fix: use patched Python and frozen scanner certificate trust

.github/workflows/clawscan-judge-diagnostic.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: ./.github/actions/setup-bun
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
+          python-version: "3.12.16"
       - name: Install pinned Codex without login
         uses: ./.github/actions/setup-codex
       - name: Select bounded installer source

.github/workflows/prepublication-publish-checks.yml

@@ -204,7 +204,7 @@ jobs:
 
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
+          python-version: "3.12.16"
 
       - name: Install Codex CLI
         uses: ./.github/actions/setup-codex

.github/workflows/security-dataset-snapshot.yml

@@ -273,7 +273,7 @@ jobs:
       - uses: actions/setup-python@v7
         if: ${{ env.HF_UPLOAD == 'true' }}
         with:
-          python-version: "3.12"
+          python-version: "3.12.16"
 
       - name: Download sanitized shard artifacts
         uses: actions/download-artifact@v8
@@ -359,7 +359,7 @@ jobs:
       - uses: actions/setup-python@v7
         if: ${{ env.HF_UPLOAD == 'true' }}
         with:
-          python-version: "3.12"
+          python-version: "3.12.16"
 
       - name: Download existing shard artifacts
         run: |

.github/workflows/security-scan-codex.yml

@@ -181,7 +181,7 @@ jobs:
 
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
+          python-version: "3.12.16"
 
       - name: Install Codex CLI
         uses: ./.github/actions/setup-codex

.github/workflows/skill-evaluation.yml

@@ -99,7 +99,7 @@ jobs:
 
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
+          python-version: "3.12.16"
 
       - uses: astral-sh/setup-uv@v7
         with:

.github/workflows/test-claw-canary-prepublication.yml

@@ -78,7 +78,7 @@ jobs:
 
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
+          python-version: "3.12.16"
 
       - name: Install Codex CLI
         uses: ./.github/actions/setup-codex

scripts/security/clawscan-source-commit.txt

@@ -1 +1 @@
-d4dc23c1525f2dd7d82e0b4ef087116daef6bbf0
+022143b39b3285d1ac24cce7fbb61c36f5207935

scripts/security/install-clawscan-scanners.sh

@@ -36,7 +36,8 @@ git -C "$source_dir" apply "$runtime_dir/patches/$scanner-responses.patch"
 # Pin the existing maintained resolver; SkillSpector ships an upstream uv.lock.
 python -m pip install "uv==0.13.5"
 if [ "$scanner" = skillspector ]; then
-  uv sync --locked --no-dev --project "$source_dir"
+  python_executable=$(python -c 'import sys; print(sys.executable)')
+  uv sync --locked --no-dev --python "$python_executable" --project "$source_dir"
   venv="$source_dir/.venv"
 else
   venv="$RUNNER_TEMP/aig-venv"

scripts/security/prepublication-worker-workflow.test.ts

@@ -222,7 +222,7 @@ describe("pre-publication publish worker workflow", () => {
     expect(steps).toContainEqual(
       expect.objectContaining({
         uses: "actions/setup-python@v7",
-        with: { "python-version": "3.12" },
+        with: { "python-version": "3.12.16" },
       }),
     );
     const aigInstall = steps.find((step) => step.name === "Install A.I.G scanner")?.run;

scripts/security/scanner-installation.test.ts

@@ -95,7 +95,7 @@ describe("reviewed ClawScan installation", () => {
           'echo "$(basename "$0") $*" >> "$COMMAND_LOG"',
           'case "$(basename "$0")" in',
           ' git) if [ "${3:-}" = rev-parse ]; then case "$2" in */clawscan) echo "$CLAWSCAN_PIN";; *) echo "$SCANNER_PIN";; esac; fi;;',
-          ' python) if [ "${1:-}" = -m ] && [ "${2:-}" = venv ]; then mkdir -p "$3/bin"; cp "$0" "$3/bin/python"; cp "$0" "$3/bin/aig-skill-scan"; fi;;',
+          ' python) if [ "${1:-}" = -c ]; then printf "%s\\n" "$SELECTED_PYTHON"; elif [ "${1:-}" = -m ] && [ "${2:-}" = venv ]; then mkdir -p "$3/bin"; cp "$0" "$3/bin/python"; cp "$0" "$3/bin/aig-skill-scan"; fi;;',
           ' uv) if [ "${1:-}" = sync ]; then for last; do :; done; mkdir -p "$last/.venv/bin"; cp "$0" "$last/.venv/bin/python"; cp "$0" "$last/.venv/bin/skillspector"; fi;;',
           "esac",
         ].join("\n");
@@ -109,6 +109,7 @@ describe("reviewed ClawScan installation", () => {
             env: {
               PATH: path,
               COMMAND_LOG: log,
+              SELECTED_PYTHON: join(bin, "python"),
               CLAWSCAN_PIN: pin,
               SCANNER_PIN: scannerPin,
               CLAWSCAN_SOURCE_DIR: source,
@@ -136,7 +137,9 @@ describe("reviewed ClawScan installation", () => {
           "--require-hashes -r " + scriptDir + "/aig-worker-requirements.txt",
         );
         expect(commands).toContain("--no-deps " + root + "/aig-source.");
-        expect(commands).toContain("uv sync --locked --no-dev --project");
+        expect(commands).toContain(
+          "uv sync --locked --no-dev --python " + join(bin, "python") + " --project",
+        );
         const paths = await readFile(join(root, "github-path"), "utf8");
         expect(paths).toBe((join(root, "clawscan-scanner-bin") + "\n").repeat(2));
       } finally {

specs/security-consumer-model-policy.md

@@ -37,7 +37,7 @@ paths. Environment-only changes cannot implement this policy: official GPT-6.1
 Sol function/tool calls require Responses rather than Chat Completions.
 
 `clawscan-source-commit.txt` pins merged ClawScan commit
-`d4dc23c1525f2dd7d82e0b4ef087116daef6bbf0`. The
+`022143b39b3285d1ac24cce7fbb61c36f5207935`. The
 workflow installer fetches that exact commit, verifies HEAD, builds its Go CLI
 with Go 1.27.3, and retains the matching source tree for host scanner installation.
 No mutable `main`, `latest`, or unapproved public ClawScan release is consumed.
@@ -59,7 +59,9 @@ real-adapter tests as that ClawScan revision's runtime image:
 
 - SkillSpector: NVIDIA source commit
   `95a52d89fa16f608f0b18ccee76b0918ea4b7eef`, with the maintained LangChain
-  Responses path and its upstream `uv.lock` (`uv sync --locked --no-dev`).
+  Responses path and its upstream `uv.lock` (`uv sync --locked --no-dev --python <selected interpreter>`). The installer
+  binds uv to the workflow-selected Python; another installed interpreter must
+  not silently replace the patched runtime selected by setup-python.
 - AIG: Tencent AI-Infra-Guard source commit
   `a5c5a72c2e5b88fc6e5b27e0c86110943c4d350b` (`skill-scan` package), with the
   ClawScan-owned Responses streaming adapter. The existing hash-locked AIG 0.2.2
@@ -73,8 +75,11 @@ real-adapter tests as that ClawScan revision's runtime image:
   dependencies are not claimed to be fully hash-reproducible. The AIG hash lock
   additionally admits the published macOS arm64 CPython 3.12 wheels for `jiter`
   and `pydantic-core`, without replacing the existing Ubuntu runner hashes. Its
-  certifi dependency is 2026.10.23 with the normal published wheel hash. This
-  independent update does not rewrite SkillSpector's upstream frozen CA lock.
+  certifi dependency is 2026.10.23 with the normal published wheel hash. The
+  ClawScan-owned SkillSpector patch also refreshes its frozen upstream lock to
+  certifi 2026.10.23, retaining the published distribution hashes. Updating the
+  CA bundle does not replace the patched Python runtime required to reject
+  compromised keys when an operator supplies historical explicit roots.
 
 The adapter implementation stays upstream in ClawScan; ClawHub must not grow a
 second independent OpenAI adapter. Offline transport contracts prove serialization,