nordisk/edda

.nornir/assets/build-variants.svg

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1180 560" font-family="'DejaVu Sans', 'Segoe UI', sans-serif">
  <defs>
    <linearGradient id="board" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0" stop-color="#0b1c2e"/><stop offset="1" stop-color="#06111d"/>
    </linearGradient>
    <linearGradient id="chip" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0" stop-color="#14384f"/><stop offset="1" stop-color="#0e2a3e"/>
    </linearGradient>
    <linearGradient id="rail" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0" stop-color="#173d57"/><stop offset="1" stop-color="#0c2438"/>
    </linearGradient>
    <linearGradient id="slot" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0" stop-color="#123448"/><stop offset="1" stop-color="#0a2032"/>
    </linearGradient>
    <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
      <path d="M0 0 L10 5 L0 10 z" fill="#6fd3f5"/>
    </marker>
    <marker id="arrg" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
      <path d="M0 0 L10 5 L0 10 z" fill="#7CFFB2"/>
    </marker>
  </defs>

  <rect x="0" y="0" width="1180" height="560" fill="url(#board)"/>
  <g stroke="#143a52" stroke-width="1"><line x1="0" y1="82" x2="1180" y2="82"/><line x1="0" y1="516" x2="1180" y2="516"/></g>

  <text x="40" y="42" fill="#eaf6ff" font-size="22" font-weight="700">the build-thing</text>
  <text x="40" y="64" fill="#9fc9e0" font-size="14.5">declarative build <tspan fill="#bfe6ff">goals</tspan> &#8594; validated <tspan fill="#bfe6ff">variants</tspan> &#8594; content-addressed <tspan fill="#7CFFB2">provenance</tspan> &#183; one leaf crate <tspan font-family="'DejaVu Sans Mono', monospace" fill="#bfe6ff">nornir-build-thing</tspan></text>

  <g font-size="12.5">
    <line x1="820" y1="60" x2="860" y2="60" stroke="#7CFFB2" stroke-width="3" marker-end="url(#arrg)"/>
    <text x="868" y="64" fill="#cfe6f5">build / attest</text>
    <line x1="1000" y1="60" x2="1040" y2="60" stroke="#6fd3f5" stroke-width="3" marker-end="url(#arr)"/>
    <text x="1048" y="64" fill="#cfe6f5">render / read</text>
  </g>

  <!-- 1. declared goals -->
  <rect x="36" y="112" width="220" height="150" rx="12" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
  <text x="146" y="140" fill="#eaf6ff" font-size="14.5" font-weight="700" text-anchor="middle">declared goals</text>
  <text x="146" y="159" fill="#9fc9e0" font-size="10.5" text-anchor="middle">data, not a Makefile</text>
  <g font-family="'DejaVu Sans Mono', monospace">
    <rect x="54" y="174" width="184" height="24" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="146" y="190" fill="#bfe6ff" font-size="10" text-anchor="middle">[build] in nornir.toml</text>
    <rect x="54" y="204" width="184" height="24" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="146" y="220" fill="#bfe6ff" font-size="10" text-anchor="middle">build-variants.toml</text>
  </g>
  <text x="146" y="250" fill="#86b3cc" font-size="9.5" text-anchor="middle">embedded &#183; minimal &#183; full</text>

  <line x1="256" y1="187" x2="316" y2="187" stroke="#7CFFB2" stroke-width="3" marker-end="url(#arrg)"/>

  <!-- 2. variant set (validate) -->
  <rect x="322" y="112" width="248" height="150" rx="12" fill="url(#rail)" stroke="#7CFFB2" stroke-width="2.5"/>
  <text x="446" y="140" fill="#eaf6ff" font-size="14.5" font-weight="700" text-anchor="middle">BuildVariantSet</text>
  <text x="446" y="159" fill="#9fc9e0" font-size="10.5" text-anchor="middle">validate the chosen point</text>
  <g font-family="'DejaVu Sans Mono', monospace">
    <rect x="342" y="174" width="208" height="22" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="446" y="189" fill="#bfe6ff" font-size="9.5" text-anchor="middle">offers &#183; exclusive &#183; required</text>
    <rect x="342" y="202" width="208" height="22" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="446" y="217" fill="#7CFFB2" font-size="9.5" text-anchor="middle">cargo_args() &#8594; build -p --bin …</text>
  </g>
  <text x="446" y="250" fill="#86b3cc" font-size="9.5" text-anchor="middle">reject bad combos up front, not via cargo</text>

  <line x1="570" y1="187" x2="630" y2="187" stroke="#7CFFB2" stroke-width="3" marker-end="url(#arrg)"/>

  <!-- 3. cargo build -> artifacts -->
  <rect x="636" y="112" width="238" height="150" rx="12" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
  <text x="755" y="140" fill="#eaf6ff" font-size="14.5" font-weight="700" text-anchor="middle">cargo build</text>
  <text x="755" y="159" fill="#9fc9e0" font-size="10.5" text-anchor="middle">subprocess, --message-format=json</text>
  <rect x="656" y="176" width="198" height="26" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="755" y="193" fill="#bfe6ff" font-size="10" text-anchor="middle" font-family="'DejaVu Sans Mono', monospace">compiler-artifact executables</text>
  <text x="755" y="228" fill="#86b3cc" font-size="9.5" text-anchor="middle">three split executables from one tree</text>
  <text x="755" y="248" fill="#7fa8c4" font-size="9.5" text-anchor="middle">each artifact SHA-256 hashed</text>

  <!-- down to provenance -->
  <path d="M755 262 V296" stroke="#7CFFB2" stroke-width="3" fill="none" marker-end="url(#arrg)"/>

  <!-- 4. provenance / attestation -->
  <rect x="322" y="302" width="552" height="150" rx="12" fill="url(#rail)" stroke="#7CFFB2" stroke-width="2.5"/>
  <text x="598" y="330" fill="#eaf6ff" font-size="14.5" font-weight="700" text-anchor="middle">BuildProvenance &#8594; Attestation</text>
  <text x="598" y="349" fill="#9fc9e0" font-size="10.5" text-anchor="middle">what actually happened, folded to one canonical SHA-256 digest</text>
  <g font-family="'DejaVu Sans Mono', monospace" font-size="9.5">
    <rect x="342" y="364" width="126" height="24" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="405" y="380" fill="#bfe6ff" text-anchor="middle">variant + inputs</text>
    <rect x="474" y="364" width="126" height="24" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="537" y="380" fill="#bfe6ff" text-anchor="middle">toolchain + host</text>
    <rect x="606" y="364" width="126" height="24" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="669" y="380" fill="#bfe6ff" text-anchor="middle">vcs rev + dirty</text>
    <rect x="738" y="364" width="118" height="24" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="797" y="380" fill="#bfe6ff" text-anchor="middle">artifact hashes</text>
  </g>
  <text x="598" y="410" fill="#86b3cc" font-size="9.5" text-anchor="middle">digest binds the record; tampering breaks it</text>
  <text x="598" y="430" fill="#7fa8c4" font-size="9.5" text-anchor="middle">a fresh attestation is UNSEALED &#8212; no faked signature</text>

  <line x1="874" y1="377" x2="934" y2="377" stroke="#7CFFB2" stroke-width="3" marker-end="url(#arrg)"/>

  <!-- 5. seal + sinks -->
  <rect x="940" y="302" width="204" height="150" rx="12" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
  <text x="1042" y="330" fill="#eaf6ff" font-size="13.5" font-weight="700" text-anchor="middle">seal &amp; keep</text>
  <text x="1042" y="348" fill="#9fc9e0" font-size="10" text-anchor="middle">feature build-provenance</text>
  <rect x="958" y="360" width="168" height="22" rx="5" fill="url(#slot)" stroke="#7CFFB2" stroke-width="1.2"/><text x="1042" y="375" fill="#7CFFB2" font-size="9.5" text-anchor="middle">znippy CMS seal</text>
  <rect x="958" y="388" width="168" height="22" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="1042" y="403" fill="#bfe6ff" font-size="9.5" text-anchor="middle">warehouse ledger</text>
  <text x="1042" y="432" fill="#86b3cc" font-size="9" text-anchor="middle">+ .znippy beside the binary</text>

  <!-- surface tap (read side) -->
  <path d="M446 262 V196" stroke="none"/>
  <line x1="146" y1="302" x2="146" y2="360" stroke="#6fd3f5" stroke-width="2.5" fill="none" marker-end="url(#arr)"/>
  <rect x="36" y="302" width="220" height="150" rx="12" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
  <text x="146" y="330" fill="#eaf6ff" font-size="13.5" font-weight="700" text-anchor="middle">BuildSurface</text>
  <text x="146" y="349" fill="#9fc9e0" font-size="10" text-anchor="middle">the read-side view-model</text>
  <rect x="54" y="362" width="184" height="22" rx="5" fill="url(#slot)" stroke="#6fd3f5" stroke-width="1.2"/><text x="146" y="377" fill="#bfe6ff" font-size="9.5" text-anchor="middle" font-family="'DejaVu Sans Mono', monospace">state_json &#183; Build action</text>
  <text x="146" y="404" fill="#86b3cc" font-size="9.5" text-anchor="middle">CLI --json / viz tab / MCP</text>
  <text x="146" y="424" fill="#7fa8c4" font-size="9.5" text-anchor="middle">per-variant validity + reason</text>

  <!-- ground -->
  <rect x="36" y="466" width="1108" height="38" rx="10" fill="url(#rail)" stroke="#7fc8ea" stroke-width="2"/>
  <text x="58" y="490" fill="#bcd9ec" font-size="11">The descriptor holds the POSSIBLE build points; a provenance record captures what ONE materialized build produced &#8212; JFrog build-info / SLSA in one dep-light crate.</text>
</svg>