[antoinetoussaint-byte]

Python companion 0.0.7 inherits two copies of pip26.2.2's vulnerable vendored dependencies: installed pip and the ensurepip bootstrap wheel. Removing only one leaves the other available. The current upstream pip wheel matches the bundled wheel, so upgrading standalone packages or reinstalling current pip does not replace those vendors.

Fix at the owner: remove build-only pip after installing debugpy, and remove ensurepip using Python's sysconfig-derived standard-library path. Keep uv, debugpy and their metadata. No vendor list, SBOM, or advisory suppression is modified. Core0.19.16 selects new immutable Python0.0.8. Agent wire contract unchanged.

Reuse and scope: the existing uv-based FastAPI/runtime and DAP paths remain owners of environment creation and debugging. Core's host-process editable-library and upgrade helpers are unchanged; a companion filesystem change does not justify redefining their interpreter contract. Direct in-image pip/ensurepip/default venv bootstrap and pip-dependent CLI commands are not preserved. Documentation: companions/python/README.md records these limits, DAP protocol ordering, verification and historical-layer scope.

The maintained DAP client also needed three owner fixes exposed during qualification: complete configuration before awaiting deferred launch/attach responses, preserve early telemetry bytes read by the connection probe, and omit unspecified launch args/env instead of serializing null. Explicit args/env overrides are preserved. The unchanged tagged image test continues to exercise the production client.

Validation: source companion/version checks passed. Independent review accepted the narrow image design and DAP ordering/byte preservation at a262446; focused protocol regression race count10 passed. Python0.0.8 was published from exact a262446 as candidate index sha256:d47baaec3ffe9b197cd998b9949e5aea7f1557b9e269689f00f504d46f41983d by https://github.com/codefly-dev/cli/actions/runs/40784597603, with verified attestation. Both architectures freshly executed pip/ensurepip absence, adapter entrypoint and uv installation/import in that publishing build. Core0.19.16 is not released.

Actual arm64 tagged DAP execution at a262446 failed: debugpy rejected null args with Invalid message: "args"[0] must be str. Test exit1, exact owned container cleanup verified through destroy event and subsequent absence. A pure production-client wire regression reproduced null args/env before the correction. The correction at 0ffe2e6 passes race count10 and go vet, and fresh independent review accepted it with additional nil/empty/mixed wire tests. The unchanged actual-image test now PASSES on arm64 (exit0, package6.253s): production Docker backend, initialize/launch/termination and debugpy import plus pip/ensurepip-absence marker. Exact test container65f3ed7493889bd655d380e46c038a626d7f95ba7ac7e9ed5e01e94b1623deeb was destroyed; subsequent inspection verifies absence. Actual DAP execution was arm64 only; both image architecture build checks passed. Dockerfile/image inputs did not change. Final normal CI remains pending before readiness/merge.

FastAPI owner107 has prepared an explicit native candidate pinned to the published Python index. Final service rebuild/import checks and exact-digest scans remain downstream obligations. This DAP-specific failure does not itself establish ordinary application runtime failure. No NYL clearance claim. Removal changes the merged runtime filesystem, not historical immutable layer blobs.