Problem
Publish-time and retained-artifact malware blocks are correctly fail-closed and durable, but the current incident runbook's “update definitions and rescan” step cannot be completed after quarantine: installable metadata and objects are deliberately removed, and the tombstone prevents pkgx fallback from recreating them.
The Vault false-positive reproduction in #225 makes this an operational requirement, not a hypothetical edge case.
Outcome
Add a digest-bound, operator-only quarantine review workflow that scans the private quarantined object with current definitions and:
- keeps it quarantined on any blocked/error/review result;
- restores installable objects and clean attestations only after a fresh
cleanverdict; - atomically publishes metadata last;
- preserves the original quarantine bytes and evidence for audit;
- removes only the exact reviewed tombstone;
- works with isolated external ClamAV runners in production;
- never depends on the legacy migration cutoff and never accepts a digest mismatch.
Acceptance criteria
- Private tombstones retain the quarantine object identity needed for future reviews.
- Existing tombstones created before that field can be reviewed with an explicit validated filename.
- Prepare/attest APIs are operator-only and bind domain, version, digest, size, object identity, and quarantine key.
- A blocked rescan updates review evidence and exposes zero installable bytes.
- A clean rescan copies bytes and sidecars first, writes metadata last, and removes only the matching tombstone.
- A stale or changed quarantine object is rejected.
- The hosted workflow and CLI provide a manual, reusable review path.
- Tests and the incident runbook cover release and non-release behavior.
Refs #220
Refs #224
Refs #225