coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close verified zlib remediation and lifecycle repair workplan

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 13:29:23 +02:00
parent 312ab97e87
commit 47881fc1ff
28 changed files with 4010 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

55
docs/evidence/2026-10-11-purpose-image-release/inherited-vulnerability-follow-through.json
View file

@ -3,19 +3,60 @@
"kind": "owner-vulnerability-follow-through",
"owner": "informed-decision",
"task": "INFD-WP-0009-T05",
"status": "open",
"status": "resolved",
"created": "2026-10-11",
"review_due": "2026-10-18",
"finding": "CVE-2026-85091",
"scanner_severity": "MEDIUM",
"estate_risk_grade": null,
"affected_package": "zlib",
"installed": "1.3.2-r0",
"installed": "1.3.2-r1",
"fixed": "1.3.2-r1",
"actual_current_base_and_candidate_findings_identical": true,
"actual_current_base_and_candidate_findings_identical": false,
"source_evidence": "security-summary.json, trivy-full.json, base-trivy-full.json",
"human_temporary_disposition": "pending",
"follow_through": "Prepare a separately source-bound official-base/dependency refresh through normal owner CI, verify full scan and runtime compatibility, obtain distinct native release approval before updating this workload",
"manual_review_expiry": "Due date requires owner review/escalation if unresolved; no automatic rollback/controller is installed",
"close_condition": "Verified installed native fixed package and full unfiltered rescan; preserve original detection and any human disposition"
"human_temporary_disposition": "closed-by-distinct-approved-remediation",
"follow_through": "Completed actual independently reviewed founder-approved native zlib-only remediation; original detection and every failed/prephase/source refinement retained",
"manual_review_expiry": "Original manual due2026-10-18; resolved2026-10-11 by installed remediation proof. No automatic controller or permanent zero-vulnerability claim.",
"close_condition": "Verified installed native fixed package and full unfiltered rescan; preserve original detection and any human disposition",
"resolved": "2026-10-11",
"original_detection": {
"id": "INFD-RISK-20261011-ZLIB-85091",
"kind": "owner-vulnerability-follow-through",
"owner": "informed-decision",
"task": "INFD-WP-0009-T05",
"status": "open",
"created": "2026-10-11",
"review_due": "2026-10-18",
"finding": "CVE-2026-85091",
"scanner_severity": "MEDIUM",
"estate_risk_grade": null,
"affected_package": "zlib",
"installed": "1.3.2-r0",
"fixed": "1.3.2-r1",
"actual_current_base_and_candidate_findings_identical": true,
"source_evidence": "security-summary.json, trivy-full.json, base-trivy-full.json",
"human_temporary_disposition": "pending",
"follow_through": "Prepare a separately source-bound official-base/dependency refresh through normal owner CI, verify full scan and runtime compatibility, obtain distinct native release approval before updating this workload",
"manual_review_expiry": "Due date requires owner review/escalation if unresolved; no automatic rollback/controller is installed",
"close_condition": "Verified installed native fixed package and full unfiltered rescan; preserve original detection and any human disposition"
},
"resolution": {
"execution_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
"image": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"native_fixed_package": "1.3.2-r1",
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"fresh_full_scan_completed_at": "2026-10-11T10:48:46.790940+00:00",
"package_count": 44,
"allseverity_findings": 0,
"no_suppression": true,
"scan_fresh_at_actual_verification": true,
"verification_at": "2026-10-11T11:20:25.876927+00:00",
"receipt_manifest_sha256": "0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d",
"evidence": "docs/evidence/2026-10-11-zlib-native-acceptance/",
"review": "docs/reviews/2026-10-11-zlib-native-product-owner-acceptance.md",
"estate_risk_grade": null,
"future_vulnerability_assurance": false
}
}

10
docs/evidence/2026-10-11-zlib-native-acceptance/approved-local-image-readiness.json Normal file
View file

@ -0,0 +1,10 @@
{
"exact_image_available": true,
"pulled": true,
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"image_config_id": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"exact_registry_digest_bound": true,
"source_labels_match": true,
"container_execution": false,
"credentials_used": false
}

672
docs/evidence/2026-10-11-zlib-native-acceptance/approved-native-preflight.json Normal file
View file

@ -0,0 +1,672 @@
{
"all_checks_pass": true,
"observed_at": "2026-10-11T10:44:51.809259+00:00",
"native_changed": false,
"protected_database_read": false,
"secret_read": false,
"deployment_generation": 25,
"ready_replicas": 1,
"sealed_live_deployment": {
"apiVersion": "apps/v1",
"kind": "Deployment",
"metadata": {
"annotations": {
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
},
"name": "informed-decision",
"namespace": "informed-decision",
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
},
"spec": {
"progressDeadlineSeconds": 600,
"replicas": 1,
"revisionHistoryLimit": 10,
"selector": {
"matchLabels": {
"app.kubernetes.io/name": "informed-decision"
}
},
"strategy": {
"type": "Recreate"
},
"template": {
"metadata": {
"annotations": {
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
},
"labels": {
"app.kubernetes.io/component": "review",
"app.kubernetes.io/name": "informed-decision"
}
},
"spec": {
"automountServiceAccountToken": false,
"containers": [
{
"env": [
{
"name": "INFD_KEYCAPE_ISSUER",
"value": "https://kc.coulomb.social"
},
{
"name": "INFD_CONTAINER_CONFIG",
"value": "/configuration/runtime.json"
}
],
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"imagePullPolicy": "IfNotPresent",
"livenessProbe": {
"failureThreshold": 3,
"httpGet": {
"path": "/healthz",
"port": "http",
"scheme": "HTTP"
},
"periodSeconds": 10,
"successThreshold": 1,
"timeoutSeconds": 2
},
"name": "informed-decision",
"ports": [
{
"containerPort": 8080,
"name": "http",
"protocol": "TCP"
},
{
"containerPort": 8081,
"name": "workload",
"protocol": "TCP"
}
],
"readinessProbe": {
"failureThreshold": 3,
"httpGet": {
"path": "/healthz",
"port": "http",
"scheme": "HTTP"
},
"periodSeconds": 10,
"successThreshold": 1,
"timeoutSeconds": 2
},
"resources": {
"limits": {
"cpu": "500m",
"memory": "256Mi"
},
"requests": {
"cpu": "5m",
"memory": "64Mi"
}
},
"securityContext": {
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"ALL"
]
},
"readOnlyRootFilesystem": true
},
"startupProbe": {
"failureThreshold": 12,
"httpGet": {
"path": "/healthz",
"port": "http",
"scheme": "HTTP"
},
"periodSeconds": 10,
"successThreshold": 1,
"timeoutSeconds": 2
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"volumeMounts": [
{
"mountPath": "/data",
"name": "data"
},
{
"mountPath": "/run/informed-decision",
"name": "runtime"
},
{
"mountPath": "/tmp",
"name": "tmp"
},
{
"mountPath": "/configuration",
"name": "configuration",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/policy",
"name": "caller",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/audit",
"name": "audit",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
"name": "kubernetes-api",
"readOnly": true
},
{
"mountPath": "/workload-registry",
"name": "workload-registry",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/requester",
"name": "sitting-requester",
"readOnly": true
}
]
}
],
"dnsPolicy": "ClusterFirst",
"restartPolicy": "Always",
"schedulerName": "default-scheduler",
"securityContext": {
"fsGroup": 10001,
"fsGroupChangePolicy": "OnRootMismatch",
"runAsGroup": 10001,
"runAsNonRoot": true,
"runAsUser": 10001,
"seccompProfile": {
"type": "RuntimeDefault"
}
},
"serviceAccount": "review",
"serviceAccountName": "review",
"terminationGracePeriodSeconds": 45,
"volumes": [
{
"name": "data",
"persistentVolumeClaim": {
"claimName": "informed-decision-data"
}
},
{
"emptyDir": {
"medium": "Memory",
"sizeLimit": "16Mi"
},
"name": "runtime"
},
{
"emptyDir": {
"medium": "Memory",
"sizeLimit": "16Mi"
},
"name": "tmp"
},
{
"configMap": {
"defaultMode": 292,
"name": "informed-decision-runtime-6c221878d051"
},
"name": "configuration"
},
{
"name": "caller",
"projected": {
"defaultMode": 288,
"sources": [
{
"serviceAccountToken": {
"audience": "flex-auth",
"expirationSeconds": 3600,
"path": "token"
}
}
]
}
},
{
"name": "audit",
"secret": {
"defaultMode": 288,
"items": [
{
"key": "token",
"path": "token"
}
],
"secretName": "informed-decision-audit"
}
},
{
"name": "kubernetes-api",
"projected": {
"defaultMode": 288,
"sources": [
{
"serviceAccountToken": {
"expirationSeconds": 600,
"path": "token"
}
},
{
"configMap": {
"items": [
{
"key": "ca.crt",
"path": "ca.crt"
}
],
"name": "kube-root-ca.crt"
}
}
]
}
},
{
"configMap": {
"defaultMode": 292,
"name": "informed-decision-workload-registry"
},
"name": "workload-registry"
},
{
"name": "sitting-requester",
"secret": {
"defaultMode": 288,
"items": [
{
"key": "client-secret",
"path": "client-secret"
}
],
"optional": false,
"secretName": "informed-decision-sitting-requester"
}
}
]
}
}
}
},
"candidate_deployment": {
"apiVersion": "apps/v1",
"kind": "Deployment",
"metadata": {
"annotations": {
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
},
"name": "informed-decision",
"namespace": "informed-decision",
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
},
"spec": {
"progressDeadlineSeconds": 600,
"replicas": 1,
"revisionHistoryLimit": 10,
"selector": {
"matchLabels": {
"app.kubernetes.io/name": "informed-decision"
}
},
"strategy": {
"type": "Recreate"
},
"template": {
"metadata": {
"annotations": {
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
},
"labels": {
"app.kubernetes.io/component": "review",
"app.kubernetes.io/name": "informed-decision"
}
},
"spec": {
"automountServiceAccountToken": false,
"containers": [
{
"env": [
{
"name": "INFD_KEYCAPE_ISSUER",
"value": "https://kc.coulomb.social"
},
{
"name": "INFD_CONTAINER_CONFIG",
"value": "/configuration/runtime.json"
}
],
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"imagePullPolicy": "IfNotPresent",
"livenessProbe": {
"failureThreshold": 3,
"httpGet": {
"path": "/healthz",
"port": "http",
"scheme": "HTTP"
},
"periodSeconds": 10,
"successThreshold": 1,
"timeoutSeconds": 2
},
"name": "informed-decision",
"ports": [
{
"containerPort": 8080,
"name": "http",
"protocol": "TCP"
},
{
"containerPort": 8081,
"name": "workload",
"protocol": "TCP"
}
],
"readinessProbe": {
"failureThreshold": 3,
"httpGet": {
"path": "/healthz",
"port": "http",
"scheme": "HTTP"
},
"periodSeconds": 10,
"successThreshold": 1,
"timeoutSeconds": 2
},
"resources": {
"limits": {
"cpu": "500m",
"memory": "256Mi"
},
"requests": {
"cpu": "5m",
"memory": "64Mi"
}
},
"securityContext": {
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"ALL"
]
},
"readOnlyRootFilesystem": true
},
"startupProbe": {
"failureThreshold": 12,
"httpGet": {
"path": "/healthz",
"port": "http",
"scheme": "HTTP"
},
"periodSeconds": 10,
"successThreshold": 1,
"timeoutSeconds": 2
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"volumeMounts": [
{
"mountPath": "/data",
"name": "data"
},
{
"mountPath": "/run/informed-decision",
"name": "runtime"
},
{
"mountPath": "/tmp",
"name": "tmp"
},
{
"mountPath": "/configuration",
"name": "configuration",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/policy",
"name": "caller",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/audit",
"name": "audit",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
"name": "kubernetes-api",
"readOnly": true
},
{
"mountPath": "/workload-registry",
"name": "workload-registry",
"readOnly": true
},
{
"mountPath": "/var/run/secrets/informed-decision/requester",
"name": "sitting-requester",
"readOnly": true
}
]
}
],
"dnsPolicy": "ClusterFirst",
"restartPolicy": "Always",
"schedulerName": "default-scheduler",
"securityContext": {
"fsGroup": 10001,
"fsGroupChangePolicy": "OnRootMismatch",
"runAsGroup": 10001,
"runAsNonRoot": true,
"runAsUser": 10001,
"seccompProfile": {
"type": "RuntimeDefault"
}
},
"serviceAccount": "review",
"serviceAccountName": "review",
"terminationGracePeriodSeconds": 45,
"volumes": [
{
"name": "data",
"persistentVolumeClaim": {
"claimName": "informed-decision-data"
}
},
{
"emptyDir": {
"medium": "Memory",
"sizeLimit": "16Mi"
},
"name": "runtime"
},
{
"emptyDir": {
"medium": "Memory",
"sizeLimit": "16Mi"
},
"name": "tmp"
},
{
"configMap": {
"defaultMode": 292,
"name": "informed-decision-runtime-6c221878d051"
},
"name": "configuration"
},
{
"name": "caller",
"projected": {
"defaultMode": 288,
"sources": [
{
"serviceAccountToken": {
"audience": "flex-auth",
"expirationSeconds": 3600,
"path": "token"
}
}
]
}
},
{
"name": "audit",
"secret": {
"defaultMode": 288,
"items": [
{
"key": "token",
"path": "token"
}
],
"secretName": "informed-decision-audit"
}
},
{
"name": "kubernetes-api",
"projected": {
"defaultMode": 288,
"sources": [
{
"serviceAccountToken": {
"expirationSeconds": 600,
"path": "token"
}
},
{
"configMap": {
"items": [
{
"key": "ca.crt",
"path": "ca.crt"
}
],
"name": "kube-root-ca.crt"
}
}
]
}
},
{
"configMap": {
"defaultMode": 292,
"name": "informed-decision-workload-registry"
},
"name": "workload-registry"
},
{
"name": "sitting-requester",
"secret": {
"defaultMode": 288,
"items": [
{
"key": "client-secret",
"path": "client-secret"
}
],
"optional": false,
"secretName": "informed-decision-sitting-requester"
}
}
]
}
}
}
},
"sealed_dependencies": {
"configmap": {
"apiVersion": "v1",
"immutable": true,
"kind": "ConfigMap",
"metadata": {
"annotations": {
"argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051",
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
},
"name": "informed-decision-runtime-6c221878d051",
"namespace": "informed-decision",
"uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5"
},
"canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6"
},
"pvc": {
"apiVersion": "v1",
"kind": "PersistentVolumeClaim",
"metadata": {
"annotations": {
"argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data",
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover",
"pv.kubernetes.io/bind-completed": "yes",
"pv.kubernetes.io/bound-by-controller": "yes",
"volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path",
"volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net",
"volume.kubernetes.io/storage-provisioner": "rancher.io/local-path"
},
"finalizers": [
"kubernetes.io/pvc-protection"
],
"name": "informed-decision-data",
"namespace": "informed-decision",
"uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c"
},
"spec": {
"accessModes": [
"ReadWriteOnce"
],
"resources": {
"requests": {
"storage": "1Gi"
}
},
"storageClassName": "local-path",
"volumeMode": "Filesystem",
"volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c"
}
},
"pvc_phase": "Bound"
},
"argo": {
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
"source": {
"path": "deploy/lifecycle",
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
},
"destination": {
"namespace": "informed-decision",
"server": "https://kubernetes.default.svc"
},
"automated": false,
"health": {
"lastTransitionTime": "2026-10-11T07:00:42Z",
"status": "Healthy"
},
"sync": {
"comparedTo": {
"destination": {
"namespace": "informed-decision",
"server": "https://kubernetes.default.svc"
},
"source": {
"path": "deploy/lifecycle",
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
}
},
"revision": "c96b0c6d881e855d1d158003c6de90ef390262e2",
"status": "OutOfSync"
}
},
"server_dry_run_passed": true,
"admission_only_image_delta": true,
"client_diff_exit": 1,
"client_diff_sha256": "ee53537b71df69ea1ce4a67498a47524d1aef87aa5ad1e9499c3f699f142762e",
"allocatable_cpu_m": 4000,
"requested_cpu_m": 3460,
"strategy": "Recreate"
}

48
docs/evidence/2026-10-11-zlib-native-acceptance/canonical-provider-verification.json Normal file
View file

@ -0,0 +1,48 @@
{
"before": {
"all_checks_pass": true,
"observed_at": "2026-10-11T11:20:14.889361+00:00",
"deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92",
"generation": 26,
"ready_replicas": 1,
"pod_name": "informed-decision-68d5f488d8-c576r",
"pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"image_id": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"application_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
"application_health": "Healthy",
"native_data_change": false
},
"native_provider": {
"request_memo_id": "infd-20261011-zlib-remediation-r1",
"request_memo_version": 1,
"request_identity_source": "fixed-authenticated-route",
"has_review": true,
"disposition_count": 1,
"dispositions_interpreted": false,
"approval_inferred": false,
"current_approval_claimed": false,
"http_status": 200,
"observed_at": "2026-10-11T11:20:25.876927+00:00",
"native_authenticated_canonical_lifecycle_outcomes": true,
"native_provider_path_returned": true,
"credential_material_output": false
},
"after": {
"all_checks_pass": true,
"observed_at": "2026-10-11T11:20:27.541827+00:00",
"deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92",
"generation": 26,
"ready_replicas": 1,
"pod_name": "informed-decision-68d5f488d8-c576r",
"pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"image_id": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"application_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
"application_health": "Healthy",
"native_data_change": false
},
"provider_command_sha256": "ddfe2619f4847238fe79ec779a15b0d8df5d178cbed989ac2d73c1480b57a706",
"founder_approval_inferred": false,
"protected_database_contents_exported": false
}

5
docs/evidence/2026-10-11-zlib-native-acceptance/cleanup-offline.json Normal file
View file

@ -0,0 +1,5 @@
{
"all_checks_pass": true,
"only_disposable_offline_volume_removed": "infd-zlib-r1-restore-20261011",
"native_and_offcluster_original_snapshots_retained": true
}

23
docs/evidence/2026-10-11-zlib-native-acceptance/confirmed-root-authority.json Normal file
View file

@ -0,0 +1,23 @@
{
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
"memo_id": "infd-20261011-zlib-remediation-r1",
"memo_version": 1,
"memo_sha256": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206",
"source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
"executor_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61",
"native_outcome_sha256": "7cd00372d1a7c4fb4dc92e2c550d8d4c586f96cda3aecec8016a883370893c86",
"activation": "APPROVED",
"authority_mode": "ADMINISTER",
"target": "realm:kubernetes/railiance01/informed-decision",
"verification_method": "root-fixed-origin-native-readback",
"runtime_authenticated_grant": false,
"outcome_query": "/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1",
"verified_at": "2026-10-11T11:19:17.592644+00:00",
"review_memo_id": "review-2cf690a6-8c46-4faa-826c-a24a88d53dea",
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"bounded_outage_rollback_pre_authorized": true,
"note": "Template is not evidence/approval. Root sets scopedpreauthorizationtrue only after actual confirmed founder acceptance of this exact new packet/terms, retains original currentreadback before release.",
"native_observed_at": "2026-10-11T11:19:18.476232+00:00"
}

53
docs/evidence/2026-10-11-zlib-native-acceptance/cutover-backup.json Normal file
View file

@ -0,0 +1,53 @@
{
"phase": "cutover-backup",
"all_checks_pass": true,
"raw_output_withheld": true,
"native_approval_verified_by_root": {
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"verified_at": "2026-10-11T11:17:33.972874+00:00"
},
"native_authenticated_grant": false,
"source_readonly_baseline": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"snapshot_readonly": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"snapshot_sha256": "e0bac513f7445bf702c504ec7c15a1eb277ed7a48529099437d0dd63cf0679bb",
"snapshot_bytes": 23347200,
"snapshot_file": "cutover.sqlite",
"native_parent_private": true,
"native_uid": 10001,
"pod_name": "informed-decision-5557446c88-lvm88",
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662"
}

36
docs/evidence/2026-10-11-zlib-native-acceptance/cutover-copy.json Normal file
View file

@ -0,0 +1,36 @@
{
"phase": "cutover-copy",
"all_checks_pass": true,
"raw_output_withheld": true,
"native_approval_verified_by_root": {
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"verified_at": "2026-10-11T11:18:05.531924+00:00"
},
"native_authenticated_grant": false,
"snapshot_file": "cutover.sqlite",
"snapshot_bytes": 23347200,
"snapshot_sha256": "e0bac513f7445bf702c504ec7c15a1eb277ed7a48529099437d0dd63cf0679bb",
"snapshot_readonly": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"pod_name": "informed-decision-5557446c88-lvm88",
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662",
"off_cluster_private_copy_verified": true,
"snapshot_contents_output": false
}

53
docs/evidence/2026-10-11-zlib-native-acceptance/drill-backup.json Normal file
View file

@ -0,0 +1,53 @@
{
"phase": "drill-backup",
"all_checks_pass": true,
"raw_output_withheld": true,
"native_approval_verified_by_root": {
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"verified_at": "2026-10-11T11:11:32.769166+00:00"
},
"native_authenticated_grant": false,
"source_readonly_baseline": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"snapshot_readonly": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"snapshot_sha256": "97d7dfb8fce4f720456468ff169f5e2b2bcb1edc328687b1a6c1225b66f2b0ba",
"snapshot_bytes": 23330816,
"snapshot_file": "drill.sqlite",
"native_parent_private": true,
"native_uid": 10001,
"pod_name": "informed-decision-5557446c88-lvm88",
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662"
}

36
docs/evidence/2026-10-11-zlib-native-acceptance/drill-copy.json Normal file
View file

@ -0,0 +1,36 @@
{
"phase": "drill-copy",
"all_checks_pass": true,
"raw_output_withheld": true,
"native_approval_verified_by_root": {
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"verified_at": "2026-10-11T11:12:17.399753+00:00"
},
"native_authenticated_grant": false,
"snapshot_file": "drill.sqlite",
"snapshot_bytes": 23330816,
"snapshot_sha256": "97d7dfb8fce4f720456468ff169f5e2b2bcb1edc328687b1a6c1225b66f2b0ba",
"snapshot_readonly": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"pod_name": "informed-decision-5557446c88-lvm88",
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662",
"off_cluster_private_copy_verified": true,
"snapshot_contents_output": false
}

2338
docs/evidence/2026-10-11-zlib-native-acceptance/fresh-scan-full.json Normal file
View file

File diff suppressed because it is too large Load diff

68
docs/evidence/2026-10-11-zlib-native-acceptance/fresh-scan-receipt.json Normal file
View file

@ -0,0 +1,68 @@
{
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
"artifact_source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"full_allseverity_scan": true,
"no_suppression": true,
"exit_code": 0,
"completed_at": "2026-10-11T10:48:46.790940+00:00",
"db_metadata": {
"Version": 2,
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
},
"db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917",
"full_report_sha256": "42473695abfb99cb32ae29e607120996d339683da7987e9a91117aab9a7e5c00",
"public_archive_sha256": "d24993af69028c6ac43640ee17dcccdc3e962cda4bc28dc8000b4ac77728bc2d",
"archive_config_and_11_layers_verified": true,
"started_at": "2026-10-11T10:48:21.420853+00:00",
"command": [
"docker",
"--config",
"/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z/empty-docker-config",
"--host",
"unix:///var/run/docker.sock",
"run",
"--rm",
"--user",
"1000:1000",
"--network",
"none",
"--cpus",
"1",
"--memory",
"1g",
"--read-only",
"--tmpfs",
"/tmp:rw,nosuid,nodev,noexec,size=268435456",
"--cap-drop",
"ALL",
"--security-opt",
"no-new-privileges",
"-v",
"/tmp/infd-zlib-published-9b4bb25d/image.tar:/artifact/image.tar:ro",
"-v",
"/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z/scanner-cache:/cache",
"-v",
"/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z:/output",
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"image",
"--input",
"/artifact/image.tar",
"--cache-dir",
"/cache",
"--skip-db-update",
"--skip-java-db-update",
"--scanners",
"vuln",
"--format",
"json",
"--output",
"/output/trivy-full.json"
],
"raw_output_withheld": true,
"native_actions": false,
"native_database_read": false,
"credential_read": false
}

68
docs/evidence/2026-10-11-zlib-native-acceptance/offline-verify.json Normal file
View file

@ -0,0 +1,68 @@
{
"all_checks_pass": true,
"offline_volume": "infd-zlib-r1-restore-20261011",
"offline_readonly": {
"integrity": "ok",
"lifecycle": {
"events": 59,
"pending": 0,
"records": 17
},
"outbox": {
"delivered": 344
},
"read_only_pre_open": true,
"schema_version": 5,
"store_constructed": false,
"submissions": {
"confirmed": 44
}
},
"offline_post_admin_readonly": {
"integrity": "ok",
"lifecycle": {
"events": 59,
"pending": 0,
"records": 17
},
"outbox": {
"delivered": 344
},
"read_only_pre_open": true,
"schema_version": 5,
"store_constructed": false,
"submissions": {
"confirmed": 44
}
},
"original_snapshot_hash_unchanged": true,
"created_volume_identity": {
"Name": "infd-zlib-r1-restore-20261011",
"Labels": {
"informed-decision.attempt": "643de582-9501-45dd-bac1-754b8524f5b9",
"informed-decision.case": "infd-zlib-20261011-r1",
"informed-decision.use": "offline-restore-only"
},
"Driver": "local",
"Scope": "local",
"CreatedAt": "2026-10-11T13:16:36+02:00"
},
"admin_counts": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
}
},
"network": "none",
"runtime_tokens_or_config_mounted": false,
"service_entrypoint_started": false,
"original_snapshot_retained": true
}

82
docs/evidence/2026-10-11-zlib-native-acceptance/original-receipt-manifest.json Normal file
View file

@ -0,0 +1,82 @@
[
{
"path": "drill-backup.json",
"sha256": "53ea89341b3ed9d62b6db11070c19a3f1a97aa705ca5e69f75e5badb6d0f085e"
},
{
"path": "drill-copy.json",
"sha256": "06011d148a022d7249f85e794455f297bf8193e19480762b667c8a42afa30e4e"
},
{
"path": "offline-verify.json",
"sha256": "4cf2df2c91877c87be8eebb279640473bb3627fe93ed4467467058e8f7baa7ab"
},
{
"path": "cleanup-offline.json",
"sha256": "ee89cddb506e65959c96b8da453443cd77e3a5cce927e0102acf56f28c38408c"
},
{
"path": "cutover-backup.json",
"sha256": "3d7a79ddb6f29368284a2d87ffbf350e27a0548750e29e8a532ad9736b3e2cc7"
},
{
"path": "cutover-copy.json",
"sha256": "14f008e0b8a7b1447847c3c02f1a07ffa13285832f91a6c5a795200f1c68c12f"
},
{
"path": "release.json",
"sha256": "05cb8b520c9414b5f3a39b2fa5f9b6bf07e93145390fd252c7ddf8cd618687d7"
},
{
"path": "verify.json",
"sha256": "efe87612f116839340a8e4c777ee7a66f806c8b8ded7f4a13451ec858c838f9a"
},
{
"path": "canonical-provider-verification.json",
"sha256": "bee994ec4a965f2dccdd252feeb4b527f523fad172db8999849e7c9bc2b12794"
},
{
"path": "fresh-scan-receipt.json",
"sha256": "0336de3a48d9e1af3e0d74ef7c4a4c01c3a0ac4418a1d84856e87c424dda6db1"
},
{
"path": "fresh-scan-full.json",
"sha256": "42473695abfb99cb32ae29e607120996d339683da7987e9a91117aab9a7e5c00"
},
{
"path": "confirmed-root-authority.json",
"sha256": "0d64760ba43581a19ec74489e655e89af150083aa59cea2414c12faa76912e88"
},
{
"path": "approved-native-preflight.json",
"sha256": "90a8222c400c8e21e4850111fd91c22be9d33c3de9e3351da2bb49c69c3d40eb"
},
{
"path": "root-clock-diagnosis.json",
"sha256": "6e3cf5fee7471a58016652b7aa8a11756b40e0c8c75c5b74292fad8e11ec6ffe"
},
{
"path": "prephase-refusal-first.json",
"sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d"
},
{
"path": "prephase-refusal-second.json",
"sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d"
},
{
"path": "prephase-refusal-traced.json",
"sha256": "2932b60db10ce8295b376e6b5964ce695a489699782dd03eb02d9cff9c25bfb6"
},
{
"path": "root-authority-helper-before-clock-correction.py",
"sha256": "64afd31c9776bd38c84f82972800fe59cbfb34b5315e9cb56aa25f5eb0e4c96d"
},
{
"path": "root-authority-helper-final.py",
"sha256": "0e4fde2db800d0055c5ef94bd4efcb4f29207dfdb7fbab5df370bac0c65aa42a"
},
{
"path": "approved-local-image-readiness.json",
"sha256": "285bd23bc05a41fe9942e399527594da896f9a2160af757c9b7ffa9e006fbf37"
}
]

21
docs/evidence/2026-10-11-zlib-native-acceptance/original-risk-record.json Normal file
View file

@ -0,0 +1,21 @@
{
"id": "INFD-RISK-20261011-ZLIB-85091",
"kind": "owner-vulnerability-follow-through",
"owner": "informed-decision",
"task": "INFD-WP-0009-T05",
"status": "open",
"created": "2026-10-11",
"review_due": "2026-10-18",
"finding": "CVE-2026-85091",
"scanner_severity": "MEDIUM",
"estate_risk_grade": null,
"affected_package": "zlib",
"installed": "1.3.2-r0",
"fixed": "1.3.2-r1",
"actual_current_base_and_candidate_findings_identical": true,
"source_evidence": "security-summary.json, trivy-full.json, base-trivy-full.json",
"human_temporary_disposition": "pending",
"follow_through": "Prepare a separately source-bound official-base/dependency refresh through normal owner CI, verify full scan and runtime compatibility, obtain distinct native release approval before updating this workload",
"manual_review_expiry": "Due date requires owner review/escalation if unresolved; no automatic rollback/controller is installed",
"close_condition": "Verified installed native fixed package and full unfiltered rescan; preserve original detection and any human disposition"
}

6
docs/evidence/2026-10-11-zlib-native-acceptance/prephase-refusal-first.json Normal file
View file

@ -0,0 +1,6 @@
{
"all_checks_pass": false,
"phase": "drill-backup",
"status": "phase_receipt_unverified",
"raw_output_withheld": true
}

6
docs/evidence/2026-10-11-zlib-native-acceptance/prephase-refusal-second.json Normal file
View file

@ -0,0 +1,6 @@
{
"all_checks_pass": false,
"phase": "drill-backup",
"status": "phase_receipt_unverified",
"raw_output_withheld": true
}

33
docs/evidence/2026-10-11-zlib-native-acceptance/prephase-refusal-traced.json Normal file
View file

@ -0,0 +1,33 @@
{
"all_checks_pass": false,
"phase": "drill-backup",
"status": "prephase_receipt_unverified",
"exception_locations": [
{
"file": "actuator.py",
"line": 321,
"exception_type": "ValueError"
},
{
"file": "actuator.py",
"line": 23,
"exception_type": "ValueError"
},
{
"file": "actuator.py",
"line": 325,
"exception_type": "ValueError"
},
{
"file": "actuator.py",
"line": 397,
"exception_type": "ValueError"
},
{
"file": "actuator.py",
"line": 399,
"exception_type": "SystemExit"
}
],
"raw_output_withheld": true
}

46
docs/evidence/2026-10-11-zlib-native-acceptance/release.json Normal file
View file

@ -0,0 +1,46 @@
{
"phase": "release",
"all_checks_pass": true,
"raw_output_withheld": true,
"native_approval_verified_by_root": {
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"verified_at": "2026-10-11T11:18:37.429056+00:00"
},
"native_authenticated_grant": false,
"live_readonly_schema_integrity_counts": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"live_counts_may_include_concurrent_commits": true,
"pod_name": "informed-decision-5557446c88-lvm88",
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662",
"operation_requested": true,
"source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
"resources": [
{
"group": "apps",
"kind": "Deployment",
"name": "informed-decision",
"namespace": "informed-decision"
}
],
"prune": false,
"rollout_verified": false,
"latest_live_database_retained": true,
"client_diff_sha256": "d61acc1da118dbd1dee8a94080c8b48a2e12f4b144704b2cb49f3443c49a3587"
}

42
docs/evidence/2026-10-11-zlib-native-acceptance/root-authority-helper-before-clock-correction.py Normal file
View file

@ -0,0 +1,42 @@
import datetime,hashlib,json,os,stat,subprocess
from pathlib import Path
base=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release')
revision='312ab97e876e17341bf16f9e95397e14c2ac2720'
program='''import json,re,urllib.request
from datetime import datetime,timezone
from api.services.memo_dispatch import ORIGIN,NoRedirect,token_file
ident='infd-20261011-zlib-remediation-r1';expected='review-2cf690a6-8c46-4faa-826c-a24a88d53dea'
try:
request=urllib.request.Request(ORIGIN+'/v1/decisions/'+ident+'/outcomes?version=1',headers={'Authorization':'Bearer '+token_file('/var/run/secrets/state-hub/informed-decision/lifecycle-token')})
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect())
with opener.open(request,timeout=20) as response:
raw=response.read(1024*1024+1)
if response.code!=200 or len(raw)>1024*1024:raise ValueError('response_refused')
value=json.loads(raw);review=value['review'];rows=value['dispositions']
if not isinstance(review,dict) or review.get('memo_id')!=expected or review.get('stale') is not False or review.get('intake_state')!='ready' or not isinstance(rows,list):raise ValueError('review_refused')
if len(rows)!=1:print(json.dumps({'status':'approval_pending','disposition_count':len(rows)}));raise SystemExit(3)
row=rows[0];d=row['disposition'];founder={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
if row.get('submission_state')!='confirmed' or d.get('verb')!='accept':print(json.dumps({'status':'approval_not_confirmed_accept'}));raise SystemExit(3)
if d.get('actor')!=founder or d.get('memo_version')!=1 or d.get('memo_id')!=expected or not re.fullmatch('[a-f0-9-]{36}',d.get('approval_id','')) or not re.fullmatch('disp-[a-f0-9-]{36}',d.get('id','')):raise ValueError('founder_refused')
accepted=datetime.fromisoformat(d['at'].replace('Z','+00:00'));now=datetime.now(timezone.utc)
if accepted.tzinfo is None or accepted>now:raise ValueError('time_refused')
normalized={'memo_id':ident,'request_identity_origin':'fixed_authenticated_request_route','review':{'memo_id':expected,'intake_state':'ready','stale':False},'dispositions':[{'submission_state':'confirmed','disposition':{k:d[k] for k in ['id','at','memo_id','memo_version','verb','approval_id','actor']}}],'observed_at':now.isoformat()}
print(json.dumps({'status':'confirmed_founder_acceptance','normalized_outcome':normalized}),flush=True)
except SystemExit:raise
except Exception:print(json.dumps({'status':'native_readback_unverified'}),flush=True);raise SystemExit(1) from None
'''
run=subprocess.run(['ssh','railiance01','kubectl -n state-hub exec -i deployment/state-hub-memo-dispatch -c dispatcher -- python -'],input=program,text=True,capture_output=True,timeout=60)
try:result=json.loads(run.stdout)
except Exception:raise SystemExit('Native readback unverified; raw transport suppressed')
if run.returncode or result.get('status')!='confirmed_founder_acceptance':print(json.dumps({'status':result.get('status','native_readback_unverified'),'native_action':False}));raise SystemExit(3)
outcome=result['normalized_outcome'];d=outcome['dispositions'][0]['disposition']
raw=(json.dumps(outcome,sort_keys=True,indent=2)+'\n').encode()
receipt=json.loads((base/'root-authority-receipt-template.json').read_text())
receipt.update(memo_sha256=hashlib.sha256((base/'memo.json').read_bytes()).hexdigest(),source_revision=revision,executor_plan_sha256=hashlib.sha256((base/'execution/execution-plan.json').read_bytes()).hexdigest(),native_outcome_sha256=hashlib.sha256(raw).hexdigest(),activation='APPROVED',verified_at=outcome['observed_at'],review_memo_id=outcome['review']['memo_id'],approval_id=d['approval_id'],disposition_id=d['id'],accepted_at=d['at'],bounded_outage_rollback_pre_authorized=True)
for path,data in [(Path('/tmp/security-infd-zlib-native-outcome-latest.json'),raw),(Path('/tmp/security-infd-zlib-root-authority.json'),(json.dumps(receipt,indent=2)+'\n').encode())]:
if path.exists():
info=path.lstat()
if not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1:raise SystemExit('Authority custody refused')
fd=os.open(path,os.O_CREAT|os.O_TRUNC|os.O_WRONLY|os.O_NOFOLLOW,0o600);os.fchmod(fd,0o600)
with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno())
print(json.dumps({'status':'confirmed_founder_acceptance','approval_id':d['approval_id'],'disposition_id':d['id'],'accepted_at':d['at'],'source_revision':revision,'verified_at':receipt['verified_at'],'native_action':False}))

42
docs/evidence/2026-10-11-zlib-native-acceptance/root-authority-helper-final.py Normal file
View file

@ -0,0 +1,42 @@
import datetime,hashlib,json,os,stat,subprocess
from pathlib import Path
base=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release')
revision='312ab97e876e17341bf16f9e95397e14c2ac2720'
program='''import json,re,urllib.request
from datetime import datetime,timezone
from api.services.memo_dispatch import ORIGIN,NoRedirect,token_file
ident='infd-20261011-zlib-remediation-r1';expected='review-2cf690a6-8c46-4faa-826c-a24a88d53dea'
try:
request=urllib.request.Request(ORIGIN+'/v1/decisions/'+ident+'/outcomes?version=1',headers={'Authorization':'Bearer '+token_file('/var/run/secrets/state-hub/informed-decision/lifecycle-token')})
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect())
with opener.open(request,timeout=20) as response:
raw=response.read(1024*1024+1)
if response.code!=200 or len(raw)>1024*1024:raise ValueError('response_refused')
value=json.loads(raw);review=value['review'];rows=value['dispositions']
if not isinstance(review,dict) or review.get('memo_id')!=expected or review.get('stale') is not False or review.get('intake_state')!='ready' or not isinstance(rows,list):raise ValueError('review_refused')
if len(rows)!=1:print(json.dumps({'status':'approval_pending','disposition_count':len(rows)}));raise SystemExit(3)
row=rows[0];d=row['disposition'];founder={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
if row.get('submission_state')!='confirmed' or d.get('verb')!='accept':print(json.dumps({'status':'approval_not_confirmed_accept'}));raise SystemExit(3)
if d.get('actor')!=founder or d.get('memo_version')!=1 or d.get('memo_id')!=expected or not re.fullmatch('[a-f0-9-]{36}',d.get('approval_id','')) or not re.fullmatch('disp-[a-f0-9-]{36}',d.get('id','')):raise ValueError('founder_refused')
accepted=datetime.fromisoformat(d['at'].replace('Z','+00:00'));now=datetime.now(timezone.utc)
if accepted.tzinfo is None or accepted>now:raise ValueError('time_refused')
normalized={'memo_id':ident,'request_identity_origin':'fixed_authenticated_request_route','review':{'memo_id':expected,'intake_state':'ready','stale':False},'dispositions':[{'submission_state':'confirmed','disposition':{k:d[k] for k in ['id','at','memo_id','memo_version','verb','approval_id','actor']}}],'observed_at':now.isoformat()}
print(json.dumps({'status':'confirmed_founder_acceptance','normalized_outcome':normalized}),flush=True)
except SystemExit:raise
except Exception:print(json.dumps({'status':'native_readback_unverified'}),flush=True);raise SystemExit(1) from None
'''
run=subprocess.run(['ssh','railiance01','kubectl -n state-hub exec -i deployment/state-hub-memo-dispatch -c dispatcher -- python -'],input=program,text=True,capture_output=True,timeout=60)
try:result=json.loads(run.stdout)
except Exception:raise SystemExit('Native readback unverified; raw transport suppressed')
if run.returncode or result.get('status')!='confirmed_founder_acceptance':print(json.dumps({'status':result.get('status','native_readback_unverified'),'native_action':False}));raise SystemExit(3)
outcome=result['normalized_outcome'];d=outcome['dispositions'][0]['disposition']
raw=(json.dumps(outcome,sort_keys=True,indent=2)+'\n').encode()
receipt=json.loads((base/'root-authority-receipt-template.json').read_text())
receipt.update(memo_sha256=hashlib.sha256((base/'memo.json').read_bytes()).hexdigest(),source_revision=revision,executor_plan_sha256=hashlib.sha256((base/'execution/execution-plan.json').read_bytes()).hexdigest(),native_outcome_sha256=hashlib.sha256(raw).hexdigest(),activation='APPROVED',verified_at=datetime.datetime.now(datetime.timezone.utc).isoformat(),native_observed_at=outcome['observed_at'],review_memo_id=outcome['review']['memo_id'],approval_id=d['approval_id'],disposition_id=d['id'],accepted_at=d['at'],bounded_outage_rollback_pre_authorized=True)
for path,data in [(Path('/tmp/security-infd-zlib-native-outcome-latest.json'),raw),(Path('/tmp/security-infd-zlib-root-authority.json'),(json.dumps(receipt,indent=2)+'\n').encode())]:
if path.exists():
info=path.lstat()
if not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1:raise SystemExit('Authority custody refused')
fd=os.open(path,os.O_CREAT|os.O_TRUNC|os.O_WRONLY|os.O_NOFOLLOW,0o600);os.fchmod(fd,0o600)
with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno())
print(json.dumps({'status':'confirmed_founder_acceptance','approval_id':d['approval_id'],'disposition_id':d['id'],'accepted_at':d['at'],'source_revision':revision,'verified_at':receipt['verified_at'],'native_action':False}))

5
docs/evidence/2026-10-11-zlib-native-acceptance/root-clock-diagnosis.json Normal file
View file

@ -0,0 +1,5 @@
{
"immediate_authority_pass": false,
"delta_seconds": -1.1806,
"static_reason": "fresh root native readback required before every phase"
}

16
docs/evidence/2026-10-11-zlib-native-acceptance/validation.json Normal file
View file

@ -0,0 +1,16 @@
{
"all20_original_receipt_hashes_verified": true,
"all8_phase_receipts_pass": true,
"drill_and_cutover_private_copies_equal": true,
"offline_pre_admin_post_equal": true,
"native_current_schema_counts_equal_cutover": true,
"installed_fixed_package_and_hashes": true,
"sameReadyPod_source_image_before_after_real_provider": true,
"actual_canonical_provider_HTTP200": true,
"synthetic_purpose_forms_remain_separate": true,
"full44_zero_scan_at_actual_verification_fresh": true,
"approved_owner_executor_render_plan_unchanged": true,
"original3_prephase_refusals_preserved": true,
"existing_residualIN10_unpromoted": true,
"native_actions_by_reviewer": false
}

55
docs/evidence/2026-10-11-zlib-native-acceptance/verify.json Normal file
View file

@ -0,0 +1,55 @@
{
"phase": "verify",
"all_checks_pass": true,
"raw_output_withheld": true,
"native_approval_verified_by_root": {
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
"accepted_at": "2026-10-11T10:40:55Z",
"verified_at": "2026-10-11T11:19:17.592644+00:00"
},
"native_authenticated_grant": false,
"live_readonly_schema_integrity_counts": {
"schema_version": 5,
"lifecycle": {
"records": 17,
"events": 59,
"pending": 0
},
"outbox": {
"delivered": 344
},
"submissions": {
"confirmed": 44
},
"integrity": "ok",
"read_only_pre_open": true,
"store_constructed": false
},
"live_counts_may_include_concurrent_commits": true,
"installed_zlib_files": {
"lib/apk/db/installed": "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001",
"usr/lib/libz.so.1.3.2": "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
},
"zlib_package": "1.3.2-r1",
"installed_purpose_checks": {
"installed_image_purpose_variants": 10,
"binding_forms_allowed": 2,
"advisory_or_malformed_refused": 8,
"synthetic_only": true,
"native_provider": false
},
"policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
"policy_mode": "0644",
"policy_uid": 0,
"health_statuses": {
"/healthz": 200,
"/readyz": 200
},
"native_provider_probe": false,
"pod_name": "informed-decision-68d5f488d8-c576r",
"pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be",
"native_rollout_verified": true,
"current_schema5_database_retained": true,
"recovery_verification": false
}

37
docs/evidence/2026-10-11-zlib-native-acceptance/verify_receipts.py Normal file
View file

@ -0,0 +1,37 @@
from pathlib import Path
import json,hashlib,datetime,importlib.util,sys
R=Path('/home/worsch/informed-decision');P=Path('/tmp/infd-zlib-native-completed-evidence');O=Path('/tmp/infd-zlib-native-product-acceptance-stage');H=lambda b:hashlib.sha256(b).hexdigest()
raw=(P/'manifest.json').read_bytes();assert H(raw)=='0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d';entries=json.loads(raw);assert len(entries)==20
for e in entries:assert H((P/e['path']).read_bytes())==e['sha256']
d={e['path']:json.loads((P/e['path']).read_text()) for e in entries if e['path'].endswith('.json')};phases=['drill-backup','drill-copy','offline-verify','cleanup-offline','cutover-backup','cutover-copy','release','verify']
for phase in phases:assert d[phase+'.json']['all_checks_pass'] is True
for phase in ['drill','cutover']:
a=d[phase+'-backup.json'];b=d[phase+'-copy.json']
for k in ['snapshot_file','snapshot_bytes','snapshot_sha256','snapshot_readonly']:assert a[k]==b[k]
assert b['off_cluster_private_copy_verified'] and not b['snapshot_contents_output']
o=d['offline-verify.json'];assert o['offline_readonly']==o['offline_post_admin_readonly']==d['drill-copy.json']['snapshot_readonly']
for k in ['schema_version','lifecycle','outbox','submissions']:assert o['admin_counts'][k]==o['offline_readonly'][k]
assert o['network']=='none' and not o['runtime_tokens_or_config_mounted'] and not o['service_entrypoint_started'] and o['original_snapshot_hash_unchanged']
v=d['verify.json'];assert v['live_readonly_schema_integrity_counts']==d['cutover-copy.json']['snapshot_readonly'] and v['zlib_package']=='1.3.2-r1' and v['native_rollout_verified'] and v['current_schema5_database_retained']
expected=json.loads((R/'docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json').read_text())
for n,h in v['installed_zlib_files'].items():assert h==expected['files'][n][4]
assert v['policy_sha256']==H((R/'informed_decision/policy.py').read_bytes())=='9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62'
assert v['installed_purpose_checks']=={'installed_image_purpose_variants':10,'binding_forms_allowed':2,'advisory_or_malformed_refused':8,'synthetic_only':True,'native_provider':False}
prov=d['canonical-provider-verification.json'];a=prov['before'];b=prov['after'];native=prov['native_provider']
for k in ['pod_uid','image','image_id','application_revision','deployment_uid','generation','ready_replicas']:assert a[k]==b[k]
assert a['pod_uid']==v['pod_uid']=='1153f806-1e05-4596-baf3-a4fa8adf08be' and a['generation']==26 and a['ready_replicas']==1 and a['application_revision']=='312ab97e876e17341bf16f9e95397e14c2ac2720'
assert native['http_status']==200 and native['native_authenticated_canonical_lifecycle_outcomes'] and not native['approval_inferred'] and not native['dispositions_interpreted'];assert a['observed_at']<native['observed_at']<b['observed_at']
assert d['release.json']['resources']==[{'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}] and d['release.json']['prune'] is False
scan=d['fresh-scan-receipt.json'];report=d['fresh-scan-full.json'];assert scan['full_report_sha256']==H((P/'fresh-scan-full.json').read_bytes()) and scan['image']==a['image']
E=R/'docs/evidence/2026-10-11-zlib-image-release/execution';spec=importlib.util.spec_from_file_location('closure_authority',E/'authority_journal.py');mod=importlib.util.module_from_spec(spec);spec.loader.exec_module(mod)
mod.fresh_scan(scan,report,json.loads((E.parent/'fresh-scan-contract.json').read_text()),datetime.datetime.fromisoformat(native['observed_at']))
count=sum(len(x['Packages']) for x in report['Results']);assert count==44 and not [v for x in report['Results'] for v in x.get('Vulnerabilities',[])]
auth=d['confirmed-root-authority.json'];assert auth['memo_sha256']==H((E.parent/'memo.json').read_bytes()) and auth['source_revision']==a['application_revision'];assert auth['executor_plan_sha256']==H((E/'execution-plan.json').read_bytes())
plan=json.loads((E/'execution-plan.json').read_text())
for n,h in plan['executor_files'].items():assert H((E/n).read_bytes())==h
for n,h in plan['owner_source_files'].items():assert H((R/n).read_bytes())==h
assert auth['approval_id']=='b5ce337c-5d7d-44fa-864d-706b54039f7c' and auth['disposition_id']=='disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f' and auth['accepted_at']=='2026-10-11T10:40:55Z'
for n in ['prephase-refusal-first.json','prephase-refusal-second.json','prephase-refusal-traced.json']:assert not d[n]['all_checks_pass']
intakes=(R/'intakes/intakes.md').read_text();assert 'id: INFD-IN-0010' in intakes and 'promotion: not-promoted' in intakes
(O/'validation.json').write_text(json.dumps(dict(all20_original_receipt_hashes_verified=True,all8_phase_receipts_pass=True,drill_and_cutover_private_copies_equal=True,offline_pre_admin_post_equal=True,native_current_schema_counts_equal_cutover=True,installed_fixed_package_and_hashes=True,sameReadyPod_source_image_before_after_real_provider=True,actual_canonical_provider_HTTP200=True,synthetic_purpose_forms_remain_separate=True,full44_zero_scan_at_actual_verification_fresh=True,approved_owner_executor_render_plan_unchanged=True,original3_prephase_refusals_preserved=True,existing_residualIN10_unpromoted=True,native_actions_by_reviewer=False),indent=2)+'\n')
print('20 hashes, all8 phases, native installed/canonical-provider proof, fresh full44 scan and unchanged approved source verified.')

90
docs/reviews/2026-10-11-zlib-native-product-owner-acceptance.md Normal file
View file

@ -0,0 +1,90 @@
# Actual zlib native outcome Product acceptance
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T10
scope: actual bounded T05 release outcome and owner task/risk closure
execution_revision: 312ab97e876e17341bf16f9e95397e14c2ac2720
receipt_manifest_sha256: 0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d
comment: >-
Distinct completed T10 source-only outcome review anchor prepared before
formal acceptance; T09 remains source preparation. Accept bounded actual
installed remediation evidence, not new human authority, autonomy or a
scored new trial. T05 done, vulnerability follow-through resolved, WP9
finished after retaining its existing live unpromoted residual.
```
All twenty immutable publicmetadata file hashes independently verify; exact
original bytes and manifest are retained here, with no private DB/snapshot/
cache/journal content copied. Founder confirmed approval
b5ce337c-5d7d-44fa-864d-706b54039f7c/disposition
disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f at10:40:55Z binds source1 memo
5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206 and
execution312ab97. Root authenticated this disposition through the existing
fixed-origin provider; metadata receipt bookkeeping is not a signed autonomous
grant and this reviewer did not authenticate a human or certify all real MFA.
Current owner executor/plan/render hashes remain exactly approved.
All eight drill-backup/copy/offline-verify/cleanup/cutover-backup/copy/release/
verify receipts pass. Native/offcluster copies match their original private
snapshot digest/size/count metadata. Actual isolated clone before/admin/after
schema5/integrity/counts match17records/59events/0pending,344delivered/44confirmed;
networknone, no runtime token/config/service mounts/entrypoint and original
snapshot retained. Cleanup removes only the created named disposable clone.
Fresh cutover private snapshot23347200bytes SHAe0bac513f7445bf702c504ec7c15a1eb277ed7a48529099437d0dd63cf0679bb
and exact offcluster copy precede image-only one-Deployment explicitfalse-prune
release. Current schema5/integrity/live counts equal retained cutover metadata,
with latest database preserved. No historical data restore or pruning occurred.
Installed imagef558 on generation26/Ready1/Pod
1153f806-1e05-4596-baf3-a4fa8adf08be at exact312ab97 carries zlib1.3.2-r1,
APK DB SHA f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001
and libz SHA ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2.
Policy9d7 root-owned0644, healthz/readyz200 and installed10 purpose fixtures
2allow/8refuse verify; those fixture responses remain synthetic/native_provider=false.
Distinct actual authenticated canonical lifecycle.outcomes HTTP200 at
11:20:25.876927UTC lies between before/after structural reads with identical
Ready PodUID/imageID/source/generation. Minimal requestidentity derives from
fixed source1 route, not an invented response field; no review/disposition/
state/actor/privatebody export or approval inference. Installed `_authorize`
canonical binding path returned; no provider advisory emission claim.
Fresh full unfiltered scan at10:48:46 verifies this exact immutable image/config/
eleven layers and38OS+6Python44package inventory, fixedzlibr1 and zero findings.
The actual scan guard validates report hash/config/layers/inventory and freshness
at11:20:25: scanage under4hours and DBNextUpdate18:59:50. It satisfies installed
fixed-package/fullscan closure, not a permanent zero-CVE or estate Risk Engine
grade. The original inherited MEDIUM finding/dueOct18/detection remain retained
verbatim in original-risk-record.json and original_detection within the resolved
owner follow-through.
Three prephase root authority refusals remain unchanged and were not completed
phase attempts. Diagnosis retained service clock1.1806seconds ahead of root.
Root helper's sole correction sets local verified_at after native readback and
retains native_observed_at; the actual approval/outcome source is not fabricated
or re-dated. Approved actuator/render/plan unchanged. No old journal rewrite,
phase replay or changed-source trial/new scored success. Original T04/R2 failures
and all source changes-requested history remain preserved. Rollback/outage path
was unused; this acceptance certifies no actual recovery success, standing
exception, future reuse or agent promotion.
All five WP9 tasks are now done. Before finished status, existing live
INFD-IN-0010 (origin residual, origin_ref INFD-WP-0009, open/not-promoted) is
retained unchanged for original-helper future reuse correction. T05's separately
approved task-specific actuator does not promote or implement that generic
residual. INFD-IN-0009 remains its separate class-specific emission guarantee/
verification residual; all other intakes untouched. Outbox aggregate counts and
this consumer release do not declare full Staff emission conformance.
This closes INFD-WP-0009-T05 and INFD-RISK-20261011-ZLIB-85091 and permits
INFD-WP-0009 finished. No native command, secret/credential access, private DB
open, cache/journal read, snapshot copy, owner checkout write or push occurred
in this review. Validation is source/receipt hashes and metadata comparisons;
existing synthetic tests were not repeated.
T05 source metadata clears needs_human=false with the actual confirmed founder
disposition and verified-completion note, replacing the pending-decision condition.
This source closure adds only work-record/docs/risk metadata; approved render,
helper, memo and execution-plan bytes remain unchanged. Argo execution revision
312ab97 remains pinned even when owner HEAD later receives closure documents.

37
workplans/ADHOC-2026-10-11.md
View file

@ -405,3 +405,40 @@ refinement record precedes final technical acknowledgment. T05progress/WP9active
newfounderacceptance/actualinstalled/scan/providerproof still required. Rootfinal
2ACK/row19 memo-reference rebinding needs bounded confirmation before humanpost.
Review: docs/reviews/2026-10-11-zlib-release-product-owner-final-ack.md.
## Accept bounded actual T05 native outcome and reconcile owner closure
```task
id: INFD-WP-ADHOC-2026-10-11-T10
status: done
priority: medium
```
Completed distinct low-risk source-only native-outcome review, not an extension
of T09 source-preparation scope. Independently verified exact20publicmetadata
manifest0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d
and all original file hashes. All8 phases pass; actual isolated schema5/integrity/
counts match pre/admin/post; protected native/offcluster backups retained and only
created disposable clone removed. Fresh cutover copy and live post-release counts
match17records/59events/0pending,344delivered/44confirmed.
Installedf558/generation26/Ready1/Pod1153f806 has zlib1.3.2-r1 with exact published
file hashes, policy9d7 and health200. Synthetic2allow/8refuse remains separate
from actual authenticated canonical HTTP20011:20:25 between same Pod/source
readbacks. Full44package zero scan10:48 is valid at verification; no future-grade
claim. New founder source1 acceptanceb5ce337c/disp-cf61c2cf binds source312ab97.
Three prephase root-clock refusals retained; root-only verification-clock fix
preserves native observed time and approved executor/render/plan unchanged.
No phase replay/oldjournalrewrite or new scored trial. Rollback unused.
Prepared T05done/WP0009finished and vulnerability follow-throughresolved, with
original risk detection retained. Existing liveINFD-IN-0010 originresidual/WP9
remains open/unpromoted before finish; INFD-IN-0009 and other intakes unchanged.
Completed T10 anchor precedes formal actual Product acceptance. No native
commands, private DB/cache/journal copy, credential access or ownercheckoutwrite.
Review: docs/reviews/2026-10-11-zlib-native-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-zlib-native-acceptance/.
T10 closure metadata also clears T05 needs_human=false after confirmed founder
acceptance and verified actual outcome. Approved render/helper/memo/plan bytes
are unchanged; Argo retains exact312ab97 execution pin as closure-only owner
HEAD updates are staged.

36
workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Repair lifecycle consumer pin after Access Engine v2 policy release"
domain: infotech
repo: informed-decision
status: active
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-10"
@ -160,7 +160,9 @@ and docs/evidence/2026-10-11-purpose-native-acceptance/.
```task
id: INFD-WP-0009-T05
status: progress
status: done
needs_human: false
intervention_note: "Founder acceptance b5ce337c/disp-cf61c2cf confirmed; exact312/f558 native completion and installed/fresh-scan/provider proof verified. No T05 decision remains pending."
priority: medium
state_hub_task_id: "1743596f-8558-5a6b-afef-4dd5c1e9c0ae"
```
@ -189,3 +191,33 @@ NoT04/nativec96/helper/journal/DB/ConfigMap/PVC/identity/policy changes.
Prepared distinct source-only T05 zlib85091 native release packet in `docs/evidence/2026-10-11-zlib-image-release/`: actual published image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23, full scan zero44packages, fresh image-only candidate and unchanged-baseline rollback server dry-runs. New proposed close-downitem19 manualoutagerecovery term (not approved): freshrootconfirmedpre-releaseacceptancecache, same763/c96 oneDeployment/latestDBpreservingrollback≤30minANDdeadline, forbid401/403/revoked/conflict/mismatch/healthyservice/otherphase/futurereuse; subsequentrevocationuncheckableduringoutage explicitlyrequiresNEWhumanconsent. Product/Platform changed-requested143 reviews and fullbytes retained; typedproviderallowlist omitsfreeform fields, ephemeralPod guard anddeduplicateddocumentdecode tests added. New private drill/cutover custody, no-network schema5 clone, immutable prior T04 helpers/journals, explicitfalse request plus Argo bool-omitempty completion guards and separate post-Ready authenticated canonical lifecycle/PDP proof. Product/Platform exact acknowledgment and NEW founder informed decision still required before protected database/workload action; old T04 approval is excluded. T05 remains progress and risk stays open until actual installed acceptance/native rescan. INFD-IN-0010 remains unpromoted.
**Actual T05 completion and workplan closure, 2026-10-11:** historical preparation
and open-risk/gate statements above describe their then-current state. New
confirmed founder acceptanceb5ce337c-5d7d-44fa-864d-706b54039f7c/disposition
disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f at10:40:55Z binds source1 exactmemo5dea
and execution revision312ab97e876e17341bf16f9e95397e14c2ac2720. All8 protected
drill/copy/offline/cleanup/cutover/copy/release/verify receipts pass. New native
imagef558/generation26/Ready1/Pod1153f806 installedzlibr1 and exact file hashes
match fresh full44package zero-findings scan10:48, valid at actual11:20 proof.
Policy9d/config/schema5/identity/PVC retained, installed10synthetic forms
2allow/8refuse and health200 pass; separate actual canonicalPDP-gated outcomes
HTTP20011:20:25 correlated with same Ready Pod/image/source before and after.
Live database retained17records/59events/0pending,344delivered/44confirmed.
Only one Deployment explicitprune=false released; rollback unused, not a native
recovery success. Old T04/R2 failed/UNCERTAIN journals retained. Three new
prephase root-clock refusals remain recorded; only root local verified_at clock
was corrected with native_observed_at preserved, no approved source amendment
or phase replay/new scored trial. INFD-RISK-20261011-ZLIB-85091 resolved by actual
installed fixed-package/fullscan proof, with original detection preserved and no
Risk Engine/estate grade or future vulnerability guarantee.
All five workplan tasks are now done. Before marking finished, existing live
residual INFD-IN-0010 (originresidual,origin_refINFD-WP-0009) remains open and
not-promoted in intakes/intakes.md; original approved helper generic reuse
correction is not implemented/promoted by T05's separate task-specific actuator.
INFD-IN-0009 remains separate class-guarantee evidence work; other intakes are
unchanged. No required leftovers are parked only in this closure prose.
Review: docs/reviews/2026-10-11-zlib-native-product-owner-acceptance.md.
Actual metadata/hash receipts: docs/evidence/2026-10-11-zlib-native-acceptance/.