The vision tie-breaker failed TLS once the worker image was unpacked onto the virtual machine. That Python’s OpenSSL still looks for certificates under a path that exists only inside the container. urllib was following those defaults. It now verifies with the bundle the other Google clients already carry. The human had blamed the host trust store.