coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare independently reviewed zlib-only image candidate
All checks were successful
Publish exact zlib-only remediation candidate / publish-candidate (push) Successful in 13s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 11:36:02 +02:00
parent f0f89b6d1d
commit 9b4bb25d32
154 changed files with 29358 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

75
workplans/ADHOC-2026-10-11.md
View file

@ -228,3 +228,78 @@ handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
**Exact amended confirmation, same completed T08 preparation trial:** verified
final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs
change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB
remain identical. New3 artifact tests pass (optimized malformed input refused
before reads; matching directories pass; directory mode/UID/GID drift refuse).
Independent actual saved-image reread proves all directory metadata unchanged,
with the same two final file changes. Initial Product manifest5f334/ack/validation
are retained as historical source agreement, not new scored native success.
This work-record refinement precedes final formal acknowledgment. No publication,
native operation, credentials or owner edits. T05progress/WP0009active remains.
Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md.
**Exact66 whiteout follow-through, same completed T08 preparation:** independently
verified manifest3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0
and all66 hashes. New source correction preserves leading whiteout dots/root
parent handling, but three Product synthetic probes find same-layer new files
incorrectly removed by subsequent nested/root opaque or explicit descendant
whiteouts. OCI requires whiteouts affect only lower layers and preserve same-layer
additions regardless archive order. Completed source assessment changes_requested
before formal entry: apply whiteouts only previous layers then merge current
layer additions, with both archive orders covered. No actual candidate failure
or image/sourcecontext/scan change is inferred. Initial5f334 and intermediate
8bc6 reviews/evidence remain historical, not rewritten; same T08/no new trial.
No owner edits, native operation, publication or credentials.
Review: docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md.
**Exact74 final acknowledgment, same completed T08:** all74 candidate hashes
verify for manifest724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec.
Checker now collects additions separately, applies whiteouts only lower-layer
state and merges additions afterward. Five audit tests pass, including12 whiteout
semantic cases/both marker orders. All three original Product counterexamples
now preserve same-layer files. Independent actual saved-image re-audit proves
313directories unchanged and same two changed files/nine base prefix/runtime/
SBOM/scan. Image78/contextc554/recipe/workflow/package/trust/DB unchanged.
Initial5f334, intermediate8bc6 and changes-requested85ffd source reviews/evidence
remain exact historical bytes, not revised prior success or a new scored trial.
Completed refinement record precedes final formal exact74 technical agreement.
No owner edits, native operation, publication or credentials; T05progress and
WP0009active remain. Distinct published/installed proof and founder approval
remain pending.
Final review: docs/reviews/2026-10-11-zlib-candidate-product-owner-complete-ack.md.

12
workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md
View file

@ -160,7 +160,7 @@ and docs/evidence/2026-10-11-purpose-native-acceptance/.
```task
id: INFD-WP-0009-T05
status: todo
status: progress
priority: medium
state_hub_task_id: "1743596f-8558-5a6b-afef-4dd5c1e9c0ae"
```
@ -176,3 +176,13 @@ Preserve the original detection, pending founder disposition and remediation
evidence. Close only after actual installed-package proof and full rescan.
Evidence: `docs/evidence/2026-10-11-purpose-image-release/inherited-vulnerability-follow-through.json`.
2026-10-11 — T05 bounded zlib-only source candidate preparation:
Exactcurrent763base andsignedofficialr1/packageindex buildoffline. Actual44package
fullscan sameDB baseline1MEDCVE85091→localcandidate0allseverity. Finalfilesystem
deltaonlylibz+APKdb;36appfiles/policy9d/world/keys/Python/runtime unchanged.
Localcandidate is unpublished/unapproved;4sourcenegative tests+actualbackend
and10purpose checks pass. Source/evidence:docs/evidence/2026-10-11-zlib-remediation-candidate/.
T05progress/planactive:actualownerCIpublishedprovenance/fullscan/SBOM,distinctnative
founderreleaseapproval andactualinstalledr1/runtime/fullrescan still required.
NoT04/nativec96/helper/journal/DB/ConfigMap/PVC/identity/policy changes.