phoxal-bundle

Persisted runtime bundle contract for Phoxal.

phoxal-manifest compiles authored YAML/URDF into canonical source facts. Build tooling combines those facts with selected binaries and participant metadata to construct one [RuntimeDocument]. Runtime participant instances select reusable executable artifacts, so one staged binary can implement more than one component-bound process. BundleWriter streams those executable sources into a canonical executable mode and persists the document as runtime.json beside the indexed assets/ and supervisor-only bin/ trees. RuntimeBundle::open_verified validates the complete artifact and its schema, canonical model, participant set, artifact contracts, embedded config schemas, normalized paths, file sizes, and SHA-256 digests. BundleWriter assembles the bundle in a private sibling directory, verifies that candidate completely, and only then renames it onto its final name, so a target name is either absent or holds a complete bundle. An existing target is refused, so a build never modifies an installed bundle. A failed build removes its own staging directory.

The reader has no source-parser or catalog dependency. A supervisor or builder uses RuntimeBundle::open_verified to verify the complete installed artifact once: the layout admits exactly runtime.json, the indexed files below assets/ and bin/, and the directories those files need, and every indexed file is proven by size and digest as it is read. A participant uses ParticipantBundle::open to select one typed ParticipantId record before opening its bus; it checks participant assets lazily rather than re-hashing unrelated binaries, and receives one validated ParticipantRuntimeInputs value. Assets are logical and digest checked as they are read. Binaries are never reachable through ParticipantAssets, and no asset pathname API is exposed.