informed-decision/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md

Requested decision

Approve the exact new T05 zlib-only image release and protected same-schema compatibility drill, after final independent Product and Platform acknowledgments. This packet is prepared and unapproved; fresh rollback server dry-run passed with exactly the baseline image and empty diff. Root retains exact final owner source revision and independent acknowledgments before asking for native founder disposition. The prior T04 approval is excluded.

The admitted owner CI published immutable image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 from source9b4bb25d325698ae543e7e8a8a3c3592db1f58fc. Its actual full scan reports zero findings across44packages. The same scan DB finds oneMEDIUM on currentimage763c. Signed official Alpine zlib1.3.2-r1 is the sole package change; actual published filesystem proof shows onlylibz andAPKinstalleddatabase changes, zero313directorymetadata changes, retainedninebaselayers and unchanged36applicationfiles/purposepolicy/config/credentials/audience/resources. Registry-to-daemon config serialization differs under closed verified normalization, without runtime change.

The exact ordered protected drill and release are specified in native-backup-restore-protocol.md and hash-bound execution bundle. New backup paths, isolated clone and journal are distinct from old evidence. Real private data will enter only approved private custody and the isolated no-network clone; content never enters public evidence. Failed/uncertain phase states remain durable and cannot be retried. Prior T04 failed copy/verify are preserved.

After schema5/integrity/exactclonecounts pass and clone cleanup succeeds, fresh cutover backup/copy precedes the exact manual image-only Deployment sync. Current baseline is healthygeneration25/image763c/Applicationc96. ImmutableCM6c/PVC/Podconfiguration/PDP origins remain sealed. FreshnodeCPU3460of4000m supports unchangedRecreate, with another check before effect. Brief availability interruption expected.

Rollback restores Deploymentimage763c andApplicationc96 while retaining latestschema5database; no old snapshot restoration. Separate installed/native health/custody/PDP-gated readback and actual native image rescan precede T05 closure. Allphase starts expireOct12 23:59:59Z; release reserves30minutesforverificationandrecovery. Afterexpiry a newfounderdecision is required. EUR0newrecurringinfrastructure, boundedprivate storage andunpricedattendedtime. No newdoctrine/autopilot/credentialgrant is authorized.

Explicit recovery decision

Also approve the proposed item19 manual service-outage recovery term above: exact historical rootconfirmed acceptance captured before release may authorize only same763/c96 one-Deployment/latestDB-preserving rollback after failedf558 service outage, within30minutes AND the existingdeadline. Root must retain freshunavailable/failedcandidate witnesses and exactcache/journal/custody pins. Duringserviceoutage subsequentrevocation cannot bechecked; this bounded uncertainty is expressly disclosed and consented to in this new decision. No401/403/revoked/conflict/mismatch/healthyservice fallback, no backup/release fallback or future/customer-production reuse. Ordinaryfreshreadback remains preferred. Recovered placement is verified separately; rollback grants no claim of currentPDPsuccess or T05closure. See fullprotocol andclose-downchecklistitem19(PROPOSEDuntilactualacceptance).

Post-Ready provider preservation proof records only fixed canonical sourceT05@1 request identity (derived from the authenticated route), HTTP200/timestamp and review-presence/disposition count. Actual native outcomes need not contain top-level memo identity. No review/disposition/state/actor body is exported or interpreted, and no currentapproval/acceptance is inferred from this provider proof. Actual founder go remains separate. Exact prior481 bytes and both completed contract reviews are retained by digest maps; unchanged history is not recopied.