diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/mapping.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/mapping.json
new file mode 100644
index 0000000..61a920b
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/mapping.json
@@ -0,0 +1,82 @@
+[
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
+    "sha256": "72c2f3d87a45d8a3b77fe0a06dc6c793003e2ee351574b42829a546450f70783"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
+    "sha256": "30c685422c4608b045c7027c795033ecfda12ecfab9df7a09f6e7f4f5bb0d898"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
+    "sha256": "ed5f303cb063230ba20806b2be3b99d6249e6f62bfca6af0780894fd7b697154"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
+    "sha256": "b8d8b9abe82ec5c19023fb9e7af289bbd2b591e079b55ae5a785aca7c5e3c337"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
+    "sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
+    "sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
+    "sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
+    "sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
+    "sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
+    "sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
+    "sha256": "f450cd2b29b818782d432d010dc0221564d500b61df15413add203c09cdaa19e"
+  },
+  {
+    "original_path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "sha256": "7b3f5340c833e6e6641741044369b0251dfe31bb5bf6c1719d07821226a51376"
+  }
+]
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/original-manifest.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/original-manifest.json
new file mode 100644
index 0000000..1b51ad9
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/original-manifest.json
@@ -0,0 +1,114 @@
+[
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
+    "original_sha256": null,
+    "staged_sha256": "72c2f3d87a45d8a3b77fe0a06dc6c793003e2ee351574b42829a546450f70783"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
+    "original_sha256": null,
+    "staged_sha256": "30c685422c4608b045c7027c795033ecfda12ecfab9df7a09f6e7f4f5bb0d898"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
+    "original_sha256": null,
+    "staged_sha256": "ed5f303cb063230ba20806b2be3b99d6249e6f62bfca6af0780894fd7b697154"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
+    "original_sha256": null,
+    "staged_sha256": "b8d8b9abe82ec5c19023fb9e7af289bbd2b591e079b55ae5a785aca7c5e3c337"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
+    "original_sha256": null,
+    "staged_sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "original_sha256": null,
+    "staged_sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "original_sha256": null,
+    "staged_sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "original_sha256": null,
+    "staged_sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "original_sha256": null,
+    "staged_sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
+    "original_sha256": null,
+    "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
+    "original_sha256": null,
+    "staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
+    "original_sha256": null,
+    "staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
+    "original_sha256": null,
+    "staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
+    "original_sha256": null,
+    "staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
+    "original_sha256": null,
+    "staged_sha256": "f450cd2b29b818782d432d010dc0221564d500b61df15413add203c09cdaa19e"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "original_sha256": null,
+    "staged_sha256": "7b3f5340c833e6e6641741044369b0251dfe31bb5bf6c1719d07821226a51376"
+  }
+]
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json
new file mode 100644
index 0000000..ab1716f
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json
@@ -0,0 +1,15 @@
+{
+  "source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0",
+  "maker_tests_independently_passed": 8,
+  "independent_synthetic_probes": {
+    "OO_refusal_before_read": true,
+    "root_directory_removed_refused": true,
+    "root_opaque_refused": true,
+    "nested_opaque_parent_preserved_descendant_refused": true,
+    "nested_removed_directory_refused": true
+  },
+  "all66_hashes_match": true,
+  "initial27_exact_archive_verified": true,
+  "actual_candidate_changed_by_refinement": false,
+  "native_actions": false
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json
new file mode 100644
index 0000000..f60b462
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json
@@ -0,0 +1,66 @@
+{
+  "review_id": "RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R2",
+  "work_record": "RPF-IN-0008",
+  "role": "railiance-platform technical owner only",
+  "status": "technical-agreement-source-candidate-preparation-only",
+  "source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0",
+  "source_paths": 66,
+  "initial_conditional_review_manifest_sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c",
+  "intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
+  "history": "Exact initial four owner files plus original manifest/map archived durably at initial-380c6172; intermediate645 checker/test/proof/source-manifest and independent failed reason retained. Same completed IN8 anchor precedes review.",
+  "refinements_verified": [
+    "Optimization refused before artifact reads/output under -O and independently -OO.",
+    "Directory mode/UID/GID included; drift negatives pass.",
+    "Leading dot whiteout names preserved; root/nested deletion and opaque boundaries refuse fixture drift for correct effective paths.",
+    "Existing source/package provenance, exact763c base, four-file context and bounded existing owner publication/credential routes unchanged."
+  ],
+  "actual_local_candidate": {
+    "daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
+    "registry_digest": null,
+    "context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
+    "effective_changed_files": [
+      "lib/apk/db/installed",
+      "usr/lib/libz.so.1.3.2"
+    ],
+    "directories": 313,
+    "directory_metadata_delta": {},
+    "nine_base_layers_preserved": true,
+    "runtime_policy_module_unchanged": true,
+    "fullscan_same_snapshot_baseline_findings": 1,
+    "fullscan_same_snapshot_local_candidate_findings": 0,
+    "raw_runtime_config_bytes_identical": false,
+    "closed_default_normalization_semantics_unchanged": true,
+    "initial_or_intermediate_candidate_failed": false
+  },
+  "validation": {
+    "source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0",
+    "maker_tests_independently_passed": 8,
+    "independent_synthetic_probes": {
+      "OO_refusal_before_read": true,
+      "root_directory_removed_refused": true,
+      "root_opaque_refused": true,
+      "nested_opaque_parent_preserved_descendant_refused": true,
+      "nested_removed_directory_refused": true
+    },
+    "all66_hashes_match": true,
+    "initial27_exact_archive_verified": true,
+    "actual_candidate_changed_by_refinement": false,
+    "native_actions": false
+  },
+  "remaining_gates": [
+    "Actual owner CI source-pinned publication and immutable registry descriptor/layer/config/source readback.",
+    "Actual published full unsuppressed pinned scan/SBOM/runtime/purpose proof; local artifact zero does not extend to a different artifact.",
+    "Concrete separately reviewed native target/data-retaining protocol and fresh founder disposition; old purpose R2 approval does not authorize zlib release."
+  ],
+  "scope_limits": {
+    "owner_source_write": false,
+    "registry_publish": false,
+    "native_workload_changed": false,
+    "database_access": false,
+    "credentials_read": false,
+    "human_native_approval": false,
+    "T05_complete": false,
+    "other_owner_role": false
+  },
+  "checker_scope": "Agreement concerns this exact bounded candidate and challenged proof boundary; does not certify a general-purpose OCI extraction or signature verifier."
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py
new file mode 100644
index 0000000..78c0c7e
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py
@@ -0,0 +1,29 @@
+"""Synthetic public-artifact boundary probes; no native/provider/database use."""
+import importlib.util,json,subprocess,sys,tempfile
+from pathlib import Path
+root=Path(sys.argv[1])
+spec=importlib.util.spec_from_file_location("fixtures",root/"test_artifact_audit.py")
+f=importlib.util.module_from_spec(spec);spec.loader.exec_module(f)
+def layer(entries):
+ b=f.io.BytesIO()
+ with f.tarfile.open(fileobj=b,mode="w") as t:
+  for name,data in entries:f.add(t,name,data)
+ return b.getvalue()
+results={}
+with tempfile.TemporaryDirectory() as tmp:
+ r=subprocess.run([sys.executable,"-OO",str(f.CHECKER),str(Path(tmp)/"absent")],capture_output=True,text=True)
+ results["OO_refusal_before_read"]=r.returncode!=0 and "REFUSED: optimized Python" in r.stderr and "FileNotFoundError" not in r.stderr
+for name,base,overlay,expected in [
+ ("removed_directory",[("usr",None)],[(".wh.usr",b"")],"usr"),
+ ("root_opaque",[("usr",None)],[(".wh..wh..opq",b"")],"usr"),
+ ("nested_opaque",[("usr",None),("usr/inner",None)],[("usr/.wh..wh..opq",b"")],"usr/inner"),
+ ("nested_removed_directory",[("usr",None),("usr/inner",None)],[("usr/.wh.inner",b"")],"usr/inner"),
+]:
+ with tempfile.TemporaryDirectory() as tmp:
+  p=Path(tmp);f.fixture(p);b=layer(base)
+  f.archive(p/"base-image.tar",[b],["base"])
+  f.archive(p/"image.tar",[b,layer(overlay),layer([])],["base","overlay","cleanup"])
+  r=subprocess.run([sys.executable,str(f.CHECKER),str(p)],capture_output=True,text=True)
+  results[name]=r.returncode!=0 and repr({expected}) in r.stderr and not (p/"artifact-comparison.json").exists()
+print(json.dumps(results,sort_keys=True))
+if not all(results.values()):raise SystemExit(1)
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json
new file mode 100644
index 0000000..3acb21e
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json
@@ -0,0 +1,22 @@
+[
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
+  },
+  {
+    "original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
+  },
+  {
+    "original_path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
+  }
+]
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json
new file mode 100644
index 0000000..576b7c8
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json
@@ -0,0 +1,30 @@
+[
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
+    "original_sha256": null,
+    "staged_sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
+    "original_sha256": null,
+    "staged_sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
+    "original_sha256": null,
+    "staged_sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
+  },
+  {
+    "repo": "railiance-platform",
+    "path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
+    "original_sha256": null,
+    "staged_sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
+  }
+]
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json
new file mode 100644
index 0000000..497b529
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json
@@ -0,0 +1,37 @@
+{
+  "review_id": "RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1",
+  "work_record": "RPF-IN-0008",
+  "role": "railiance-platform technical owner only",
+  "status": "narrow-proof-helper-refinement-requested",
+  "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
+  "paths": 27,
+  "all_manifest_hashes_match": true,
+  "all13_local_evidence_hashes_match": true,
+  "source_test_methods_independently_passed": 4,
+  "actual_local_scan_base": "one MEDIUM CVE-2026-85091",
+  "actual_local_scan_candidate": "zero findings all severities stated DB snapshot",
+  "independent_directory_metadata_delta": {},
+  "sound_boundaries": [
+    "Exact763c current purpose base; signed official package/index hashes verified in offline named package upgrade against base keys, no allow-untrusted, no broader APK/Python/base refresh.",
+    "Current local final regular files differ only libz and APK installed DB; independent local export analysis confirms no directory metadata delta. Nine base layers/app36/policy9d/runtime/keys/world/Python/OpenSSL retained, closed serialization default caveat visible.",
+    "Workflow fixed owner/exactGITHUB_SHA+publicsourcearchive/fourcontext hash checks, existing admitted registry capability passwordstdin/private Dockerconfig cleanup; no borrowedcredential/newgrant/no nativeKubernetes or database action.",
+    "Workflow publishes candidate only; post-CI actual immutable registry descriptor/layer/config/source proof and fullscan/SBOM remain mandatory before separate nativefounderproposal. LocalimageID78bfdcc/config625d notregistrydigest and localzero doesnotextendactualCIartifact.",
+    "Current native763c remains legitimate inheritedMEDIUM/manualT05dueOct18, purposeR2approval/currentDB/journals immutable and not reused for remediation."
+  ],
+  "required_refinement": {
+    "source": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
+    "issue": "Seven assertion gates disappear with optimization; generated effective runtime / scan-zero claims can remain unconditional.",
+    "required": "Explicit sys.flags.optimize refusal before artifact archive/JSON/output IO (or non-assert guards), with regression proving no evidence output under -O. Include directory metadata in reusable full filesystem proof or retain explicit independent supplemental proof before actual published artifact approval."
+  },
+  "publication_scan_boundary": "CI does not itself perform pinned fullscan/SBOM before push. This is adequately disclosed for source-only candidate publication; no clean published artifact/native release is acknowledged by this review. Source guard and actual artifact proof must be valid before any native proposal.",
+  "scope_limits": {
+    "candidate_publication_executed": false,
+    "native_changes": false,
+    "database_access": false,
+    "credentials_read": false,
+    "owner_source_write": false,
+    "human_native_release_approval": false,
+    "T05_complete": false,
+    "other_owner_role": false
+  }
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json
new file mode 100644
index 0000000..d21a1d7
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json
@@ -0,0 +1,5 @@
+{
+  "public_local_exports_only": true,
+  "native_action": false,
+  "directory_metadata_changes": {}
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json
new file mode 100644
index 0000000..2f8b67b
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json
@@ -0,0 +1,19 @@
+{
+  "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
+  "paths": 27,
+  "all_manifest_hashes_match": true,
+  "all13_local_evidence_hashes_match": true,
+  "actual_raw_scan_findings": {
+    "base-trivy-full.json": [
+      [
+        "CVE-2026-85091",
+        "MEDIUM"
+      ]
+    ],
+    "trivy-full.json": []
+  },
+  "artifact_helper_assert_count": 7,
+  "artifact_helper_optimized_code_keeps_assertion_errors": false,
+  "local_candidate_registry_digest": null,
+  "publication_or_native_action": false
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md
new file mode 100644
index 0000000..bf92fa2
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md
@@ -0,0 +1,23 @@
+---
+id: RPF-IN-0008
+kind: intake
+type: intake
+title: "Platform source review of separate INFD zlib candidate publication"
+repo: railiance-platform
+lane: supervised
+status: closed
+owner: railiance-platform
+requested_by: the-custodian
+origin: handoff
+origin_ref: INFD-WP-0009-T05
+priority: high
+created: "2026-10-11"
+updated: "2026-10-11"
+tags: [security, cross-owner, review]
+---
+
+Bounded new Platform review of source candidate manifest `8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66`: official zlib package/index provenance, exact current763c base and minimal layer/runtime changes, local scan/SBOM proof, source-pinned ownerCI publication/credential boundaries. Distinct from completed purpose-actuator RPF-IN-0007 and its approvedR2 trial. No native rollout/data action, owner source write, registry publish or carried-forward human approval. Native763c still has disclosed inheritedMEDIUM/T05 dueOct18; source candidate is unpublished. This owner work record precedes formal review.
+
+## Completed initial source review
+
+Initial technical review `RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1` validates exact27-path8d345 source/localproofs and publication owner boundary. Source proof helper must refuse optimized Python before artifact IO; directory coverage verified independently for current artifacts and required on actual published readback. Four source methods pass; raw scans confirm base1MED/candidate0 on stated DB. Current local candidate remains unpublished; no native authorization transferred. Review refinement remains in promoted INFD-WP-0009-T05, separate from unpromoted verifier residual and completed IN7. Completed owner work record precedes formal entry.
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json
new file mode 100644
index 0000000..b828d2b
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json
@@ -0,0 +1,12 @@
+{
+  "candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
+  "source_only": true,
+  "synthetic_fixture_only": true,
+  "native_actions": false,
+  "probe": "directory whiteout normalization",
+  "refused": true,
+  "correct_effective_removed_directory_reason": false,
+  "incorrect_dot_stripped_whiteout_reason": true,
+  "finding": "lstrip dot normalization prevents declared whiteout branch from interpreting rootfs deletion",
+  "current_local_candidate_failed": false
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json
new file mode 100644
index 0000000..c99f1fb
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json
@@ -0,0 +1,75 @@
+{
+  "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
+  "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
+  "candidate_registry_digest": null,
+  "base_layers_preserved": 9,
+  "new_layers": 2,
+  "effective_runtime_config_identical": true,
+  "raw_config_bytes_identical": false,
+  "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
+  "labels_before": {
+    "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
+    "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
+    "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
+    "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
+  },
+  "labels_after": {
+    "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
+    "org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
+    "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
+    "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
+    "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
+  },
+  "final_changed_files": {
+    "lib/apk/db/installed": {
+      "before": [
+        "file",
+        420,
+        0,
+        0,
+        "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
+      ],
+      "after": [
+        "file",
+        420,
+        0,
+        0,
+        "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
+      ]
+    },
+    "usr/lib/libz.so.1.3.2": {
+      "before": [
+        "file",
+        493,
+        0,
+        0,
+        "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
+      ],
+      "after": [
+        "file",
+        493,
+        0,
+        0,
+        "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
+      ]
+    }
+  },
+  "directory_metadata_compared": true,
+  "directory_count_base": 313,
+  "directory_count_candidate": 313,
+  "directory_metadata_delta": {},
+  "sbom_package_count_base": 44,
+  "sbom_package_count_candidate": 44,
+  "sbom_only_delta": {
+    "zlib": [
+      "1.3.2-r0",
+      "1.3.2-r1"
+    ]
+  },
+  "full_scan_baseline_findings": 1,
+  "full_scan_candidate_allseverity_findings": 0,
+  "db_snapshot_same": true,
+  "native_workload_changed": false,
+  "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
+  "candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs."
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json
new file mode 100644
index 0000000..948fb25
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json
@@ -0,0 +1,21 @@
+{
+  "proposal_id": "INFD-WP-0009-T05/zlib-85091-r1",
+  "same_trial": true,
+  "original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
+  "original_local_verification_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1",
+  "reason": "Platform source-review guard gaps; original actual candidate/build/scan did not fail",
+  "changes": [
+    "Explicit optimized Python refusal before any archive/JSON read",
+    "Filesystem audit includes final directory mode/UID/GID metadata",
+    "Three synthetic tests: optimized malformed artifact refuses before read; unchanged directory passes; mode/UID/GID mutation refuses"
+  ],
+  "actual_existing_artifact_reaudit": "Passed; no directory metadata differences, same two changed files",
+  "candidate_image_unchanged": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
+  "four_file_build_context_unchanged": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
+  "registry_publication": false,
+  "native_changes": false,
+  "checker_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794",
+  "tests_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71",
+  "comparison_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89",
+  "verification_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json
new file mode 100644
index 0000000..5c9ebd2
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json
@@ -0,0 +1,408 @@
+[
+  {
+    "repo": "informed-decision",
+    "path": ".forgejo/workflows/zlib-overlay-image.yaml",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
+    "original_sha256": null,
+    "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "deploy/zlib-overlay/.dockerignore",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
+    "original_sha256": null,
+    "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "deploy/zlib-overlay/APKINDEX.tar.gz",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
+    "original_sha256": null,
+    "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "deploy/zlib-overlay/Containerfile",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
+    "original_sha256": null,
+    "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "deploy/zlib-overlay/pins.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
+    "original_sha256": null,
+    "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
+    "original_sha256": null,
+    "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
+    "original_sha256": null,
+    "staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
+    "original_sha256": null,
+    "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
+    "original_sha256": null,
+    "staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
+    "original_sha256": null,
+    "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
+    "original_sha256": null,
+    "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
+    "original_sha256": null,
+    "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
+    "original_sha256": null,
+    "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
+    "original_sha256": null,
+    "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
+    "original_sha256": null,
+    "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
+    "original_sha256": null,
+    "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
+    "original_sha256": null,
+    "staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
+    "original_sha256": null,
+    "staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
+    "original_sha256": null,
+    "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
+    "original_sha256": null,
+    "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
+    "original_sha256": null,
+    "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
+    "original_sha256": null,
+    "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
+    "original_sha256": null,
+    "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
+    "original_sha256": null,
+    "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
+    "original_sha256": null,
+    "staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
+    "original_sha256": null,
+    "staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
+    "original_sha256": null,
+    "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
+    "original_sha256": null,
+    "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
+    "original_sha256": null,
+    "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
+    "original_sha256": null,
+    "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
+    "original_sha256": null,
+    "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
+    "original_sha256": null,
+    "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
+    "original_sha256": null,
+    "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
+    "original_sha256": null,
+    "staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
+    "original_sha256": null,
+    "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
+    "original_sha256": null,
+    "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
+    "original_sha256": null,
+    "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
+    "original_sha256": null,
+    "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
+    "original_sha256": null,
+    "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
+    "original_sha256": null,
+    "staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
+    "original_sha256": null,
+    "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
+    "original_sha256": null,
+    "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
+    "original_sha256": null,
+    "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
+    "original_sha256": null,
+    "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
+    "original_sha256": null,
+    "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
+    "original_sha256": null,
+    "staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
+    "original_sha256": null,
+    "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
+    "original_sha256": null,
+    "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
+    "original_sha256": null,
+    "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
+    "original_sha256": null,
+    "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
+    "original_sha256": null,
+    "staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
+    "original_sha256": null,
+    "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
+    "original_sha256": null,
+    "staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "tools/zlib_overlay/check_build_inputs.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
+    "original_sha256": null,
+    "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "tools/zlib_overlay/check_runtime.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
+    "original_sha256": null,
+    "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "tools/zlib_overlay/compare_runtime.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
+    "original_sha256": null,
+    "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "tools/zlib_overlay/test_candidate.py",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
+    "original_sha256": null,
+    "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
+  },
+  {
+    "repo": "informed-decision",
+    "path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
+    "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
+    "original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
+    "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
+  }
+]
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py
new file mode 100644
index 0000000..332e2e8
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py
@@ -0,0 +1,47 @@
+"""Synthetic artifact boundaries; never access owner/native databases."""
+from pathlib import Path
+import io,json,subprocess,sys,tarfile,tempfile,unittest
+CHECKER=Path(__file__).with_name('verify_local_artifacts.py')
+def add(t,name,data=None,metadata=(0o755,0,0)):
+ m=tarfile.TarInfo(name);m.mode,m.uid,m.gid=metadata
+ if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
+ else:m.size=len(data);t.addfile(m,io.BytesIO(data))
+def archive(path,layers,ids):
+ with tarfile.open(path,'w') as t:
+  add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':[f'{i}.tar' for i in range(len(layers))]}]).encode())
+  add(t,'config.json',json.dumps({'rootfs':{'diff_ids':ids},'config':{}}).encode())
+  for i,data in enumerate(layers):add(t,f'{i}.tar',data)
+def layer(metadata):
+ b=io.BytesIO()
+ with tarfile.open(fileobj=b,mode='w') as t:add(t,'usr',metadata=metadata)
+ return b.getvalue()
+def fixture(root,metadata=(0o755,0,0)):
+ base=layer((0o755,0,0));candidate=layer(metadata)
+ archive(root/'base-image.tar',[base],['base'])
+ archive(root/'image.tar',[base,candidate,layer(metadata)],['base','overlay','cleanup'])
+ for name,version in [('base-sbom.cdx.json','1.3.2-r0'),('sbom.cdx.json','1.3.2-r1')]:
+  (root/name).write_text(json.dumps({'components':[{'name':'zlib','version':version,'purl':'pkg:apk/zlib'}]}))
+ for name,findings in [('base-trivy-full.json',[{'VulnerabilityID':'CVE-2026-85091','Severity':'MEDIUM'}]),('trivy-full.json',[])]:
+  (root/name).write_text(json.dumps({'Results':[{'Vulnerabilities':findings}]}))
+class ArtifactAuditTests(unittest.TestCase):
+ def execute(self,root,optimize=False):
+  return subprocess.run([sys.executable,*(['-O'] if optimize else []),str(CHECKER),str(root)],capture_output=True,text=True)
+ def test_optimized_tampered_artifacts_refused_before_read(self):
+  with tempfile.TemporaryDirectory() as tmp:
+   root=Path(tmp);(root/'base-image.tar').write_bytes(b'tampered not an archive')
+   r=self.execute(root,True)
+   self.assertNotEqual(r.returncode,0);self.assertIn('REFUSED: optimized Python',r.stderr)
+   self.assertNotIn('ReadError',r.stderr);self.assertFalse((root/'artifact-comparison.json').exists())
+ def test_matching_directory_metadata_passes(self):
+  with tempfile.TemporaryDirectory() as tmp:
+   root=Path(tmp);fixture(root);r=self.execute(root)
+   self.assertEqual(r.returncode,0,r.stderr)
+   proof=json.loads((root/'artifact-comparison.json').read_text())
+   self.assertTrue(proof['directory_metadata_compared']);self.assertEqual(proof['directory_metadata_delta'],{})
+ def test_directory_mode_uid_gid_drift_refuses(self):
+  for metadata in [(0o777,0,0),(0o755,10001,0),(0o755,0,10001)]:
+   with self.subTest(metadata=metadata),tempfile.TemporaryDirectory() as tmp:
+    root=Path(tmp);fixture(root,metadata);r=self.execute(root)
+    self.assertNotEqual(r.returncode,0);self.assertIn("{'usr'}",r.stderr)
+    self.assertFalse((root/'artifact-comparison.json').exists())
+if __name__=='__main__':unittest.main()
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py
new file mode 100644
index 0000000..81654b4
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py
@@ -0,0 +1,49 @@
+from pathlib import Path
+import hashlib,io,json,tarfile,sys
+if sys.flags.optimize:
+ raise SystemExit("REFUSED: optimized Python disables required artifact validation")
+root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
+def image(path):
+ with tarfile.open(path) as archive:
+  manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
+  configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
+  files={}
+  for name in manifest[0]['Layers']:
+   with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
+    for member in layer:
+     path=member.name.lstrip('./');p=Path(path)
+     if p.name=='.wh..wh..opq':
+      folder=p.parent.as_posix();files={key:value for key,value in files.items() if not key.startswith(folder+'/')};continue
+     if p.name.startswith('.wh.'):
+      removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue
+     if member.isfile():
+      data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
+     elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
+     elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
+     else:continue
+     files[path]=value
+  return config,hashlib.sha256(configbytes).hexdigest(),files
+base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
+assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
+changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
+expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
+assert set(changed)<=expected,set(changed)
+a,b=base['config'].copy(),candidate['config'].copy()
+labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
+a.pop('Image',None);b.pop('Image',None)
+defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
+for key,value in defaults.items():
+ a.setdefault(key,value);b.setdefault(key,value)
+assert a==b,(a,b)
+components=[]
+for name in ['base-sbom.cdx.json','sbom.cdx.json']:
+ data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
+sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
+assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
+vulns=[]
+for name in ['base-trivy-full.json','trivy-full.json']:
+ data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
+assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
+assert not vulns[1]
+proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
+(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md
new file mode 100644
index 0000000..29593ea
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md
@@ -0,0 +1,31 @@
+---
+id: RPF-IN-0008
+kind: intake
+type: intake
+title: "Platform source review of separate INFD zlib candidate publication"
+repo: railiance-platform
+lane: supervised
+status: closed
+owner: railiance-platform
+requested_by: the-custodian
+origin: handoff
+origin_ref: INFD-WP-0009-T05
+priority: high
+created: "2026-10-11"
+updated: "2026-10-11"
+tags: [security, cross-owner, review]
+---
+
+Bounded new Platform review of source candidate manifest `8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66`: official zlib package/index provenance, exact current763c base and minimal layer/runtime changes, local scan/SBOM proof, source-pinned ownerCI publication/credential boundaries. Distinct from completed purpose-actuator RPF-IN-0007 and its approvedR2 trial. No native rollout/data action, owner source write, registry publish or carried-forward human approval. Native763c still has disclosed inheritedMEDIUM/T05 dueOct18; source candidate is unpublished. This owner work record precedes formal review.
+
+## Completed initial source review
+
+Initial technical review `RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1` validates exact27-path8d345 source/localproofs and publication owner boundary. Source proof helper must refuse optimized Python before artifact IO; directory coverage verified independently for current artifacts and required on actual published readback. Four source methods pass; raw scans confirm base1MED/candidate0 on stated DB. Current local candidate remains unpublished; no native authorization transferred. Review refinement remains in promoted INFD-WP-0009-T05, separate from unpromoted verifier residual and completed IN7. Completed owner work record precedes formal entry.
+
+## Completed amended-source review preparation
+
+Same bounded review completed against the amended source. Exact initial conditional source review and four-file workrecord/probe snapshot are archived under `initial-380c6172`; initial failed optimized-proof boundary remains historical. Seven maker tests and independent optimized/deletion boundary probes reviewed. This completed workrecord is staged before the final formal review. Published-image readback and separate native authorization remain outside this source review.
+
+## Completed final exact-source review
+
+Final frozen66-path source `3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0` completed after optimization, directory metadata and whiteout-boundary refinements. Eight maker tests and five independent synthetic boundary probes pass. All66 hashes match. Actual existing local candidate remains unpublished with unchanged two-file delta,313 directory records and stated scan snapshot. This workrecord update precedes the formal narrow-source agreement; original380c conditional and645 failed proof-boundary evidence remain archived. No native result, approval, publication or T05 completion is recorded.
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-order-source-probes.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-order-source-probes.json
new file mode 100644
index 0000000..385978b
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-order-source-probes.json
@@ -0,0 +1,11 @@
+{
+  "source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
+  "all74_hashes_match": true,
+  "maker_test_methods_independently_passed": 9,
+  "independent_cli_order_cases_passed": 8,
+  "independent_prior_negative_cases_passed": 5,
+  "order_case_assertion": "Full CLI success plus emitted libz replacement file hash equals current-layer synthetic bytes for root/nested regular/opaque whiteouts before and after additions.",
+  "fixtures_only": true,
+  "native_actions": false,
+  "actual_candidate_image_unchanged": true
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-order-source-review.json b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-order-source-review.json
new file mode 100644
index 0000000..848d12d
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-order-source-review.json
@@ -0,0 +1,65 @@
+{
+  "review_id": "RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R3",
+  "work_record": "RPF-IN-0008",
+  "role": "railiance-platform technical owner only",
+  "status": "technical-agreement-source-candidate-preparation-only",
+  "source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
+  "source_paths": 74,
+  "initial_conditional_review_manifest_sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c",
+  "intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
+  "history": "Exact previous16 review files plus original manifest/map archived at accepted-66-6af44c10. This includes original380c four-file snapshot and645 failed boundary evidence. Prior agreement preserved as intermediate, superseded for source-whiteout semantics. Same completed IN8 trial anchor updated before entry; no new privilege or success.",
+  "refinements_verified": [
+    "Optimization refused before artifact reads/output under -O and independently -OO.",
+    "Directory mode/UID/GID included; drift negatives pass.",
+    "Leading dot whiteout names preserved; root/nested deletion and opaque boundaries refuse fixture drift for correct effective paths.",
+    "Existing source/package provenance, exact763c base, four-file context and bounded existing owner publication/credential routes unchanged.",
+    "Markers apply only to previous-layer state; current-layer additions merged after masking. Eight independent full CLI cases verify replacement hashes survive root/nested regular/opaque markers in both stream orders."
+  ],
+  "actual_local_candidate": {
+    "daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
+    "registry_digest": null,
+    "context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
+    "effective_changed_files": [
+      "lib/apk/db/installed",
+      "usr/lib/libz.so.1.3.2"
+    ],
+    "directories": 313,
+    "directory_metadata_delta": {},
+    "nine_base_layers_preserved": true,
+    "runtime_policy_module_unchanged": true,
+    "fullscan_same_snapshot_baseline_findings": 1,
+    "fullscan_same_snapshot_local_candidate_findings": 0,
+    "raw_runtime_config_bytes_identical": false,
+    "closed_default_normalization_semantics_unchanged": true,
+    "initial_or_intermediate_candidate_failed": false
+  },
+  "validation": {
+    "source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
+    "all74_hashes_match": true,
+    "maker_test_methods_independently_passed": 9,
+    "independent_cli_order_cases_passed": 8,
+    "independent_prior_negative_cases_passed": 5,
+    "order_case_assertion": "Full CLI success plus emitted libz replacement file hash equals current-layer synthetic bytes for root/nested regular/opaque whiteouts before and after additions.",
+    "fixtures_only": true,
+    "native_actions": false,
+    "actual_candidate_image_unchanged": true
+  },
+  "remaining_gates": [
+    "Actual owner CI source-pinned publication and immutable registry descriptor/layer/config/source readback.",
+    "Actual published full unsuppressed pinned scan/SBOM/runtime/purpose proof; local artifact zero does not extend to a different artifact.",
+    "Concrete separately reviewed native target/data-retaining protocol and fresh founder disposition; old purpose R2 approval does not authorize zlib release."
+  ],
+  "scope_limits": {
+    "owner_source_write": false,
+    "registry_publish": false,
+    "native_workload_changed": false,
+    "database_access": false,
+    "credentials_read": false,
+    "human_native_approval": false,
+    "T05_complete": false,
+    "other_owner_role": false
+  },
+  "checker_scope": "Agreement concerns this exact bounded candidate and challenged proof boundary; does not certify a general-purpose OCI extraction or signature verifier.",
+  "previous_agreement_manifest_sha256": "6af44c102084f7cdf09268264c5fd7bb0b0b354723edb10b7da2c1800ab726d4",
+  "previous_source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0"
+}
diff --git a/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_order_probes.py b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_order_probes.py
new file mode 100644
index 0000000..e51fcd6
--- /dev/null
+++ b/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_order_probes.py
@@ -0,0 +1,22 @@
+"""CLI proof regression using temporary synthetic public image archives only."""
+import importlib.util,subprocess,tempfile,json,hashlib,sys
+from pathlib import Path
+root=Path(sys.argv[1]);spec=importlib.util.spec_from_file_location("fixture",root/"test_artifact_audit.py");f=importlib.util.module_from_spec(spec);spec.loader.exec_module(f)
+def layer(entries):
+ b=f.io.BytesIO()
+ with f.tarfile.open(fileobj=b,mode="w") as t:
+  for name,data in entries:f.add(t,name,data)
+ return b.getvalue()
+results={};target="usr/lib/libz.so.1.3.2";new=b"synthetic-new"
+for marker in [".wh..wh..opq","usr/lib/.wh..wh..opq",".wh.usr","usr/lib/.wh.libz.so.1.3.2"]:
+ for first in [True,False]:
+  with tempfile.TemporaryDirectory() as tmp:
+   p=Path(tmp);f.fixture(p);base=layer([(target,b"synthetic-old")]);entries=[(marker,b""),(target,new)]
+   if not first:entries.reverse()
+   f.archive(p/"base-image.tar",[base],["base"]);f.archive(p/"image.tar",[base,layer(entries),layer([])],["base","overlay","cleanup"])
+   r=subprocess.run([sys.executable,str(f.CHECKER),str(p)],capture_output=True,text=True)
+   proof=json.loads((p/"artifact-comparison.json").read_text()) if r.returncode==0 else {}
+   after=proof.get("final_changed_files",{}).get(target,{}).get("after")
+   results[marker+":"+str(first)]=r.returncode==0 and after is not None and after[0]=="file" and after[-1]==hashlib.sha256(new).hexdigest()
+print(json.dumps(results,sort_keys=True))
+if not all(results.values()):raise SystemExit(1)
diff --git a/intakes/RPF-IN-0008-infd-zlib-candidate-review.md b/intakes/RPF-IN-0008-infd-zlib-candidate-review.md
new file mode 100644
index 0000000..7a93b0d
--- /dev/null
+++ b/intakes/RPF-IN-0008-infd-zlib-candidate-review.md
@@ -0,0 +1,35 @@
+---
+id: RPF-IN-0008
+kind: intake
+type: intake
+title: "Platform source review of separate INFD zlib candidate publication"
+repo: railiance-platform
+lane: supervised
+status: closed
+owner: railiance-platform
+requested_by: the-custodian
+origin: handoff
+origin_ref: INFD-WP-0009-T05
+priority: high
+created: "2026-10-11"
+updated: "2026-10-11"
+tags: [security, cross-owner, review]
+---
+
+Bounded new Platform review of source candidate manifest `8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66`: official zlib package/index provenance, exact current763c base and minimal layer/runtime changes, local scan/SBOM proof, source-pinned ownerCI publication/credential boundaries. Distinct from completed purpose-actuator RPF-IN-0007 and its approvedR2 trial. No native rollout/data action, owner source write, registry publish or carried-forward human approval. Native763c still has disclosed inheritedMEDIUM/T05 dueOct18; source candidate is unpublished. This owner work record precedes formal review.
+
+## Completed initial source review
+
+Initial technical review `RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1` validates exact27-path8d345 source/localproofs and publication owner boundary. Source proof helper must refuse optimized Python before artifact IO; directory coverage verified independently for current artifacts and required on actual published readback. Four source methods pass; raw scans confirm base1MED/candidate0 on stated DB. Current local candidate remains unpublished; no native authorization transferred. Review refinement remains in promoted INFD-WP-0009-T05, separate from unpromoted verifier residual and completed IN7. Completed owner work record precedes formal entry.
+
+## Completed amended-source review preparation
+
+Same bounded review completed against the amended source. Exact initial conditional source review and four-file workrecord/probe snapshot are archived under `initial-380c6172`; initial failed optimized-proof boundary remains historical. Seven maker tests and independent optimized/deletion boundary probes reviewed. This completed workrecord is staged before the final formal review. Published-image readback and separate native authorization remain outside this source review.
+
+## Completed final exact-source review
+
+Final frozen66-path source `3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0` completed after optimization, directory metadata and whiteout-boundary refinements. Eight maker tests and five independent synthetic boundary probes pass. All66 hashes match. Actual existing local candidate remains unpublished with unchanged two-file delta,313 directory records and stated scan snapshot. This workrecord update precedes the formal narrow-source agreement; original380c conditional and645 failed proof-boundary evidence remain archived. No native result, approval, publication or T05 completion is recorded.
+
+## Completed lower-layer-only whiteout refinement review
+
+Same IN8 preparation trial completed against frozen74-path source `724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec`. Whiteout markers now mask prior-layer state before merging current additions. Nine maker tests and thirteen independent CLI probes pass, including eight root/nested regular/opaque whiteout order variants that check the actual emitted replacement-file hash. All74 hashes match; existing local candidate remains unchanged/unpublished. Exact preceding16-file agreement snapshot and manifest/map are archived at `accepted-66-6af44c10` before supersession. This completed anchor precedes formal review and does not create a new success or native authority.