# Release Payload Inventory, Deduplication, and Media Sizing

**Status**: Repository-derived planning baseline; no build authority.  
**Observed source revision**: `bea082a2014a3edc31cb006108b952c8adbbc8bc` plus the uncommitted
specification changes in this task.  
**Observed artifact fact**: `autoinstall/cezen-ai-ubuntu2204.iso` is 0 bytes and is not usable as a
release or sizing baseline.

## Inventory Rules

Every payload object has one canonical inventory row containing object ID, class, immutable upstream
identity, license, architecture, media type, compressed/download bytes, unpacked bytes, on-target
bytes, digest, source URL/repository, included artifacts, activation profiles, dedup group, and evidence
status. No bytes are counted from model names, tags, estimates, sparse files, or expected upstream size.

The release manifest is generated from the finalized inventory. The inventory is not reconstructed
from an ISO after publication except as independent verification.

## Four-Artifact Boundary

| Artifact | Embedded boundary | Explicit exclusions | Current sizing state |
|---|---|---|---|
| Online Universal Server | Ubuntu boot/install base, network/preflight/acquisition client, trust roots, signed-index support, local recovery/help | Platform payload, optional/large models and mutable default-branch source | Current checked-in ISO is 0 bytes; no valid measured size |
| Offline Workstation AMD64 | Ubuntu base, universal NVIDIA/CPU-adaptive platform superset, required packages/runtimes/images, local help/recovery, approved small starter models | AMD GPU/ROCm, ARM64 DGX Spark, large optional models, customer license/data | Candidate lists exist; no complete built payload or measured ISO |
| Offline Server S/M AMD64 | Ubuntu base plus superset required for both S and M; selection restricted to `starter/basic`; small approved starter models only | Server L/Max selection and large models | No complete inventory/build/size evidence |
| Offline Server L/Max AMD64 | Ubuntu base plus enterprise platform superset for L and Max; selection restricted to `pro/max`; only approved bootstrap/small validation models | Large L/Max models, which are separate signed packs | No complete inventory/build/size evidence; current roles do not yet prove a distinct payload |

Architecture is part of artifact identity. Any later Workstation ARM64 media has its own inventory and
measurements while remaining the same commercial product category.

## Repository-Derived Candidate Inventory

### Common source and trust

- Exact platform source revision excluding `.git`, ISOs, offline output, user collateral and secrets.
- Boot/autoinstall data, first-boot/browser setup, install orchestration and Ansible roles/playbooks.
- Portal, backend, local documentation, recovery and diagnostic tooling.
- License public key, artifact trust roots, manifest schemas, signature/revocation policy and SBOM.
- Ubuntu installer/base identity and boot metadata.

### Current Workstation offline lists

- 26 non-comment APT package names.
- 15 non-comment additional Python package requirements plus backend requirements and pinned
  `chromadb==0.5.23`.
- Six container image names: Open WebUI, vLLM, DCGM exporter, Prometheus, node exporter and Grafana.
- Miniconda, Ollama runtime, K3s, MinIO and `mc` binaries described by the current offline material.
- Ollama `phi3:mini` and `nomic-embed-text` candidate pins plus the Hugging Face Phi-3 snapshot.

These are candidate inputs, not complete objects: several versions/tags, licenses, transitive packages,
architectures and actual byte/digest inventories remain unresolved.

### Role matrix

| Role | Workstation adaptive | Server S | Server M | Server L | Server Max |
|---|---|---|---|---|---|
| Base, Docker, Ollama, vLLM, ChromaDB, monitoring, backend, ttyd, Nginx | Profile-dependent | Yes | Yes | Yes | Yes |
| JupyterLab | Optional/profile | Optional | Yes | Yes | Yes |
| K3s, MLflow, MinIO | Not enabled on low profiles; payload decision pending | No | Yes | Yes | Yes |
| NVIDIA driver/runtime | Only on supported NVIDIA profile | Hardware-dependent | Hardware-dependent | Required profile decision | Required profile decision |
| Large default model | Separate pack | Separate/not required | Separate pack | Separate pack | Separate pack |

The existing `entry`, `pro`, and `max` playbooks contain the same role set. Pro/Max differ primarily in
model choice, tensor parallelism, quantization and hardware expectations. Because large models are now
separate packs, current repository evidence does not yet prove that Offline Server L/Max needs a
materially different boot payload from the Server M superset. The agreed separate L/Max artifact may
still be justified by support boundary, validation, driver/runtime, capacity or enterprise policy,
but that distinction must be explicit before implementation.

## Deduplication Policy

1. Every object is identified by SHA-256 of exact bytes. Identical digests share one dedup group.
2. Within one artifact, store identical package/wheel/image/model/runtime objects once; manifests may
   reference the same object from multiple profiles/tiers.
3. Container layers are deduplicated by compressed layer digest, not image tag.
4. Python wheels and APT packages are deduplicated by exact file digest and architecture; different
   builds/architectures are distinct even when package/version text matches.
5. Model weights are deduplicated only when exact object digests match. Similar model names or
   quantizations are distinct.
6. Shared source, local help and portal/backend copies use one canonical payload object and explicit
   install destinations rather than duplicated archives.
7. Deduplication across separately distributed ISOs does not reduce each customer's media size and is
   reported only as build-store efficiency, never as ISO byte reduction.
8. Compression savings and filesystem sparse allocation are recorded separately from logical bytes.

## Measurement Worksheet

For each build candidate record exact bytes:

| Component class | Unique compressed bytes | ISO/on-media bytes | Unpacked target bytes | Staging bytes | Rollback bytes | Evidence |
|---|---:|---:|---:|---:|---:|---|
| Ubuntu boot/install base | TBD | TBD | TBD | TBD | N/A | Base ISO digest/signature required |
| Platform source/config/help | TBD | TBD | TBD | TBD | TBD | Exact revision/archive digest |
| APT packages/repository metadata | TBD | TBD | TBD | TBD | TBD | Resolved package manifest |
| Python/Conda environments | TBD | TBD | TBD | TBD | TBD | Wheel/conda explicit lock |
| Runtime binaries | TBD | TBD | TBD | TBD | TBD | Immutable URLs/digests/licenses |
| Container layers | TBD | TBD | TBD | TBD | TBD | Digest/layer inventory |
| Starter model objects | TBD | TBD | TBD | TBD | TBD | Exact model/layer inventory |
| Trust/SBOM/provenance/manifests | TBD | TBD | TBD | TBD | TBD | Signed build output |
| ISO filesystem/boot overhead | N/A | TBD | N/A | N/A | N/A | Final image measurement |

Totals MUST distinguish download/media bytes, target bytes, temporary staging, last-known-good
rollback and operational free space. Target disk minimum is not the same as USB capacity.

## Media Capacity Rule

After final ISO bytes are measured, compute `required_flash_bytes = final_iso_bytes + tool/filesystem
overhead`, then add at least 20% headroom. Publish the smallest commonly available USB capacity above
that result. Recommend the next larger capacity when field reliability or signed forecast growth
requires it. Record exact arithmetic and artifact digest.

Current 2–4 GB Online and 35–50 GB Workstation numbers remain labelled estimates only. Offline Server
S/M and L/Max sizes remain unpublished until their resolved inventories are built and deduplicated.
Large-model-pack media is sized independently from boot media.

## Evidence Gate

1. Resolve every input to immutable version/revision/digest, architecture and redistribution license.
2. Produce SBOM and object inventory before assembly; verify every fetched byte.
3. Fail the build for missing, extra, duplicate-path/different-digest or mutable-tag objects.
4. Build from a clean staging host, record logical and physical bytes, and verify manifest totals.
5. Extract the ISO independently and reconcile every embedded object to the signed inventory.
6. Complete zero-network install and record actual peak target/staging/rollback disk usage.
7. Repeat the build to assess reproducibility; unexplained digest differences block release.
8. Product/delivery approve the L/Max split justification after comparing its resolved payload to M.

## Open Decisions

- Exact immutable Ubuntu, APT, Python/Conda, runtime, image and binary inputs/licenses.
- Whether K3s/MinIO tooling belongs in Workstation media when disabled for lower profiles.
- Small bootstrap-model boundary for Server S/M and L/Max.
- Concrete platform difference justifying separate Offline Server L/Max media after large models are removed.
- Compression format/level, reproducible timestamps/ordering, SBOM/provenance formats and build host.
- Published USB capacities only after real artifact and flashing measurements.