ops(bake-in): bump bio submodule + Operator Action #11 for volume cleanup

[ahmetabdullahgultekin]

Summary

Parent-side companion to bio repo PR
Rollingcat-Software/biometric-processor#104
which closes the 4th recurrence of feedback_readonly_rootfs_cache_dirs
(prior offenders: DeepFace, Numba, UniFace; now MiniFASNet).

• Bumps biometric-processor submodule from 053e73d → 726d3c3
  (fix(docker): bake DeepFace/Facenet weights + self-healing cache volume).
• Adds Operator Action item 11 to OPERATOR_ACTIONS_2026-05-12.md
  with the post-merge cleanup runbook + dependency-matrix update.

Why the bug existed

Bio container runs with read_only: true rootfs and a named volume
biometric_models mounted at /tmp/.deepface. The volume is created by
Docker owned by root:root. The app runs as uid 100. When DeepFace tries
to download MiniFASNet .pth weights on first inference it cannot write
the cache → silently degrades → anti-spoof verdict collapses to
false-positive.

Today's hot-fix manually docker cp'd the two .pth files into the
live volume. That fix was load-bearing on operator memory: next
docker volume rm would have re-triggered the bug.

What ships with the bio submodule bump

• New model-fetcher Dockerfile builder stage downloads the four
  critical weight files with SHA256 verification at build time:
  • facenet512_weights.h5 (3f76b51...)
  • centerface.onnx (77e394b...)
  • 2.7_80x80_MiniFASNetV2.pth (a5eb02e...)
  • 4_0_0_80x80_MiniFASNetV1SE.pth (84ee1d3...)
• deploy/entrypoint.sh runs as root, chowns /tmp/.deepface to
  100:101, seeds missing weights from /opt/baked-models/, then drops
  to uid 100 via gosu.
• App user uid/gid pinned explicitly to 100/101.
• .env.example documents DEEPFACE_FACENET512_SHA256 required by PR
  infra(submodule): bump web (suite green) #102 (DEEPFACE_SHA256_REQUIRED=true).

Operator Action item 11 (added here)

Post-rebuild cleanup runbook. Two paths:

• A — Wipe & verify self-heal (recommended).

  cd /opt/projects/fivucsas/biometric-processor
  docker compose -f docker-compose.prod.yml --env-file .env.prod down biometric-api
  docker volume rm biometric-processor_biometric_models
  docker compose -f docker-compose.prod.yml --env-file .env.prod up -d biometric-api
  docker exec biometric-api ls -la /tmp/.deepface/.deepface/weights/

• B — Keep & re-own the existing volume.

  chown -R 100:101 /var/lib/docker/volumes/biometric-processor_biometric_models/_data
  docker compose -f docker-compose.prod.yml --env-file .env.prod restart biometric-api

Acceptance: docker exec biometric-api stat -c '%u:%g' /tmp/.deepface/.deepface/weights/facenet512_weights.h5 returns 100:101.

Base branch

This PR targets fix/2026-05-12-infra-hygiene (the open PR #67 which
introduces OPERATOR_ACTIONS_2026-05-12.md). Once PR #67 merges to
master, this PR will retarget master automatically. The submodule
bump and the new item 11 are independent of items 1–10 and do not
conflict.

Test plan

• After merge: rebuild bio image and verify the four SHA256 checks pass in the build log.
• Run Operator Action item 11 path A (volume wipe) and confirm self-heal seeds the four model files with the documented SHAs.
• Run a face /verify call against the testbed and confirm anti-spoof verdict no longer returns block due to missing MiniFASNet.
• Confirm OPERATOR_ACTIONS_2026-05-12.md reads cleanly end-to-end and the dependency matrix lists 11 rows.

Memory references

• feedback_readonly_rootfs_cache_dirs (4th sighting)
• feedback_env_file_docker (commands use --env-file .env.prod)
• feedback_git_push (bare git push -u origin <branch>)
• reference_fivucsas_branch_model (parent integration is master, default main; targeted intermediate fix/2026-05-12-infra-hygiene because the OPERATOR_ACTIONS file is only on that branch today)

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[ahmetabdullahgultekin]

Superseded: the bio submodule bump (053e73d→726d3c3) + Operator Action #11 already landed on master via #69; residual commits already shipped via #74. Closing.