Stage 4

Each unit lives as packages/<name>/recipe.sh defining recipe_build and recipe_install, registered in sources.lock (name, version, HTTPS URL, SHA-256), dependencies.tsv (runtime and build dependencies) and recipe-requirements.tsv. Preflight checks those requirements against the chroot before any compiler runs, so missing capabilities are reported before work starts, not after.

One recipe may produce several outputs using the split convention: foo, foo-dev, foo-doc, modules and tools. Builds run out of tree where the build system supports it, install only into a staging destination, and never touch the running rootfs.

Audit rules reject payloads containing host trees, glibc interpreters, paths under /usr/lib64 or anything borrowed silently from outside. A package violating the layout policy fails; it is not corrected quietly.

Next: the final image, back to Stage 3, or the forge overview.