b14a38725b296967e7dc9c7a1f4d7f0bf82e1ce5** | ✅ `ci/headless/bases.env` | Added at Slice 130: the final stage of the hardened headless image as this project publishes it (`ci/ironbank/Dockerfile`, docs/regulated/headless-image.md), `registry.access.redhat.com/ubi9/ubi-micro` 9.8. The digest is the one Iron Bank's own ubi9-micro image declares as its source, so the published build and an Iron Bank build start from the same bytes. Iron Bank builds the same Dockerfile from its own registry with the tags in `ci/ironbank/hardening_manifest.yaml`. |
+| `Headless image builder base (UBI9)` | **sha256:c26665a762876d5de27d1ed50e029ab3bc80ef3a3e155824ee7ab43e70055b63** | ✅ `ci/headless/bases.env` | Added at Slice 130: the builder stages of the hardened headless image (OTP from source, the release, the runtime root filesystem), `registry.access.redhat.com/ubi9` 9.8, the digest Iron Bank's own ubi9 image declares as its source. Nothing from these stages reaches the final image except the release and the root filesystem `dnf --installroot` assembles. |
+| `Image vulnerability scanner (grype)` | **v0.119.0** | ✅ `.github/workflows/headless-image.yml` | Added at Slice 130 and chosen by measurement over Trivy 0.74.0: grype identifies the Erlang/OTP runtime inside a release from `beam.smp` and matches its advisories, which Trivy does not see at all (slice 130 NOTES, D-130-6). Pinned by image digest in the workflow, and to a release at least two weeks old when chosen. |
+| `SCAP Security Guide` | **0.1.82** | ✅ `scripts/stig_scan.sh` | Added at Slice 130: the datastream (`ssg-rhel9-ds.xml`) and DISA STIG profile OpenSCAP evaluates the headless image against, the profile Iron Bank's pipeline uses for a UBI9 image. The release zip is checked against its published SHA-512, pinned beside the version in the script. |
 
 ### Core libraries
 
 
@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+#
+# The bases of the headless image this project publishes, as build arguments for
+# ci/ironbank/Dockerfile (slice 130). Iron Bank builds the same file with its own registry and
+# the tags in hardening_manifest.yaml; this build pins every base by digest instead, through the
+# tag argument, so a base change is a diff here and never a silent drift under a moving tag.
+# `test/ironbank_submission_test.exs` resolves every FROM in the Dockerfile against this file and
+# fails on one that does not carry a digest.
+#
+# Both digests are the ones Iron Bank's own UBI 9.8 images declare as their sources
+# (dsop/redhat/ubi/9.x/ubi9-micro and .../ubi9, hardening_manifest.yaml, read 2026-10-08), so
+# this build and theirs start from the same bytes.
+BASE_REGISTRY=registry.access.redhat.com
+BASE_IMAGE=ubi9/ubi-micro
+BASE_TAG=9.8@sha256:932aec77f5b86a5dba854a18b14a38725b296967e7dc9c7a1f4d7f0bf82e1ce5
+BUILDER_IMAGE=ubi9
+BUILDER_TAG=9.8@sha256:c26665a762876d5de27d1ed50e029ab3bc80ef3a3e155824ee7ab43e70055b63
@@ -0,0 +1,55 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+#
+# Findings of `mix trinity.image.inspect` that the headless image carries on purpose (slice 130,
+# AC6; NOTES D-130-10). Only four kinds can be allowed: certificate, documentation, build_library
+# and private_key. A package manager, a build tool, shell history, a SUID or SGID bit, a
+# world-writable path, a distribution cookie, /etc/passwd's mode and the image's user cannot.
+#
+# `path` is a file, or a directory prefix ending in `/`. A private_key allowance names one file
+# and the SHA-256 of each PEM block in it (header to footer inclusive), so another key, or a
+# changed one, fails again. An allowance that allows nothing in the image fails as stale: when a
+# reason stops being true, the row has to go.
+---
+allowances:
+  # The operating system's trust store. openssl-libs requires ca-certificates, so the store and
+  # its READMEs arrive with the libraries the release links. Public CA certificates, which the
+  # runtime verifies model providers' TLS servers against; Iron Bank's own ubi9-micro carries the
+  # same store "for default certificates". A deployment adds its own anchors under
+  # /etc/pki/ca-trust/source/anchors.
+  - path: "/etc/pki/ca-trust/"
+    kinds: ["certificate", "documentation"]
+    reason: "the OS trust store, installed by ca-certificates, a dependency of openssl-libs"
+  - path: "/usr/share/pki/"
+    kinds: ["certificate", "documentation"]
+    reason: "the OS trust store's sources, installed by ca-certificates"
+
+  # castore's bundle of public CA certificates, a dependency of tokenizers. Slice 133 removes
+  # tokenizers from the regulated image; if castore goes with it, this row goes too.
+  - path: "/opt/trinity/lib/castore-1.0.21/priv/cacerts.pem"
+    kinds: ["certificate"]
+    reason: "public CA certificates bundled by castore, a dependency of tokenizers (release composition, slice 133)"
+
+  # jose's fixed RSA test key pair: deps/jose/src/jose_server.erl, rsa_private_key/0, which its
+  # capability probe signs with. The private half is published in jose's source; it is the same
+  # in every copy of jose and protects nothing. Iron Bank's rule names test material, so this is
+  # for the owner's AC7 review to see, not to hide.
+  - path: "/opt/trinity/lib/jose-1.11.12/ebin/jose_server.beam"
+    kinds: ["private_key"]
+    sha256: ["01bd092767f5183944bb4f93406659a6db0e9c3f89b664004eb8a07da83012bb"]
+    reason: "jose's published RSA test key pair, used by its capability probe (jose_server.erl rsa_private_key/0)"
+
+  # Build-time libraries the release carries as applications because a dependency does not mark
+  # them runtime: false. Release composition is slice 133's; these rows go when it removes them.
+  - path: "/opt/trinity/lib/rustler-0.38.0/"
+    kinds: ["build_library", "documentation"]
+    reason: "rustler, a NIF build library, carried as a release application (release composition, slice 133)"
+  - path: "/opt/trinity/lib/igniter-0.8.4"
+    kinds: ["build_library"]
+    reason: "igniter, a code generator, carried as a release application (release composition, slice 133)"
+  - path: "/opt/trinity/lib/burrito-1.6.0"
+    kinds: ["build_library"]
+    reason: "burrito, the desktop packager, carried as a release application (release composition, slice 133)"
+  - path: "/opt/trinity/lib/ex_tauri-0.2.0"
+    kinds: ["build_library"]
+    reason: "ex_tauri, the desktop shell's build library, carried as a release application (release composition, slice 133)"