release: freeze Nexus One AI 1.0.0-rc1

specs/001-enterprise-experience/contracts/online-universal-acquisition.md

@@ -0,0 +1,110 @@
+# Online Universal Server Acquisition Contract
+
+**Status**: Approval draft; no implementation authority.
+
+## Purpose and Boundary
+
+The Online Universal Server ISO boots and installs the supported Ubuntu base, performs local hardware
+and license preflight, permits Server S/M/L/Max selection, then acquires the exact signed platform
+payload for the approved release. Network access is required, but network availability never replaces
+artifact authenticity, compatibility, or rollback checks.
+
+The current implementation clones the default branch from
+`https://cgit.cezentech.com/jinojose/aipackage.git` during Ubuntu late commands and subsequently allows
+APT, Python, container, runtime, and model tooling to fetch mutable dependencies. This is observed
+legacy behavior, not the accepted release contract.
+
+## Approved Endpoint Classes
+
+Every release candidate MUST provide an explicit allowlist containing scheme, hostname, port,
+certificate policy, purpose, authentication method, and whether access occurs before or after target
+disk mutation. No wildcard hostname is allowed.
+
+| Endpoint class | Required purpose | Contract |
+|---|---|---|
+| Release index | Discover one approved release manifest by channel/version | HTTPS; small signed index; no executable content |
+| Content store | Download content-addressed payload objects | HTTPS; object path bound to SHA-256; range/resume supported |
+| Ubuntu/package sources | Acquire pinned OS/package objects not embedded in media | Approved mirrors only; repository metadata and package signatures verified |
+| Container registry | Acquire pinned images | Digest references only; registry authentication scoped read-only |
+| License service | Optional online license acquisition/refresh where policy permits | Separate authenticated endpoint; signed license remains independently verifiable |
+| Time source | Optional clock confidence | Never establishes artifact authenticity; absence has declared license/policy behavior |
+
+Git default branches, container tags, `latest` runtime URLs, unauthenticated scripts piped to shells,
+and model names without immutable revision/digest MUST NOT be release inputs.
+
+## Acquisition Sequence
+
+1. Verify local boot-media identity and embedded trust roots.
+2. Establish network and record interface, DNS, route, proxy, and local clock confidence without
+   recording credentials.
+3. Fetch the signed release index; verify trust policy, digest, signature, channel, expiry policy, and
+   rollback/security floor before selecting a release.
+4. Select Server tier only after license and hardware preflight. Tier selection does not change trust.
+5. Resolve one immutable artifact manifest and evaluate architecture/category/tier/OS/capacity
+   compatibility locally.
+6. Download objects into a staging area by digest with bounded retries, timeouts, rate limits, and
+   resumable range requests. Partial objects use a non-final name and are never executable.
+7. Verify every completed object size/digest, then verify the complete signed manifest again.
+8. Create and verify the declared pre-change checkpoint before platform mutation.
+9. Activate through the shared durable operation/rollback contract.
+10. Record release ID, manifest/signature identity, object inventory, endpoint classes used, retry
+    counts, and final state without tokens, passwords, customer content, or full signed licenses.
+
+## Authentication and TLS
+
+- TLS certificate and hostname validation is mandatory; insecure/skip-verify modes are prohibited.
+- The embedded OS CA set is the minimum web PKI trust. A Cezen release-signing signature remains
+  mandatory even when TLS succeeds.
+- Private content credentials MUST be short-lived, least-privilege, read-only, redacted from command
+  lines/logs, and stored only for the operation lifetime unless an approved refresh policy requires
+  otherwise.
+- Proxy support MUST preserve TLS validation and provide a customer-visible explanation when TLS
+  interception uses a customer-approved CA. Silent trust-root installation is prohibited.
+- Redirects across hostnames are rejected unless the destination is independently allowlisted.
+
+## Retry, Resume, Cache, and Idempotency
+
+- DNS, connect, TLS, first-byte, idle, and total-operation timeouts are explicit release-policy values.
+- Retries are bounded exponential backoff with jitter and honor server retry guidance within limits.
+- A resumed object is retained only when its expected digest and length still match the signed
+  manifest. ETag alone is insufficient identity.
+- Verified content-addressed objects MAY be reused across attempts and tiers; unverified or partial
+  content is quarantined or deleted.
+- Re-running acquisition for the same operation ID resumes the same staging inventory. A different
+  manifest creates a new operation and cannot silently replace active staging.
+
+## Failure and Recovery Contract
+
+| Failure point | Required outcome |
+|---|---|
+| No DHCP/static route/DNS | Target remains at local setup; show network evidence and safe retry |
+| TLS/certificate/hostname failure | Stop before payload trust; never offer insecure bypass |
+| Index/manifest unsigned, revoked, stale, or below security floor | Stop before payload download/mutation; preserve redacted evidence |
+| Authentication denied/expired | Stop or renew through approved flow; do not log credential |
+| Interrupted object download | Retain only bounded partial staging; safely resume by digest |
+| Digest/size mismatch | Quarantine/delete object, invalidate cache entry, bounded retry from approved endpoint |
+| Insufficient disk discovered | Stop before activation; report staging and rollback space separately |
+| Network loss after full verification, before activation | Activation MAY continue only when every required object is locally verified |
+| Network loss during activation | Activation outcome depends only on local staged objects; shared rollback contract applies |
+| Reboot interruption | Resume the same durable operation and never reacquire already verified objects unnecessarily |
+
+## Evidence Gates
+
+Before implementation-ready status:
+
+1. Platform/security owners approve the exact endpoint allowlist and ownership.
+2. Release-index schema and test vectors extend the shared manifest/signature fixtures.
+3. Credential source, lifetime, rotation, revocation, proxy, and customer-CA policies are approved.
+4. Timeout/retry/cache quotas and staging retention are measurable and approved.
+5. Tests cover DNS, TLS, redirect, proxy, auth, partial content, resume, corrupted cache, manifest
+   replacement, insufficient disk, network loss before/after verification, activation, and reboot.
+6. A clean install proves the deployed source revision and every acquired object match the accepted
+   manifest; cloning a mutable default branch is a release blocker.
+
+## Decisions Still Requiring Owners
+
+- Production release-index and content-store hostnames and responsible operator.
+- Public versus authenticated payload access and credential issuer.
+- Approved Ubuntu/package mirrors and any customer-hosted mirror mode.
+- Proxy/customer CA enrollment workflow.
+- Supported release channels, index expiry, cache quota/retention, retry/timeouts, and support SLA.