# NEXT temporary contract 3.16 — Docker/OCI agent-image build capability {#root}

@status:impl/plan

[p01] @fact:NEXT-A16-SCOPE Temporary normative staging unit. Its body is the accepted architecture from refined plan revision 4, section 3.16. Before production code cites this law, promote the relevant clauses into permanent specifications. This file is consumed only after semantic coverage, implemented behavior and retained evidence are accepted. The task/retirement checker cannot perform semantic acceptance. @status:spec/done

[p02] @fact:NEXT-A16-U001 **D-021 required phase result:** the same environment definition drives both user profile delivery and an agent image. ImageDefinition selects an exact base image/platform, environment lock/profile, runtime user/home/workdir, explicit packages/config, ports/volumes/service bindings and entrypoint. Source context is a bounded declared capture, not a recursive upload of HOME/repository secrets. Build executor, target image and registry destination have separate identities. @status:spec/done

[p03] @fact:NEXT-A16-U002 Reuse existing build/package/deploy provider and artifact DAG for a BuildKit backend; no independent general build language/second scheduler. Lower the normalized image plan to a reviewable deterministic Dockerfile/build context or equivalent supported BuildKit graph. Generated representation must stay inspectable; machine API reports exact stage/input/output identities. A hand-authored opaque Dockerfile may be an explicit trusted escape hatch but cannot claim complete Vibe package inventory/effect/reproducibility guarantees without evidence. @status:spec/done

[p04] @fact:NEXT-A16-U003 First executable target: linux/amd64 under local Docker Desktop Linux engine. Architecture supports other targets through explicit capability negotiation; arm64 execution/QEMU/remote builders are not silently assumed. Runtime native extensions load only on their own executor platform. Linux binaries are built/installed/metadata-verified in Linux stages, not executed by the Windows control process. @status:spec/done

[p05] @fact:NEXT-A16-U004 Stages separate fetch/preparation, dependency/build tools, realization, verification and minimal runtime output. Build dependencies need not ship. Prepared exact sources/base layers/package closure permit a network-disabled replay once locally available. Cache is optional; mutable tags/repository URLs are resolved and captured before replay. Missing captures give unavailable, never hidden fetch in offline mode. BuildKit platform selection, OCI exporter and cache behavior are external capabilities to probe and record, not shipped Vibe functionality (E38–E40). @status:spec/done

[p06] @fact:NEXT-A16-U005 Runtime image includes installed tools/libraries, chosen four-client-compatible configuration, classified Vibe package/spec resources needed for boot, active profile, machine inventory and service catalog. Actual mandatory client support remains D-012; image tests must cover all four client configuration/launch contracts as separate selectable profiles, rather than baking every client into every image. No model subscription is needed to verify configuration and local command launch; live model inference stays optional and its absence explicit. Runtime starts as a non-root target user; build-only root use is separate. @status:spec/done

[p07] @fact:NEXT-A16-U006 Credentials are runtime bindings or explicit BuildKit secret/SSH mounts. Do not pass secrets as build arguments, copy user configuration/token stores, or persist secret values in generated context, layers, history, logs, provenance or cache exports. Runtime needs no Docker socket, broad host HOME mount or privileged container flag. Builder daemon is trusted execution infrastructure; this is not a claim that ordinary containers sandbox hostile native packages. Minimal runtime filesystem and network permissions are explicit deployment choices. @status:spec/done

[p08] @fact:NEXT-A16-U007 Image evidence distinguishes definition/lock, package inventory, normalized rootfs digest, OCI image config/layers/index and execution proof. Package closure equality is weaker than byte-identical image output. Reproducibility level is declared and measured: reproducible resolution; reproducible installed files/metadata; byte-reproducible OCI only after two independent cache-disabled builds yield equal exact declared OCI subjects: config, manifest/index and layer digests/bytes (and archive bytes if that archive is the claimed subject). Normalized rootfs equality proves only installed-content/metadata reproducibility. Declared normalization never excludes unexplained runtime payload changes; volatile execution logs/attestations are identified separately. Attestations/SBOM retained in exported OCI evidence when supported; unavailable retention is visible, not silently assumed. Local artifact export, loading for tests and registry push are separate effects; push uses M-07 current-A policy. @status:spec/done

[p09] @fact:NEXT-A16-U008 Rootfs population does not start host services or run target binaries on the wrong architecture. Service definitions may be emitted during build; startup/health run in the resulting isolated environment. Container cloning binds image-generation evidence to a new runtime instance; build-host absolute paths and live receipt IDs are not copied as authority over the new host. @status:spec/done

[p10] @fact:NEXT-A16-U009 Docker update/remove/rollback uses rebuilt immutable image generations: prepare a replacement from changed locked intent, start/verify the new target, then switch the explicitly managed local deployment; retain the previous image/config/runtime binding for rollback. Removing a package rebuilds the image from the remaining dependency closure; no claim that deleting it in one writable container layer removes it from the original image. Runtime volumes/databases survive replacement and removal unless separately included in an admitted data operation; image rollback does not roll back data schema/content. GC protects live containers, retained image generations, exported artifacts and recovery references. Cleanup is restricted to exact owned resource IDs, never global Docker prune. M-15-I proves replacement, failed startup rollback, package removal/rebuild and live-reference-safe image GC. @status:spec/done