Portability starts with a stable thing to move. Presolve packages validated application semantics and immutable workload identity once, then evaluates that release against environments later.
Current .presolved format: 0.2.
orders.presolved
├── manifest.json
└── artifacts/
├── api.wasm
└── worker.wasmThe archive is deterministic tar. Component artifacts are embedded under artifacts/<workload>.wasm. Container workloads record immutable OCI descriptor identity rather than registry location, tags, credentials, or pull URLs.
The canonical manifest carries application identity.
| Included | Why it matters |
|---|---|
| application metadata + requirements | defines the portable application semantics |
| workload declarations | defines executable constituents |
| artifact path, digest, size, media type | binds Component bytes transitively into release identity |
| immutable OCI descriptor identity | binds container content without binding registry location |
| interfaces + relationships | preserves application-local topology |
Logical release identity is derived from canonical manifest bytes.
sha256:…| Change | Release identity |
|---|---|
| application semantics change | changes |
| embedded workload bytes change | changes transitively through artifact digest |
| OCI content descriptor changes | changes |
| environment/provider selection changes | must not change |
| re-encode same logical release | remains the same |
Presolve verifies both logical identity and exact archive bytes.
sha256:fa8cb59cf09dd5ed507d865fd4b739f6229e1422367bfe1f9afdfba6adc57c5e45e6f9dca20dce54337f34f403e772e510a1f6b6a333a44112d82c09af014344The first identifies the logical Presolve release. The second proves that the exact file passed through planning and execution did not mutate. Same-release proofs record both before environment selection and verify both afterward.
Deployment details are intentionally excluded.
- application requirements
- workload identity
- capability requirements
- resource/network intent
- application topology
- selected environment ID
- selected provider IDs
- deployment plan
- credentials/secrets
- endpoints, buckets, database paths
- registry locations and deployment placement
Components and containers participate differently.
The .wasm artifact is embedded in the archive. Its digest, size, and media type are recorded in the manifest.
The release records the immutable OCI image manifest/index descriptor. Registry hostname, repository, tag, credentials, and pull URL remain outside application identity.
Decoding revalidates the release.
The bundle decoder verifies supported format, safe paths, duplicate/unexpected entries, topology, artifact shape, embedded artifact presence, OCI descriptor form, artifact sizes/digests, and capability requirement structure. Malformed or adversarial archives are rejected before compatibility checks or execution.
presolve build
presolve inspect dist/orders.presolved
cd path/to/environment
presolve plan /absolute/path/to/dist/orders.presolvedThe last command evaluates the already-built release against the environment in the current directory. It does not rebuild the application.
Canonical bundle reference on GitHub ↗The invariant is executable.
KV, object storage, and SQL each have public same-release proofs. Queue has a detached-release capability proof with one provider and remains the next target for cross-provider substitution.
Explore all proofsDigests, provider matrices, commands, semantic differences, and explicit non-claims.