release: freeze Nexus One AI 1.0.0-rc1

autoinstall/offline/build-bundle.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Stage all network-fetched Server Starter inputs for a disconnected install.
+# Stage reviewed, immutable Offline Workstation inputs for a disconnected install.
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -7,10 +7,20 @@ PACKAGE_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
 OUTPUT_DIR="${OFFLINE_OUTPUT_DIR:-$PACKAGE_DIR/autoinstall/offline-output}"
 PAYLOAD_DIR="$OUTPUT_DIR/payload"
 MANIFEST_DIR="$OUTPUT_DIR/manifest"
+PAYLOAD_LOCK="${OFFLINE_PAYLOAD_LOCK:-$SCRIPT_DIR/payload-lock.json}"
 
 # shellcheck source=payload.env
 source "$SCRIPT_DIR/payload.env"
 
+# Gate 2 preflight MUST run before privilege checks, network access, output deletion, or acquisition.
+python3 "$SCRIPT_DIR/validate-payload-lock.py" "$PAYLOAD_LOCK"
+
+# The legacy acquisition path below does not yet consume the reviewed lock. Keep it unreachable until
+# each acquisition step verifies bytes against the lock before placing them in trusted staging.
+echo "ERROR: immutable lock preflight passed, but lock-driven acquisition is not implemented yet." >&2
+echo "ERROR: refusing to execute the legacy mutable bundle builder." >&2
+exit 1
+
 if [ "${EUID:-$(id -u)}" -ne 0 ]; then
   echo "ERROR: run as root on a connected Ubuntu 22.04 staging host." >&2
   exit 1