The operator's superproject-discuss task superproject-chat-1790605165371930576 completed with exit status 0, but its shell tool failed before reading the workspace: Bubblewrap reported that the pod could not create a user namespace. The pod had Kubernetes RuntimeDefault seccomp and the default containerd AppArmor profile. The prepared SuperProject root contained only AGENTS.md and SUPERPROJECT.json; its unavailable_members listed AutoCoder-Engine and Documentation clone failures because Gitea's internal certificate was not trusted. The assistant response was therefore incomplete. Preserve that response as history; task completion was not outcome verification.
PR #6750 merged into dev as ccf6b7aff52c80039ef85488bf46d8d3bc132af4. Candidate run #3948 and its automatic main integration succeeded; production promotion served that exact source. The documented worker-image workflow was dispatched for the production source and selected gitea.app.lan/autocoder/autocoder-engine@sha256:c9c14cc44e23db6409d3c324d046991825e630cca72e32a30ccc953ac05300ea, replacing sha256:45b592ca390969e632cb5fa3490c7c1247c9a2133a6d81f1b4873dc29227460a.
Only the operator-chat worker container now selects the existing installed localhost seccomp profile autocoder/worker-sandbox.json and AppArmor profile autocoder-worker-sandbox; the init container and other worker scopes retain RuntimeDefault. The installed profile files on worker01 matched the repository source SHA-256 values 51dd053b256ede84d0046210fac95e32c8de6beb3254b55eb8635ce2f3d1f01d and 2bdb1c876d675ad87366cd5f069ca3010b141e8b79f9eb535f29c3166abecf28. The worker remains non-root with all capabilities dropped and privilege escalation disabled.
Detached worker pods now mount the existing immutable runtime CA ConfigMap autocoder-runtime-ca-b76bcb2776ce3a9e7d027a17a4c36b6cb547182fcc1bcda15b3ab43f305fcf85 at /etc/autocoder/trust, and Git/TLS clients receive its certificate path. The App Server subprocess inherits only the CA path, not the worker's Gitea token or administrator credentials. The ConfigMap data hash matched its repository contract.
A credential-free diagnostic pod on worker01 ran Codex :read-only pwd and denied a write under the installed profiles; the temporary pod was deleted. After rollout, all three operator pods reached Running on the new digest. In a live operator pod, codex sandbox -P :read-only ran pwd and read the prepared root, and curl --cacert reached Gitea's version endpoint with HTTP 200. Unauthenticated Git reached the authentication step instead of a certificate error. Production flags remained background=false, implementation=false, requirements=false, operator-chat=true.
No new normal SuperProject chat task has yet rematerialized the two child repositories, so the full agent response and UI context remain unverified. Do not describe the earlier failed task as repaired retroactively. The normal next chat task is the acceptance evidence for child checkouts and App Server shell use. Broader host-administrator permissions, if requested, are a separate authority and product-scope decision.
The worker image was selected through the repository's publish-and-drain workflow with migration Lease and rollback handling. If rollback is needed, restore the prior immutable worker digest through that path after inspecting active task ownership. Preserve chat history and queued/running task records.