zerone-1 observer 20260909.2 — experimental Linux amd64

zerone-1-observer-20260909.2 — experimental legacy observer

Keep your own copy of the existing zerone-1 ledger with a separate Linux amd64 observer. This exact signed package passed fresh sync, retained-home restart, applied-root verification and three transaction-broadcast refusal checks.

Experimental legacy runtime: SDK 0.50 is end of life, and Go 1.25.14 is outside Go's two supported major versions after Go 1.27's release. The dated assessment retains 42 advisory IDs, including 11 exact function-name matches. These are not automatically exploitable findings; absent name matches do not establish safety. No current standard-library advisory was identified in this scan, which does not restore upstream support. The bootstrap window is not a production-security or long-term maintenance promise. A subsequent release needs review and reproduction on a maintained Go baseline.

Use Linux amd64, Python 3.11+, gpgv, local Docker, 2 available CPUs, 6 GiB available memory and 20 GiB free disk for an initial trial. Disk use grows. macOS, ARM and remote Docker are outside the tested platform.

Follow the source-pinned setup guide. Confirm the public authority fingerprint through an already trusted source:

09327B031F8FF2C2EE49B18F2234027FC5B68C19

Use tooling commit ed364bc0afec062612b61a309002f23da85acf2c to verify and unpack the archive, then verify the separate signed rehearsal receipt before init. Use a fresh dedicated home. RPC stays at 127.0.0.1:27657; REST/gRPC are disabled and the nop mempool refuses broadcasts. Raw local check_tx is not promised to be query-only.

Artifact	SHA-256
OBSERVER-RELEASE.json	1300f9381d2e290e1468075806734c586fd92e4df7d0ec55e2f7c7a858df7d92
observer-release.tar.gz — 43,975,496 bytes	5d874b4c38427117f1567ea0152fc4782e066e4926f3294f1eb776ff6ce22d08
REHEARSAL-RECEIPT.json	c99a1bac24b9ccc71a2769ce10d72f0a947eec8cb4b4afe9df22df2886c0ed0b
REHEARSAL-RECEIPT.json.sig	b6c47423166cff29731741b71e9e9a1d5e30820eab93a41c06f26a3fd8b8c56f
Packaged zeroned	d6391ea7e500425c898b6b98cb422f76a4262361d45452955182d9b92b743443

New bootstrap expires 2026-09-16 19:19:13 UTC. A successfully synced home can resume afterward with its original authenticated package; a fresh or unsynced home requires a current package.

The executable uses legacy application base 2e37c4c86c31e67515d6aa07b6fd406083e012ea plus the manifest-authenticated dependency patch, CometBFT 0.38.25 and Go 1.25.14. Two fresh-cache builds by the same operator matched. Build provenance remains pinned to 84a1f7304515b52da002ebd7e2da782b5aef1634; v2 changed the helper's empty-startup parsing and added maintenance disclosure. Original build VCS metadata remains absent. The running validator was unchanged.

GitHub's automatic “Source code” archives contain the modern tagged repository/tooling. Reproduce this legacy executable from the authenticated legacy-source.tar.gz and observer-dependencies.patch inside the observer archive, using the pinned build guide. Current main is not a drop-in live binary.

The native trial followed heights 1,262,486–1,262,488 and resumed the same home/identity through 1,262,496–1,262,498. Both phases had zero voting power, unused local signing state, all three nop broadcast refusals and clean exit 0 without OOM. Offline checks matched both applied roots to signed headers at H+1. The phases completed at 2026-09-09 23:28:52 and 23:33:51 UTC; the live executable and authority were checked unchanged at 23:35:17 UTC.

The main-signed receipt remains an operator attestation. These pair checks do not inspect the durable database, prove checkpoint ancestry or establish independent trust. The chain still relies on the disclosed sole validator; signer custody is unresolved and the RPC aliases share one upstream. This release grants no validator membership, account, funds, rewards, transaction admission or upgrade authority.

The release report preserves v1's failed, unpublished startup attempt, exact source/runtime evidence and a separate revalidation of earlier census commitments. Public-download and website checks are recorded separately.