Fleet declares NO python in automation (infra/CLAUDE.md; sovereign-ci image has no python3 by design) — aprender has 53 .py scripts and 97 shell guards invoking python: inventory, UNMEASURED-with-a-name, and interpreter-free readers #3649

What

Fleet declaration from the infra lane (infra-c8, 2026-09-21 02:05Z, for infra#708): the fleet's stack does not include a TOML-capable python on runners — or any python in automation. infra/CLAUDE.md: "PYTHON IS BANNED … no python3 -c … in a workflow step, Makefile recipe or guard"; the sovereign-ci image having no python3 is the premise, not a gap. Measured tonight: the intel host runs python 3.10.12 with neither tomllib nor tomli; the sovereign-ci container has no python3 at all; lambda has 3.13 (every local run green) — #3626 and #3647 died on it and now report UNMEASURED (rc=2) there.

aprender on origin/main today: 53 .py files under scripts/, 97 shell scripts that invoke python/python3, 6 workflow files that invoke it (counts from git ls-tree -r origin/main + grep; the command is the number). Every one of those is UNMEASURED-or-dead on a runner class the fleet declares python-free, and whether a given guard-tree run lands on such a runner is the runner lottery.

Ruling in force (cop, 02:10Z)

UNMEASURED with a name (rc=2, interpreter + $RUNNER_NAME) is the honest state and stays. The durable path is infra's declaration, not a python install: for Cargo.toml, cargo metadata --format-version 1 | jq (cargo is on every runner by definition of the job); for other TOML/YAML, the sovereign stack owes a reader (bashrs or a tiny Rust bin). No "which runners lack python" sensor — it would measure a dependency the declaration says must not exist.

done_when

• an inventory row per python-dependent guard/script/workflow step on main, with its runner classes and whether it is on a required-check path (derived, in the PR body, from the commands above)
• every guard on a required-check path either reads without an interpreter or classifies python absence as UNMEASURED(rc=2) with the runner named — never rc=1, never a false PASS; a planted python3 that exits 127 turns each case row to UNMEASURED (control table)
• the count of python3 -c / .py invocations on required-check paths is a shrink-only ledger with the reason per remaining row

Refs infra#708, #3626, #3647, #3635. 0.70; not a cut input — but the first required check that lands a python guard on a container is.