Repository navigation
fix: reject compromised CA keys in the Claude runtime - #74
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs real behavior proof before merge. What this changesThis PR updates the bundled Claude Code version from 2.1.289 to 2.1.306 to reject compromised certificate-authority keys. Example: Claude connects using an older extra-CA bundle containing compromised authorities.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness⛔ Blocked before merge - 3 items remain Keep this PR open: main still selects the older Claude runtime, and the focused security update has no identified introduced defect. Priority: P1 Before merge
FindingsNone. Tests
Agent review detailsHow this fits togetherThe Docker runtime installs pinned scanner and judge CLIs; ClawScan executes selected commands inside that image, where Claude's native TLS verifier controls connections to provider endpoints. flowchart LR
A[Dockerfile version pin] --> B[npm package installation]
B --> C[Multi-platform runtime image]
D[ClawScan judge command] --> C
C --> E[Claude native TLS verifier]
E --> F[Provider HTTP request]
Technical reviewBest possible solution: Ship the focused Claude pin update through the existing multi-platform runtime workflow while preserving supported private-CA transports. Do we have a high-confidence way to reproduce the issue? Main's older package selection is verified, but the reported compromised-certificate acceptance cannot be independently reproduced from the supplied narrative and opaque native dependency. Is this the best way to solve the issue? Updating the existing direct dependency pin is the smallest complete source change for this scoped runtime repair; Windows behavior and downstream image rollout are separate from this Linux image selection. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 4d2f57f1cb08. Merge-risk optionsMaintainer options:
Provenance checked
TestingProof path: none. SecurityNeeds attention: No introduced security defect was identified, but the changed certificate-trust boundary needs inspectable final-effect evidence. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 21, 2026, 4:11 AM ET / 08:11 UTC. |
Summary
The runtime image directly installs Claude Code 2.1.289. Update that existing pin to released 2.1.306, whose authenticated Linux amd64 and arm64 native packages contain all eight compromised-key block constants. This direct CLI update does not depend on the separately lagging ACPX adapter.
Scope
Security / Trust Impact
Only the direct Claude runtime selection changes. Scanner refs, Responses adapters, Codex and other tool selections remain unchanged. Rebuild/publication and downstream source/digest updates follow separately; this PR does not claim the whole image is repaired.
Verification
git diff --checkpasses; independent Codex P0–P3 review reports no actionable findings.CERT_REJECTEDin default, deliberately old extra-CA and current guest system-store modes (36 rejection cases; the guest OS CA bundle is already repaired). The original diagnostic classifier omitted this native code; the retained exact results were reclassified without replaying requests.Notes
The npm
latesttag selects 2.1.306, an ordinary non-prerelease 2.1 version; the distinctstablerollout tag currently selects 2.1.304. The reported Windows Bedrock custom-CA regression remains a platform validation concern. Image build/publication, Windows/native-store and real-provider proof remain distinct from this source pin.Retained native TLS diagnostics and private-CA controls
These are sanitized excerpts of the completed isolated guest runs, with the system-store qualification and original classifier failure preserved. No provider inference or new runtime execution is claimed.
{ "purpose": "Sanitized extraction of retained actual CLI TLS observations; no new execution. Intended for lead inspection before any GitHub posting.", "head": "dcc2527d0026160dbee0befc53881de8970d0993", "runtime": "Ubuntu 24.04.5 arm64 in task-owned isolated UTM guest", "execution_utc": "2026-10-21T07:45:50.520560+00:00", "selected_fixed_package": { "name": "@anthropic-ai/claude-code-linux-arm64", "version": "2.1.306", "npm_sri": "sha512-AePKWuymgDSCh7nScJ4dx/pF1Kppzk4IwQuh6JCROiqQdBVGaaHw6jVf/fY5PhbSjy9EQML6yOiUfc50aFpnTA==", "archive_sha256": "3ae52d6b4fe4cd3e6c5efc47c0b9d970186fc8a1b152e32260d7f640bdf063d2", "executable_sha256": "77d257d5e8b8730ec61d5a4992a8eb65550aaf9589f464988aa1a9684338d801" }, "old_extra_ca_sha256": "714d457d580922dbf1d0be8bd35ba236a842b50b0072ae791582a19adef772a5", "system_ca_sha256": "0e4c9a8eb123513b1c131c0aec2d3f9ddaad02b77b8af53bff30e1e7fc3c6b71", "qualification": [ "Default uses package-selected roots; extra-old sets NODE_EXTRA_CA_CERTS to old affected CA bundle; system sets CLAUDE_CODE_CERT_STORE=system with an already repaired guest OS store.", "Native TLS diagnostics establish rejection before TLS completes; these client logs do not claim independent server-side packet capture for incident hosts.", "Synthetic private-CA tests observe actual HTTP requests at a local TLS server, directly and through CONNECT; processes stop after HTTP observation, so exit143 is deliberate rather than a successful model response.", "No provider credentials or inference; only a synthetic placeholder key.", "Original classification harness lacked CERT_REJECTED and HTTP405 patterns and exited1. The retained60raw rows were independently classified after completion; no network replay." ], "counts": { "2.1.289/default": { "certificate-rejected-issuer": 6, "TLS-accepted-HTTP405": 6 }, "2.1.289/extra-old": { "TLS-accepted-HTTP405": 12 }, "2.1.306/default": { "certificate-rejected-CERT_REJECTED": 12 }, "2.1.306/extra-old": { "certificate-rejected-CERT_REJECTED": 12 }, "2.1.306/system": { "certificate-rejected-CERT_REJECTED": 12 } }, "exact_native_diagnostics": [ { "version": "2.1.289", "mode": "default", "host": "dv-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:41.880Z [ERROR] Connection error details: code=UNABLE_TO_GET_ISSUER_CERT_LOCALLY (SSL error), message=unable to get local issuer certificate" ] }, { "version": "2.1.289", "mode": "default", "host": "dv-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:41.914Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "default", "host": "dv-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:41.856Z [ERROR] Connection error details: code=UNABLE_TO_GET_ISSUER_CERT_LOCALLY (SSL error), message=unable to get local issuer certificate" ] }, { "version": "2.1.289", "mode": "default", "host": "dv-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:41.923Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "default", "host": "ev-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:42.397Z [ERROR] Connection error details: code=UNABLE_TO_GET_ISSUER_CERT_LOCALLY (SSL error), message=unable to get local issuer certificate" ] }, { "version": "2.1.289", "mode": "default", "host": "ev-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:42.484Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "default", "host": "ev-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:42.397Z [ERROR] Connection error details: code=UNABLE_TO_GET_ISSUER_CERT_LOCALLY (SSL error), message=unable to get local issuer certificate" ] }, { "version": "2.1.289", "mode": "default", "host": "ev-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:42.471Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "default", "host": "ov-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:42.859Z [ERROR] Connection error details: code=UNABLE_TO_GET_ISSUER_CERT_LOCALLY (SSL error), message=unable to get local issuer certificate" ] }, { "version": "2.1.289", "mode": "default", "host": "ov-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:42.944Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "default", "host": "ov-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:43.009Z [ERROR] Connection error details: code=UNABLE_TO_GET_ISSUER_CERT_LOCALLY (SSL error), message=unable to get local issuer certificate" ] }, { "version": "2.1.289", "mode": "default", "host": "ov-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:43.096Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "dv-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:43.407Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "dv-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:43.520Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "dv-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:43.514Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "dv-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:43.678Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ev-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:43.993Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ev-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:44.123Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ev-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:44.126Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ev-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:44.268Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ov-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:44.619Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ov-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:44.760Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ov-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:44.770Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.289", "mode": "extra-old", "host": "ov-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:44.902Z [ERROR] API error (attempt 1/11): 405 405 only GET, HEAD and OPTIONS" ] }, { "version": "2.1.306", "mode": "default", "host": "dv-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:45.249Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "dv-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:45.350Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "dv-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:45.440Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "dv-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:45.546Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ev-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:45.817Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ev-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:46.054Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ev-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:46.047Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ev-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:46.194Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ov-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:46.497Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ov-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:46.612Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ov-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:46.590Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "default", "host": "ov-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:46.704Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "dv-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:47.093Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "dv-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:47.240Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "dv-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:47.199Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "dv-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:47.358Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ev-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:47.785Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ev-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:47.935Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ev-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:47.911Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ev-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:48.032Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ov-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:48.505Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ov-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:48.610Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ov-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:48.623Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "extra-old", "host": "ov-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:48.585Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "dv-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.119Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "dv-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.137Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "dv-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.166Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "dv-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.129Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ev-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.707Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ev-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.732Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ev-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.779Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ev-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:49.748Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ov-g3b-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:50.180Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ov-g3b-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:50.316Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ov-g3c-aaa-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:50.355Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] }, { "version": "2.1.306", "mode": "system", "host": "ov-g3c-emudhra.we-have-a-problem.com", "exit_code": 1, "exact_native_diagnostic_lines": [ "2026-10-21T07:45:50.333Z [ERROR] Connection error details: code=CERT_REJECTED (SSL error), message=certificate rejected" ] } ], "synthetic_private_ca_http_observations": [ { "version": "2.1.289", "mode": "direct", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "HEAD", "path": "/api/hello" }, { "method": "POST", "path": "/v1/messages?beta=true" } ], "proxy_connect_count": 0 }, { "version": "2.1.289", "mode": "direct-proxy", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "POST", "path": "/v1/messages?beta=true" } ], "proxy_connect_count": 1 }, { "version": "2.1.289", "mode": "bedrock", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "GET", "path": "/inference-profiles?type=SYSTEM_DEFINED" }, { "method": "POST", "path": "/model/[synthetic-test-model]/invoke-with-response-stream" } ], "proxy_connect_count": 0 }, { "version": "2.1.289", "mode": "bedrock-proxy", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "GET", "path": "/inference-profiles?type=SYSTEM_DEFINED" }, { "method": "POST", "path": "/model/[synthetic-test-model]/invoke-with-response-stream" } ], "proxy_connect_count": 2 }, { "version": "2.1.306", "mode": "direct", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "POST", "path": "/v1/messages?beta=true" } ], "proxy_connect_count": 0 }, { "version": "2.1.306", "mode": "direct-proxy", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "POST", "path": "/v1/messages?beta=true" } ], "proxy_connect_count": 1 }, { "version": "2.1.306", "mode": "bedrock", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "GET", "path": "/inference-profiles?type=SYSTEM_DEFINED" }, { "method": "POST", "path": "/model/[synthetic-test-model]/invoke-with-response-stream" } ], "proxy_connect_count": 0 }, { "version": "2.1.306", "mode": "bedrock-proxy", "terminated_after_observation": true, "exit_code": 143, "server_requests": [ { "method": "GET", "path": "/inference-profiles?type=SYSTEM_DEFINED" }, { "method": "POST", "path": "/model/[synthetic-test-model]/invoke-with-response-stream" } ], "proxy_connect_count": 2 } ], "source_sha256": { "claude-incident-results.json": "f1d9bbd33e0371b9faf15a44395e91a03fb1cb683b98ddd456dfb803b4093c28", "claude-incident-summary.json": "4bbaac10428833e09f87d828ab915f334535b9d2a280e77fa9c3b5145c2566a3", "claude-arm64-static.json": "d587db6571c85dba2332ea8363630d5c56e2be7eccd3937329064c125741ca38", "claude-install-versions.log": "e700ade950693f46499b612c14f603cf82495088bd1ee98a084e2a6eb6c501ca", "custom-ca-qualified.log": "bef8743045cea2d07f845b16a78f0026844189fb83a7f6c65de9d248f85bc080", "claude-incident-proof.py": "788fa3772cb78f8771c53eb9f608e1fa125469c278fc38418e38a41be69f9721", "custom-ca-proof.py": "2b5a39b910736cbbb3d1965d1d373b51a23a03f1fad7994ad16fc448bcd44077" }, "redaction": "Only native certificate-error/HTTP405 diagnostic lines copied from raw debug tails. Full debug tails, runtime model identities, request headers, internal guest paths and UUIDs omitted. Synthetic model path component and proxy endpoints removed." }Landing scope
Landing is explicitly authorized with the existing automatic multiarchitecture GHCR runtime-image publication from main. The selected direct Claude CLI is independent of the separately waiting ACPX adapter. No tag-driven CLI/npm release is initiated.