@@ -4,6 +4,30 @@ All notable changes to AgentFlow are documented in this file.
 
 ## [Unreleased]
 
+### Security — the Flink image stops shipping pip's vendored packages
+
+* **pip's vendored dependency set was the image's last two unwaived HIGH
+  findings.** Trivy reads `pip/_vendor/vendor.txt` as installed packages, so
+  msgpack 1.1.2 (GHSA-6v7p-g79w-8964) and setuptools 70.3.0 (CVE-2025-47273)
+  were reported against `agentflow-flink` even though no code imports either.
+  Neither is fixable in place: no pin changes what pip vendors, and both
+  advisories are fixed upstream, so neither qualifies for a waiver — the rule
+  `security/trivy-waivers.json` enforces is *upstream has published no fix*
+  (FB-02).
+* **Nothing installs at runtime, so the build removes pip** once the venv is
+  complete; the API image has shipped without it since P1-3. The job's
+  dependencies are the hash-locked `flink-requirements.lock` set, and PyFlink
+  shells out to pip only when `python.requirements` is configured, which no
+  job here sets.
+* **The removal is proven, not assumed.** It runs in the same layer that
+  installed the requirements — a later `RUN` would leave pip's files in an
+  earlier layer, where an image pulled at that layer still carries them — and
+  an `apache_beam`/`pyflink` import immediately after it fails the *build* if
+  the venv no longer starts, instead of failing the smoke job or production.
+* **A shell in the container now has no `pip install`.**
+  `docs/operations/flink-operators.md` says so, and says what to do instead:
+  change the lock and rebuild.
+
 ### Quality — the auth-manager coverage gate was measuring 82%, not 94%
 
 * **The file list *is* the gate.** `Run auth manager coverage gate` runs the
 
@@ -120,6 +120,13 @@ standard `/docker-entrypoint.sh`. PyFlink and job dependencies live in
 `/opt/pyflink-venv`; both rendered jobs pass that interpreter through
 `-pyclientexec`.
 
+That venv ships no `pip`. pip carries vendored copies of its own
+dependencies (`pip/_vendor`), and those copies were the image's last two
+unwaived HIGH findings -- unfixable in place, because no pin changes what pip
+vendors. Nothing installs at runtime, so the build removes pip once the venv
+is complete. A shell in the container therefore has no `pip install`: change
+`flink-requirements.lock` and rebuild the image instead.
+
 ## Kubernetes Operator 1.15 compatibility
 
 Install the pinned Apache Flink Kubernetes Operator 1.15.0 chart before the
 
@@ -21,6 +21,17 @@ ARG CURL_GUARDS="--connect-timeout 30 --speed-limit 65536 --speed-time 60 --retr
 USER root
 # BuildKit cache reuses a verified JAR across CI's same-runner build retry.
 # Cache hits skip the network; corrupt/partial entries are discarded.
+#
+# pip is removed once the venv is built. pip vendors its own dependency set
+# (pip/_vendor/vendor.txt), which Trivy reports as installed packages: msgpack
+# 1.1.2 (GHSA-6v7p-g79w-8964) and setuptools 70.3.0 (CVE-2025-47273) were the
+# image's last two unwaived HIGH findings, and both are unfixable in place --
+# no pin can change what pip vendors, and both advisories are fixed upstream,
+# so neither qualifies for a waiver under security/trivy-waivers.json. Nothing
+# installs at runtime: the job's dependencies are the hash-locked set above,
+# and PyFlink only shells out to pip when python.requirements is configured,
+# which no job here sets. The API image drops pip for the same reason. The
+# import check after the removal proves the venv still runs the job's stack.
 RUN --mount=type=cache,id=flink-sql-connector-kafka-5.0.0-2.2,target=/var/cache/flink-connectors \
     apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates curl python3 python3-pip python3-venv \
@@ -63,6 +74,8 @@ RUN --mount=type=cache,id=flink-sql-connector-kafka-5.0.0-2.2,target=/var/cache/
     && /opt/pyflink-venv/bin/python -m pip install --no-cache-dir --upgrade pip \
     && /opt/pyflink-venv/bin/python -m pip install --no-cache-dir --require-hashes -r /tmp/flink-requirements.lock \
     && /opt/pyflink-venv/bin/python -c "from importlib.metadata import version; v = version('apache-flink'); assert v == '${FLINK_VERSION}', f'flink-requirements.lock installed apache-flink {v}, ARG FLINK_VERSION is ${FLINK_VERSION}'" \
+    && /opt/pyflink-venv/bin/python -m pip uninstall --yes pip \
+    && /opt/pyflink-venv/bin/python -c "import apache_beam, pyflink; from pyflink.datastream import StreamExecutionEnvironment" \
     && rm -rf /var/lib/apt/lists/* /tmp/flink-requirements.lock
 
 WORKDIR /opt/agentflow
 
@@ -0,0 +1,78 @@
+"""Contract: the Flink job image does not ship pip.
+
+pip vendors its own dependency set (``pip/_vendor/vendor.txt``) and Trivy
+reports those vendored copies as installed packages. msgpack 1.1.2
+(GHSA-6v7p-g79w-8964) and setuptools 70.3.0 (CVE-2025-47273) were the image's
+last two unwaived HIGH findings and are unfixable in place: no pin changes what
+pip vendors, and both advisories have upstream fixes, so neither is waivable
+under ``security/trivy-waivers.json``. Removing pip once the venv is built is
+the fix, and it is only safe while nothing installs at runtime.
+
+Docker is not available on the Windows development host, so these checks read
+the Dockerfile text. The image rebuild plus Trivy proof is the CI ``trivy`` job;
+the job actually starting is the CI ``flink-smoke`` job.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+DOCKERFILE = PROJECT_ROOT / "src" / "agentflow_runtime" / "processing" / "flink_jobs" / "Dockerfile"
+
+VENV_PYTHON = "/opt/pyflink-venv/bin/python"
+REQUIREMENTS_INSTALL = f"{VENV_PYTHON} -m pip install --no-cache-dir --require-hashes"
+PIP_REMOVAL = f"{VENV_PYTHON} -m pip uninstall --yes pip"
+IMPORT_CHECK = f'{VENV_PYTHON} -c "import apache_beam, pyflink;'
+
+
+def _dockerfile() -> str:
+    return DOCKERFILE.read_text(encoding="utf-8")
+
+
+def test_the_runtime_venv_does_not_keep_pip() -> None:
+    text = _dockerfile()
+
+    assert text.count(PIP_REMOVAL) == 1
+
+
+def test_pip_is_removed_after_the_locked_requirements_are_installed() -> None:
+    text = _dockerfile()
+
+    install_at = text.index(REQUIREMENTS_INSTALL)
+    removal_at = text.index(PIP_REMOVAL)
+
+    assert install_at < removal_at
+
+
+def test_pip_is_removed_in_the_same_layer_that_installed_it() -> None:
+    text = _dockerfile()
+
+    # A removal in a later RUN would leave pip's files in the earlier layer,
+    # and an image pulled at that layer still carries the vendored packages.
+    venv_run = next(block for block in text.split("\nRUN ") if REQUIREMENTS_INSTALL in block)
+
+    assert PIP_REMOVAL in venv_run
+
+
+def test_the_venv_is_proven_to_still_import_the_job_stack_after_the_removal() -> None:
+    text = _dockerfile()
+
+    removal_at = text.index(PIP_REMOVAL)
+    import_at = text.index(IMPORT_CHECK)
+
+    # Without this the build would happily produce an image whose Python
+    # environment no longer starts, and the failure would land in flink-smoke
+    # (or production) instead of the build.
+    assert removal_at < import_at
+    assert "StreamExecutionEnvironment" in text[import_at : import_at + 200]
+
+
+def test_the_reason_pip_cannot_simply_be_upgraded_is_recorded() -> None:
+    text = _dockerfile()
+
+    # The next person to reach for "just bump pip" needs the two advisory ids
+    # and the reason a waiver is not available for them.
+    assert "GHSA-6v7p-g79w-8964" in text
+    assert "CVE-2025-47273" in text
+    assert "pip/_vendor" in text