[{"data":1,"prerenderedAt":798},["ShallowReactive",2],{"navigation":3,"\u002Fdevelopment\u002Fbuilds":250,"\u002Fdevelopment\u002Fbuilds-surround":793},[4,28,56,91,117,135,169,224],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Start here","\u002Fgetting-started","1.getting-started\u002F1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Decisions and open gates","\u002Fgetting-started\u002Fdecisions","1.getting-started\u002F2.decisions",{"title":16,"path":17,"stem":18},"Scope and non-goals","\u002Fgetting-started\u002Fscope","1.getting-started\u002F3.scope",{"title":20,"path":21,"stem":22},"Organization pilot","\u002Fgetting-started\u002Fpilot","1.getting-started\u002F4.pilot",{"title":24,"path":25,"stem":26},"Economics and quotas","\u002Fgetting-started\u002Feconomics","1.getting-started\u002F5.economics","i-lucide-compass",{"title":29,"path":30,"stem":31,"children":32,"icon":55},"Architecture","\u002Farchitecture","2.architecture\u002F1.index",[33,35,39,43,47,51],{"title":34,"path":30,"stem":31},"System architecture",{"title":36,"path":37,"stem":38},"Trust zones","\u002Farchitecture\u002Ftrust-zones","2.architecture\u002F2.trust-zones",{"title":40,"path":41,"stem":42},"Control plane","\u002Farchitecture\u002Fcontrol-plane","2.architecture\u002F3.control-plane",{"title":44,"path":45,"stem":46},"Organization tenancy","\u002Farchitecture\u002Ftenancy","2.architecture\u002F4.tenancy",{"title":48,"path":49,"stem":50},"Core data model","\u002Farchitecture\u002Fdata-model","2.architecture\u002F5.data-model",{"title":52,"path":53,"stem":54},"Codebase organization","\u002Farchitecture\u002Fcodebase","2.architecture\u002F6.codebase","i-lucide-layers",{"title":57,"icon":58,"path":59,"stem":60,"children":61,"page":90},"Identity and security","i-lucide-shield-check","\u002Fsecurity","3.security",[62,66,70,74,78,82,86],{"title":63,"path":64,"stem":65},"Identity and sessions","\u002Fsecurity\u002Fidentity","3.security\u002F1.identity",{"title":67,"path":68,"stem":69},"Domains and TLS","\u002Fsecurity\u002Fdomains","3.security\u002F2.domains",{"title":71,"path":72,"stem":73},"Ingress and egress","\u002Fsecurity\u002Fnetworking","3.security\u002F3.networking",{"title":75,"path":76,"stem":77},"Access policies and WAF-lite","\u002Fsecurity\u002Faccess-policies","3.security\u002F4.access-policies",{"title":79,"path":80,"stem":81},"Secrets and integrations","\u002Fsecurity\u002Fsecrets-integrations","3.security\u002F5.secrets-integrations",{"title":83,"path":84,"stem":85},"Governance and ownership","\u002Fsecurity\u002Fgovernance","3.security\u002F6.governance",{"title":87,"path":88,"stem":89},"Threat model","\u002Fsecurity\u002Fthreat-model","3.security\u002F7.threat-model",false,{"title":92,"icon":93,"path":94,"stem":95,"children":96,"page":90},"Building applications","i-lucide-code","\u002Fdevelopment","4.development",[97,101,105,109,113],{"title":98,"path":99,"stem":100},"AI and MCP","\u002Fdevelopment\u002Fai-mcp","4.development\u002F1.ai-mcp",{"title":102,"path":103,"stem":104},"Source control","\u002Fdevelopment\u002Fsource-control","4.development\u002F2.source-control",{"title":106,"path":107,"stem":108},"Sandboxed builds","\u002Fdevelopment\u002Fbuilds","4.development\u002F3.builds",{"title":110,"path":111,"stem":112},"Runtime contract and SDK","\u002Fdevelopment\u002Fruntime-contract","4.development\u002F4.runtime-contract",{"title":114,"path":115,"stem":116},"APIs and protocols","\u002Fdevelopment\u002Fapi","4.development\u002F5.api",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":90},"Runtime and delivery","i-lucide-rocket","\u002Fdelivery","5.delivery",[123,127,131],{"title":124,"path":125,"stem":126},"Runtime clusters and previews","\u002Fdelivery\u002Fruntime-clusters","5.delivery\u002F1.runtime-clusters",{"title":128,"path":129,"stem":130},"Deployments and approvals","\u002Fdelivery\u002Fdeployments","5.delivery\u002F2.deployments",{"title":132,"path":133,"stem":134},"Databases and recovery","\u002Fdelivery\u002Fdata-recovery","5.delivery\u002F3.data-recovery",{"title":136,"icon":137,"path":138,"stem":139,"children":140,"page":90},"Operations","i-lucide-activity","\u002Foperations","6.operations",[141,145,149,153,157,161,165],{"title":142,"path":143,"stem":144},"Observability and audit","\u002Foperations\u002Fobservability","6.operations\u002F1.observability",{"title":146,"path":147,"stem":148},"Operating model","\u002Foperations\u002Foperating-model","6.operations\u002F2.operating-model",{"title":150,"path":151,"stem":152},"Deploy and roll back","\u002Foperations\u002Fdeploy-rollback","6.operations\u002F3.deploy-rollback",{"title":154,"path":155,"stem":156},"Back up and restore","\u002Foperations\u002Fbackup-restore","6.operations\u002F4.backup-restore",{"title":158,"path":159,"stem":160},"Upgrade and patch","\u002Foperations\u002Fupgrades","6.operations\u002F5.upgrades",{"title":162,"path":163,"stem":164},"Rotate keys and credentials","\u002Foperations\u002Fkey-rotation","6.operations\u002F6.key-rotation",{"title":166,"path":167,"stem":168},"Incidents and access revocation","\u002Foperations\u002Fincidents","6.operations\u002F7.incidents",{"title":170,"path":171,"stem":172,"children":173,"icon":223},"Implementation plan","\u002Froadmap","7.roadmap\u002F01.index",[174,175,179,183,187,191,195,199,203,207,211,215,219],{"title":170,"path":171,"stem":172},{"title":176,"path":177,"stem":178},"Phase 0: architecture spikes and ADRs","\u002Froadmap\u002Fphase-0","7.roadmap\u002F02.phase-0",{"title":180,"path":181,"stem":182},"Phase 1: control-plane foundation","\u002Froadmap\u002Fphase-1","7.roadmap\u002F03.phase-1",{"title":184,"path":185,"stem":186},"Phase 2: managed source and change sets","\u002Froadmap\u002Fphase-2","7.roadmap\u002F04.phase-2",{"title":188,"path":189,"stem":190},"Phase 3: sandboxed build system","\u002Froadmap\u002Fphase-3","7.roadmap\u002F05.phase-3",{"title":192,"path":193,"stem":194},"Phase 4: runtime and data plane","\u002Froadmap\u002Fphase-4","7.roadmap\u002F06.phase-4",{"title":196,"path":197,"stem":198},"Phase 5: deployment, preview, migration, and recovery","\u002Froadmap\u002Fphase-5","7.roadmap\u002F07.phase-5",{"title":200,"path":201,"stem":202},"Phase 6: Entra identity and security policy","\u002Froadmap\u002Fphase-6","7.roadmap\u002F08.phase-6",{"title":204,"path":205,"stem":206},"Phase 7: MCP and AI-native workflow","\u002Froadmap\u002Fphase-7","7.roadmap\u002F09.phase-7",{"title":208,"path":209,"stem":210},"Phase 8: Pilot hardening","\u002Froadmap\u002Fphase-8","7.roadmap\u002F10.phase-8",{"title":212,"path":213,"stem":214},"Phase 9: developer hybrid and v1 GA","\u002Froadmap\u002Fphase-9","7.roadmap\u002F11.phase-9",{"title":216,"path":217,"stem":218},"Test strategy","\u002Froadmap\u002Ftesting","7.roadmap\u002F12.testing",{"title":220,"path":221,"stem":222},"Definition of done","\u002Froadmap\u002Fdefinition-of-done","7.roadmap\u002F13.definition-of-done","i-lucide-list-checks",{"title":225,"icon":226,"path":227,"stem":228,"children":229,"page":90},"Reference","i-lucide-book-open","\u002Freference","8.reference",[230,234,238,242,246],{"title":231,"path":232,"stem":233},"Plan coverage","\u002Freference\u002Fplan-coverage","8.reference\u002F1.plan-coverage",{"title":235,"path":236,"stem":237},"Decision register","\u002Freference\u002Fdecisions","8.reference\u002F2.decisions",{"title":239,"path":240,"stem":241},"Glossary","\u002Freference\u002Fglossary","8.reference\u002F3.glossary",{"title":243,"path":244,"stem":245},"Sources","\u002Freference\u002Fsources","8.reference\u002F4.sources",{"title":247,"path":248,"stem":249},"Contributing and docs access","\u002Freference\u002Fcontributing","8.reference\u002F5.contributing",{"id":251,"title":106,"body":252,"description":786,"extension":787,"links":788,"meta":789,"navigation":790,"path":107,"seo":791,"stem":108,"__hash__":792},"docs\u002F4.development\u002F3.builds.md",{"type":253,"value":254,"toc":775},"minimark",[255,271,276,279,290,297,301,304,341,344,350,353,356,382,386,389,423,426,430,433,436,456,459,463,469,472,476,479,732,735,739,742,745,748,752,755,759,771],[256,257,258],"note",{},[259,260,261,265,266,270],"p",{},[262,263,264],"strong",{},"v1 design baseline."," This page specifies intended behavior. Delivery and validation are tracked in the ",[267,268,269],"a",{"href":171},"implementation plan","; it is not a claim that the platform is already implemented.",[272,273,275],"h2",{"id":274},"build-input","Build input",[259,277,278],{},"Every build is tied to:",[280,281,287],"pre",{"className":282,"code":284,"language":285,"meta":286},[283],"language-text","organization\napplication\nenvironment target\nimmutable source revision\nruntime contract version\nbuilder image digest\nlockfile digest\n","text","",[288,289,284],"code",{"__ignoreMap":286},[259,291,292,293,296],{},"No build runs against a moving branch reference such as “whatever ",[288,294,295],{},"main"," is now.”",[272,298,300],{"id":299},"build-sandbox","Build sandbox",[259,302,303],{},"Each build runs in a disposable sandbox with:",[305,306,307,311,314,317,320,323,326,329,332,335,338],"ul",{},[308,309,310],"li",{},"Fresh filesystem",[308,312,313],{},"Fixed CPU and memory limits",[308,315,316],{},"Wall-clock timeout",[308,318,319],{},"No host mounts",[308,321,322],{},"No production secrets",[308,324,325],{},"No runtime database",[308,327,328],{},"No control-plane credentials",[308,330,331],{},"Restricted outbound networking",[308,333,334],{},"Read-only source token",[308,336,337],{},"One-time artifact upload credential",[308,339,340],{},"Destruction after completion",[259,342,343],{},"The target implementation is:",[280,345,348],{"className":346,"code":347,"language":285,"meta":286},[283],"Kubernetes Job\n    ↓\nKata\u002FFirecracker-style microVM RuntimeClass\n",[288,349,347],{"__ignoreMap":286},[259,351,352],{},"with gVisor as the fallback candidate if the chosen infrastructure cannot support the preferred KVM-backed model.",[259,354,355],{},"The Phase 0 sandbox bake-off must validate:",[305,357,358,361,364,367,370,373,376,379],{},[308,359,360],{},"Escape resistance model",[308,362,363],{},"Cold-start time",[308,365,366],{},"Nuxt build performance",[308,368,369],{},"Memory overhead",[308,371,372],{},"Network enforcement",[308,374,375],{},"Filesystem destruction",[308,377,378],{},"Operational upgrade process",[308,380,381],{},"Density\u002Fcost",[272,383,385],{"id":384},"supported-build-contract","Supported build contract",[259,387,388],{},"For intrnl-managed Nuxt apps:",[305,390,391,394,399,405,408,411,414,417,420],{},[308,392,393],{},"Supported Node version pinned by runtime contract",[308,395,396],{},[288,397,398],{},"pnpm",[308,400,401,402],{},"Frozen ",[288,403,404],{},"pnpm-lock.yaml",[308,406,407],{},"Fixed builder image",[308,409,410],{},"Standard build command",[308,412,413],{},"No arbitrary Dockerfile",[308,415,416],{},"No privileged build",[308,418,419],{},"No host socket",[308,421,422],{},"No nested container daemon",[259,424,425],{},"External Git apps must conform to a supported manifest rather than supplying arbitrary infrastructure.",[272,427,429],{"id":428},"package-installation","Package installation",[259,431,432],{},"Package installation should use a controlled npm proxy\u002Fcache.",[259,434,435],{},"Benefits:",[305,437,438,441,444,447,450,453],{},[308,439,440],{},"Reduced public registry dependency",[308,442,443],{},"Repeatability",[308,445,446],{},"Policy enforcement",[308,448,449],{},"Better observability",[308,451,452],{},"Ability to block known packages or sources",[308,454,455],{},"Reduced arbitrary egress during installation",[259,457,458],{},"Post-install scripts remain possible because ecosystem packages sometimes require them, but they execute only inside the disposable sandbox.",[272,460,462],{"id":461},"build-pipeline","Build pipeline",[280,464,467],{"className":465,"code":466,"language":285,"meta":286},[283],"1. Fetch exact source revision\n2. Validate repository structure\n3. Validate intrnl.config\n4. Verify supported runtime\u002Fframework version\n5. Install locked dependencies\n6. Generate dependency inventory\u002FSBOM\n7. Run secret scan\n8. Run dependency\u002Flicense\u002Fvulnerability policy\n9. Type-check\u002Flint as configured\n10. Run tests\n11. Analyze requested capabilities\n12. Analyze migrations\n13. Build Nuxt\u002FNitro Worker bundle\n14. Separate and hash static assets\n15. Run compatibility smoke test in workerd\n16. Create artifact manifest\n17. Sign artifact\n18. Upload artifact and reports\n19. Destroy sandbox\n",[288,468,466],{"__ignoreMap":286},[259,470,471],{},"Scanner findings feed policy; they do not automatically prove an application safe.",[272,473,475],{"id":474},"artifact-manifest","Artifact manifest",[259,477,478],{},"Each artifact records:",[280,480,484],{"className":481,"code":482,"language":483,"meta":286,"style":286},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"application_id\": \"app_01K...\",\n  \"source_revision\": \"def456...\",\n  \"runtime_contract\": \"2026-09-01\",\n  \"builder_image\": \"sha256:...\",\n  \"lockfile_digest\": \"sha256:...\",\n  \"worker_bundle_digest\": \"sha256:...\",\n  \"static_assets_digest\": \"sha256:...\",\n  \"migration_set_digest\": \"sha256:...\",\n  \"sbom_digest\": \"sha256:...\",\n  \"created_at\": \"...\",\n  \"signature\": \"...\"\n}\n","json",[288,485,486,495,523,544,565,586,606,626,646,666,686,707,726],{"__ignoreMap":286},[487,488,491],"span",{"class":489,"line":490},"line",1,[487,492,494],{"class":493},"sMK4o","{\n",[487,496,498,501,505,508,511,514,518,520],{"class":489,"line":497},2,[487,499,500],{"class":493},"  \"",[487,502,504],{"class":503},"spNyl","application_id",[487,506,507],{"class":493},"\"",[487,509,510],{"class":493},":",[487,512,513],{"class":493}," \"",[487,515,517],{"class":516},"sfazB","app_01K...",[487,519,507],{"class":493},[487,521,522],{"class":493},",\n",[487,524,526,528,531,533,535,537,540,542],{"class":489,"line":525},3,[487,527,500],{"class":493},[487,529,530],{"class":503},"source_revision",[487,532,507],{"class":493},[487,534,510],{"class":493},[487,536,513],{"class":493},[487,538,539],{"class":516},"def456...",[487,541,507],{"class":493},[487,543,522],{"class":493},[487,545,547,549,552,554,556,558,561,563],{"class":489,"line":546},4,[487,548,500],{"class":493},[487,550,551],{"class":503},"runtime_contract",[487,553,507],{"class":493},[487,555,510],{"class":493},[487,557,513],{"class":493},[487,559,560],{"class":516},"2026-09-01",[487,562,507],{"class":493},[487,564,522],{"class":493},[487,566,568,570,573,575,577,579,582,584],{"class":489,"line":567},5,[487,569,500],{"class":493},[487,571,572],{"class":503},"builder_image",[487,574,507],{"class":493},[487,576,510],{"class":493},[487,578,513],{"class":493},[487,580,581],{"class":516},"sha256:...",[487,583,507],{"class":493},[487,585,522],{"class":493},[487,587,589,591,594,596,598,600,602,604],{"class":489,"line":588},6,[487,590,500],{"class":493},[487,592,593],{"class":503},"lockfile_digest",[487,595,507],{"class":493},[487,597,510],{"class":493},[487,599,513],{"class":493},[487,601,581],{"class":516},[487,603,507],{"class":493},[487,605,522],{"class":493},[487,607,609,611,614,616,618,620,622,624],{"class":489,"line":608},7,[487,610,500],{"class":493},[487,612,613],{"class":503},"worker_bundle_digest",[487,615,507],{"class":493},[487,617,510],{"class":493},[487,619,513],{"class":493},[487,621,581],{"class":516},[487,623,507],{"class":493},[487,625,522],{"class":493},[487,627,629,631,634,636,638,640,642,644],{"class":489,"line":628},8,[487,630,500],{"class":493},[487,632,633],{"class":503},"static_assets_digest",[487,635,507],{"class":493},[487,637,510],{"class":493},[487,639,513],{"class":493},[487,641,581],{"class":516},[487,643,507],{"class":493},[487,645,522],{"class":493},[487,647,649,651,654,656,658,660,662,664],{"class":489,"line":648},9,[487,650,500],{"class":493},[487,652,653],{"class":503},"migration_set_digest",[487,655,507],{"class":493},[487,657,510],{"class":493},[487,659,513],{"class":493},[487,661,581],{"class":516},[487,663,507],{"class":493},[487,665,522],{"class":493},[487,667,669,671,674,676,678,680,682,684],{"class":489,"line":668},10,[487,670,500],{"class":493},[487,672,673],{"class":503},"sbom_digest",[487,675,507],{"class":493},[487,677,510],{"class":493},[487,679,513],{"class":493},[487,681,581],{"class":516},[487,683,507],{"class":493},[487,685,522],{"class":493},[487,687,689,691,694,696,698,700,703,705],{"class":489,"line":688},11,[487,690,500],{"class":493},[487,692,693],{"class":503},"created_at",[487,695,507],{"class":493},[487,697,510],{"class":493},[487,699,513],{"class":493},[487,701,702],{"class":516},"...",[487,704,507],{"class":493},[487,706,522],{"class":493},[487,708,710,712,715,717,719,721,723],{"class":489,"line":709},12,[487,711,500],{"class":493},[487,713,714],{"class":503},"signature",[487,716,507],{"class":493},[487,718,510],{"class":493},[487,720,513],{"class":493},[487,722,702],{"class":516},[487,724,725],{"class":493},"\"\n",[487,727,729],{"class":489,"line":728},13,[487,730,731],{"class":493},"}\n",[259,733,734],{},"The runtime verifies the manifest and signature before activation.",[272,736,738],{"id":737},"no-production-secrets-at-build-time","No production secrets at build time",[259,740,741],{},"Apps must not require secrets to compile.",[259,743,744],{},"Public build-time settings may be supplied through a separate non-secret configuration class.",[259,746,747],{},"Production credentials are attached only at runtime.",[272,749,751],{"id":750},"signing-trust-boundary","Signing trust boundary",[259,753,754],{},"The pipeline order does not grant the untrusted build process access to an artifact signing key. The trusted signing service must authorize and bind the manifest to the recorded build and source revision. Phase 0 must specify signing protocol, key custody, verification, and revocation behavior.",[272,756,758],{"id":757},"related-documentation","Related documentation",[305,760,761,766],{},[308,762,763],{},[267,764,765],{"href":111},"Runtime contract",[308,767,768],{},[267,769,770],{"href":129},"Deployments",[772,773,774],"style",{},"html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":286,"searchDepth":490,"depth":497,"links":776},[777,778,779,780,781,782,783,784,785],{"id":274,"depth":497,"text":275},{"id":299,"depth":497,"text":300},{"id":384,"depth":497,"text":385},{"id":428,"depth":497,"text":429},{"id":461,"depth":497,"text":462},{"id":474,"depth":497,"text":475},{"id":737,"depth":497,"text":738},{"id":750,"depth":497,"text":751},{"id":757,"depth":497,"text":758},"Immutable build inputs, dependency policy, disposable execution, and signed artifact provenance.","md",null,{},true,{"title":106,"description":786},"4XdgTZtKHsVJjJ8H6eiwtsQx5Z00pp8JGFhzxtbyVfY",[794,796],{"title":102,"path":103,"stem":104,"description":795,"children":-1},"Managed Forgejo repositories, change sets, GitHub canonical mode, and full-history transfer.",{"title":110,"path":111,"stem":112,"description":797,"children":-1},"The proposed Nuxt\u002Fworkerd contract, explicit bindings, compatibility versions, and SDK responsibilities.",1790019415367]