Build inputs.
Reproducible build inputs start at request time. Bit-for-bit verification is a later milestone; the first release records the controls needed to support it.
Resolve input
Git branches resolve to an immutable commit. The inspector records direct download metadata, final URL, detected format, and pinned byte digest online. After review, a controlled extractor handles supported tar, zip, deb, rpm, AppImage, and .run inputs inside the isolated offline build; unsupported formats stop with a recorded reason.
Seal dependencies
The factory prefers Arch or omapkg packages where available. When vendoring is required, online verification creates a checksum-bound bundle and SBOM. The worker receives those bytes through the reviewed manifest.
Build offline
Arch devtools run in a disposable environment with network access disabled. The job records architecture, builder image digest, source date, recipe hash, source manifest, smoke tests, and output hashes.
Promote with evidence
Successful builds enter dev. Maintainers check quarantine time, smoke tests, crash evidence, and dependency readiness before making the promotion decision. Stable publication keeps older versions addressable for rollback.