Build & Capsules

Two steps: build, then seal

The public build is closed-world. It reads only the normalized application files, the source crisptastic.toml, and the compiler tables shipped with the binary. It must not read process environment values, local secret files, network resources, the current time, Git state or machine-specific paths.

Deployment assembly is a separate outer step. It reads only the variables named by [env] and [env_from_process], puts their values in a distinct secure section, removes those tables from the public manifest copy, and encrypts the complete deployment Capsule to the target server's key.

The build pipeline

discover
→ normalize paths and source bytes
→ parse manifest
→ map and validate routes
→ resolve the include graph
→ compile programs
→ compile and collect assets
→ validate capability references
→ normalize the manifest
→ construct the canonical bundle
→ encode deterministic CBOR
→ sign with COSE Sign1
→ wrap in Capsule framing

Each phase returns stable diagnostics; a failed phase writes no output. Output uses same-directory temp files, fsync, and atomic rename.

Reproducibility

Two builds with the same build identity and normalized inputs produce identical unsigned bundle bytes. That requires lexicographic path ordering, canonical CBOR, deterministic map ordering, LF-normalized embedded source, and no timestamps, absolute paths or machine metadata in the semantic payload. Provenance is a detached, optional signed statement keyed by the bundle digest.

Identity

• The public bundle is identified by its content digest.
• The archived deployment Capsule is identified by the SHA-256 of its ciphertext. That digest is the reference passed in management messages, and the object-store key is derived from it.
• At unpack, the runtime assigns a fresh UUID for the deployment directory.

Secrets never land on disk

After authenticated decryption and full validation: public files extract atomically to the deployment directory; secure variables move directly into a tenant-scoped, non-serializable memory generation; no secure value is written to the deployment directory, temp files, logs, registries or telemetry; and a domain is not routable until files, runtime and secret generation are all ready.

Losing volatile secret state is a deliberate property — recovery requires reinjection.

Inspecting an artifact

A built artifact can be listed — routes, assets, normalized manifest — without decrypting or revealing any secure-variable value.