Artifact Manifest v1

Relevant source files (branch fix/adapter-pid-readiness; not on main)

Not on main. On main, inputs are supplied only through AXIOMOS_* environment variables and identified by SHA-256.

The axiomOS build producer emits one JSON manifest alongside its immutable artifacts. voln-vp validates and copies inputs; it never builds a guest or infers source identity from filenames. Select it with --artifact-manifest PATH or VOLN_VP_ARTIFACT_MANIFEST (the same contract; conflicting values fail before launch).


cargo run -- test --board virt --artifact-manifest /path/to/bundle/build.json
cargo run -- test --board virt-pi5 --artifact-manifest /path/to/pi5/build.json

Validation rules

All objects reject unknown and duplicate keys.
Paths are relative to the manifest directory, must resolve inside it, and must name regular files.
SHA-256 values are 64 lowercase hex characters. Byte counts are positive integers (not booleans); embedded offsets may be zero.
Source commits are full 40- or 64-character lowercase Git object IDs.

Top-level fields

Field	Contents
`schema_version`	Integer `1`
`source`	`repository`, `commit`, `dirty` (boolean); optional `submodules` mapping paths to full commit IDs
`build`	Strings `target`, `architecture`, `profile`, `board`, `toolchain`, `producer_id`; sorted array `features`
`artifacts`	Map of role to `path`, `size`, `sha256`
`rootfs`	External or embedded descriptor
`boot_contract`	String `axiomos-userspace-v1`

Supported profiles

Adapter board / backend	Guest board	Target / arch	Profile / exact features	Roles
`virt` / QEMU	`virt`	`aarch64-unknown-none` / `aarch64`	`release` / `["aarch64_arch", "cloud-profile", "virt"]`	`kernel`, `rootfs`
`virt-pi5` / Renode	`rpi5`	`aarch64-unknown-none` / `aarch64`	`release` / `["aarch64_arch", "embedded-profile", "embedded-rpi5", "rpi5"]`	`kernel`, `dtb`

features lists every enabled feature of the kernel package, including alias-implied ones, sorted, with default features disabled (checked against axiomOS b8953b593d5f3be2a15960aef24ccef0fc507ca3). A different feature set requires a reviewed contract change. x86_64 and RISC-V manifest profiles are unsupported; their manual inputs remain usable.

Rootfs descriptor

Generic virt:


{"storage": "external", "role": "rootfs"}

Pi: storage: "embedded", container: "kernel", integer offset and length, and sha256. The offset is a file byte offset in the ELF, not a guest address. The consumer verifies both the whole ELF and the exact embedded bytes. Compressed containers are unsupported. The kernel must have an ELF64 little-endian AArch64 header.

Boot contract `axiomos-userspace-v1`

Requires the literal UART milestone === axiomos eBPF init ===, no observed panic or boot fatal, and successful bounded adapter cleanup. It establishes only that observed milestone.

Producer responsibilities

Capture source commit and dirty state before building; record real features and toolchain; package matching kernel/rootfs/DTB together; hash final bytes; tie producer_id to retained build logs; include submodule identities; publish atomically. voln-vp does not retroactively attribute older binaries to a commit. Dirty bundles may be used for diagnosis but cannot establish qualification. This tranche makes no qualification claims, even for a clean, valid manifest.

Consumer behavior

Manifest mode rejects any ambient manual variable (AXIOMOS_KERNEL, AXIOMOS_DISK_IMAGE, AXIOMOS_ISO, AXIOMOS_OVMF_CODE, AXIOMOS_OVMF_VARS, VOLN_VP_DTB) and any conflicting architecture or diagnostic boot marker.
Manifest test rejects raw emulator arguments and QEMU semihosting; diagnostic run may accept raw arguments, without qualification.
Inputs are copied into the fresh run directory, revalidated there, and those private copies are passed to the emulator. manifest.json preserves the producer manifest; inputs.json records normalized staged paths and hashes.
--dry-run prints the manifest path marked (not validated) without reading it.