informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md

T05 zlib85091 release — preliminary, unapproved

This is a distinct proposal/trial for existing INFD-WP-0009-T05. The actual T04 source2 acceptance does not authorize it. Previous R1 copy and R2 verify UNCERTAIN journal states remain untouched. INFD-IN-0010 remains an unpromoted general verifier residual; this new task-specific verifier is a prerequisite of active T05, not an amendment of the old approved helper.

Exact intended image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 was built by admitted owner CI11534/run4 from 9b4bb25d32. Publication is not installed acceptance. Final packet requires independent published-image scan/runtime/filesystem/source proof and fresh read-only native projection/one-object dry-run evidence. Until all final inputs and independent owner acknowledgments are frozen, execution-plan state remains preliminary and the actuator refuses before any authority, journal or native action.

After a NEW exact confirmed founder acceptance, root freshly authenticates fixed-origin native source-version1 outcomes before each phase. Receipt files are supervised bookkeeping, not signed grants or autonomy. Wrong task, source, memo/version, stale/pending/agent disposition, old T04 acceptance or changed inputs refuse. Root retains exact approved source revision/digests and action results in supervision. Approval does not promote any agent.

Fixed phase order: drill-backup → drill-copy → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify. New private native /data/private/zlib85091-r1, root .private-backups/20261011-infd-zlib-r1 and local volume infd-zlib-r1-restore-20261011 are distinct from all T04 custody. New private journal intent is fsynced RUNNING before dispatch; no attempted phase replay. Fixed output schema contains only counts, hashes, object identity and boolean results; raw errors and private content are withheld. Existing native snapshots/database/sidecars are never removed or restored over current data.

Fresh backup inspection uses copied explicit-close SQLite helpers: live and offline clone readers are mode=ro/query_only and WAL-aware, before any Store/admin open. Immutable reader is used only for freshly closed hash-bound private snapshot with absent/zero WAL frames and stable identity/metadata/digest before/after read/copy. Main and sidecars remain retained. Schema must equal5, integrity ok, and exact snapshot/isolated clone counts match before/admin/after. The detached local clone has network none, readonly root, no service/runtime config/credential mounts; only narrowly scoped UID0 CAP_CHOWN initializer precedes UID10001 reads/admin. Original private copy is hash-stable. Cleanup removes only the disposable volume whose nonce/labels/creation metadata match this trial, before cutover.

Each snapshot is bounded512MiB. At most two new snapshots occupy each native/offcluster custody (1GiB payload each); the disposable offcluster clone adds512MiB while present, plus16MiB sidecar/metadata reserve. New native drill phase checks free space for both; local custody checks two snapshot bounds plus reserve. Existing T04 retention consumes additional pre-existing space. EUR0 recurring infrastructure estimate; human/compute time unpriced.

Cutover takes a fresh native backup and exact offcluster copy. Release then requires latest schema5 readonly proof, sealed Pod/Deployment/config/PVC custody and same baseline image763c/current Application sourcec96, a healthy single target92.205.62.239 node and fresh requested CPU ≤ allocatable capacity. Recreate and resources remain unchanged. Server dry-run/client diff must show only the image. Application UID/resourceVersion/source CAS dispatches manual exact final revision, initiatedBy custodian-codex, explicit prune=false and only apps/Deployment informed-decision in its namespace. No whole-Application sync, namespace/config/credential/resource change or pruning.

Verification reads imageID/readiness/owner chain/exact configured Pod fields, schema5/integrity/metadata counts, installed policy hash and synthetic purpose refusals, health200, installed fixed zlib and exact image proof. After exact candidate Ready and verified rollout, root executes attached post-ready-native-outcomes-command.py inside the existing admitted StateHub Pod. It calls canonical lifecycle.outcomes for infd-20261011-zlib-remediation-r1 SOURCEversion1 at dispatcher fixed ORIGIN with NoRedirect/proxy disabled; existing internal token_file stays inside that Pod and no token/body/private content is exported. Root retains bounded HTTP-success metadata/observationtime and correlates verified candidate PodUID/image/source, then rechecks those identities. This actual provider/PDP-gated preservation proof is separate from installed synthetic2allow8refuse; both are required before task closure. It does not assert provider advisory emissions or new doctrine. Argo3.5.3 omits false prune in operation status: missing or exactfalse is accepted only together with this journal's COMPLETE explicitfalse request, exact source/resources/initiation, operation start after our durable attempt, bounded finish and one Synced Deployment result. True/null/string/prior/foreign/extra-resource results refuse.

Rollback → rollback-verify is separate and permitted only after a recorded release attempt. It switches only Application source back to c96 and Deployment image763c; it never restores an old snapshot over the latest database. Recovery dispatch works even if candidate Pod is absent/unready and never depends on candidate DB inspection. Recovery verification separately requires Ready1/old image/current schema5/data-custody and exact recorded scoped completion. All phases must begin before2026-10-12T23:59:59Z; release must begin at least30minutes earlier. Beyond expiry stop and obtain a new founder decision; no automatic extension or emergency grant. A failed/uncertain attempt requires informed recovery rather than retry.

T05 remains progress until actual installed acceptance and native rescan prove the finding absent. No Risk Engine grade is assigned. Only then may owner close T05/risk and consider finishing WP9, with existing residuals live first.

Actual release and installed verification also require fixed private root scan receipt and retained fullreport at /tmp/security-infd-zlib-fresh-scan-{receipt,full}.json, supervised metadata binding to exact immutablef558/artifactsource9b4/scannerdigest62b1. Before journal start, fullreporthash must match, no suppression/allseverity flags true, exit0, nonempty valid fullresults contain zero findings, scan completed within4hours and now precedes DB NextUpdate. The published DB expires2026-10-11T18:59:50Z; it is not valid until release deadline. Root refreshes DB and rescans the same immutable image as routine read-only verification when needed, retaining all raw publicscan artifacts. Any new finding refuses release/closure and is retained for informed reassessment/new decision as needed, never filtered or ignored. Existing risk stays open until actual installed proof/native rescan.

Refinement preserves reviewed81/source bytes and exactdraft29 complete archives. Initial67 manifest hash is known but exact original67manifest/source snapshot was not retained before81; preparation-failure-history.json discloses this. No priornativeeffect occurred. New full CLI synthetic tests exercise main sourcehash/receipt/journal/dispatch wiring for drill-copy,release,verify and refuse source drift before newjournal/native boundary. Remote payload carries exact frozen snapshot identity and completed release intent. Full scan contract additionally requires SchemaVersion2/container_image, published configImageID622 (not daemonserializationf2), exact11DiffIDs/rootfs/source/contextlabels, exactly38OS+6Python packages with canonicalPURL/version inventory, fixedzlibr1 and no omissions/duplicates/truncated/emptycoverage. Archive scan RepoDigests absent is legitimate; not fabricated.

Proposed explicit manual service-outage recovery consent

Close-down checklist item19 in the-custodian/docs/security-close-down-checklist.md is PROPOSED ONLY until the founder accepts this exact new packet. This term changes the recovery authority dependency for this trial; previous T04 approval and owner source reviews do not grant it. Ordinary fresh native sourceT05@1 confirmed founder readback remains preferred for every phase. No standing recovery/autopilot/signed grant is created.

Before release, root freshly authenticates the independently confirmed acceptance of these exact terms, marks its scoped receipt bounded_outage_rollback_pre_authorized=true, and captures exact receipt/outcome bytes into a unique0600 release-authority-cache.json in this trial's0700 ignored custody. Hash is recorded in durable release journal before remote effect. Cache is historical confirmed acceptance, never fabricated current outcomes. During failed-candidate service outage the ability to check subsequent revocation is unavailable. The founder explicitly accepts that narrow uncertainty for manual supervised rollback only, for at most30minutes from the actual durable release attempt AND beforeOct12 deadline. Root must personally evaluate the exact bounded recovery receipt; no agent promotion or automatic grant.

If fresh source1 readback is unavailable, a separate fixed private /tmp/security-infd-zlib-root-recovery-receipt.json must record fresh≤120second structural unavailable evidence (transport unavailable orHTTP502/503/504), rootmanualverification, exactproposal/source/memo/cache/releaseattempt/DeploymentUID/configmapUID/PVCUID and sameimage763/sourcec96 rollback scope. No401/403/explicitrevocation/currentconflict/identity-or-scope-mismatch/healthy-service fallback. Cached consent must have been rootverified≤120seconds before this release. Native rollback independently requires actual candidateimagef558 at exactnewsource andReady0 plus sealedDeployment/config/PVC. It changes only existingApplicationsource and oneDeployment, prune=false, while retaining latestschema5database; no candidatePod/DB open is required. No drill/backup/copy/release/normalverify fallback is permitted. A rejected current outcome is never disguised as an outage.

Fallback rollback-verify after completed recovery requires COMPLETE rollback in this same private journal, hashlinked original outage/failed-candidate witness, current recoveredimage763/sourcec96/Ready1 and sealedcustody. It does not require a candidate that has already been recovered. Original outage evidence is retained unchanged. Actual PDP preservation can remain unavailable or rejected; no currentapproval/PDPsuccess or taskclosure is inferred from rollback. Ordinary fresh outcome receipt is preferred once restored. Beyond30minutes/deadline or any mismatch, stop and obtain a new independently available founder disposition; neither expiry nor uncertainty grants emergency authority. Item19 is closed by actual disposition/trial outcome, preserving ordinaryfreshgate with no future/customer-production reuse. Standing recovery, if wanted later, needs separately reviewed independently obtainable authority.

Post-Ready provider command now exports NO review/disposition/actor/submissionstate body. It records HTTP200 and timestamp, has_review and disposition_count, and request sourceID/version explicitly DERIVED from the fixed authenticated canonical route. Actual LifecycleService.outcomes returns only review/dispositions, without top-level source identity. ReviewNone/dict and dispositions list-of-dicts are checked; nullable comment states, SYSTEM actors, prepared/in_flight/confirmed/unresolved states and not_submitted/intake_created review states are accepted without interpreting them. Optional nativebodyidentity/version, if present, must match the route. No acceptance/currentapproval/go inference is made; founderconsent remains the separately independentlyrootverifiedauthority path. Freeform/unknown/private fields never leave; failures emit fixed metadata, never raw repr/body. Actual ownerPod verification also refuses any nonempty ephemeralContainers; current native estate is not claimed to have this drift. Document command-local content is deduplicated by digest while memo preserves both labels; actualtypedmemo/documents/intake andHTTPbodylimit are tested.