R-1303: every pin names its security-notice source (upstream.txt, # upstream: above each FROM); gate upstream + decoys. No runtime change.

controller/scripts/controller_gates.py

@@ -21,6 +21,8 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
   …  security-scan      govulncheck (called vulnerabilities) + gitleaks on the pushed commits, WARN-FIRST: it
                         lists, it never refuses (R-986; shared, felhom.eu/scripts/security_scan_gate.py). Fast
                         although it reads vuln.go.dev: offline it says NOT CHECKED, so it cannot stop a push
+  …  upstream           every infra.go pin and every Dockerfile FROM names where its security notices are
+                        published (R-1303; shared, felhom.eu/scripts/security_watch_inventory.py)
   …  gate-decoys        the decoy suite (test_gate_decoys.py): every gate above still convicts its
                         decoys (R-1116). ~22 s and it edits real files in this tree for a moment, so
                         the full run only, never --fast (never the hook, never CI)
@@ -65,6 +67,8 @@ SHARED_INSTRUCTIONS = os.path.join(SHARED_DIR, "instructions_gate.py")
 SHARED_OBSERVATIONS = os.path.join(SHARED_DIR, "observations_gate.py")
 # R-986 — shared too: the dependency and secret scanner, warn-first.
 SHARED_SECURITY = os.path.join(SHARED_DIR, "security_scan_gate.py")
+# R-1303 — shared too: every pin names where its security notices are published (the nightly watch reads it).
+SHARED_UPSTREAM = os.path.join(SHARED_DIR, "security_watch_inventory.py")
 
 # R-404 — the golden NOTICE. Lives here, beside the runner, because it is about THIS repo's
 # releases; it imports the felhom.eu gate rather than copying its comparison.
@@ -114,6 +118,9 @@ GATES = [
     # although it reads vuln.go.dev: it cannot refuse, so a network blink is a NOT CHECKED line. ~8 s here. CI fetches
     # the pinned gitleaks (FELHOM_SCAN_FETCH=1) and has no Go, so govulncheck says NOT CHECKED there.
     ("security-scan",   SHARED_SECURITY,                                       [REPO],   True, True),
+    # R-1303 (2026-10-26) — every infra.go pin (upstream.txt beside it) and every Dockerfile FROM / restic ARG (a
+    # `# upstream:` comment directly above) names its notice source. Fast: stdlib file reads.
+    ("upstream",        SHARED_UPSTREAM,                                       ["--gate=controller", REPO], True, True),
     # R-404 — ADVISORY. Reports the golden debt where it is created; never refuses.
     ("golden-notice", GOLDEN_NOTICE, [REPO], True, False),
     # R-1116 (2026-10-17) — the gates' OWN decoy suite: every gate above, red-proved against its decoys. It was