Build Camino packages from explicit contract inputs

Project source-free capability contracts and keep exact source provenance in package assembly. Reuse compiled groups across unrelated graph and dependency implementation edits. Keep React public inputs separate from workspace query lowering and retain explicit type-companion dependencies.

Allow independent execution-package checks, scope resource compilation to declared dependencies, and memoize source closure traversal. Document generic-specialization limits and measured Reader rebuild behavior.

Verified protocol, artifact, package, React, and managed activation checks; retained-Git independent/workspace artifact equality and incompatible type dependency rejection; nix fmt -- --check and lint. One-off Reader measurements recompiled 1 of 13 groups for a child edit and 0 for a workspace QX default edit.

src/capability-language/execution-scaffold.ts

@@ -80,9 +80,8 @@ export async function executionScaffold(
       devShells.default = (import (helpers + "/quixos-package-helpers.nix")).mkCaminoYarnShell { inherit pkgs; };
       quixosPackages.checkedArtifacts = context:
 let
-  plan = builtins.fromJSON (builtins.readFile context.plan);
-  package = pkgs.lib.findFirst (entry: entry.revision == context.packageRevisionId)
-    (throw "Package missing from checked plan") plan.definition.packages;
+  contract = builtins.fromJSON (builtins.readFile context.buildContract);
+  package = contract.definition.package;
   portable = builtins.filter (entry: entry.execution.kind != "remote") package.exports;
   remote = builtins.filter (entry: entry.execution.kind == "remote") package.exports;
   modules = import ./components.nix;
@@ -107,7 +106,7 @@ in camino.assembleCaminoPackage {
     );
     create(
       "README.md",
-      `# ${spec.name}\n\nThis execution package exports checked browser/server modules and a process service.\nUse scaffold function with an explicit execution contract to add a typed handler.\nSnapshot/transaction targets choose browser.ts and/or server.ts; remote handlers\nuse remote.ts. Shared helpers are ordinary imports. Generated bindings are build\noutputs, not authored source. The coordinator supplies the checked workspace plan\nand runtime dependencies to checkedArtifacts.\n\nRun qx-workspace check from the workspace root to compile exact source and build\nchecked artifacts. Activate the resulting report separately through the workspace\nhost. A source-only structural check is not runtime qualification.\n`,
+      `# ${spec.name}\n\nThis execution package exports checked browser/server modules and a process service.\nUse scaffold function with an explicit execution contract to add a typed handler.\nSnapshot/transaction targets choose browser.ts and/or server.ts; remote handlers\nuse remote.ts. Shared helpers are ordinary imports. Generated bindings are build\noutputs, not authored source. The Nix composition supplies the canonical package contract\nand explicit runtime dependencies to checkedArtifacts.\n\nRun qx-workspace check from this package to build it independently, or from a\nworkspace to also check installed bindings. Activate the resulting report separately through the workspace\nhost. A source-only structural check is not runtime qualification.\n`,
     );
   } else if (command === "function") {
     if (!spec.declaration)

src/capability-language/structural-plan.ts

@@ -168,8 +168,8 @@ export const planStructure = async (rootPath: string, request: StructuralRequest
         });
         if (compiled.resource.kind === "package") {
           const configuration = JSON.parse(await fs.readFile(path.join(resourceRoot, "quixos.check.json"), "utf8"));
-          // Execution bindings require the complete workspace plan and are owned
-          // by checkedArtifacts, not a package-only structural preview.
+          // Execution bindings are immutable build outputs owned by checkedArtifacts,
+          // not source edits produced by a structural preview.
           const artifacts =
             configuration.backend === "execution"
               ? []

src/capability-language/workspace-cli.ts

@@ -5,7 +5,7 @@ import process from "node:process";
 import { compileWorkspaceRepository } from "./assembly.js";
 import { createGitCapabilityResolver } from "./git-resolver.js";
 import { loadQueryGenerator } from "./query-generator.js";
-import { compileExecutionPlan } from "../execution-world/index.js";
+import { compileExecutionPlan, packageBuildContexts } from "../execution-world/index.js";
 import { bindingSchema, specializeBindingSchema } from "../bindings/index.js";
 import {
   planEvolution,
@@ -17,7 +17,7 @@ import {
 const usage = `usage: quixos-workspace-compile --root DIRECTORY --checkout-root DIRECTORY
        [--snapshot-map PATH] [--graph-out PATH] [--workspace-id ID] [--workspace-revision-id ID]
        [--source-root-commit GIT_REV] [--baseline PLAN_JSON] [--evolution-out PATH]
-       [--reviews REVIEW_JSON] [--schemas-out PATH] [--execution-plan-out PATH]
+       [--reviews REVIEW_JSON] [--schemas-out PATH] [--execution-plan-out PATH] [--build-contexts-out PATH]
        [--query-generator BUILD_MODULE_PATH]
 
 Resolves a workspace's recursive resource-lock graph, clones every exact
@@ -41,6 +41,7 @@ const parseArgs = (args: string[]) => {
     graphOut: values.get("--graph-out"),
     schemasOut: values.get("--schemas-out"),
     executionPlanOut: values.get("--execution-plan-out"),
+    buildContextsOut: values.get("--build-contexts-out"),
     snapshotMap: values.get("--snapshot-map"),
     workspaceId: values.get("--workspace-id"),
     workspaceRevisionId: values.get("--workspace-revision-id"),
@@ -108,11 +109,11 @@ const main = async () => {
     );
   }
   const candidate = { ...assembled.workspace, executionContracts: runtimeContracts(assembled.workspace) };
-  if (options.executionPlanOut) {
-    await writeFile(
-      options.executionPlanOut,
-      `${JSON.stringify(compileExecutionPlan(assembled.workspace), null, 2)}\n`,
-    );
+  if (options.executionPlanOut || options.buildContextsOut) {
+    const plan = compileExecutionPlan(assembled.workspace);
+    if (options.executionPlanOut) await writeFile(options.executionPlanOut, `${JSON.stringify(plan, null, 2)}\n`);
+    if (options.buildContextsOut)
+      await writeFile(options.buildContextsOut, JSON.stringify(packageBuildContexts(plan.definition.bindingSchema)));
   }
   if (options.schemasOut) {
     const schemas: Record<string, unknown> = {};