Runtime modification notice (23 October 2026)

The bundled Python 3.12.14 runtime is not an unmodified PSF Windows installer. Its ssl.SSLContext constructor additionally loads a bundled rejection-policy certificate file, codex-rejected-cas.pem, using OpenSSL trusted-certificate auxiliary data to distrust emSign ECC Root CA - G3. This build retains that security restriction. This is a change to Python, not a claim that the entire application is part of Python. Native dependencies can differ from PCbuild default versions: observed Python OpenSSL 3.5.8, cryptography OpenSSL 4.0.3, SQLite 3.53.1 and Tcl/Tk 8.6.12. Original copyright and licence texts accompany the runtime.

The policy PEM contains public certificate/trust data, not a private key. The exact policy input is supplied in the source-material archive for inspection, together with its source-context excerpt; it is not a recommendation to install or trust that certificate. Nuntivra-specific changes do not restrict rights granted by applicable upstream licences.
