Runbook — Clean Installation

Preconditions

• Approved baseline manifest and all required artifact IDs are available.
• Input checksums, rights/access rules, and secrets delivery path are known.
• Target host is disposable or explicitly approved, isolated, and has enough storage.
• A rollback point exists if the target is not disposable.

Procedure

1. Record host OS, architecture, time, locale, package sources, and baseline ID.
2. Verify every source artifact and Git commit before extraction or checkout.
3. Create new server and client working directories; never operate in original/.
4. Install the pinned toolchain/dependencies from recorded sources.
5. Build/install the pinned server revision and record output hashes.
6. Initialize a fresh database from the baseline schema and ordered migrations.
7. Generate configuration from templates and inject secrets at runtime.
8. Generate the client working copy using Runbook — Client Working Copy.
9. Start with loopback-only exposure and run integrity, process, port, login, world/session, restart, and backup checks.
10. Store sanitized logs and update the compatibility row. Destroy disposable secrets and temporary data.

Success

The documented milestone repeats after a clean restart with no undocumented manual changes. Otherwise preserve the failed working copy long enough to record a finding, then rebuild rather than silently repairing drift.