[ORESoftware]

Scope

Adds the first native installation slice beneath DEN-1437 without requiring mise, another manager, a registry, backend plugin, or global PATH mutation.

zed-tool [--lock .zed/environment.lock.toml] [--json] verify [--portable] [--plan-digest SHA]
zed-tool [--lock .zed/environment.lock.toml] [--json] list --target TARGET
zed-tool [--lock .zed/environment.lock.toml] [--json] install --target TARGET --offline [--profile .zed/tools] [--home PATH]

Frozen replay contract

• Parse TOML or JSON through the shared EnvironmentLock contract.
• Require portable validation for installation.
• Select exactly one locked variant per logical tool for the requested target.
• Support authenticated tar_gz and ZIP bytes already present in Zed's local cache; all other formats fail closed.
• Verify exact artifact size and SHA-256 before extraction.
• Reuse the existing traversal-safe, per-digest locked, atomic content-addressed store.
• Resolve every command below the locked install root without symlink traversal.
• Reject executable and alias collisions case-insensitively for Windows portability.
• Stage and synchronize a complete profile under .zed/tools/v1/<target> while holding the checkout operation lock, then atomically replace the prior owned profile.
• Expose immutable-store symlinks on Unix and exact copied command files on Windows.
• Record a distinct live store reference for the profile, avoiding collision with package-install GC ownership.
• Return unchanged without rewriting state when lock, target, command set, and profile state are identical.

Failure atomicity and Windows durability

Independent zed-pkg-test/offline-cache-e2e#2 found and pinned these defects:

1. failed installs left newly created empty .zed/tools/v1 parents;
2. Windows copied commands successfully but attempted sync_all() through a read-only File::open handle, producing OS error 5;
3. strict all-target Clippy rejected a test fixture that mutated EnvironmentLock::default() after construction; and
4. the independent Windows harness passed literal quote characters inside a cmd.exe /C argv element.

The product now:

• removes only profile-directory prefixes created by a failed invocation when they remain empty;
• preserves caller-owned, nonempty, symlinked, or type-changed state;
• opens copied Windows executables with write access before sync_all();
• keeps the directory-sync File import Unix-only;
• includes a Windows copied-.cmd synchronization regression; and
• requires the complete .zed/tools namespace to remain absent after missing cache, hash mismatch, wrong size, executable collision, online mode, wrong plan digest, and unsafe-target rejection.

State and security

profile.json records only lock digest, target, tool/version/backend, artifact digest, relative install root, and relative command layout. It contains no source URL, credential, environment value, timestamp, hostname, PID, home path, or absolute store path.

The staged installer never performs network access, version discovery, plugin evaluation, install hooks, package-manager execution, or downloaded-binary execution. --offline is mandatory.

Exact product evidence

Final connector-authored exact head:

77a19fe3be0520b29e0c2fef2072518a0f6d043b

Every workflow on this exact head is terminal-green:

• full CI;
• repository hardening and agents policy;
• formal review procedure;
• frozen offline tool profiles;
• global executable package profiles;
• recursive Windows locking and blocking store locks;
• mise/asdf/native task runtime;
• Nix interop, fetch bundle, export bundle, and bundle write;
• OCI copy mode;
• polyglot; and
• develop-shell.

There are no unresolved review threads.

Independent certification

zed-pkg-test/offline-cache-e2e#2 merged as:

certification head: 808daad296bf820b069b74a976fb7b68c4259585
merge commit:       cc966e02743ed690797c834f11711138c138482a

Its exact candidate-quality, Ubuntu 24.04, macOS 15, Windows 2025, and generated-harness jobs are all green against this product tree. It independently proves cache-only operation under malformed credentials, unreachable registry/proxies, execution and alias behavior, unchanged replay, store/cache reuse, failure atomicity, collision handling, unsafe-target rejection, checkout immutability, and secret-free project-relative profile state.

The certified formatted src/tool_profile.rs SHA-256 is:

2749b999c67cf2fc609db22b8cb784ce6b1db2284df376225fedbec56a41c442

This is deliberately not yet canonical zed tool: version discovery/download, signatures, multiple active versions, backend families, update/prune, lazy shims, and zed dev activation remain separate certified slices.

Linear: DEN-2923, DEN-1437, DEN-1482, DEN-1442

Independent certification: zed-pkg-test/offline-cache-e2e#2

[linear-code]

DEN-2923

[ORESoftware]

Independent test-org certification is open at zed-pkg-test/offline-cache-e2e#2.

Current exact pins after two failure-driven product repairs:

product:    b260d4f13d6257160343ec6c8f9f3195859748b8
interfaces: a23cdd2ac509a39ca6fd6d21a3774fdd3a0f7660
test head:  3ad2b6e6fb755aa9a9156f7f5b7260dd9f458666

The independent gate found two real candidate defects:

1. 07c5678… was not rustfmt-clean; repaired in 9217abf….
2. All three platforms then showed missing-cache rejection left empty .zed/tools/v1 directories. Product b260d4f… now records absent profile prefixes and rolls back only newly created empty directories on failure. Existing caller-owned or nonempty state is not removed. Compiled CLI regressions require the entire .zed/tools namespace to remain absent after missing/tampered/wrong-size/collision/online/digest/unsafe-target rejection.

The read-only Ubuntu/macOS/Windows black-box gate constructs its own authenticated tar.gz and JSON EnvironmentLock, tests successful execution/idempotence/shared cache, and runs all red cases with malformed credentials, a runtime-assembled fake token, an unreachable registry, and failing proxies. Both earlier runs are superseded; only the current exact heads count as evidence.

[ORESoftware]

Windows exact-head follow-up — August 8, 2026

The first repair materialization run (31263879376) proved the product-side diagnosis:

• focused library tests passed;
• compiled CLI tests passed;
• opening the copied executable with write access before sync_all() fixed Access is denied (os error 5);
• first Windows offline install succeeded;
• unchanged replay succeeded.

The run then failed in the independent harness while executing the installed .cmd: the harness passed f'"{path}"' as an argv element to cmd.exe, so the quote characters became part of the command and Windows attempted to execute a filename beginning with ". That is a harness quoting defect, not product behavior.

A superseding exact materializer run (31264325401) now:

1. retains the write-capable copied-file flush repair;
2. makes the Unix-only File import conditional, removing the Windows unused-import warning;
3. fixes the strict-Clippy EnvironmentLock::default() test fixture;
4. runs focused tests plus cargo clippy --all-targets -D warnings;
5. invokes the Windows batch path as an ordinary cmd.exe /C argument; and
6. reruns the complete independent Windows profile contract before emitting exact product bytes.

No product branch update will be pushed until this combined proof is green.