[gregoryfoster]

Refs #66 (the deploy and live checks come after the merge).

The release venv trusts certifi's bundle, not the system store, and certifi 2026.07.22 still holds emSign ECC Root CA - G3, the root of the eMudhra-compromised chains. 2026.10.19 drops it.

Change

• uv.lock: uv lock --upgrade-package certifi, 2026.7.22 → 2026.10.19. No other package moves. The diff also adds [manifest] constraints and moves revision 3 → 5. Both of the lock's readers handle that: CI's setup-uv@v7 (latest) and deploy's /usr/local/bin/uv 0.13.5, which wrote it.
• The floor: [tool.uv] constraint-dependencies = ["certifi>=2026.10.19"], commented with certifi ≥ 2026.10.19: the live venv still trusts the eMudhra-compromised emSign G3 chain #66 and the advisory. certifi stays transitive.
• The guard: new tests/test_tls_trust.py. The lock and the installed certifi are ≥ 2026.10.19, compared as dated parts. The bundle has no subject CN emSign ECC Root CA - G3: it parses the certificates with ssl, not the comment lines. A control checks that the matcher sees emSign Root CA - G1. Red first (fabdcba): 3 failed on 2026.07.22. Green after the lock.
• Docs: DEPLOYMENT.md gets a ## TLS trust section: the trust is certifi's, a distrust is a bump plus a deploy, and the restart is the fix. Also the AGENTS.md Detail Docs line, and the plan at docs/plans/2026-10-23-66-certifi.md.

processor_version stays 0.38.0+1 (certifi isn't co-core), so no Watcher notice is due (D5).

Verified

• uv run pytest: 701 passed, 14 skipped. ruff check and ruff format --check are clean.
• tests/test_pin.py is green: co-core didn't move.

After the merge

git pull --ff-only → scripts/deploy.sh → live checks: the release venv's certifi is ≥ 2026.10.19, the noct host raises SSLError, a good site answers, starting and NRestarts, the next ack, the next drift run.

🤖 Generated with Claude Code