# ADR-0010: Immutable, explicitly approved download plans

## Status

Accepted — 2026-08-25

## Decision

A download is derived from an immutable exact commit and selected file inventory. Its canonical
payload, target, expected bytes/checksums, preflights, expiry and idempotency hash cannot change.
Plan creation and approval are separate actions. Mutable refs and stale/unapproved plans cannot
execute.

## Consequences

Operators review the precise transfer before bytes move; retries reuse the same intent; upstream
movement requires a new revision and plan; duplicate execution resolves to one job.