Runbook — Client Working Copy

Inputs

• Authorized immutable client artifact ID and checksum manifest.
• Declared server baseline and compatibility row.
• Ordered patch/configuration recipes with versions and expected output hashes.

Procedure

1. Verify the original snapshot without launching it.
2. Copy or losslessly normalize into a new working directory.
3. Remove personal profiles, caches, chat logs, screenshots, credentials, machine identifiers, and unrelated save data.
4. Apply endpoint configuration, launcher settings, runtime shims, and patches in the recorded order.
5. Record every changed file and input/output hash. Keep proprietary original bytes out of public patch repositories.
6. Deny public-network access by default and use disposable credentials.
7. Run malware/untrusted-binary checks in the isolated test environment and record tool versions/results.
8. Execute the baseline test, then archive only the declarative recipe and public-safe evidence.

Drift

Recreate the working copy and compare manifests. Unexplained differences invalidate the clean-state claim until a finding resolves them.