# Build and artifacts

Build turns one locked physical plan into exact per-root artifacts without
reselecting meaning, providers, or authority.

## Action IR

A-IR materializes the sources, dependencies, toolchains, generated bindings,
compiler invocations, packaging, signing, and inspection actions required by
P-IR.

Action identity commits every canonical input that can affect output.
Containing-file paths and refreshable diagnostic maps do not poison a build
cache when the exact selected body and dependency closure are unchanged.

## Hermeticity is visible

Build actions declare filesystem, environment, network, clock, process,
secret, toolchain, and platform requirements. Undeclared host access fails.

An action that cannot be fully hermetic records the exact weaker grade,
facilities, observations, and reproducibility consequences.

## Source-language builds

Native One and foreign executable sections use their exact selected compiler
or toolchain. Build rechecks:

- entry and helper body digests;
- source-language and implementation-profile revisions;
- expected OCS bindings and analysis receipt;
- package dependencies and configuration;
- target applicability and physical selection;
- tool admission, sandbox, and artifact evidence.

Compilation cannot add requirements to R-IR or execute an application
operation.

## Artifacts are content addressed

Artifacts record digest, type, target, source closure, action, toolchain,
dependencies, generated projections, SBOM, signatures, inspection,
conformance, and provenance.

A generated manifest is a receipted physical projection. It is not semantic
authority or proof that deployment converged.

## First native-One target

The recommended first slice is a typed contract function compiled into a
WebAssembly component. WIT is derived from the exact OCS contract with
fingerprints and exhaustive dispositions. An unsupported contract feature
fails instead of being weakened.

Canonical owner:
[Build](https://github.com/muijf/one/blob/main/systems/build/AGENTS.md).