coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare independently reviewed zlib-only image candidate
All checks were successful
Publish exact zlib-only remediation candidate / publish-candidate (push) Successful in 13s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 11:36:02 +02:00
parent f0f89b6d1d
commit 9b4bb25d32
154 changed files with 29358 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

71
.forgejo/workflows/zlib-overlay-image.yaml Normal file
View file

@ -0,0 +1,71 @@
name: Publish exact zlib-only remediation candidate
on:
push:
branches: [main]
paths:
- ".forgejo/workflows/zlib-overlay-image.yaml"
- "deploy/zlib-overlay/**"
- "tools/zlib_overlay/**"
workflow_dispatch:
concurrency:
group: informed-decision-zlib-overlay
cancel-in-progress: false
permissions:
contents: read
env:
REGISTRY: forgejo.coulomb.social
IMAGE_NAME: coulomb/informed-decision
DOCKER_HOST: tcp://127.0.0.1:2375
jobs:
publish-candidate:
runs-on: container-build
steps:
- name: Verify and publish zlib-only candidate
env:
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
run: |
set -eu
umask 077
REF="${GITHUB_SHA:?exact source revision required}"
echo "${REF}" | grep -Eq '^[0-9a-f]{40}$'
test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision"
if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
echo "Admitted owner registry capability unavailable; no borrowed credential permitted." >&2
exit 2
fi
BUILD_ROOT="$(mktemp -d)"
export DOCKER_CONFIG="${BUILD_ROOT}/docker-config"
cleanup() { rm -rf "${BUILD_ROOT}"; }
trap cleanup EXIT
mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/context" "${DOCKER_CONFIG}" "${HOME}/bin"
wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1
CONTEXT="${BUILD_ROOT}/source/deploy/zlib-overlay"
for INPUT in .dockerignore Containerfile zlib-1.3.2-r1.apk APKINDEX.tar.gz; do
cp "${CONTEXT}/${INPUT}" "${BUILD_ROOT}/context/${INPUT}"
chmod 0644 "${BUILD_ROOT}/context/${INPUT}"
done
echo "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 ${BUILD_ROOT}/context/zlib-1.3.2-r1.apk" | sha256sum -c -
echo "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 ${BUILD_ROOT}/context/APKINDEX.tar.gz" | sha256sum -c -
echo "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a ${BUILD_ROOT}/context/.dockerignore" | sha256sum -c -
echo "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15 ${BUILD_ROOT}/context/Containerfile" | sha256sum -c -
wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
export PATH="${HOME}/bin:${PATH}"
echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
BASE="${REGISTRY}/${IMAGE_NAME}@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a"
docker pull "${BASE}"
IMAGE="${REGISTRY}/${IMAGE_NAME}:zlib-85091-${REF}"
docker build --network none --pull=false --memory 256m --cpu-period 100000 --cpu-quota 100000 --build-arg "SOURCE_REVISION=${REF}" --build-arg "SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" --file "${BUILD_ROOT}/context/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/context"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/base-runtime.json"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/candidate-runtime.json"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - "$(cat "${BUILD_ROOT}/base-runtime.json")" "$(cat "${BUILD_ROOT}/candidate-runtime.json")" < "${BUILD_ROOT}/source/tools/zlib_overlay/compare_runtime.py"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py"
OUTPUT="$(docker push "${IMAGE}")"
printf '%s\n' "${OUTPUT}"
DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)"
printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$'
echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
echo "source_revision=${REF}"
echo "context_sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d"
echo "candidate_only=true; actual published digest/full scan/SBOM/provenance and distinct native founder release approval remain required"

5
deploy/zlib-overlay/.dockerignore Normal file
View file

@ -0,0 +1,5 @@
*
!.dockerignore
!Containerfile
!zlib-1.3.2-r1.apk
!APKINDEX.tar.gz

BIN
deploy/zlib-overlay/APKINDEX.tar.gz Normal file
View file

Binary file not shown.

17
deploy/zlib-overlay/Containerfile Normal file
View file

@ -0,0 +1,17 @@
FROM forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a
ARG SOURCE_REVISION=uncommitted-T05-local-preparation
ARG SOURCE_CONTEXT_SHA256
USER 0:0
COPY zlib-1.3.2-r1.apk APKINDEX.tar.gz /tmp/infd-zlib/x86_64/
RUN echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \
&& echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \
&& apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \
&& apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \
&& apk info --exists 'zlib=1.3.2-r1' \
&& rm -rf /tmp/infd-zlib
USER 10001:10001
LABEL org.opencontainers.image.revision="$SOURCE_REVISION" \
org.opencontainers.image.base.digest="sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" \
social.coulomb.source.context.sha256="$SOURCE_CONTEXT_SHA256" \
social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" \
social.coulomb.release.scope="INFD-WP-0009-T05/zlib-85091-r1"

15
deploy/zlib-overlay/pins.json Normal file
View file

@ -0,0 +1,15 @@
{
"files": {
".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a",
"Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15",
"zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47",
"APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"package_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk",
"index_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz",
"package_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245",
"package_signature": "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub",
"status": "prepared-unpublished-unapproved"
}

BIN
deploy/zlib-overlay/zlib-1.3.2-r1.apk Normal file
View file

Binary file not shown.

259
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/original-manifest.json Normal file
View file

@ -0,0 +1,259 @@
{
"owner": "informed-decision",
"decision": "changes_requested",
"scope": "same T08 exact66 lower-layer whiteout finding; initial/intermediate historical reviews retained; no native go",
"files": [
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json",
"original_sha256": null,
"staged_sha256": "8bc6da5507f4d9d1ff6d4439a82eb8b32098cc23fcec52bde4fecdcae939e384"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"original_sha256": null,
"staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"original_sha256": null,
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"original_sha256": null,
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"original_sha256": null,
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"original_sha256": null,
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"original_sha256": null,
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"original_sha256": null,
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"original_sha256": null,
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"original_sha256": null,
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"original_sha256": null,
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"original_sha256": null,
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
},
{
"repo": "informed-decision",
"path": "workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/workplans/ADHOC-2026-10-11.md",
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
"staged_sha256": "b22c0e9c803a455d4235b70684fe05c655a8f9addb0b9836a2012d9904a93a09"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md",
"original_sha256": null,
"staged_sha256": "99bd69d3898b6d79e32ed21664ad3659b5d8410db1a314b751a84daaf5579b65"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json",
"original_sha256": null,
"staged_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py",
"original_sha256": null,
"staged_sha256": "2bb7a5352da28bad2c7cc2566d6bd19875d1310c1ac8f558bc546f3da6442b56"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json",
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json",
"original_sha256": null,
"staged_sha256": "f3639bbe5e962c839d55e67fdbc36341d23255df9341e797d3a4dff9cc471f40"
}
]
}

20
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py Normal file
View file

@ -0,0 +1,20 @@
import pathlib,json,hashlib
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
entries=json.loads(m.read_text());assert len(entries)==58
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
for e in old:
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
exec(compile(code,'product-amended-readback','exec'),{})
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
print('Exact amended source and directory metadata readback pass.')

73
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json Normal file
View file

@ -0,0 +1,73 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"directory_metadata_compared": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

42
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json Normal file
View file

@ -0,0 +1,42 @@
{
"owner": "informed-decision",
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"files": [
{
"repo": "informed-decision",
"path": "workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
}
]
}

39
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

74
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md Normal file
View file

@ -0,0 +1,74 @@
# Bounded zlib candidate Product owner review
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact local zlib-only source candidate technical preparation
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
comment: >-
Informed-decision intent requires human binding and preserved evidence; this
candidate changes only a native compression dependency while preserving
application authorization/presentation behavior. T08 review work record was
completed first. This is technical source agreement, not native go, publication
receipt, founder acceptance or T05 completion.
```
All27 staged hashes and retained evidence-file hashes independently verify.
Independent saved-image archive readback confirms all nine exact763 base diff_ids
as prefix, equal effective runtime configuration with only explicitly normalized
empty/false/null defaults, and final filesystem changes exactly
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
No service values, namespace, DB, customer data, config, PVC, schema, audience,
policy pins, protected helper or existing release journal is changed.
Package/index bytes match pinned official HTTPS download hashes. Both signed
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
in unchanged baseline trust metadata. Retained actual maker apk verify success
against exact763 installed keys is the execution evidence; this review separately
checks archive signatures' metadata, bytes and trust identity, without claiming
a new signature-verification execution. Containerfile requires digest checks and
`apk verify` success before offline named-package upgrade; no allow-untrusted or
keys-dir override. Existing trusted keys are not replaced.
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
defines integrity/signature checking and nonzero failure.
Upgrade selects only zlib from retained local signed index, disables network,
preupgrade and logging, and removes temporary public artifacts.
Both full CycloneDX/Trivy artifacts independently show44 packages and only
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
CVE-2026-85091; candidate has zero findings at the retained same database
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
scan improvement at that snapshot, not estate risk grading or future safety.
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
representations; neither is a published registry digest or native image proof.
Four existing source tests pass, covering eight mutations; five additional Product
mutations of app source, trust keys, APK world, network and provider/data flags
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
and ten installed purpose variants are local synthetic checks, not live PDP
or customer/native-data testing. No new container or native execution by reviewer.
Workflow publishes only a source-bound candidate through existing admitted owner
registry capability after root source review/commit: exact40hex source revision,
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
bounded build, unchanged runtime comparison and purpose checks before push.
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
The workflow is unexecuted; source review does not attest CI credentials, actual
publication or published artifact equivalence. Root must retain actual CI/source
revision and registry descriptor/layer/config/package/signature/context readback,
then full published scan/SBOM and scoped candidate release preparation. Only
distinct exact informed-decision founder native approval followed by installedr1,
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
to763 preserves latest DB; no historical snapshot restore.
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
controller is implied. T04/c96 accepted outcome and original uncertain journals
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
No new native authority, owner checkout write, credential/login, deployment or
customer-data access occurred in this review.

259
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md Normal file
View file

@ -0,0 +1,259 @@
---
id: INFD-WP-ADHOC-2026-10-11
type: workplan
title: "Application-owner catalogue facts review"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
```task
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
and Layer Placement. Read actual owner OIDC, requester and policy-request
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
value-free native registration/Ingress/preflight receipts. Exact canonical
facts agree. Browser client is distinct from create-only requester.
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
Canonical facts SHA-256:
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
Reviewed refined nine-file executor manifest SHA-256:
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
This task completes the application-facts source review only. It grants no
maintenance exception, native dry-run/apply/recovery, IAM permission, image
release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.
## Reconcile Staff evidence source declaration and current guarantees
```task
id: INFD-WP-ADHOC-2026-10-11-T04
status: done
priority: medium
```
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
class definitions, transactional recording, heartbeat/reconciliation scheduling,
existing component-test assertions and native count/receipt evidence. Reconciled
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
source intake for remaining class-specific declaration/verification gaps,
origin INFD-WP-0007. No residual implementation or native action occurred.
Source evidence reconciliation:
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
Formal source review:
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
compromised-source and commitment/content availability limits remain unchanged.
## Independently review supervised purpose actuator product boundaries
```task
id: INFD-WP-ADHOC-2026-10-11-T05
status: done
priority: medium
```
Same informed-decision-owner reviewed exact23-path helper manifest
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
private snapshot custody, confined offline UID0 initialization followed by
UID10001 pre/post-admin verification, independent failed-candidate rollback
and all-phase start deadline are technically agreed as source preparation.
No purpose-policy or candidate image change. Retained helper16 synthetic tests
and platform5 independent recovery negatives are mechanism proof; prior50
product policy negatives remain applicable. No new test run was needed for this
unchanged-source review. Native-provider acceptance remains distinct from the
installed10 synthetic purpose forms; T04 is not complete. Before first human
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
initializer/recovery/deadline refinements and preserved full scan provenance.
Exact combined packet acknowledgement remains a separate review gate.
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
No native reads/backups/export/restore/release, credentials, human disposition,
founder approval or phase authority was exercised by this review.
## Prepare separately gated provider-derived denial mechanism probe
```task
id: INFD-WP-ADHOC-2026-10-11-T06
status: done
priority: medium
```
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
canonical real DENY is required; no claims are invented to obtain ALLOW.
One actual provider response will remain in Pod memory; ten transformed
noncanonical purpose copies test installed consumer refusal without further
provider calls, DB/admin or act effects. This is a denial/binding mechanism
proof candidate, not actual authorized lifecycle or full T04 acceptance.
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
Ten synthetic source tests pass; no actual provider, credential, runtime config,
DB, native data or live action was accessed. Posted frozen112 packet/helper
remain unchanged. Exact separate founder go for this newly prepared probe and
its target must precede any execution; current memo has no acceptance and this
new helper is not hash-bound in that submitted packet. T04 remains progress.
## Review exact existing-snapshot rescue version2 preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T07
status: done
priority: medium
```
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
require fresh founder acceptance. Immutable reads are bounded to proven frozen
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
guards pass (including eight refusal mutations and a frozen initial packet check).
No native command, DB open, credentials or rescue operation occurred.
Initial review decision changes_requested: proposal.json misleadingly names old
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
label it original/historical and refreeze all dependent packet hashes. Correct
current bundle/plan digests already exist. The normalized test fixture is not an
owner edit or approval. Initial review/failure must remain after correction;
exact amended confirmation is still required before newhuman submission/execution.
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
T04 remains progress; original version1 approval is not newversion2 authority.
**Amended source confirmation, same T07 trial:** exact134-path manifest
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
corrects only the historical helper provenance label and dependent packet hashes;
original66 source and initial changes-requested review remain retained. Current
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
mutations and three packet mutations independently refuse. Final technical
source acknowledgement approved; no new human acceptance or native rescue.
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
**Actual-outcome assessment preparation, same completed T07 trial:** independently
verified original receipt-byte hashes and source consumer path after approved
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
backup/private copy matches live post-release counts16/56/0, delivered336,
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
is separate from installed ten synthetic purpose forms (2allow/8refuse).
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.

20
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json Normal file
View file

@ -0,0 +1,20 @@
{
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"all58_hashes_verified": true,
"all27_initial_archived_hashes_verified": true,
"changed_initial_paths": [
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
],
"image_context_source_workflow_runtime_scan_unchanged": true,
"new_source_tests_passed": 3,
"directory_negative_mutations": 3,
"optimized_tampered_before_read_refusal": true,
"existing_actual_archives_directory_reaudit": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"native_actions": false
}

39
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

464
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json Normal file
View file

@ -0,0 +1,464 @@
[
{
"repo": "informed-decision",
"path": ".forgejo/workflows/zlib-overlay-image.yaml",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
"original_sha256": null,
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/.dockerignore",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
"original_sha256": null,
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/APKINDEX.tar.gz",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
"original_sha256": null,
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/Containerfile",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
"original_sha256": null,
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/pins.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
"original_sha256": null,
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"original_sha256": null,
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"original_sha256": null,
"staged_sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
"original_sha256": null,
"staged_sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"original_sha256": null,
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"original_sha256": null,
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"original_sha256": null,
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"original_sha256": null,
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"original_sha256": null,
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"original_sha256": null,
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
"original_sha256": null,
"staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
"original_sha256": null,
"staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
"original_sha256": null,
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
"original_sha256": null,
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
"original_sha256": null,
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
"original_sha256": null,
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
"original_sha256": null,
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"original_sha256": null,
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"original_sha256": null,
"staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"original_sha256": null,
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"original_sha256": null,
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"original_sha256": null,
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"original_sha256": null,
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"original_sha256": null,
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"original_sha256": null,
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"original_sha256": null,
"staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"original_sha256": null,
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"original_sha256": null,
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"original_sha256": null,
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"original_sha256": null,
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
"original_sha256": null,
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
"original_sha256": null,
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
"original_sha256": null,
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
"original_sha256": null,
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"original_sha256": null,
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
"original_sha256": null,
"staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
"original_sha256": null,
"staged_sha256": "3e81c1cedb2e3b25d83a779011898181a7860ff76532ede5fa3e9b8f63632700"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
"original_sha256": null,
"staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
"original_sha256": null,
"staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
"original_sha256": null,
"staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
"original_sha256": null,
"staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"original_sha256": null,
"staged_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"original_sha256": null,
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"original_sha256": null,
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"original_sha256": null,
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
"original_sha256": null,
"staged_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"original_sha256": null,
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/check_build_inputs.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
"original_sha256": null,
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/check_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
"original_sha256": null,
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/compare_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
"original_sha256": null,
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/test_candidate.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
"original_sha256": null,
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
},
{
"repo": "informed-decision",
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
}
]

52
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py Normal file
View file

@ -0,0 +1,52 @@
from pathlib import Path
import hashlib,io,json,tarfile,sys
if sys.flags.optimize:
raise SystemExit("REFUSED: optimized Python disables required artifact validation")
root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
def image(path):
with tarfile.open(path) as archive:
manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
files={}
for name in manifest[0]['Layers']:
with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
for member in layer:
path=member.name
while path.startswith('./'):path=path[2:]
path=path.lstrip('/');p=Path(path)
if p.name=='.wh..wh..opq':
folder=p.parent.as_posix();prefix='' if folder=='.' else folder+'/'
files={key:value for key,value in files.items() if not key.startswith(prefix)};continue
if p.name.startswith('.wh.'):
removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue
if member.isfile():
data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
else:continue
files[path]=value
return config,hashlib.sha256(configbytes).hexdigest(),files
base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
assert set(changed)<=expected,set(changed)
a,b=base['config'].copy(),candidate['config'].copy()
labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
a.pop('Image',None);b.pop('Image',None)
defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
for key,value in defaults.items():
a.setdefault(key,value);b.setdefault(key,value)
assert a==b,(a,b)
components=[]
for name in ['base-sbom.cdx.json','sbom.cdx.json']:
data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
vulns=[]
for name in ['base-trivy-full.json','trivy-full.json']:
data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
assert not vulns[1]
proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))

113
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json Normal file
View file

@ -0,0 +1,113 @@
{
"owner": "informed-decision",
"scope": "exact amended T05 source agreement; same T08; historical initial review retained; no publication or native go",
"candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"initial_product_review_manifest_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225",
"files": [
{
"repo": "informed-decision",
"path": "workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/workplans/ADHOC-2026-10-11.md",
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
"staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"original_sha256": null,
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"original_sha256": null,
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"original_sha256": null,
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"original_sha256": null,
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"original_sha256": null,
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
}
]
}

20
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py Normal file
View file

@ -0,0 +1,20 @@
import pathlib,json,hashlib
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
entries=json.loads(m.read_text());assert len(entries)==58
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
for e in old:
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
exec(compile(code,'product-amended-readback','exec'),{})
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
print('Exact amended source and directory metadata readback pass.')

73
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json Normal file
View file

@ -0,0 +1,73 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"directory_metadata_compared": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

42
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json Normal file
View file

@ -0,0 +1,42 @@
{
"owner": "informed-decision",
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"files": [
{
"repo": "informed-decision",
"path": "workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
}
]
}

39
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

74
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md Normal file
View file

@ -0,0 +1,74 @@
# Bounded zlib candidate Product owner review
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact local zlib-only source candidate technical preparation
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
comment: >-
Informed-decision intent requires human binding and preserved evidence; this
candidate changes only a native compression dependency while preserving
application authorization/presentation behavior. T08 review work record was
completed first. This is technical source agreement, not native go, publication
receipt, founder acceptance or T05 completion.
```
All27 staged hashes and retained evidence-file hashes independently verify.
Independent saved-image archive readback confirms all nine exact763 base diff_ids
as prefix, equal effective runtime configuration with only explicitly normalized
empty/false/null defaults, and final filesystem changes exactly
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
No service values, namespace, DB, customer data, config, PVC, schema, audience,
policy pins, protected helper or existing release journal is changed.
Package/index bytes match pinned official HTTPS download hashes. Both signed
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
in unchanged baseline trust metadata. Retained actual maker apk verify success
against exact763 installed keys is the execution evidence; this review separately
checks archive signatures' metadata, bytes and trust identity, without claiming
a new signature-verification execution. Containerfile requires digest checks and
`apk verify` success before offline named-package upgrade; no allow-untrusted or
keys-dir override. Existing trusted keys are not replaced.
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
defines integrity/signature checking and nonzero failure.
Upgrade selects only zlib from retained local signed index, disables network,
preupgrade and logging, and removes temporary public artifacts.
Both full CycloneDX/Trivy artifacts independently show44 packages and only
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
CVE-2026-85091; candidate has zero findings at the retained same database
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
scan improvement at that snapshot, not estate risk grading or future safety.
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
representations; neither is a published registry digest or native image proof.
Four existing source tests pass, covering eight mutations; five additional Product
mutations of app source, trust keys, APK world, network and provider/data flags
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
and ten installed purpose variants are local synthetic checks, not live PDP
or customer/native-data testing. No new container or native execution by reviewer.
Workflow publishes only a source-bound candidate through existing admitted owner
registry capability after root source review/commit: exact40hex source revision,
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
bounded build, unchanged runtime comparison and purpose checks before push.
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
The workflow is unexecuted; source review does not attest CI credentials, actual
publication or published artifact equivalence. Root must retain actual CI/source
revision and registry descriptor/layer/config/package/signature/context readback,
then full published scan/SBOM and scoped candidate release preparation. Only
distinct exact informed-decision founder native approval followed by installedr1,
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
to763 preserves latest DB; no historical snapshot restore.
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
controller is implied. T04/c96 accepted outcome and original uncertain journals
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
No new native authority, owner checkout write, credential/login, deployment or
customer-data access occurred in this review.

259
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md Normal file
View file

@ -0,0 +1,259 @@
---
id: INFD-WP-ADHOC-2026-10-11
type: workplan
title: "Application-owner catalogue facts review"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
```task
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
and Layer Placement. Read actual owner OIDC, requester and policy-request
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
value-free native registration/Ingress/preflight receipts. Exact canonical
facts agree. Browser client is distinct from create-only requester.
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
Canonical facts SHA-256:
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
Reviewed refined nine-file executor manifest SHA-256:
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
This task completes the application-facts source review only. It grants no
maintenance exception, native dry-run/apply/recovery, IAM permission, image
release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.
## Reconcile Staff evidence source declaration and current guarantees
```task
id: INFD-WP-ADHOC-2026-10-11-T04
status: done
priority: medium
```
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
class definitions, transactional recording, heartbeat/reconciliation scheduling,
existing component-test assertions and native count/receipt evidence. Reconciled
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
source intake for remaining class-specific declaration/verification gaps,
origin INFD-WP-0007. No residual implementation or native action occurred.
Source evidence reconciliation:
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
Formal source review:
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
compromised-source and commitment/content availability limits remain unchanged.
## Independently review supervised purpose actuator product boundaries
```task
id: INFD-WP-ADHOC-2026-10-11-T05
status: done
priority: medium
```
Same informed-decision-owner reviewed exact23-path helper manifest
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
private snapshot custody, confined offline UID0 initialization followed by
UID10001 pre/post-admin verification, independent failed-candidate rollback
and all-phase start deadline are technically agreed as source preparation.
No purpose-policy or candidate image change. Retained helper16 synthetic tests
and platform5 independent recovery negatives are mechanism proof; prior50
product policy negatives remain applicable. No new test run was needed for this
unchanged-source review. Native-provider acceptance remains distinct from the
installed10 synthetic purpose forms; T04 is not complete. Before first human
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
initializer/recovery/deadline refinements and preserved full scan provenance.
Exact combined packet acknowledgement remains a separate review gate.
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
No native reads/backups/export/restore/release, credentials, human disposition,
founder approval or phase authority was exercised by this review.
## Prepare separately gated provider-derived denial mechanism probe
```task
id: INFD-WP-ADHOC-2026-10-11-T06
status: done
priority: medium
```
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
canonical real DENY is required; no claims are invented to obtain ALLOW.
One actual provider response will remain in Pod memory; ten transformed
noncanonical purpose copies test installed consumer refusal without further
provider calls, DB/admin or act effects. This is a denial/binding mechanism
proof candidate, not actual authorized lifecycle or full T04 acceptance.
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
Ten synthetic source tests pass; no actual provider, credential, runtime config,
DB, native data or live action was accessed. Posted frozen112 packet/helper
remain unchanged. Exact separate founder go for this newly prepared probe and
its target must precede any execution; current memo has no acceptance and this
new helper is not hash-bound in that submitted packet. T04 remains progress.
## Review exact existing-snapshot rescue version2 preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T07
status: done
priority: medium
```
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
require fresh founder acceptance. Immutable reads are bounded to proven frozen
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
guards pass (including eight refusal mutations and a frozen initial packet check).
No native command, DB open, credentials or rescue operation occurred.
Initial review decision changes_requested: proposal.json misleadingly names old
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
label it original/historical and refreeze all dependent packet hashes. Correct
current bundle/plan digests already exist. The normalized test fixture is not an
owner edit or approval. Initial review/failure must remain after correction;
exact amended confirmation is still required before newhuman submission/execution.
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
T04 remains progress; original version1 approval is not newversion2 authority.
**Amended source confirmation, same T07 trial:** exact134-path manifest
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
corrects only the historical helper provenance label and dependent packet hashes;
original66 source and initial changes-requested review remain retained. Current
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
mutations and three packet mutations independently refuse. Final technical
source acknowledgement approved; no new human acceptance or native rescue.
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
**Actual-outcome assessment preparation, same completed T07 trial:** independently
verified original receipt-byte hashes and source consumer path after approved
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
backup/private copy matches live post-release counts16/56/0, delivered336,
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
is separate from installed ten synthetic purpose forms (2allow/8refuse).
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.

20
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json Normal file
View file

@ -0,0 +1,20 @@
{
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"all58_hashes_verified": true,
"all27_initial_archived_hashes_verified": true,
"changed_initial_paths": [
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
],
"image_context_source_workflow_runtime_scan_unchanged": true,
"new_source_tests_passed": 3,
"directory_negative_mutations": 3,
"optimized_tampered_before_read_refusal": true,
"existing_actual_archives_directory_reaudit": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"native_actions": false
}

39
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

55
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md Normal file
View file

@ -0,0 +1,55 @@
# Exact amended zlib candidate Product confirmation
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact amended local T05 source candidate preparation only
manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
comment: >-
Same completed T08 preparation trial: work-record refinement was prepared
before this formal exact acknowledgment. Initial Product agreement/manifest
5f334 remains historical, including its bounded audit validation. This final
confirmation covers the guard refinement, not publication/native approval,
a second scored success or T05 completion.
```
All58 final staged hashes verify; all27 initial candidate snapshots match
immutable manifest8d345bb2. Actual initial-to-current diff changes only four
existing paths: artifact checker, its comparison and local-validation receipts,
and README. New audit tests/refinement record and original source archive are
additions. No Containerfile/workflow, signed APK/index/pins/four-file context,
package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source
scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe
contextc554 and actual retained DB03cacb remain exact. Original four-source-test
and Product five negative-probe findings remain applicable, not needlessly rerun.
The artifact checker now refuses optimized Python before any archive/JSON read,
so assertions cannot silently disappear. Directory mode/UID/GID metadata is
included in final layer reconstruction and diff enforcement. Three new source
tests pass: malformed archive under -O refuses explicitly before reads; identical
directory metadata passes; each mode/UID/GID mutation refuses without a report.
These fixtures are isolated synthetic source tests. Independent reread of actual
existing local saved-image archives confirms equal directory counts and no
directory metadata delta; the same two final changed files are libz and APK DB,
nine base layers remain prefix and effective runtime config/SBOM/scan match.
No new image build, container launch, scan, customer/native data or provider call
was performed by this review.
Initial Product review and validation retain their exact bytes under
`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`;
original current review file remains the initial agreement, with this separate
final acknowledgment carrying the refinement. Signature trust conclusions stay
bounded to pinned signed artifacts/unchanged trust metadata, actual retained
maker apk verify and enforced recipe; this acknowledgment does not claim fresh
cryptographic execution. Zero findings remains specific to retained sameDB scan,
not an estate risk grade or future safety assurance.
T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root
source review/commit and admitted owner CI candidate publication, exact actual
published registry provenance/package/full scan/SBOM, separate fresh native
founder release acceptance and installedr1/runtime/full-rescan proof remain
required. Existing approved R2 helper/journal, native image763, DB/config/PVC/
identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and
unimplemented. This technical acknowledgment grants no native action, human
acceptance, credential capability or publication execution.

74
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md Normal file
View file

@ -0,0 +1,74 @@
# Bounded zlib candidate Product owner review
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact local zlib-only source candidate technical preparation
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
comment: >-
Informed-decision intent requires human binding and preserved evidence; this
candidate changes only a native compression dependency while preserving
application authorization/presentation behavior. T08 review work record was
completed first. This is technical source agreement, not native go, publication
receipt, founder acceptance or T05 completion.
```
All27 staged hashes and retained evidence-file hashes independently verify.
Independent saved-image archive readback confirms all nine exact763 base diff_ids
as prefix, equal effective runtime configuration with only explicitly normalized
empty/false/null defaults, and final filesystem changes exactly
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
No service values, namespace, DB, customer data, config, PVC, schema, audience,
policy pins, protected helper or existing release journal is changed.
Package/index bytes match pinned official HTTPS download hashes. Both signed
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
in unchanged baseline trust metadata. Retained actual maker apk verify success
against exact763 installed keys is the execution evidence; this review separately
checks archive signatures' metadata, bytes and trust identity, without claiming
a new signature-verification execution. Containerfile requires digest checks and
`apk verify` success before offline named-package upgrade; no allow-untrusted or
keys-dir override. Existing trusted keys are not replaced.
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
defines integrity/signature checking and nonzero failure.
Upgrade selects only zlib from retained local signed index, disables network,
preupgrade and logging, and removes temporary public artifacts.
Both full CycloneDX/Trivy artifacts independently show44 packages and only
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
CVE-2026-85091; candidate has zero findings at the retained same database
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
scan improvement at that snapshot, not estate risk grading or future safety.
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
representations; neither is a published registry digest or native image proof.
Four existing source tests pass, covering eight mutations; five additional Product
mutations of app source, trust keys, APK world, network and provider/data flags
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
and ten installed purpose variants are local synthetic checks, not live PDP
or customer/native-data testing. No new container or native execution by reviewer.
Workflow publishes only a source-bound candidate through existing admitted owner
registry capability after root source review/commit: exact40hex source revision,
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
bounded build, unchanged runtime comparison and purpose checks before push.
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
The workflow is unexecuted; source review does not attest CI credentials, actual
publication or published artifact equivalence. Root must retain actual CI/source
revision and registry descriptor/layer/config/package/signature/context readback,
then full published scan/SBOM and scoped candidate release preparation. Only
distinct exact informed-decision founder native approval followed by installedr1,
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
to763 preserves latest DB; no historical snapshot restore.
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
controller is implied. T04/c96 accepted outcome and original uncertain journals
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
No new native authority, owner checkout write, credential/login, deployment or
customer-data access occurred in this review.

273
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md Normal file
View file

@ -0,0 +1,273 @@
---
id: INFD-WP-ADHOC-2026-10-11
type: workplan
title: "Application-owner catalogue facts review"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
```task
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
and Layer Placement. Read actual owner OIDC, requester and policy-request
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
value-free native registration/Ingress/preflight receipts. Exact canonical
facts agree. Browser client is distinct from create-only requester.
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
Canonical facts SHA-256:
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
Reviewed refined nine-file executor manifest SHA-256:
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
This task completes the application-facts source review only. It grants no
maintenance exception, native dry-run/apply/recovery, IAM permission, image
release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.
## Reconcile Staff evidence source declaration and current guarantees
```task
id: INFD-WP-ADHOC-2026-10-11-T04
status: done
priority: medium
```
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
class definitions, transactional recording, heartbeat/reconciliation scheduling,
existing component-test assertions and native count/receipt evidence. Reconciled
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
source intake for remaining class-specific declaration/verification gaps,
origin INFD-WP-0007. No residual implementation or native action occurred.
Source evidence reconciliation:
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
Formal source review:
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
compromised-source and commitment/content availability limits remain unchanged.
## Independently review supervised purpose actuator product boundaries
```task
id: INFD-WP-ADHOC-2026-10-11-T05
status: done
priority: medium
```
Same informed-decision-owner reviewed exact23-path helper manifest
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
private snapshot custody, confined offline UID0 initialization followed by
UID10001 pre/post-admin verification, independent failed-candidate rollback
and all-phase start deadline are technically agreed as source preparation.
No purpose-policy or candidate image change. Retained helper16 synthetic tests
and platform5 independent recovery negatives are mechanism proof; prior50
product policy negatives remain applicable. No new test run was needed for this
unchanged-source review. Native-provider acceptance remains distinct from the
installed10 synthetic purpose forms; T04 is not complete. Before first human
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
initializer/recovery/deadline refinements and preserved full scan provenance.
Exact combined packet acknowledgement remains a separate review gate.
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
No native reads/backups/export/restore/release, credentials, human disposition,
founder approval or phase authority was exercised by this review.
## Prepare separately gated provider-derived denial mechanism probe
```task
id: INFD-WP-ADHOC-2026-10-11-T06
status: done
priority: medium
```
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
canonical real DENY is required; no claims are invented to obtain ALLOW.
One actual provider response will remain in Pod memory; ten transformed
noncanonical purpose copies test installed consumer refusal without further
provider calls, DB/admin or act effects. This is a denial/binding mechanism
proof candidate, not actual authorized lifecycle or full T04 acceptance.
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
Ten synthetic source tests pass; no actual provider, credential, runtime config,
DB, native data or live action was accessed. Posted frozen112 packet/helper
remain unchanged. Exact separate founder go for this newly prepared probe and
its target must precede any execution; current memo has no acceptance and this
new helper is not hash-bound in that submitted packet. T04 remains progress.
## Review exact existing-snapshot rescue version2 preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T07
status: done
priority: medium
```
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
require fresh founder acceptance. Immutable reads are bounded to proven frozen
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
guards pass (including eight refusal mutations and a frozen initial packet check).
No native command, DB open, credentials or rescue operation occurred.
Initial review decision changes_requested: proposal.json misleadingly names old
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
label it original/historical and refreeze all dependent packet hashes. Correct
current bundle/plan digests already exist. The normalized test fixture is not an
owner edit or approval. Initial review/failure must remain after correction;
exact amended confirmation is still required before newhuman submission/execution.
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
T04 remains progress; original version1 approval is not newversion2 authority.
**Amended source confirmation, same T07 trial:** exact134-path manifest
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
corrects only the historical helper provenance label and dependent packet hashes;
original66 source and initial changes-requested review remain retained. Current
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
mutations and three packet mutations independently refuse. Final technical
source acknowledgement approved; no new human acceptance or native rescue.
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
**Actual-outcome assessment preparation, same completed T07 trial:** independently
verified original receipt-byte hashes and source consumer path after approved
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
backup/private copy matches live post-release counts16/56/0, delivered336,
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
is separate from installed ten synthetic purpose forms (2allow/8refuse).
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
**Exact amended confirmation, same completed T08 preparation trial:** verified
final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs
change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB
remain identical. New3 artifact tests pass (optimized malformed input refused
before reads; matching directories pass; directory mode/UID/GID drift refuse).
Independent actual saved-image reread proves all directory metadata unchanged,
with the same two final file changes. Initial Product manifest5f334/ack/validation
are retained as historical source agreement, not new scored native success.
This work-record refinement precedes final formal acknowledgment. No publication,
native operation, credentials or owner edits. T05progress/WP0009active remains.
Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md.

24
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json Normal file
View file

@ -0,0 +1,24 @@
[
{
"marker": "usr/.wh..wh..opq",
"same_layer_new": "usr/new",
"actual_names": [
"usr"
],
"same_layer_new_preserved": false
},
{
"marker": ".wh..wh..opq",
"same_layer_new": "new",
"actual_names": [],
"same_layer_new_preserved": false
},
{
"marker": "usr/.wh.child",
"same_layer_new": "usr/child/new",
"actual_names": [
"usr"
],
"same_layer_new_preserved": false
}
]

23
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py Normal file
View file

@ -0,0 +1,23 @@
import ast,tarfile,io,json,hashlib,tempfile
from pathlib import Path
P=Path(__file__).parent
ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen66-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns)
def add(t,name,data):
m=tarfile.TarInfo(name);m.mode=0o755
if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
else:m.size=len(data);t.addfile(m,io.BytesIO(data))
def layer(entries):
b=io.BytesIO()
with tarfile.open(fileobj=b,mode='w') as t:
for name,data in entries:add(t,name,data)
return b.getvalue()
results=[]
for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]:
base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')])
with tempfile.TemporaryDirectory() as tmp:
path=Path(tmp)/'image.tar'
with tarfile.open(path,'w') as t:
add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over)
_,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files))
print(json.dumps(results,indent=2))
assert all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced'

55
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md Normal file
View file

@ -0,0 +1,55 @@
# Exact amended zlib candidate Product confirmation
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact amended local T05 source candidate preparation only
manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
comment: >-
Same completed T08 preparation trial: work-record refinement was prepared
before this formal exact acknowledgment. Initial Product agreement/manifest
5f334 remains historical, including its bounded audit validation. This final
confirmation covers the guard refinement, not publication/native approval,
a second scored success or T05 completion.
```
All58 final staged hashes verify; all27 initial candidate snapshots match
immutable manifest8d345bb2. Actual initial-to-current diff changes only four
existing paths: artifact checker, its comparison and local-validation receipts,
and README. New audit tests/refinement record and original source archive are
additions. No Containerfile/workflow, signed APK/index/pins/four-file context,
package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source
scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe
contextc554 and actual retained DB03cacb remain exact. Original four-source-test
and Product five negative-probe findings remain applicable, not needlessly rerun.
The artifact checker now refuses optimized Python before any archive/JSON read,
so assertions cannot silently disappear. Directory mode/UID/GID metadata is
included in final layer reconstruction and diff enforcement. Three new source
tests pass: malformed archive under -O refuses explicitly before reads; identical
directory metadata passes; each mode/UID/GID mutation refuses without a report.
These fixtures are isolated synthetic source tests. Independent reread of actual
existing local saved-image archives confirms equal directory counts and no
directory metadata delta; the same two final changed files are libz and APK DB,
nine base layers remain prefix and effective runtime config/SBOM/scan match.
No new image build, container launch, scan, customer/native data or provider call
was performed by this review.
Initial Product review and validation retain their exact bytes under
`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`;
original current review file remains the initial agreement, with this separate
final acknowledgment carrying the refinement. Signature trust conclusions stay
bounded to pinned signed artifacts/unchanged trust metadata, actual retained
maker apk verify and enforced recipe; this acknowledgment does not claim fresh
cryptographic execution. Zero findings remains specific to retained sameDB scan,
not an estate risk grade or future safety assurance.
T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root
source review/commit and admitted owner CI candidate publication, exact actual
published registry provenance/package/full scan/SBOM, separate fresh native
founder release acceptance and installedr1/runtime/full-rescan proof remain
required. Existing approved R2 helper/journal, native image763, DB/config/PVC/
identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and
unimplemented. This technical acknowledgment grants no native action, human
acceptance, credential capability or publication execution.

74
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md Normal file
View file

@ -0,0 +1,74 @@
# Bounded zlib candidate Product owner review
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact local zlib-only source candidate technical preparation
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
comment: >-
Informed-decision intent requires human binding and preserved evidence; this
candidate changes only a native compression dependency while preserving
application authorization/presentation behavior. T08 review work record was
completed first. This is technical source agreement, not native go, publication
receipt, founder acceptance or T05 completion.
```
All27 staged hashes and retained evidence-file hashes independently verify.
Independent saved-image archive readback confirms all nine exact763 base diff_ids
as prefix, equal effective runtime configuration with only explicitly normalized
empty/false/null defaults, and final filesystem changes exactly
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
No service values, namespace, DB, customer data, config, PVC, schema, audience,
policy pins, protected helper or existing release journal is changed.
Package/index bytes match pinned official HTTPS download hashes. Both signed
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
in unchanged baseline trust metadata. Retained actual maker apk verify success
against exact763 installed keys is the execution evidence; this review separately
checks archive signatures' metadata, bytes and trust identity, without claiming
a new signature-verification execution. Containerfile requires digest checks and
`apk verify` success before offline named-package upgrade; no allow-untrusted or
keys-dir override. Existing trusted keys are not replaced.
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
defines integrity/signature checking and nonzero failure.
Upgrade selects only zlib from retained local signed index, disables network,
preupgrade and logging, and removes temporary public artifacts.
Both full CycloneDX/Trivy artifacts independently show44 packages and only
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
CVE-2026-85091; candidate has zero findings at the retained same database
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
scan improvement at that snapshot, not estate risk grading or future safety.
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
representations; neither is a published registry digest or native image proof.
Four existing source tests pass, covering eight mutations; five additional Product
mutations of app source, trust keys, APK world, network and provider/data flags
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
and ten installed purpose variants are local synthetic checks, not live PDP
or customer/native-data testing. No new container or native execution by reviewer.
Workflow publishes only a source-bound candidate through existing admitted owner
registry capability after root source review/commit: exact40hex source revision,
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
bounded build, unchanged runtime comparison and purpose checks before push.
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
The workflow is unexecuted; source review does not attest CI credentials, actual
publication or published artifact equivalence. Root must retain actual CI/source
revision and registry descriptor/layer/config/package/signature/context readback,
then full published scan/SBOM and scoped candidate release preparation. Only
distinct exact informed-decision founder native approval followed by installedr1,
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
to763 preserves latest DB; no historical snapshot restore.
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
controller is implied. T04/c96 accepted outcome and original uncertain journals
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
No new native authority, owner checkout write, credential/login, deployment or
customer-data access occurred in this review.

37
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md Normal file
View file

@ -0,0 +1,37 @@
# Exact66 zlib audit whiteout Product finding
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: changes_requested
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact66 local candidate artifact-audit source refinement
manifest_sha256: 3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0
comment: >-
Same completed T08; work record prepared before this formal finding.
No actual candidate-image failure or new scored/native trial. Preserve
initial5f334 and intermediate8bc6 acknowledgments as historical.
```
All66 staged hashes independently verify. Whiteout leading-dot and root opaque
handling corrections address the prior cases, but remaining stream-order behavior
violates the lower-layer boundary. A synthetic parent layer contains usr/child/old;
next layer writes a new file before its whiteout marker. Three retained isolated
probes reproduce incorrect deletion: usr/new then usr/.wh..wh..opq, root new then
.wh..wh..opq, and usr/child/new then usr/.wh.child. Actual parsed sets lose the
same-layer new file in every case. Frozen checker/manifest and reproducible
probe/receipt are retained under docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/.
[OCI layer specification](https://github.com/opencontainers/image-spec/blob/main/layer.md)
requires whiteouts to affect only parent layers and opacity to precede new entries
regardless archive ordering. Correct reconstruction should apply whiteouts to
the prior layer state and then merge current layer additions, preserving both
marker-before and marker-after order semantics. Add meaningful root/nested opaque
and explicit-directory removal cases with same-layer children/replacements.
The existing four no-new-sibling cases cannot establish this boundary.
This finding is confined to audit-source semantics, not APK trust or actual image
contents/build/scan. Current actual candidate image/context/package/workflow/
runtime and scanner evidence remain unchanged; no native/read-only command or
customer/DB/credential access occurred. T05 remains progress/WP0009 active;
publication and distinct founder native release/installed proof remain pending.
A corrected exact frozen packet needs final technical confirmation.

288
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/workplans/ADHOC-2026-10-11.md Normal file
View file

@ -0,0 +1,288 @@
---
id: INFD-WP-ADHOC-2026-10-11
type: workplan
title: "Application-owner catalogue facts review"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
```task
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
and Layer Placement. Read actual owner OIDC, requester and policy-request
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
value-free native registration/Ingress/preflight receipts. Exact canonical
facts agree. Browser client is distinct from create-only requester.
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
Canonical facts SHA-256:
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
Reviewed refined nine-file executor manifest SHA-256:
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
This task completes the application-facts source review only. It grants no
maintenance exception, native dry-run/apply/recovery, IAM permission, image
release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.
## Reconcile Staff evidence source declaration and current guarantees
```task
id: INFD-WP-ADHOC-2026-10-11-T04
status: done
priority: medium
```
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
class definitions, transactional recording, heartbeat/reconciliation scheduling,
existing component-test assertions and native count/receipt evidence. Reconciled
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
source intake for remaining class-specific declaration/verification gaps,
origin INFD-WP-0007. No residual implementation or native action occurred.
Source evidence reconciliation:
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
Formal source review:
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
compromised-source and commitment/content availability limits remain unchanged.
## Independently review supervised purpose actuator product boundaries
```task
id: INFD-WP-ADHOC-2026-10-11-T05
status: done
priority: medium
```
Same informed-decision-owner reviewed exact23-path helper manifest
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
private snapshot custody, confined offline UID0 initialization followed by
UID10001 pre/post-admin verification, independent failed-candidate rollback
and all-phase start deadline are technically agreed as source preparation.
No purpose-policy or candidate image change. Retained helper16 synthetic tests
and platform5 independent recovery negatives are mechanism proof; prior50
product policy negatives remain applicable. No new test run was needed for this
unchanged-source review. Native-provider acceptance remains distinct from the
installed10 synthetic purpose forms; T04 is not complete. Before first human
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
initializer/recovery/deadline refinements and preserved full scan provenance.
Exact combined packet acknowledgement remains a separate review gate.
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
No native reads/backups/export/restore/release, credentials, human disposition,
founder approval or phase authority was exercised by this review.
## Prepare separately gated provider-derived denial mechanism probe
```task
id: INFD-WP-ADHOC-2026-10-11-T06
status: done
priority: medium
```
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
canonical real DENY is required; no claims are invented to obtain ALLOW.
One actual provider response will remain in Pod memory; ten transformed
noncanonical purpose copies test installed consumer refusal without further
provider calls, DB/admin or act effects. This is a denial/binding mechanism
proof candidate, not actual authorized lifecycle or full T04 acceptance.
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
Ten synthetic source tests pass; no actual provider, credential, runtime config,
DB, native data or live action was accessed. Posted frozen112 packet/helper
remain unchanged. Exact separate founder go for this newly prepared probe and
its target must precede any execution; current memo has no acceptance and this
new helper is not hash-bound in that submitted packet. T04 remains progress.
## Review exact existing-snapshot rescue version2 preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T07
status: done
priority: medium
```
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
require fresh founder acceptance. Immutable reads are bounded to proven frozen
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
guards pass (including eight refusal mutations and a frozen initial packet check).
No native command, DB open, credentials or rescue operation occurred.
Initial review decision changes_requested: proposal.json misleadingly names old
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
label it original/historical and refreeze all dependent packet hashes. Correct
current bundle/plan digests already exist. The normalized test fixture is not an
owner edit or approval. Initial review/failure must remain after correction;
exact amended confirmation is still required before newhuman submission/execution.
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
T04 remains progress; original version1 approval is not newversion2 authority.
**Amended source confirmation, same T07 trial:** exact134-path manifest
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
corrects only the historical helper provenance label and dependent packet hashes;
original66 source and initial changes-requested review remain retained. Current
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
mutations and three packet mutations independently refuse. Final technical
source acknowledgement approved; no new human acceptance or native rescue.
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
**Actual-outcome assessment preparation, same completed T07 trial:** independently
verified original receipt-byte hashes and source consumer path after approved
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
backup/private copy matches live post-release counts16/56/0, delivered336,
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
is separate from installed ten synthetic purpose forms (2allow/8refuse).
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
**Exact amended confirmation, same completed T08 preparation trial:** verified
final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs
change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB
remain identical. New3 artifact tests pass (optimized malformed input refused
before reads; matching directories pass; directory mode/UID/GID drift refuse).
Independent actual saved-image reread proves all directory metadata unchanged,
with the same two final file changes. Initial Product manifest5f334/ack/validation
are retained as historical source agreement, not new scored native success.
This work-record refinement precedes final formal acknowledgment. No publication,
native operation, credentials or owner edits. T05progress/WP0009active remains.
Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md.
**Exact66 whiteout follow-through, same completed T08 preparation:** independently
verified manifest3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0
and all66 hashes. New source correction preserves leading whiteout dots/root
parent handling, but three Product synthetic probes find same-layer new files
incorrectly removed by subsequent nested/root opaque or explicit descendant
whiteouts. OCI requires whiteouts affect only lower layers and preserve same-layer
additions regardless archive order. Completed source assessment changes_requested
before formal entry: apply whiteouts only previous layers then merge current
layer additions, with both archive orders covered. No actual candidate failure
or image/sourcecontext/scan change is inferred. Initial5f334 and intermediate
8bc6 reviews/evidence remain historical, not rewritten; same T08/no new trial.
No owner edits, native operation, publication or credentials.
Review: docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md.

23
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/check_final74.py Normal file
View file

@ -0,0 +1,23 @@
from pathlib import Path
import json,hashlib,subprocess
S=Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=Path('/tmp/infd-zlib-product-complete-ack-stage');H=lambda b:hashlib.sha256(b).hexdigest()
m=Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec';entries=json.loads(m.read_text());assert len(entries)==74
for e in entries:assert H(Path(e['staged_path']).read_bytes())==e['staged_sha256']
old=Path('/tmp/infd-zlib-product-whiteout-review-stage/frozen66-candidate-manifest.json');oldentries=json.loads(old.read_text());changed=[]
for e in oldentries:
p=S/e['path'];assert p.exists()
if H(p.read_bytes())!=e['staged_sha256']:changed.append(e['path'])
assert all(p.startswith('docs/evidence/2026-10-11-zlib-remediation-candidate/') for p in changed)
initial=P/'initial-8d345bb2/owner-snapshot';a=json.loads((initial/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text());b=json.loads((P/'local-candidate-verification.json').read_text())
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert a[k]==b[k]
(O/'frozen74-verify_local_artifacts.py').write_bytes((P/'verify_local_artifacts.py').read_bytes())
code=Path('/tmp/infd-zlib-product-whiteout-review-stage/probe_same_layer_whiteout.py').read_text().replace('frozen66-verify_local_artifacts.py','frozen74-verify_local_artifacts.py').replace("all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced'","all(r['same_layer_new_preserved'] for r in results),'same-layer addition lost'")
(O/'probe_corrected_same_layer_whiteout.py').write_text(code)
r=subprocess.run(['python3',str(O/'probe_corrected_same_layer_whiteout.py')],capture_output=True,text=True);assert r.returncode==0,r.stderr;(O/'corrected-probe-receipt.json').write_text(r.stdout)
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-complete-ack-stage')/'independent-final-artifact-comparison.json').write_text")
exec(compile(code,'product-final74-readback','exec'),{})
proof=json.loads((O/'independent-final-artifact-comparison.json').read_text());official=json.loads((P/'artifact-comparison.json').read_text())
for k in ['final_changed_files','directory_count_base','directory_count_candidate','directory_metadata_delta','base_layers_preserved','sbom_only_delta']:assert proof[k]==official[k]
assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} and not proof['directory_metadata_delta']
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all74_hashes_verified=True,changed_from66=changed,source_recipe_workflow_context_image_scan_unchanged=True,new_audit_tests_passed=5,whiteout_semantic_cases=12,additional_product_original_counterexamples_now_preserved=3,actual_saved_archive_reaudit_pass=True,directory_count_base=proof['directory_count_base'],directory_count_candidate=proof['directory_count_candidate'],directory_metadata_delta={},sameT08=True,native_actions=False,publication=False),indent=2)+'\n')
print('Exact74 and all original Product counterexamples now pass; existing actual image re-audit passes.')

28
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/corrected-probe-receipt.json Normal file
View file

@ -0,0 +1,28 @@
[
{
"marker": "usr/.wh..wh..opq",
"same_layer_new": "usr/new",
"actual_names": [
"usr",
"usr/new"
],
"same_layer_new_preserved": true
},
{
"marker": ".wh..wh..opq",
"same_layer_new": "new",
"actual_names": [
"new"
],
"same_layer_new_preserved": true
},
{
"marker": "usr/.wh.child",
"same_layer_new": "usr/child/new",
"actual_names": [
"usr",
"usr/child/new"
],
"same_layer_new_preserved": true
}
]

56
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/frozen74-verify_local_artifacts.py Normal file
View file

@ -0,0 +1,56 @@
from pathlib import Path
import hashlib,io,json,tarfile,sys
if sys.flags.optimize:
raise SystemExit("REFUSED: optimized Python disables required artifact validation")
root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
def image(path):
with tarfile.open(path) as archive:
manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
files={}
for name in manifest[0]['Layers']:
additions={};removed=[];opaque=[]
with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
for member in layer:
path=member.name
while path.startswith('./'):path=path[2:]
path=path.lstrip('/');p=Path(path)
if p.name=='.wh..wh..opq':
parent=p.parent.as_posix();opaque.append('' if parent=='.' else parent+'/');continue
if p.name.startswith('.wh.'):
removed.append((p.parent/p.name[4:]).as_posix());continue
if member.isfile():
data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
else:continue
additions[path]=value
# OCI whiteouts mask lower-layer entries only; same-layer additions survive
# independently of where the marker appeared in the layer tar stream.
files={key:value for key,value in files.items() if not any(key.startswith(prefix) for prefix in opaque) and not any(key==target or key.startswith(target+'/') for target in removed)}
files.update(additions)
return config,hashlib.sha256(configbytes).hexdigest(),files
base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
assert set(changed)<=expected,set(changed)
a,b=base['config'].copy(),candidate['config'].copy()
labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
a.pop('Image',None);b.pop('Image',None)
defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
for key,value in defaults.items():
a.setdefault(key,value);b.setdefault(key,value)
assert a==b,(a,b)
components=[]
for name in ['base-sbom.cdx.json','sbom.cdx.json']:
data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
vulns=[]
for name in ['base-trivy-full.json','trivy-full.json']:
data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
assert not vulns[1]
proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))

73
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/independent-final-artifact-comparison.json Normal file
View file

@ -0,0 +1,73 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"directory_metadata_compared": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

23
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/probe_corrected_same_layer_whiteout.py Normal file
View file

@ -0,0 +1,23 @@
import ast,tarfile,io,json,hashlib,tempfile
from pathlib import Path
P=Path(__file__).parent
ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen74-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns)
def add(t,name,data):
m=tarfile.TarInfo(name);m.mode=0o755
if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
else:m.size=len(data);t.addfile(m,io.BytesIO(data))
def layer(entries):
b=io.BytesIO()
with tarfile.open(fileobj=b,mode='w') as t:
for name,data in entries:add(t,name,data)
return b.getvalue()
results=[]
for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]:
base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')])
with tempfile.TemporaryDirectory() as tmp:
path=Path(tmp)/'image.tar'
with tarfile.open(path,'w') as t:
add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over)
_,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files))
print(json.dumps(results,indent=2))
assert all(r['same_layer_new_preserved'] for r in results),'same-layer addition lost'

22
docs/evidence/2026-10-11-zlib-candidate-product-complete-review/validation.json Normal file
View file

@ -0,0 +1,22 @@
{
"exact_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
"all74_hashes_verified": true,
"changed_from66": [
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
],
"source_recipe_workflow_context_image_scan_unchanged": true,
"new_audit_tests_passed": 5,
"whiteout_semantic_cases": 12,
"additional_product_original_counterexamples_now_preserved": 3,
"actual_saved_archive_reaudit_pass": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"sameT08": true,
"native_actions": false,
"publication": false
}

20
docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py Normal file
View file

@ -0,0 +1,20 @@
import pathlib,json,hashlib
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
entries=json.loads(m.read_text());assert len(entries)==58
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
for e in old:
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
exec(compile(code,'product-amended-readback','exec'),{})
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
print('Exact amended source and directory metadata readback pass.')

73
docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json Normal file
View file

@ -0,0 +1,73 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"directory_metadata_compared": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

42
docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json Normal file
View file

@ -0,0 +1,42 @@
{
"owner": "informed-decision",
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"files": [
{
"repo": "informed-decision",
"path": "workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
}
]
}

39
docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

74
docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md Normal file
View file

@ -0,0 +1,74 @@
# Bounded zlib candidate Product owner review
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact local zlib-only source candidate technical preparation
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
comment: >-
Informed-decision intent requires human binding and preserved evidence; this
candidate changes only a native compression dependency while preserving
application authorization/presentation behavior. T08 review work record was
completed first. This is technical source agreement, not native go, publication
receipt, founder acceptance or T05 completion.
```
All27 staged hashes and retained evidence-file hashes independently verify.
Independent saved-image archive readback confirms all nine exact763 base diff_ids
as prefix, equal effective runtime configuration with only explicitly normalized
empty/false/null defaults, and final filesystem changes exactly
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
No service values, namespace, DB, customer data, config, PVC, schema, audience,
policy pins, protected helper or existing release journal is changed.
Package/index bytes match pinned official HTTPS download hashes. Both signed
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
in unchanged baseline trust metadata. Retained actual maker apk verify success
against exact763 installed keys is the execution evidence; this review separately
checks archive signatures' metadata, bytes and trust identity, without claiming
a new signature-verification execution. Containerfile requires digest checks and
`apk verify` success before offline named-package upgrade; no allow-untrusted or
keys-dir override. Existing trusted keys are not replaced.
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
defines integrity/signature checking and nonzero failure.
Upgrade selects only zlib from retained local signed index, disables network,
preupgrade and logging, and removes temporary public artifacts.
Both full CycloneDX/Trivy artifacts independently show44 packages and only
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
CVE-2026-85091; candidate has zero findings at the retained same database
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
scan improvement at that snapshot, not estate risk grading or future safety.
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
representations; neither is a published registry digest or native image proof.
Four existing source tests pass, covering eight mutations; five additional Product
mutations of app source, trust keys, APK world, network and provider/data flags
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
and ten installed purpose variants are local synthetic checks, not live PDP
or customer/native-data testing. No new container or native execution by reviewer.
Workflow publishes only a source-bound candidate through existing admitted owner
registry capability after root source review/commit: exact40hex source revision,
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
bounded build, unchanged runtime comparison and purpose checks before push.
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
The workflow is unexecuted; source review does not attest CI credentials, actual
publication or published artifact equivalence. Root must retain actual CI/source
revision and registry descriptor/layer/config/package/signature/context readback,
then full published scan/SBOM and scoped candidate release preparation. Only
distinct exact informed-decision founder native approval followed by installedr1,
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
to763 preserves latest DB; no historical snapshot restore.
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
controller is implied. T04/c96 accepted outcome and original uncertain journals
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
No new native authority, owner checkout write, credential/login, deployment or
customer-data access occurred in this review.

259
docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md Normal file
View file

@ -0,0 +1,259 @@
---
id: INFD-WP-ADHOC-2026-10-11
type: workplan
title: "Application-owner catalogue facts review"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
```task
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
and Layer Placement. Read actual owner OIDC, requester and policy-request
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
value-free native registration/Ingress/preflight receipts. Exact canonical
facts agree. Browser client is distinct from create-only requester.
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
Canonical facts SHA-256:
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
Reviewed refined nine-file executor manifest SHA-256:
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
This task completes the application-facts source review only. It grants no
maintenance exception, native dry-run/apply/recovery, IAM permission, image
release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.
## Reconcile Staff evidence source declaration and current guarantees
```task
id: INFD-WP-ADHOC-2026-10-11-T04
status: done
priority: medium
```
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
class definitions, transactional recording, heartbeat/reconciliation scheduling,
existing component-test assertions and native count/receipt evidence. Reconciled
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
source intake for remaining class-specific declaration/verification gaps,
origin INFD-WP-0007. No residual implementation or native action occurred.
Source evidence reconciliation:
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
Formal source review:
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
compromised-source and commitment/content availability limits remain unchanged.
## Independently review supervised purpose actuator product boundaries
```task
id: INFD-WP-ADHOC-2026-10-11-T05
status: done
priority: medium
```
Same informed-decision-owner reviewed exact23-path helper manifest
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
private snapshot custody, confined offline UID0 initialization followed by
UID10001 pre/post-admin verification, independent failed-candidate rollback
and all-phase start deadline are technically agreed as source preparation.
No purpose-policy or candidate image change. Retained helper16 synthetic tests
and platform5 independent recovery negatives are mechanism proof; prior50
product policy negatives remain applicable. No new test run was needed for this
unchanged-source review. Native-provider acceptance remains distinct from the
installed10 synthetic purpose forms; T04 is not complete. Before first human
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
initializer/recovery/deadline refinements and preserved full scan provenance.
Exact combined packet acknowledgement remains a separate review gate.
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
No native reads/backups/export/restore/release, credentials, human disposition,
founder approval or phase authority was exercised by this review.
## Prepare separately gated provider-derived denial mechanism probe
```task
id: INFD-WP-ADHOC-2026-10-11-T06
status: done
priority: medium
```
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
canonical real DENY is required; no claims are invented to obtain ALLOW.
One actual provider response will remain in Pod memory; ten transformed
noncanonical purpose copies test installed consumer refusal without further
provider calls, DB/admin or act effects. This is a denial/binding mechanism
proof candidate, not actual authorized lifecycle or full T04 acceptance.
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
Ten synthetic source tests pass; no actual provider, credential, runtime config,
DB, native data or live action was accessed. Posted frozen112 packet/helper
remain unchanged. Exact separate founder go for this newly prepared probe and
its target must precede any execution; current memo has no acceptance and this
new helper is not hash-bound in that submitted packet. T04 remains progress.
## Review exact existing-snapshot rescue version2 preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T07
status: done
priority: medium
```
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
require fresh founder acceptance. Immutable reads are bounded to proven frozen
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
guards pass (including eight refusal mutations and a frozen initial packet check).
No native command, DB open, credentials or rescue operation occurred.
Initial review decision changes_requested: proposal.json misleadingly names old
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
label it original/historical and refreeze all dependent packet hashes. Correct
current bundle/plan digests already exist. The normalized test fixture is not an
owner edit or approval. Initial review/failure must remain after correction;
exact amended confirmation is still required before newhuman submission/execution.
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
T04 remains progress; original version1 approval is not newversion2 authority.
**Amended source confirmation, same T07 trial:** exact134-path manifest
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
corrects only the historical helper provenance label and dependent packet hashes;
original66 source and initial changes-requested review remain retained. Current
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
mutations and three packet mutations independently refuse. Final technical
source acknowledgement approved; no new human acceptance or native rescue.
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
**Actual-outcome assessment preparation, same completed T07 trial:** independently
verified original receipt-byte hashes and source consumer path after approved
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
backup/private copy matches live post-release counts16/56/0, delivered336,
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
is separate from installed ten synthetic purpose forms (2allow/8refuse).
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.

20
docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json Normal file
View file

@ -0,0 +1,20 @@
{
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"all58_hashes_verified": true,
"all27_initial_archived_hashes_verified": true,
"changed_initial_paths": [
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
],
"image_context_source_workflow_runtime_scan_unchanged": true,
"new_source_tests_passed": 3,
"directory_negative_mutations": 3,
"optimized_tampered_before_read_refusal": true,
"existing_actual_archives_directory_reaudit": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"native_actions": false
}

39
docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

464
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json Normal file
View file

@ -0,0 +1,464 @@
[
{
"repo": "informed-decision",
"path": ".forgejo/workflows/zlib-overlay-image.yaml",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
"original_sha256": null,
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/.dockerignore",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
"original_sha256": null,
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/APKINDEX.tar.gz",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
"original_sha256": null,
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/Containerfile",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
"original_sha256": null,
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/pins.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
"original_sha256": null,
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"original_sha256": null,
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"original_sha256": null,
"staged_sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
"original_sha256": null,
"staged_sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"original_sha256": null,
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"original_sha256": null,
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"original_sha256": null,
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"original_sha256": null,
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"original_sha256": null,
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"original_sha256": null,
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
"original_sha256": null,
"staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
"original_sha256": null,
"staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
"original_sha256": null,
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
"original_sha256": null,
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
"original_sha256": null,
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
"original_sha256": null,
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
"original_sha256": null,
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"original_sha256": null,
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"original_sha256": null,
"staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"original_sha256": null,
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"original_sha256": null,
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"original_sha256": null,
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"original_sha256": null,
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"original_sha256": null,
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"original_sha256": null,
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"original_sha256": null,
"staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"original_sha256": null,
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"original_sha256": null,
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"original_sha256": null,
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"original_sha256": null,
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
"original_sha256": null,
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
"original_sha256": null,
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
"original_sha256": null,
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
"original_sha256": null,
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"original_sha256": null,
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
"original_sha256": null,
"staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
"original_sha256": null,
"staged_sha256": "3e81c1cedb2e3b25d83a779011898181a7860ff76532ede5fa3e9b8f63632700"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
"original_sha256": null,
"staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
"original_sha256": null,
"staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
"original_sha256": null,
"staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
"original_sha256": null,
"staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"original_sha256": null,
"staged_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"original_sha256": null,
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"original_sha256": null,
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"original_sha256": null,
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
"original_sha256": null,
"staged_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"original_sha256": null,
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/check_build_inputs.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
"original_sha256": null,
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/check_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
"original_sha256": null,
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/compare_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
"original_sha256": null,
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/test_candidate.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
"original_sha256": null,
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
},
{
"repo": "informed-decision",
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
}
]

52
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py Normal file
View file

@ -0,0 +1,52 @@
from pathlib import Path
import hashlib,io,json,tarfile,sys
if sys.flags.optimize:
raise SystemExit("REFUSED: optimized Python disables required artifact validation")
root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
def image(path):
with tarfile.open(path) as archive:
manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
files={}
for name in manifest[0]['Layers']:
with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
for member in layer:
path=member.name
while path.startswith('./'):path=path[2:]
path=path.lstrip('/');p=Path(path)
if p.name=='.wh..wh..opq':
folder=p.parent.as_posix();prefix='' if folder=='.' else folder+'/'
files={key:value for key,value in files.items() if not key.startswith(prefix)};continue
if p.name.startswith('.wh.'):
removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue
if member.isfile():
data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
else:continue
files[path]=value
return config,hashlib.sha256(configbytes).hexdigest(),files
base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
assert set(changed)<=expected,set(changed)
a,b=base['config'].copy(),candidate['config'].copy()
labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
a.pop('Image',None);b.pop('Image',None)
defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
for key,value in defaults.items():
a.setdefault(key,value);b.setdefault(key,value)
assert a==b,(a,b)
components=[]
for name in ['base-sbom.cdx.json','sbom.cdx.json']:
data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
vulns=[]
for name in ['base-trivy-full.json','trivy-full.json']:
data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
assert not vulns[1]
proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))

113
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json Normal file
View file

@ -0,0 +1,113 @@
{
"owner": "informed-decision",
"scope": "exact amended T05 source agreement; same T08; historical initial review retained; no publication or native go",
"candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"initial_product_review_manifest_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225",
"files": [
{
"repo": "informed-decision",
"path": "workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/workplans/ADHOC-2026-10-11.md",
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
"staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
"original_sha256": null,
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
"original_sha256": null,
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
"original_sha256": null,
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
"original_sha256": null,
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
"original_sha256": null,
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
}
]
}

20
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py Normal file
View file

@ -0,0 +1,20 @@
import pathlib,json,hashlib
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
entries=json.loads(m.read_text());assert len(entries)==58
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
for e in old:
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
exec(compile(code,'product-amended-readback','exec'),{})
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
print('Exact amended source and directory metadata readback pass.')

73
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json Normal file
View file

@ -0,0 +1,73 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"directory_metadata_compared": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

42
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json Normal file
View file

@ -0,0 +1,42 @@
{
"owner": "informed-decision",
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"files": [
{
"repo": "informed-decision",
"path": "workplans/ADHOC-2026-10-11.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
},
{
"repo": "informed-decision",
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
"original_sha256": null,
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
"original_sha256": null,
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
"original_sha256": null,
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
}
]
}

39
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

74
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md Normal file
View file

@ -0,0 +1,74 @@
# Bounded zlib candidate Product owner review
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact local zlib-only source candidate technical preparation
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
comment: >-
Informed-decision intent requires human binding and preserved evidence; this
candidate changes only a native compression dependency while preserving
application authorization/presentation behavior. T08 review work record was
completed first. This is technical source agreement, not native go, publication
receipt, founder acceptance or T05 completion.
```
All27 staged hashes and retained evidence-file hashes independently verify.
Independent saved-image archive readback confirms all nine exact763 base diff_ids
as prefix, equal effective runtime configuration with only explicitly normalized
empty/false/null defaults, and final filesystem changes exactly
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
No service values, namespace, DB, customer data, config, PVC, schema, audience,
policy pins, protected helper or existing release journal is changed.
Package/index bytes match pinned official HTTPS download hashes. Both signed
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
in unchanged baseline trust metadata. Retained actual maker apk verify success
against exact763 installed keys is the execution evidence; this review separately
checks archive signatures' metadata, bytes and trust identity, without claiming
a new signature-verification execution. Containerfile requires digest checks and
`apk verify` success before offline named-package upgrade; no allow-untrusted or
keys-dir override. Existing trusted keys are not replaced.
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
defines integrity/signature checking and nonzero failure.
Upgrade selects only zlib from retained local signed index, disables network,
preupgrade and logging, and removes temporary public artifacts.
Both full CycloneDX/Trivy artifacts independently show44 packages and only
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
CVE-2026-85091; candidate has zero findings at the retained same database
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
scan improvement at that snapshot, not estate risk grading or future safety.
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
representations; neither is a published registry digest or native image proof.
Four existing source tests pass, covering eight mutations; five additional Product
mutations of app source, trust keys, APK world, network and provider/data flags
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
and ten installed purpose variants are local synthetic checks, not live PDP
or customer/native-data testing. No new container or native execution by reviewer.
Workflow publishes only a source-bound candidate through existing admitted owner
registry capability after root source review/commit: exact40hex source revision,
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
bounded build, unchanged runtime comparison and purpose checks before push.
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
The workflow is unexecuted; source review does not attest CI credentials, actual
publication or published artifact equivalence. Root must retain actual CI/source
revision and registry descriptor/layer/config/package/signature/context readback,
then full published scan/SBOM and scoped candidate release preparation. Only
distinct exact informed-decision founder native approval followed by installedr1,
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
to763 preserves latest DB; no historical snapshot restore.
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
controller is implied. T04/c96 accepted outcome and original uncertain journals
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
No new native authority, owner checkout write, credential/login, deployment or
customer-data access occurred in this review.

259
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md Normal file
View file

@ -0,0 +1,259 @@
---
id: INFD-WP-ADHOC-2026-10-11
type: workplan
title: "Application-owner catalogue facts review"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
```task
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
and Layer Placement. Read actual owner OIDC, requester and policy-request
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
value-free native registration/Ingress/preflight receipts. Exact canonical
facts agree. Browser client is distinct from create-only requester.
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
Canonical facts SHA-256:
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
Reviewed refined nine-file executor manifest SHA-256:
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
This task completes the application-facts source review only. It grants no
maintenance exception, native dry-run/apply/recovery, IAM permission, image
release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.
## Reconcile Staff evidence source declaration and current guarantees
```task
id: INFD-WP-ADHOC-2026-10-11-T04
status: done
priority: medium
```
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
class definitions, transactional recording, heartbeat/reconciliation scheduling,
existing component-test assertions and native count/receipt evidence. Reconciled
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
source intake for remaining class-specific declaration/verification gaps,
origin INFD-WP-0007. No residual implementation or native action occurred.
Source evidence reconciliation:
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
Formal source review:
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
compromised-source and commitment/content availability limits remain unchanged.
## Independently review supervised purpose actuator product boundaries
```task
id: INFD-WP-ADHOC-2026-10-11-T05
status: done
priority: medium
```
Same informed-decision-owner reviewed exact23-path helper manifest
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
private snapshot custody, confined offline UID0 initialization followed by
UID10001 pre/post-admin verification, independent failed-candidate rollback
and all-phase start deadline are technically agreed as source preparation.
No purpose-policy or candidate image change. Retained helper16 synthetic tests
and platform5 independent recovery negatives are mechanism proof; prior50
product policy negatives remain applicable. No new test run was needed for this
unchanged-source review. Native-provider acceptance remains distinct from the
installed10 synthetic purpose forms; T04 is not complete. Before first human
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
initializer/recovery/deadline refinements and preserved full scan provenance.
Exact combined packet acknowledgement remains a separate review gate.
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
No native reads/backups/export/restore/release, credentials, human disposition,
founder approval or phase authority was exercised by this review.
## Prepare separately gated provider-derived denial mechanism probe
```task
id: INFD-WP-ADHOC-2026-10-11-T06
status: done
priority: medium
```
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
canonical real DENY is required; no claims are invented to obtain ALLOW.
One actual provider response will remain in Pod memory; ten transformed
noncanonical purpose copies test installed consumer refusal without further
provider calls, DB/admin or act effects. This is a denial/binding mechanism
proof candidate, not actual authorized lifecycle or full T04 acceptance.
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
Ten synthetic source tests pass; no actual provider, credential, runtime config,
DB, native data or live action was accessed. Posted frozen112 packet/helper
remain unchanged. Exact separate founder go for this newly prepared probe and
its target must precede any execution; current memo has no acceptance and this
new helper is not hash-bound in that submitted packet. T04 remains progress.
## Review exact existing-snapshot rescue version2 preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T07
status: done
priority: medium
```
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
require fresh founder acceptance. Immutable reads are bounded to proven frozen
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
guards pass (including eight refusal mutations and a frozen initial packet check).
No native command, DB open, credentials or rescue operation occurred.
Initial review decision changes_requested: proposal.json misleadingly names old
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
label it original/historical and refreeze all dependent packet hashes. Correct
current bundle/plan digests already exist. The normalized test fixture is not an
owner edit or approval. Initial review/failure must remain after correction;
exact amended confirmation is still required before newhuman submission/execution.
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
T04 remains progress; original version1 approval is not newversion2 authority.
**Amended source confirmation, same T07 trial:** exact134-path manifest
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
corrects only the historical helper provenance label and dependent packet hashes;
original66 source and initial changes-requested review remain retained. Current
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
mutations and three packet mutations independently refuse. Final technical
source acknowledgement approved; no new human acceptance or native rescue.
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
**Actual-outcome assessment preparation, same completed T07 trial:** independently
verified original receipt-byte hashes and source consumer path after approved
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
backup/private copy matches live post-release counts16/56/0, delivered336,
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
is separate from installed ten synthetic purpose forms (2allow/8refuse).
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.

20
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json Normal file
View file

@ -0,0 +1,20 @@
{
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"all58_hashes_verified": true,
"all27_initial_archived_hashes_verified": true,
"changed_initial_paths": [
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
],
"image_context_source_workflow_runtime_scan_unchanged": true,
"new_source_tests_passed": 3,
"directory_negative_mutations": 3,
"optimized_tampered_before_read_refusal": true,
"existing_actual_archives_directory_reaudit": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"native_actions": false
}

39
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py Normal file
View file

@ -0,0 +1,39 @@
import pathlib,json,hashlib,copy,importlib.util,tarfile
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
H=lambda b:hashlib.sha256(b).hexdigest()
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
mutations=['appfile','keys','world','network','provider']
for field in mutations:
c=copy.deepcopy(b)
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
elif field=='world':c['apk_world_sha256']='0'*64
elif field=='network':c['network_accessed']=True
else:c['provider_or_customer_data_used']=True
try:cmp.compare(a,c)
except ValueError:pass
else:raise AssertionError(field)
# Read local image archives, source verifier operations are limited to these public local artifacts.
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
exec(compile(code,'product-local-artifact-readback','exec'),{})
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')

69
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json Normal file
View file

@ -0,0 +1,69 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false
}

21
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json Normal file
View file

@ -0,0 +1,21 @@
{
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"all27_staged_hashes_verified": true,
"evidence_hashes_verified": true,
"existing_source_tests": 4,
"existing_source_negative_mutations": 8,
"additional_product_negative_mutations": [
"appfile",
"keys",
"world",
"network",
"provider"
],
"saved_image_fs_and_layer_runtime_readback": true,
"sbom_only_zlib_delta": true,
"scan44_packages_zero_at_retained_db": true,
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
"native_actions": false,
"candidate_published": false
}

55
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md Normal file
View file

@ -0,0 +1,55 @@
# Exact amended zlib candidate Product confirmation
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact amended local T05 source candidate preparation only
manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
comment: >-
Same completed T08 preparation trial: work-record refinement was prepared
before this formal exact acknowledgment. Initial Product agreement/manifest
5f334 remains historical, including its bounded audit validation. This final
confirmation covers the guard refinement, not publication/native approval,
a second scored success or T05 completion.
```
All58 final staged hashes verify; all27 initial candidate snapshots match
immutable manifest8d345bb2. Actual initial-to-current diff changes only four
existing paths: artifact checker, its comparison and local-validation receipts,
and README. New audit tests/refinement record and original source archive are
additions. No Containerfile/workflow, signed APK/index/pins/four-file context,
package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source
scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe
contextc554 and actual retained DB03cacb remain exact. Original four-source-test
and Product five negative-probe findings remain applicable, not needlessly rerun.
The artifact checker now refuses optimized Python before any archive/JSON read,
so assertions cannot silently disappear. Directory mode/UID/GID metadata is
included in final layer reconstruction and diff enforcement. Three new source
tests pass: malformed archive under -O refuses explicitly before reads; identical
directory metadata passes; each mode/UID/GID mutation refuses without a report.
These fixtures are isolated synthetic source tests. Independent reread of actual
existing local saved-image archives confirms equal directory counts and no
directory metadata delta; the same two final changed files are libz and APK DB,
nine base layers remain prefix and effective runtime config/SBOM/scan match.
No new image build, container launch, scan, customer/native data or provider call
was performed by this review.
Initial Product review and validation retain their exact bytes under
`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`;
original current review file remains the initial agreement, with this separate
final acknowledgment carrying the refinement. Signature trust conclusions stay
bounded to pinned signed artifacts/unchanged trust metadata, actual retained
maker apk verify and enforced recipe; this acknowledgment does not claim fresh
cryptographic execution. Zero findings remains specific to retained sameDB scan,
not an estate risk grade or future safety assurance.
T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root
source review/commit and admitted owner CI candidate publication, exact actual
published registry provenance/package/full scan/SBOM, separate fresh native
founder release acceptance and installedr1/runtime/full-rescan proof remain
required. Existing approved R2 helper/journal, native image763, DB/config/PVC/
identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and
unimplemented. This technical acknowledgment grants no native action, human
acceptance, credential capability or publication execution.

74
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md Normal file
View file

@ -0,0 +1,74 @@
# Bounded zlib candidate Product owner review
```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: approved
work_item: INFD-WP-ADHOC-2026-10-11-T08
scope: exact local zlib-only source candidate technical preparation
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
comment: >-
Informed-decision intent requires human binding and preserved evidence; this
candidate changes only a native compression dependency while preserving
application authorization/presentation behavior. T08 review work record was
completed first. This is technical source agreement, not native go, publication
receipt, founder acceptance or T05 completion.
```
All27 staged hashes and retained evidence-file hashes independently verify.
Independent saved-image archive readback confirms all nine exact763 base diff_ids
as prefix, equal effective runtime configuration with only explicitly normalized
empty/false/null defaults, and final filesystem changes exactly
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
No service values, namespace, DB, customer data, config, PVC, schema, audience,
policy pins, protected helper or existing release journal is changed.
Package/index bytes match pinned official HTTPS download hashes. Both signed
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
in unchanged baseline trust metadata. Retained actual maker apk verify success
against exact763 installed keys is the execution evidence; this review separately
checks archive signatures' metadata, bytes and trust identity, without claiming
a new signature-verification execution. Containerfile requires digest checks and
`apk verify` success before offline named-package upgrade; no allow-untrusted or
keys-dir override. Existing trusted keys are not replaced.
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
defines integrity/signature checking and nonzero failure.
Upgrade selects only zlib from retained local signed index, disables network,
preupgrade and logging, and removes temporary public artifacts.
Both full CycloneDX/Trivy artifacts independently show44 packages and only
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
CVE-2026-85091; candidate has zero findings at the retained same database
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
scan improvement at that snapshot, not estate risk grading or future safety.
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
representations; neither is a published registry digest or native image proof.
Four existing source tests pass, covering eight mutations; five additional Product
mutations of app source, trust keys, APK world, network and provider/data flags
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
and ten installed purpose variants are local synthetic checks, not live PDP
or customer/native-data testing. No new container or native execution by reviewer.
Workflow publishes only a source-bound candidate through existing admitted owner
registry capability after root source review/commit: exact40hex source revision,
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
bounded build, unchanged runtime comparison and purpose checks before push.
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
The workflow is unexecuted; source review does not attest CI credentials, actual
publication or published artifact equivalence. Root must retain actual CI/source
revision and registry descriptor/layer/config/package/signature/context readback,
then full published scan/SBOM and scoped candidate release preparation. Only
distinct exact informed-decision founder native approval followed by installedr1,
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
to763 preserves latest DB; no historical snapshot restore.
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
controller is implied. T04/c96 accepted outcome and original uncertain journals
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
No new native authority, owner checkout write, credential/login, deployment or
customer-data access occurred in this review.

273
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md Normal file
View file

@ -0,0 +1,273 @@
---
id: INFD-WP-ADHOC-2026-10-11
type: workplan
title: "Application-owner catalogue facts review"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
```task
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
and Layer Placement. Read actual owner OIDC, requester and policy-request
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
value-free native registration/Ingress/preflight receipts. Exact canonical
facts agree. Browser client is distinct from create-only requester.
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
Canonical facts SHA-256:
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
Reviewed refined nine-file executor manifest SHA-256:
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
This task completes the application-facts source review only. It grants no
maintenance exception, native dry-run/apply/recovery, IAM permission, image
release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.
## Reconcile Staff evidence source declaration and current guarantees
```task
id: INFD-WP-ADHOC-2026-10-11-T04
status: done
priority: medium
```
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
class definitions, transactional recording, heartbeat/reconciliation scheduling,
existing component-test assertions and native count/receipt evidence. Reconciled
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
source intake for remaining class-specific declaration/verification gaps,
origin INFD-WP-0007. No residual implementation or native action occurred.
Source evidence reconciliation:
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
Formal source review:
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
compromised-source and commitment/content availability limits remain unchanged.
## Independently review supervised purpose actuator product boundaries
```task
id: INFD-WP-ADHOC-2026-10-11-T05
status: done
priority: medium
```
Same informed-decision-owner reviewed exact23-path helper manifest
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
private snapshot custody, confined offline UID0 initialization followed by
UID10001 pre/post-admin verification, independent failed-candidate rollback
and all-phase start deadline are technically agreed as source preparation.
No purpose-policy or candidate image change. Retained helper16 synthetic tests
and platform5 independent recovery negatives are mechanism proof; prior50
product policy negatives remain applicable. No new test run was needed for this
unchanged-source review. Native-provider acceptance remains distinct from the
installed10 synthetic purpose forms; T04 is not complete. Before first human
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
initializer/recovery/deadline refinements and preserved full scan provenance.
Exact combined packet acknowledgement remains a separate review gate.
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
No native reads/backups/export/restore/release, credentials, human disposition,
founder approval or phase authority was exercised by this review.
## Prepare separately gated provider-derived denial mechanism probe
```task
id: INFD-WP-ADHOC-2026-10-11-T06
status: done
priority: medium
```
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
canonical real DENY is required; no claims are invented to obtain ALLOW.
One actual provider response will remain in Pod memory; ten transformed
noncanonical purpose copies test installed consumer refusal without further
provider calls, DB/admin or act effects. This is a denial/binding mechanism
proof candidate, not actual authorized lifecycle or full T04 acceptance.
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
Ten synthetic source tests pass; no actual provider, credential, runtime config,
DB, native data or live action was accessed. Posted frozen112 packet/helper
remain unchanged. Exact separate founder go for this newly prepared probe and
its target must precede any execution; current memo has no acceptance and this
new helper is not hash-bound in that submitted packet. T04 remains progress.
## Review exact existing-snapshot rescue version2 preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T07
status: done
priority: medium
```
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
require fresh founder acceptance. Immutable reads are bounded to proven frozen
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
guards pass (including eight refusal mutations and a frozen initial packet check).
No native command, DB open, credentials or rescue operation occurred.
Initial review decision changes_requested: proposal.json misleadingly names old
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
label it original/historical and refreeze all dependent packet hashes. Correct
current bundle/plan digests already exist. The normalized test fixture is not an
owner edit or approval. Initial review/failure must remain after correction;
exact amended confirmation is still required before newhuman submission/execution.
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
T04 remains progress; original version1 approval is not newversion2 authority.
**Amended source confirmation, same T07 trial:** exact134-path manifest
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
corrects only the historical helper provenance label and dependent packet hashes;
original66 source and initial changes-requested review remain retained. Current
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
mutations and three packet mutations independently refuse. Final technical
source acknowledgement approved; no new human acceptance or native rescue.
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
**Actual-outcome assessment preparation, same completed T07 trial:** independently
verified original receipt-byte hashes and source consumer path after approved
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
backup/private copy matches live post-release counts16/56/0, delivered336,
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
is separate from installed ten synthetic purpose forms (2allow/8refuse).
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
handling correction; no implementation, native action or authority grant.
This work-record preparation precedes the formal actual-outcome review entry.
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
## Independently review bounded zlib-only T05 source candidate
```task
id: INFD-WP-ADHOC-2026-10-11-T08
status: done
priority: medium
```
Completed informed-decision Product source review of exact27-path candidate
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
All staged/evidence hashes verify. Independently reread local saved base/candidate
image archives, effective runtime config, nine base layer prefix, two final file
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
44 packages/base1MED to candidate0 at retained same scanner database.
Signed APK/index named key matches unchanged base trust metadata; enforced
apk verify against existing keys retained, no allow-untrusted or truststore override.
Four existing source tests pass (eight refusal mutations), plus five independent
appfile/trustkeys/world/network/provider metadata mutations refuse.
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
Technical source preparation agreement only: local image78bfdcc is unpublished,
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
new native founder approval/installed proof are still required. Current763/native
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
This completed work record is prepared before the formal review entry.
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
**Exact amended confirmation, same completed T08 preparation trial:** verified
final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs
change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB
remain identical. New3 artifact tests pass (optimized malformed input refused
before reads; matching directories pass; directory mode/UID/GID drift refuse).
Independent actual saved-image reread proves all directory metadata unchanged,
with the same two final file changes. Initial Product manifest5f334/ack/validation
are retained as historical source agreement, not new scored native success.
This work-record refinement precedes final formal acknowledgment. No publication,
native operation, credentials or owner edits. T05progress/WP0009active remains.
Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md.

24
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json Normal file
View file

@ -0,0 +1,24 @@
[
{
"marker": "usr/.wh..wh..opq",
"same_layer_new": "usr/new",
"actual_names": [
"usr"
],
"same_layer_new_preserved": false
},
{
"marker": ".wh..wh..opq",
"same_layer_new": "new",
"actual_names": [],
"same_layer_new_preserved": false
},
{
"marker": "usr/.wh.child",
"same_layer_new": "usr/child/new",
"actual_names": [
"usr"
],
"same_layer_new_preserved": false
}
]

23
docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py Normal file
View file

@ -0,0 +1,23 @@
import ast,tarfile,io,json,hashlib,tempfile
from pathlib import Path
P=Path(__file__).parent
ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen66-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns)
def add(t,name,data):
m=tarfile.TarInfo(name);m.mode=0o755
if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
else:m.size=len(data);t.addfile(m,io.BytesIO(data))
def layer(entries):
b=io.BytesIO()
with tarfile.open(fileobj=b,mode='w') as t:
for name,data in entries:add(t,name,data)
return b.getvalue()
results=[]
for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]:
base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')])
with tempfile.TemporaryDirectory() as tmp:
path=Path(tmp)/'image.tar'
with tarfile.open(path,'w') as t:
add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over)
_,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files))
print(json.dumps(results,indent=2))
assert all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced'

15
docs/evidence/2026-10-11-zlib-remediation-candidate/README.md Normal file
View file

@ -0,0 +1,15 @@
# Separate T05 zlib-only candidate — local verified, unpublished/unapproved
Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical.
Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed.
Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues.
T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits.
Platform audit refinement (same T05 proposal): the checker now refuses optimized Python before artifact reads and compares directory mode, UID and GID. The actual existing image passed the expanded audit with no directory changes and the same two changed files. Three synthetic tests cover optimization and three directory drift cases. Original 27-file source/manifest and actual scan receipts are retained in `initial-8d345bb2/`; this was a source guard correction, not an original candidate failure. Recipe, four-file build context, image78 and full scan bytes are unchanged.
Whiteout refinement: preserve the leading dot in OCI whiteout names and model root/nested removal and opaque directories. Four semantic fixtures pass. Actual image re-audit still reports 313 unchanged directories and only the same two changed files. Intermediate 64509029 manifest and changed evidence bytes are retained separately; the existing candidate did not fail.
Whiteout refinement: preserve the leading dot in OCI whiteout names and model root/nested removal and opaque directories. Twelve semantic fixtures pass, including reversed tar-order same-layer additions/replacements. Actual image re-audit still reports 313 unchanged directories and only the same two changed files. Intermediate 64509029 and 3e41ab39 manifests and changed evidence bytes are retained separately; the existing candidate did not fail.

75
docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json Normal file
View file

@ -0,0 +1,75 @@
{
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
"candidate_registry_digest": null,
"base_layers_preserved": 9,
"new_layers": 2,
"effective_runtime_config_identical": true,
"raw_config_bytes_identical": false,
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
"labels_before": {
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"labels_after": {
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
},
"final_changed_files": {
"lib/apk/db/installed": {
"before": [
"file",
420,
0,
0,
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
],
"after": [
"file",
420,
0,
0,
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
]
},
"usr/lib/libz.so.1.3.2": {
"before": [
"file",
493,
0,
0,
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
],
"after": [
"file",
493,
0,
0,
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
]
}
},
"directory_metadata_compared": true,
"directory_count_base": 313,
"directory_count_candidate": 313,
"directory_metadata_delta": {},
"sbom_package_count_base": 44,
"sbom_package_count_candidate": 44,
"sbom_only_delta": {
"zlib": [
"1.3.2-r0",
"1.3.2-r1"
]
},
"full_scan_baseline_findings": 1,
"full_scan_candidate_allseverity_findings": 0,
"db_snapshot_same": true,
"native_workload_changed": false,
"candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
"candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs."
}

26
docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json Normal file
View file

@ -0,0 +1,26 @@
{
"proposal_id": "INFD-WP-0009-T05/zlib-85091-r1",
"same_trial": true,
"original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"original_local_verification_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1",
"reason": "Platform source-review guard gaps; original actual candidate/build/scan did not fail",
"changes": [
"Explicit optimized Python refusal before any archive/JSON read",
"Filesystem audit includes final directory mode/UID/GID metadata",
"Three synthetic tests: optimized malformed artifact refuses before read; unchanged directory passes; mode/UID/GID mutation refuses",
"Preserve OCI whiteout leading dots and clear root/nested descendants correctly; four semantic fixtures cover removal and opacity",
"Whiteouts mask lower layers only; merge same-layer additions after masking. Eight root/nested opacity, sibling and replacement tar-order fixtures added"
],
"actual_existing_artifact_reaudit": "Passed; no directory metadata differences, same two changed files",
"candidate_image_unchanged": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
"four_file_build_context_unchanged": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"registry_publication": false,
"native_changes": false,
"checker_sha256": "d727f60edd004184c79903c20619643033fac68afbecfb1990cce855cdb924e3",
"tests_sha256": "12ba4ce8c082450241118d73139c59e06b3a337b152e3364918a5b2850f2dc47",
"comparison_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89",
"verification_sha256": "efbb173dcb9358b58bd703a18e63c6c25805167d5a14856ed095d05be4309709",
"intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"whiteout_refinement_note": "Conservative incorrect effective-rootfs modeling in the intermediate checker, not failure of the actual candidate",
"layer_order_review_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0"
}

1
docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json Normal file
View file

File diff suppressed because one or more lines are too long

2551
docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json Normal file
View file

File diff suppressed because it is too large Load diff

2387
docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json Normal file
View file

File diff suppressed because it is too large Load diff

1
docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json Normal file
View file

@ -0,0 +1 @@
{"Id":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","RepoTags":["informed-decision:zlib-r1-local-20261011"],"RepoDigests":["informed-decision@sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31"],"Created":"2026-10-11T09:29:32.511197114+02:00","Config":{"User":"10001:10001","ExposedPorts":{"8080/tcp":{},"8081/tcp":{}},"Env":["PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","LANG=C.UTF-8","GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305","PYTHON_VERSION=3.12.14","PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a","PYTHONDONTWRITEBYTECODE=1","PYTHONUNBUFFERED=1"],"Entrypoint":["informed-decision-container"],"WorkingDir":"/app","Labels":{"org.opencontainers.image.base.digest":"sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a","org.opencontainers.image.revision":"uncommitted-T05-local-preparation","social.coulomb.release.scope":"INFD-WP-0009-T05/zlib-85091-r1","social.coulomb.source.context.sha256":"c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d","social.coulomb.source.policy.sha256":"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"}},"Architecture":"amd64","Os":"linux","Size":31557919,"RootFS":{"Type":"layers","Layers":["sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c","sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd","sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366","sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe","sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1","sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c","sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59","sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02","sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3","sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007","sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e"]},"Metadata":{"LastTagTime":"2026-10-11T07:29:32.766526483Z"},"Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","size":2752}}

1
docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json Normal file
View file

File diff suppressed because one or more lines are too long

9
docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json Normal file
View file

@ -0,0 +1,9 @@
{
"files": {
".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a",
"Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15",
"zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47",
"APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d"
}

12
docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json Normal file
View file

@ -0,0 +1,12 @@
{
"zlib-1.3.2-r1.apk": {
"url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk",
"sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47",
"bytes": 56210
},
"APKINDEX.tar.gz": {
"url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz",
"sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5",
"bytes": 528370
}
}

140
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json Normal file
View file

@ -0,0 +1,140 @@
{
"original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
"files": [
{
"original_path": ".forgejo/workflows/zlib-overlay-image.yaml",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
"sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
},
{
"original_path": "deploy/zlib-overlay/.dockerignore",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
"sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
},
{
"original_path": "deploy/zlib-overlay/APKINDEX.tar.gz",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
"sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
{
"original_path": "deploy/zlib-overlay/Containerfile",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
"sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
},
{
"original_path": "deploy/zlib-overlay/pins.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
"sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
},
{
"original_path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
},
{
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
},
{
"original_path": "tools/zlib_overlay/check_build_inputs.py",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
"sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
},
{
"original_path": "tools/zlib_overlay/check_runtime.py",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
"sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
},
{
"original_path": "tools/zlib_overlay/compare_runtime.py",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
"sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
},
{
"original_path": "tools/zlib_overlay/test_candidate.py",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
"sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
},
{
"original_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
}
]
}

191
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json Normal file
View file

@ -0,0 +1,191 @@
[
{
"repo": "informed-decision",
"path": ".forgejo/workflows/zlib-overlay-image.yaml",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
"original_sha256": null,
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/.dockerignore",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
"original_sha256": null,
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/APKINDEX.tar.gz",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
"original_sha256": null,
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/Containerfile",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
"original_sha256": null,
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/pins.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
"original_sha256": null,
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
},
{
"repo": "informed-decision",
"path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
"original_sha256": null,
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
"original_sha256": null,
"staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
"original_sha256": null,
"staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
"original_sha256": null,
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
"original_sha256": null,
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
"original_sha256": null,
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
"original_sha256": null,
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
"original_sha256": null,
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
"original_sha256": null,
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
"original_sha256": null,
"staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
"original_sha256": null,
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
"original_sha256": null,
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
"original_sha256": null,
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
"original_sha256": null,
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
"original_sha256": null,
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
},
{
"repo": "informed-decision",
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
"original_sha256": null,
"staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/check_build_inputs.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
"original_sha256": null,
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/check_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
"original_sha256": null,
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/compare_runtime.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
"original_sha256": null,
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
},
{
"repo": "informed-decision",
"path": "tools/zlib_overlay/test_candidate.py",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
"original_sha256": null,
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
},
{
"repo": "informed-decision",
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
"original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
}
]

71
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml Normal file
View file

@ -0,0 +1,71 @@
name: Publish exact zlib-only remediation candidate
on:
push:
branches: [main]
paths:
- ".forgejo/workflows/zlib-overlay-image.yaml"
- "deploy/zlib-overlay/**"
- "tools/zlib_overlay/**"
workflow_dispatch:
concurrency:
group: informed-decision-zlib-overlay
cancel-in-progress: false
permissions:
contents: read
env:
REGISTRY: forgejo.coulomb.social
IMAGE_NAME: coulomb/informed-decision
DOCKER_HOST: tcp://127.0.0.1:2375
jobs:
publish-candidate:
runs-on: container-build
steps:
- name: Verify and publish zlib-only candidate
env:
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
run: |
set -eu
umask 077
REF="${GITHUB_SHA:?exact source revision required}"
echo "${REF}" | grep -Eq '^[0-9a-f]{40}$'
test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision"
if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
echo "Admitted owner registry capability unavailable; no borrowed credential permitted." >&2
exit 2
fi
BUILD_ROOT="$(mktemp -d)"
export DOCKER_CONFIG="${BUILD_ROOT}/docker-config"
cleanup() { rm -rf "${BUILD_ROOT}"; }
trap cleanup EXIT
mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/context" "${DOCKER_CONFIG}" "${HOME}/bin"
wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1
CONTEXT="${BUILD_ROOT}/source/deploy/zlib-overlay"
for INPUT in .dockerignore Containerfile zlib-1.3.2-r1.apk APKINDEX.tar.gz; do
cp "${CONTEXT}/${INPUT}" "${BUILD_ROOT}/context/${INPUT}"
chmod 0644 "${BUILD_ROOT}/context/${INPUT}"
done
echo "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 ${BUILD_ROOT}/context/zlib-1.3.2-r1.apk" | sha256sum -c -
echo "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 ${BUILD_ROOT}/context/APKINDEX.tar.gz" | sha256sum -c -
echo "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a ${BUILD_ROOT}/context/.dockerignore" | sha256sum -c -
echo "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15 ${BUILD_ROOT}/context/Containerfile" | sha256sum -c -
wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
export PATH="${HOME}/bin:${PATH}"
echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
BASE="${REGISTRY}/${IMAGE_NAME}@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a"
docker pull "${BASE}"
IMAGE="${REGISTRY}/${IMAGE_NAME}:zlib-85091-${REF}"
docker build --network none --pull=false --memory 256m --cpu-period 100000 --cpu-quota 100000 --build-arg "SOURCE_REVISION=${REF}" --build-arg "SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" --file "${BUILD_ROOT}/context/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/context"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/base-runtime.json"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/candidate-runtime.json"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - "$(cat "${BUILD_ROOT}/base-runtime.json")" "$(cat "${BUILD_ROOT}/candidate-runtime.json")" < "${BUILD_ROOT}/source/tools/zlib_overlay/compare_runtime.py"
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py"
OUTPUT="$(docker push "${IMAGE}")"
printf '%s\n' "${OUTPUT}"
DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)"
printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$'
echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
echo "source_revision=${REF}"
echo "context_sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d"
echo "candidate_only=true; actual published digest/full scan/SBOM/provenance and distinct native founder release approval remain required"

5
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore Normal file
View file

@ -0,0 +1,5 @@
*
!.dockerignore
!Containerfile
!zlib-1.3.2-r1.apk
!APKINDEX.tar.gz

BIN
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz Normal file
View file

Binary file not shown.

17
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile Normal file
View file

@ -0,0 +1,17 @@
FROM forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a
ARG SOURCE_REVISION=uncommitted-T05-local-preparation
ARG SOURCE_CONTEXT_SHA256
USER 0:0
COPY zlib-1.3.2-r1.apk APKINDEX.tar.gz /tmp/infd-zlib/x86_64/
RUN echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \
&& echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \
&& apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \
&& apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \
&& apk info --exists 'zlib=1.3.2-r1' \
&& rm -rf /tmp/infd-zlib
USER 10001:10001
LABEL org.opencontainers.image.revision="$SOURCE_REVISION" \
org.opencontainers.image.base.digest="sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" \
social.coulomb.source.context.sha256="$SOURCE_CONTEXT_SHA256" \
social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" \
social.coulomb.release.scope="INFD-WP-0009-T05/zlib-85091-r1"

15
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json Normal file
View file

@ -0,0 +1,15 @@
{
"files": {
".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a",
"Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15",
"zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47",
"APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
},
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
"package_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk",
"index_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz",
"package_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245",
"package_signature": "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub",
"status": "prepared-unpublished-unapproved"
}

BIN
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk Normal file
View file

Binary file not shown.

9
docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md Normal file
View file

@ -0,0 +1,9 @@
# Separate T05 zlib-only candidate — local verified, unpublished/unapproved
Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical.
Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed.
Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues.
T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits.

Some files were not shown because too many files have changed in this diff Show more