v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/stacks/unattended.go

@@ -19,7 +19,8 @@ import (
 // It presses the SAME public guarded Update a person presses (StartGuardedUpdate) — no second update
 // path — one app at a time, ONE tested step per app per night, and never:
 //   - an app whose installed version has no ladder entry (older than the ladder, or no test record);
-//   - a step whose verdict is not `proven`, or that carries the `needs_person` mark;
+//   - a step whose verdict is not `proven` or `security_fix` (v0.341.0, decision 255 — an urgent fix proven on the
+//     box, bench optional; every other guard below holds for it unchanged), or that carries the `needs_person` mark;
 //   - a `files_may_change` step unless a fresh WHOLE copy of the app exists on the box (decision 25/26);
 //   - the step that was undone or held last time, while the catalog's ladder is unchanged (R-680);
 //   - a held app, an app that is current, ahead, or unorderable.
@@ -92,6 +93,8 @@ type LegStep struct {
 	From    map[string]string `json:"from,omitempty"`
 	To      map[string]string `json:"to,omitempty"`
 	Seconds float64           `json:"seconds,omitempty"`
+	// Security names the public notice of a security_fix step the leg took (v0.341.0, decision 255): its CVE/GHSA ids.
+	Security []string `json:"security,omitempty"`
 }
 
 // UpdateLegSummary is one night's leg — the operator's summary line and the hub report's `update_leg`.
@@ -123,9 +126,15 @@ func (s *UpdateLegSummary) Line() string {
 	if s.Stopped != "" {
 		stop = " stopped=" + s.Stopped
 	}
-	return fmt.Sprintf("update leg (%s): done=%d undone=%d held=%d failed=%d skipped=%d%s in %s [skipped: %s]",
+	sec := ""
+	for _, st := range s.Steps {
+		if len(st.Security) > 0 && st.Outcome != LegOutcomeSkipped {
+			sec += fmt.Sprintf(" [security fix %s: %s %s]", st.App, strings.Join(st.Security, ","), st.Outcome)
+		}
+	}
+	return fmt.Sprintf("update leg (%s): done=%d undone=%d held=%d failed=%d skipped=%d%s in %s [skipped: %s]%s",
 		s.Trigger, s.Done, s.Undone, s.Held, s.Failed, s.Skipped, stop,
-		s.EndedAt.Sub(s.StartedAt).Round(time.Second), strings.Join(skips, ", "))
+		s.EndedAt.Sub(s.StartedAt).Round(time.Second), strings.Join(skips, ", "), sec)
 }
 
 func (s *UpdateLegSummary) add(st LegStep) {
@@ -334,10 +343,17 @@ func (m *Manager) runUpdateLeg(ctx context.Context, trigger string, manual bool)
 				continue
 			}
 			m.logger.Printf("[INFO] [update-leg] %s: step pressed %s → %s", name, summarisePin(entry.From), summarisePin(entry.To))
+			var secIDs []string
+			if entry.Verdict == LadderVerdictSecurityFix {
+				if entry.Security != nil {
+					secIDs = entry.Security.IDs
+				}
+				m.logger.Printf("[INFO] [update-leg] %s: security fix %s taken (%s → %s)", name, strings.Join(secIDs, ","), summarisePin(entry.From), summarisePin(entry.To))
+			}
 			m.setLegFlags(true, true)
 			outcome := m.legWait(ctx, o, name)
 			m.setLegFlags(true, false)
-			step := LegStep{App: name, Outcome: outcome, From: entry.From, To: entry.To, Seconds: o.Now().Sub(t0).Round(100 * time.Millisecond).Seconds()}
+			step := LegStep{App: name, Outcome: outcome, From: entry.From, To: entry.To, Seconds: o.Now().Sub(t0).Round(100 * time.Millisecond).Seconds(), Security: secIDs}
 			sum.add(step)
 			m.recordAutoUpdate(name, &AutoUpdateRecord{At: t0.UTC().Format(time.RFC3339), Outcome: outcome, From: entry.From, To: entry.To})
 			m.logger.Printf("[INFO] [update-leg] %s: step ended %s after %.1f s", name, outcome, step.Seconds)
@@ -438,7 +454,7 @@ func (m *Manager) legCandidate(ctx context.Context, name string, o *UpdateLegOpt
 		return LadderEntry{}, LegSkipOlderThanLadder
 	}
 	e := ladder[idx]
-	if e.Verdict != "proven" {
+	if e.Verdict != "proven" && e.Verdict != LadderVerdictSecurityFix {
 		return e, LegSkipNotProven
 	}
 	if e.Marks.NeedsPerson != nil && strings.TrimSpace(*e.Marks.NeedsPerson) != "" {