Installation instructions — execute only after separate trial approval

Use a NEW disposable Ubuntu 24.04.5 LTS aarch64 host with 2 vCPU, approximately
2 GiB RAM, no swap, cgroup v2/systemd, a stable host clock, and at least 5 GiB free
local disk before setup. CPython 3.12.3, SQLite 3.45.1 and venv pip 24.0 are the
reference versions checked before provisioning. No x86_64/macOS/other-distro or
newer-runtime execution compatibility is claimed. OS/image acquisition is the
operator's responsibility; this is not an OS image or a power-loss guarantee.
The parent Linux report did not bind a filesystem/image digest. Match its local
Linux filesystem assumptions; do not use network/shared/rollback-mounted storage.

The host must supply sudo, useradd/userdel/groupdel, systemd-run and Python venv.
No EZA accounts, services, runtime, credentials or previous domains are required.
No permanent systemd unit is installed. Transient scopes contain trial processes.
Ubuntu package acquisition is a future operator step, not something done during
packaging. If the base image lacks Python/venv, these are ROOT OS-package commands:

  sudo apt-get update
  sudo apt-get install python3.12 python3.12-venv

These access Ubuntu's configured OS repositories, not PyPI. They do not install
Python packages system-wide via pip. Confirm the resulting reference versions;
do not silently downgrade, upgrade or bypass runtime_check_v1.py if they differ.
The selected runtime patch/SQLite/pip versions are required for this first attempt;
other CPython 3.12 patch builds remain unqualified, despite compatible wheel tags.

1. Verify the delivered directory as your normal operator account (UNPRIVILEGED).
Set EZA_PACKAGE to its actual absolute path and the independently supplied pin:

  EZA_PACKAGE="$(pwd -P)"
  EZA_INVENTORY='REPLACE_WITH_SHA256SUMS_DIGEST_FROM_HANDOFF'
  python3 -I -B "$EZA_PACKAGE/verify_v1.py" --expected-inventory "$EZA_INVENTORY"

Do not add output files or __pycache__ inside the package. Use -I -B as shown.
The package and privileged scripts are trusted operator input; inspect them before
running root commands. Hash verification alone is not a signature or source trust.

2. Choose unused installation/state paths and an UNUSED short account prefix.
The following are examples, not hidden assumptions; all are passed explicitly:

  EZA_HOME=/opt/eza-trial-001
  EZA_STATE=/var/lib/eza-trial-001
  EZA_PREFIX=dt001
  EZA_OPERATOR="$(id -un)"

Parent directories must already be root-owned and not group/world writable;
/home/operator and /tmp are unsuitable for the protected installation/state.
Home and state must be new, separate and non-nested. Keep the state path short:
its Unix socket paths must be at most 100 bytes. Existing names/paths cause STOP.

3. ROOT: create five fresh non-login system accounts and the isolated directories.
No fixed UIDs/GIDs are used. The setup records the IDs allocated by Ubuntu.

  sudo /usr/bin/python3 -I -B "$EZA_PACKAGE/integration/setup_v1.py" fresh \
    --home "$EZA_HOME" --state "$EZA_STATE" --prefix "$EZA_PREFIX" \
    --operator "$EZA_OPERATOR" --inventory-sha256 "$EZA_INVENTORY"

This command invokes useradd, copies the verified package, creates directories,
and sets ownership/modes. It does not install dependencies, start a service or
provision a domain yet. The created identities are prefix-svc, prefix-px,
prefix-py, prefix-dx and prefix-dy. Authentication is local Linux SO_PEERCRED.
The operator/root is trusted; these protections do not contain a malicious root.

4. UNPRIVILEGED: create a fresh venv and fetch the nine pinned packages online.
The temporary runtime directory belongs to the operator solely for installation.
Do not move the venv afterward: generated scripts contain its chosen path.

  python3.12 -m venv "$EZA_HOME/runtime"
  EZA_PY="$EZA_HOME/runtime/bin/python3"
  env -i PATH=/usr/bin:/bin HOME="$HOME" PIP_CONFIG_FILE=/dev/null \
    "$EZA_PY" -I -B -m pip install --disable-pip-version-check \
    --no-index --no-cache-dir --only-binary=:all: --require-hashes --no-compile \
    -r "$EZA_HOME/package/dependencies/requirements-online.lock"

--no-index deliberately disables all indexes: requirements-online.lock names the
nine exact official files.pythonhosted.org HTTPS wheel URLs. Pip still downloads
those URLs, enforces their hashes and resolves the complete pinned closure.
No script download, source build, optional extras or implicit version selection.
The equivalent version/hash-only record is dependencies/requirements.lock; do
not mix the two files or add extras. PIP_CONFIG_FILE plus the clean environment
prevents local pip configuration/extra indexes from altering this operation.
Ordinary system CA verification stays enabled; never use --trusted-host or -k.
If HTTPS, a hash, tag, version or dependency check fails, preserve the failure
and STOP. Do not substitute a wheel/version or use a preexisting EZA environment.

5. ROOT: seal the runtime, verify its versions, and provision ONE fresh domain.

  sudo /usr/bin/python3 -I -B "$EZA_HOME/package/integration/setup_v1.py" seal \
    --config "$EZA_STATE/config.json"

This changes the runtime to root ownership/read-execute access, then runs the
runtime check and frozen one-time synthetic provisioner AS THE SERVICE UID.
It creates bound private principal/delegate contexts and principal journals.
The frozen fixture's synthetic authorization/validation records are not a claim
of separate human review. No old grants/domains are imported.
Never repeat seal after partial failure. Preserve all state and setup output;
request diagnosis rather than removing or repairing a failed domain.

Permissions created and used (every change is in the ROOT steps above):
  home/package + runtime: root-owned, directories 0755, readable code; callers
    cannot change the trusted code/runtime. Symlinks are checked at runtime seal.
  state + config: root-owned 0755 directory / 0644 mapping file.
  state/service: service-owned 0700; authority/witness inaccessible to callers.
  state/sockets: service-owned 0755; four socket files become caller-owned 0600.
  state/clients: root-owned 0755; each caller directory 0700 owned by that caller;
    contexts 0600, principal journals 0700 with immutable files created 0600.
  state/results: root-owned 0700; retains the independent operator's raw evidence.
The installer account is not a service/principal/delegate account and must not
be granted sudo access to those identities for untrusted agent processes.
The administrative operator uses sudo only for this explicitly authorized trial.

Continue with WALKTHROUGH.txt. Choose the full scripted acceptance first if a
complete PASS/FAIL result is desired: it requires an untouched revision-zero
trial domain. Manual steps consume lifetime slots and cannot be undone.
