Initial draft of the image extension ADR

[magerstam]

Merge Checklist

All boxes should be checked before merging the PR

• The changes in the PR have been built and tested
• Documentation has been updated to reflect the changes (or no doc update needed)
• Ready to merge

Description

This PR adds an ADR defining the support boundary for extending existing image artifacts in ICT.

The ADR clarifies that RAW/VHD-style disk images can be supported as additive composition baselines, while arbitrary ISO installer mutation is intentionally out of scope. Disk image extension is framed around mounting and inspecting the baseline, adding repositories and packages, resolving dependencies, detecting conflicts, resizing where supported, regenerating boot artifacts, and validating the resulting image.

The ADR also distinguishes this from ICT’s existing ISO live installer flow. ICT-owned ISO installer behavior can continue to evolve through known internal contracts, but external ISO remastering should only be added through explicit, versioned adapters.

• Defines disk image extension as additive-only.
• Excludes package removal, filesystem conversion, partition table conversion, and arbitrary repartitioning.
• Clarifies that ISO installers are not generic mutable baselines.
• Preserves ICT-owned attended/unattended ISO installer support.
• Leaves room for future external ISO remastering through explicit adapters.
• Adds risks, mitigations, testing expectations, and schema direction for baseline/extension policy handling.

Any Newly Introduced Dependencies

How Has This Been Tested?

[Copilot]

Pull request overview

Adds a new Architecture Decision Record (ADR) to define ICT’s support boundaries for extending existing image artifacts—explicitly supporting additive extension of disk images (RAW/VHD-style) while treating generic mutation of arbitrary ISO installer media as out of scope unless implemented via explicit, versioned adapters.

Changes:

• Introduces an ADR describing supported vs. unsupported baseline extension behaviors (disk images vs. ISO installers).
• Proposes template/schema directions (baseline, extensionPolicy, validation) for expressing composition mode and extension policy.
• Documents scope, phased approach, risks/mitigations, and testing expectations for baseline extension.

[arodage]

any changes in CLI?

[magerstam]

any changes in CLI?

We could consider new options, but not sure if it is immediately required. A few things that comes to mind are:

• Validation inspection (on / off) (medium prio)
• CVE inspection useful overall, not just for this against the SBOM (medium prio)
• Overriding the baseline image provided in the template (low prio)

[arodage]

LGTM

[kblaszczak-intel]

ADR files do not require docs review but if an approval is needed, here it is ;)