[tom-sapletta-com]

FixOS reported 22.6 GB of dangling images as reclaimable even though those images were still used by containers and Docker reclaimed 0 B. The inventory now excludes images referenced by running or stopped containers, distinguishes logical image totals from unknown shared-layer reclaimability, and keeps missing BuildKit measurements unknown.

Validation: 10 focused regressions (9 failed before the fix), 32 cleanup tests, Ruff including import sorting, managed governance, a real read-only Docker inventory, and the full governed Goal suite. Existing Docker prune commands are retained.

Ticket: ticket-113

Publication is delegated to the protected independent Validator for the exact frozen head. Contributor credentials must not merge.

[ifuri-validator-agent]

Validator approval after policy checks for exact head 6f5eb219aefd1323b4d438f3484ddb83ae15b643.

Ticket: ticket-113
Correlation ID: fixos113-6f5eb21-20261031
Model: zai/glm-5.3
Reviewed diff chunks: 2
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 2 diff chunk(s). Change excludes container-referenced images from dangling-image prune inventory, reports reclaimable_bytes as null for shared-layer totals, and preserves unknown state on failed usage reads. Strict output validation of docker IDs is prudent. Note-building logic is slightly convoluted but functionally harmless. Required checks (test 3.10/3.11/3.12, test-summary, onedev/local-verify) all PASS; observational checks also pass. | Test chunk for the cleanup buildcache logic adds focused regressions: container-referenced image exclusion, unknown vs zero reclaimable BuildKit measurement, and CLI labeling of unknown reclaimability. Logic in the tests is sound, no security concerns, and all required checks passed.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: not_required; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 0afa281482622cf1816293e5a5e9e61b5d043e46...6f5eb219aefd1323b4d438f3484ddb83ae15b643
Change digest: 065924c93f97299101a4fa40ec6f9b0348d1b2c27cfa382afbb70686e161dce9
Score: 44/100 (M), estimated 47 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":271,"base_sha":"0afa281482622cf1816293e5a5e9e61b5d043e46","binary_files":0,"categories":{"code":1,"configuration":1,"docs":1,"tests":1},"change_digest":"065924c93f97299101a4fa40ec6f9b0348d1b2c27cfa382afbb70686e161dce9","comparison":"0afa281482622cf1816293e5a5e9e61b5d043e46...6f5eb219aefd1323b4d438f3484ddb83ae15b643","deletions":7,"file_count":4,"files":["fixos/cli/_cleanup_space.py","project/ticket-113/README.md","project/ticket-113/intent.json","tests/unit/test_cleanup_docker_buildcache.py"],"head_sha":"6f5eb219aefd1323b4d438f3484ddb83ae15b643","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":3,"delivery":2,"scope":2,"uncertainty":3,"validation":1},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":47,"within_budget":false},"impact":{"components":["fixos","project","tests"],"files":["fixos/cli/_cleanup_space.py","project/ticket-113/README.md","project/ticket-113/intent.json","tests/unit/test_cleanup_docker_buildcache.py"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":44,"split":{"parts":[{"estimated_minutes":13,"name":"Implement fixos","scope":["fixos"]},{"estimated_minutes":13,"name":"Implement project","scope":["project"]},{"estimated_minutes":13,"name":"Implement tests","scope":["tests"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-113"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-113: fix(cleanup, ticket-113): preserve unknown Docker reclaimability</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 89,56 79,85 59,71 48,59" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 47m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-113-4513
TICKET ticket-113
HEAD_SHA 6f5eb219aefd1323b4d438f3484ddb83ae15b643
CORRELATION_ID fixos113-6f5eb21-20261031
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test-summary=PASS","test (3.10)=PASS","test-ubuntu=PASS","test-alpine=PASS","test (3.12)=PASS","test-fedora=PASS","test-arch=PASS","governance / remote lifecycle=PASS","test (3.11)=PASS","test-debian=PASS","governance / enforce=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["onedev/local-verify","test (3.10)","test (3.11)","test (3.12)","test-summary"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/fixos","pull_request":146,"head_sha":"6f5eb219aefd1323b4d438f3484ddb83ae15b643","base_sha":"0afa281482622cf1816293e5a5e9e61b5d043e46","diff_sha256":"930a63b2aa87902bef092e8e302a2cc3cc9dc8cc0d5686c5cdb9bf454e521aea"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":false,"critical_paths":[],"observed_paths":["fixos/cli/_cleanup_space.py","project/ticket-113/README.md","project/ticket-113/intent.json","tests/unit/test_cleanup_docker_buildcache.py"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"not_required","reason":null,"review_sha256":null,"unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"0afa281482622cf1816293e5a5e9e61b5d043e46","head_sha":"6f5eb219aefd1323b4d438f3484ddb83ae15b643","change_digest":"065924c93f97299101a4fa40ec6f9b0348d1b2c27cfa382afbb70686e161dce9","score":44,"complexity":"M","estimated_minutes":47,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"