ADR 0014 Organization Remote Image Build Contract

ADR 0014 Organization Remote Image Build Contract

Context

Project repositories independently assembled Buildx setup, registry login, cache, tags, scanning, and publication. GitHub-hosted builders produced cold caches, duplicated policy, and unnecessary cost. FractalOps already operates a shared Kubernetes BuildKit plane, but shared compute must not make application releases part of FractalOps.

Decision

1. yamonco/.github owns the reusable request workflow and organization workflow template. A project references only that versioned contract.
2. The project caller validates and dispatches a full default-branch commit, then exits. GitHub-hosted compute never builds, scans, or signs an image.
3. The backend repository owns the bounded FractalOps runner adapter and remote-project-image-executor.yml. Assembly owns the Kubernetes BuildKit desired state and integrated evidence.
4. Each project owns .fractalops/image-build.json, its source, image namespace, digest, lifecycle, and release decision.
5. The adapter derives image and cache destinations from source ownership. Caller selected destinations and FractalOps-prefixed project images are forbidden.
6. Project source is never executed on the runner. Dockerfile instructions execute only inside Kubernetes BuildKit, without project secrets, SSH, or installation tokens. There is no host-local or in-sandbox fallback.
7. Release fails closed unless default-branch ancestry, path confinement, digest-pinned bases, non-root runtime, provenance, SBOM, vulnerability scan, Cosign signature, digest verification, and immutable evidence all pass.
8. Results are reported to the source commit as yamon/remote-image/<profile>. FractalOps is build-provider provenance, not project identity or release authority.

Consequences

Projects remain independently owned and deployable while cache, scan, and signing work reuse the Kubernetes build plane. New repositories receive one organization caller instead of copied Buildx policy. A BuildKit or signing-plane outage blocks the release; it never silently shifts expensive work onto the host or GitHub runner.

Implementation Evidence

• Organization contract: yamonco/.github reusable request workflow.
• Backend adapter: .github/workflows/remote-project-image-executor.yml and ops/ci/project_image_build_* at backend revision 935d36f23fd326bf4047d832c15057cde4bd9580.
• Assembly authority: platform/k8s/apps/fractalops-build and this ADR.
• Project profile: .fractalops/image-build.json.
• Live authority proof: workflow run 29161611137 observed 99 assembly source refs, zero backend refs, and both root Applications as Synced and Healthy.

Revision History

• 2026-07-11: Accepted in the backend lineage as ADR-0011.
• 2026-07-11: Re-keyed as ADR-0014 when ADR authority moved to assembly; ownership boundary and implementation evidence preserved.