From f35fb2679e1362ba99fa2768176513c7bd696ab6 Mon Sep 17 00:00:00 2001
From: joshavant <830519+joshavant@users.noreply.github.com>
Date: Mon, 26 Oct 2026 00:51:13 -0500
Subject: [PATCH 1/2] fix: refresh frozen SkillSpector certificate roots

---
 .../patches/skillspector-responses.patch      | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/docker/clawscan-runtime/patches/skillspector-responses.patch b/docker/clawscan-runtime/patches/skillspector-responses.patch
index 8442151..cf0e73d 100644
--- a/docker/clawscan-runtime/patches/skillspector-responses.patch
+++ b/docker/clawscan-runtime/patches/skillspector-responses.patch
@@ -388,3 +388,23 @@ diff --git a/tests/nodes/test_report_occurrence_columns.py b/tests/nodes/test_re
 +        ("first.py", "finding-first-duplicate", "first_context\nsubprocess.run(command)"),
          ("second.py", "finding-second", "second_context\nsubprocess.run(command)"),
      ]
+diff --git a/uv.lock b/uv.lock
+index 4878677..0079882 100644
+--- a/uv.lock
++++ b/uv.lock
+@@ -1,3 +1,3 @@
+ version = 1
+-revision = 3
++revision = 5
+ requires-python = ">=3.12, <3.15"
+@@ -230,7 +230,7 @@ filecache = [
+ name = "certifi"
+-version = "2026.6.17"
++version = "2026.10.23"
+ source = { registry = "https://pypi.org/simple" }
+-sdist = { url = "https://files.pythonhosted.org/packages/c9/c7/424b75da314c1045981bd9777432fad05a9e0c69daa4ed7e308bbaffe405/certifi-2026.6.17.tar.gz", hash = "sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432", size = 134594, upload-time = "2026-06-17T10:31:07.894Z" }
++sdist = { url = "https://files.pythonhosted.org/packages/fd/11/b524cbd9bbdaca58608e4cf4053fd463417549e1959fa8d3aa18319f9555/certifi-2026.10.23.tar.gz", hash = "sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd", size = 136225, upload-time = "2026-10-23T11:36:16.478Z" }
+ wheels = [
+-    { url = "https://files.pythonhosted.org/packages/ef/2f/c5464532e965badff2f4c4c1a3a83f5697f0d7c407ed0cda44aaa99bb451/certifi-2026.6.17-py3-none-any.whl", hash = "sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db", size = 133289, upload-time = "2026-06-17T10:31:06.348Z" },
++    { url = "https://files.pythonhosted.org/packages/32/d1/a3652fe2c19134d0d15922177821d863cbd7e842d53a21bbe7e8e3a1b5ac/certifi-2026.10.23-py3-none-any.whl", hash = "sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1", size = 135082, upload-time = "2026-10-23T11:36:14.763Z" },
+ ]

From cd1488f250bf81fd2ed00265a1c9b1c85cb304c7 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 26 Oct 2026 05:27:22 -0700
Subject: [PATCH 2/2] docs: credit frozen SkillSpector certificate refresh

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f8bd8a..4e9676c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Refresh the frozen SkillSpector certificate bundle to certifi 2026.10.23, preserving the Responses adapter patch. Runtime Python delivery remains a separate requirement for incident-key rejection. Thanks @joshavant. (#94)
+
 ## 0.3.0 - 2026-10-23
 
 **Highlights:** Retain opt-in scan and judge lifecycle evidence, protect scan inputs during cancellation, and strengthen inspection receipts and runtime certificate trust.