Choose the right artifact
Obtain the versioned TEST ONLY kit and its independent release/checksum record through the authorised handoff. A source export is for developers; a binary update archive alone omits fresh-install service inputs.
Open START-HERE.txt first. Verify the complete ZIP against the separate trusted handoff, then extract into a new directory as a normal user. Do not substitute an older similarly named kit.
Follow the kit's preparation block
The matching INSTALL.md checks SHA256SUMS and KIT-BINARY-SHA256.txt, then binds the selected archive to release-draft.json. Its preparation block requires exactly one matching regular archive; preserve those checks rather than choosing a filename manually.
The bundled packaging/prepare-bundle.py prepares the full installer bundle using the compiled panel payload. It obtains reviewed third-party service inputs from their upstream sources and checks the required hashes/signatures. This step needs the documented Python 3, reviewed gpgv and network access; it does not install services. No Go/Node compiler is needed for the binary-kit route.
Review the protected bundle
Use the documented root procedure to place the complete bundle at its protected path. Review every member, ownership/mode, absence of links and BUNDLE-SHA256SUMS against the independently retained digest for that exact prepared bundle before executing helpers.
The current manifests are unsigned integrity records. They detect changed bytes but do not by themselves authenticate a vendor or establish production signing acceptance. Retain required third-party notices and covered-source sidecars with the kit.