From 9d2348c460ae2b947781f7361bcc6a78dde2e373 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Thu, 29 Oct 2026 11:04:19 -0400
Subject: [PATCH 1/3] feat(builder): negotiate immutable environment image
 bindings

---
 agents/contract/contract.json                 |   2 +-
 agents/services/build_images.go               | 102 ++++++++++
 agents/services/build_images_test.go          |  58 ++++++
 agents/services/builder.go                    |  13 ++
 docs/agent-contract.md                        |   8 +
 docs/build-image-bindings.md                  |  35 ++++
 .../codefly/services/builder/v0/builder.pb.go |  96 ++++++----
 .../codefly/services/builder/v0/docker.pb.go  | 178 +++++++++++++-----
 .../services/builder/v0/builder_pb2.py        |  22 +--
 .../codefly/services/builder/v0/docker_pb2.py |  46 ++---
 .../codefly/services/builder/v0/builder.proto |   4 +
 .../codefly/services/builder/v0/docker.proto  |  18 ++
 12 files changed, 461 insertions(+), 121 deletions(-)
 create mode 100644 agents/services/build_images.go
 create mode 100644 agents/services/build_images_test.go
 create mode 100644 docs/build-image-bindings.md

diff --git a/agents/contract/contract.json b/agents/contract/contract.json
index 4c4d3086..ad0a641e 100644
--- a/agents/contract/contract.json
+++ b/agents/contract/contract.json
@@ -2,5 +2,5 @@
   "protocolVersion": 1,
   "capabilities": ["container-recovery-scope/v1"],
   "startupProtocolVersion": 2,
-  "operationContracts": ["artifact-execution/v1", "runtime-init-dependency-mappings/v1", "codefly.dev/docker-build-recipe/v4", "codefly.dev/docker-build-recipe/v5", "codefly.dev/docker-build-recipe/v6", "configuration-value-template/v1", "runtime-init-image/v1", "deployment-composition-provenance/v1", "runtime-started-artifact/v1", "runtime-backend-declaration/v1"]
+  "operationContracts": ["base-image-bindings/v1", "artifact-execution/v1", "runtime-init-dependency-mappings/v1", "codefly.dev/docker-build-recipe/v4", "codefly.dev/docker-build-recipe/v5", "codefly.dev/docker-build-recipe/v6", "configuration-value-template/v1", "runtime-init-image/v1", "deployment-composition-provenance/v1", "runtime-started-artifact/v1", "runtime-backend-declaration/v1"]
 }
diff --git a/agents/services/build_images.go b/agents/services/build_images.go
new file mode 100644
index 00000000..500f3b3e
--- /dev/null
+++ b/agents/services/build_images.go
@@ -0,0 +1,102 @@
+package services
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+
+	builderv0 "github.com/codefly-dev/core/generated/go/codefly/services/builder/v0"
+	"github.com/distribution/reference"
+	"google.golang.org/protobuf/proto"
+)
+
+// BuildImageBindingsContract requires the agent to declare its loaded service's
+// image inputs and render every selected binding into its verified recipe.
+// Merely compiling the transport does not implement this operation contract.
+const BuildImageBindingsContract = "base-image-bindings/v1"
+
+var imageRoleName = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
+
+// ValidateBuildImageInput rejects ambiguous or mutable image bindings. The
+// variant is an agent-owned compatibility declaration, not a host-side roster.
+func ValidateBuildImageInput(input *builderv0.BuildImageInput) error {
+	if input == nil || !imageRoleName.MatchString(input.GetRole()) {
+		return fmt.Errorf("image input requires a lowercase role name")
+	}
+	if input.Variant == "" || strings.TrimSpace(input.Variant) != input.Variant {
+		return fmt.Errorf("image role %q requires an explicit recipe variant", input.Role)
+	}
+	if input.Reference == "scratch" {
+		return nil
+	}
+	named, err := reference.ParseNormalizedNamed(input.Reference)
+	if err != nil {
+		return fmt.Errorf("image role %q: invalid reference: %w", input.Role, err)
+	}
+	digested, ok := named.(reference.Digested)
+	if !ok || digested.Digest().Algorithm().String() != "sha256" || digested.Digest().Validate() != nil {
+		return fmt.Errorf("image role %q requires a sha256-pinned reference", input.Role)
+	}
+	if !strings.HasPrefix(input.Reference, reference.Domain(named)+"/") {
+		return fmt.Errorf("image role %q requires a fully qualified registry reference", input.Role)
+	}
+	return nil
+}
+
+// ResolveBuildImages validates bindings against the agent's declared recipe
+// inputs. Missing bindings retain defaults; unknown roles, duplicate roles and
+// unsupported variants refuse. The result owns its messages and preserves the
+// agent's declaration order. Consumers render only from this result.
+func ResolveBuildImages(defaults, bindings []*builderv0.BuildImageInput) ([]*builderv0.BuildImageInput, error) {
+	result := make([]*builderv0.BuildImageInput, 0, len(defaults))
+	indices := make(map[string]int, len(defaults))
+	for _, input := range defaults {
+		if err := ValidateBuildImageInput(input); err != nil {
+			return nil, err
+		}
+		if _, exists := indices[input.Role]; exists {
+			return nil, fmt.Errorf("duplicate declared image role %q", input.Role)
+		}
+		indices[input.Role] = len(result)
+		result = append(result, proto.CloneOf(input))
+	}
+	seen := make(map[string]bool, len(bindings))
+	for _, input := range bindings {
+		if err := ValidateBuildImageInput(input); err != nil {
+			return nil, err
+		}
+		i, exists := indices[input.Role]
+		if !exists {
+			return nil, fmt.Errorf("unsupported image role %q", input.Role)
+		}
+		if seen[input.Role] {
+			return nil, fmt.Errorf("duplicate image binding %q", input.Role)
+		}
+		seen[input.Role] = true
+		if input.Variant != result[i].Variant {
+			return nil, fmt.Errorf("image role %q: unsupported recipe variant %q; this service requires %q", input.Role, input.Variant, result[i].Variant)
+		}
+		// scratch is a built-in empty filesystem, not a registry image. Replacing
+		// it changes the recipe contract even if a caller copies the variant name.
+		if (input.Reference == "scratch") != (result[i].Reference == "scratch") {
+			return nil, fmt.Errorf("image role %q cannot substitute scratch and a registry image", input.Role)
+		}
+		result[i] = proto.CloneOf(input)
+	}
+	return result, nil
+}
+
+// RequireBuildImageBindings holds an opt-in request to the running executor's
+// advertisement. A known agent name, library version or generated getter is
+// never evidence that an executor implements the operation.
+func RequireBuildImageBindings(capabilities *builderv0.BuildCapabilitiesResponse) error {
+	if !slices.Contains(capabilities.GetExecutionContracts(), BuildImageBindingsContract) {
+		return fmt.Errorf("builder must advertise %s to select environment image bindings", BuildImageBindingsContract)
+	}
+	if len(capabilities.GetImageInputs()) == 0 {
+		return fmt.Errorf("builder advertises %s but declares no image inputs", BuildImageBindingsContract)
+	}
+	_, err := ResolveBuildImages(capabilities.ImageInputs, nil)
+	return err
+}
diff --git a/agents/services/build_images_test.go b/agents/services/build_images_test.go
new file mode 100644
index 00000000..2391f868
--- /dev/null
+++ b/agents/services/build_images_test.go
@@ -0,0 +1,58 @@
+package services
+
+import (
+	builderv0 "github.com/codefly-dev/core/generated/go/codefly/services/builder/v0"
+	"github.com/stretchr/testify/require"
+	"strings"
+	"testing"
+)
+
+func testImage(role, ref, variant string) *builderv0.BuildImageInput {
+	return &builderv0.BuildImageInput{Role: role, Reference: ref, Variant: variant}
+}
+
+// The recipe owns compatibility, even when a caller selects another registry
+// or a different digest. A selection must never silently become the default.
+func TestBuildImageBindingsRefuseIncompatibleOrAmbiguousSelections(t *testing.T) {
+	ref := "docker.io/library/alpine@sha256:" + strings.Repeat("a", 64)
+	defaults := []*builderv0.BuildImageInput{testImage("runtime", ref, "alpine3.23-musl"), testImage("empty", "scratch", "scratch")}
+	for _, tc := range []struct {
+		name     string
+		bindings []*builderv0.BuildImageInput
+		refusal  string
+	}{
+		{"unknown", []*builderv0.BuildImageInput{testImage("typo", ref, "alpine3.23-musl")}, "unsupported image role"},
+		{"variant", []*builderv0.BuildImageInput{testImage("runtime", ref, "debian-glibc")}, "unsupported recipe variant"},
+		{"mutable", []*builderv0.BuildImageInput{testImage("runtime", "docker.io/library/alpine:3.23", "alpine3.23-musl")}, "sha256-pinned"},
+		{"implicit-registry", []*builderv0.BuildImageInput{testImage("runtime", "alpine@sha256:"+strings.Repeat("a", 64), "alpine3.23-musl")}, "fully qualified"},
+		{"scratch", []*builderv0.BuildImageInput{testImage("runtime", "scratch", "alpine3.23-musl")}, "cannot substitute scratch"},
+		{"duplicate", []*builderv0.BuildImageInput{defaults[0], defaults[0]}, "duplicate image binding"},
+		{"nil", []*builderv0.BuildImageInput{nil}, "role name"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := ResolveBuildImages(defaults, tc.bindings)
+			require.ErrorContains(t, err, tc.refusal)
+		})
+	}
+	selected := testImage("runtime", "registry.example/approved/alpine@sha256:"+strings.Repeat("b", 64), "alpine3.23-musl")
+	actual, err := ResolveBuildImages(defaults, []*builderv0.BuildImageInput{selected})
+	require.NoError(t, err)
+	require.Equal(t, selected.Reference, actual[0].Reference)
+	require.Equal(t, "scratch", actual[1].Reference)
+	actual[0].Reference = "mutated"
+	actual[1].Reference = "mutated"
+	require.Contains(t, selected.Reference, "registry.example")
+	require.Equal(t, "scratch", defaults[1].Reference)
+	_, err = ResolveBuildImages(append(defaults, defaults[0]), nil)
+	require.ErrorContains(t, err, "duplicate declared")
+}
+
+// Capability is an explicit executor promise, never inferred from a known
+// agent name, an image declaration alone or a new library version.
+func TestBuildImageBindingsRequireExplicitExecutorContract(t *testing.T) {
+	input := testImage("runtime", "scratch", "scratch")
+	require.Error(t, RequireBuildImageBindings(nil))
+	require.Error(t, RequireBuildImageBindings(&builderv0.BuildCapabilitiesResponse{ImageInputs: []*builderv0.BuildImageInput{input}}))
+	require.ErrorContains(t, RequireBuildImageBindings(&builderv0.BuildCapabilitiesResponse{ExecutionContracts: []string{BuildImageBindingsContract}}), "no image inputs")
+	require.NoError(t, RequireBuildImageBindings(&builderv0.BuildCapabilitiesResponse{ExecutionContracts: []string{"unknown-contract/v99", BuildImageBindingsContract}, ImageInputs: []*builderv0.BuildImageInput{input}}))
+}
diff --git a/agents/services/builder.go b/agents/services/builder.go
index 61135140..b9c295de 100644
--- a/agents/services/builder.go
+++ b/agents/services/builder.go
@@ -45,6 +45,19 @@ func (b *BuilderAgent) Build(ctx context.Context, req *builderv0.BuildRequest, o
 		}
 	}
 	selected := req.GetBuildContext().GetDockerBuildContext().GetBuildxBuilder()
+	bindings := req.GetBuildContext().GetDockerBuildContext().GetImageBindings()
+	if len(bindings) > 0 {
+		capabilities, err := b.BuildCapabilities(ctx, &builderv0.BuildCapabilitiesRequest{}, opts...)
+		if err != nil {
+			return nil, fmt.Errorf("cannot verify image binding support before execution: %w", err)
+		}
+		if err = RequireBuildImageBindings(capabilities); err != nil {
+			return nil, err
+		}
+		if _, err = ResolveBuildImages(capabilities.GetImageInputs(), bindings); err != nil {
+			return nil, err
+		}
+	}
 	if selected != "" {
 		capabilities, err := b.BuildCapabilities(ctx, &builderv0.BuildCapabilitiesRequest{}, opts...)
 		if err != nil {
diff --git a/docs/agent-contract.md b/docs/agent-contract.md
index 87920ab5..69d0757c 100644
--- a/docs/agent-contract.md
+++ b/docs/agent-contract.md
@@ -433,3 +433,11 @@ that service before admitting the replacement. Identical bytes remain reusable
 after atomic reinstallation. Startup also rejects a concurrently replaced
 executable before publishing the connection. These checks do not establish
 publisher authority or qualify a rebuilt runtime output.
+
+## Environment image selection
+
+`base-image-bindings/v1` is an optional builder operation: the running agent
+advertises its loaded service's image roles and recipe variants, validates
+selected immutable bindings and renders them into its recipe. See
+[environment image bindings](build-image-bindings.md). Callers selecting this
+policy require the live advertisement; unconfigured builds remain unchanged.
diff --git a/docs/build-image-bindings.md b/docs/build-image-bindings.md
new file mode 100644
index 00000000..c4bcd6a8
--- /dev/null
+++ b/docs/build-image-bindings.md
@@ -0,0 +1,35 @@
+# Environment image bindings
+
+An environment can select immutable images for roles declared by a service's
+running builder agent. This is the image-selection portion of customer build
+policy; it does not implement package-source restrictions, dependency adaptation,
+network isolation or universal vulnerability clearance.
+
+The optional `base-image-bindings/v1` operation uses the existing
+`BuildCapabilities` and `Build` RPCs. `BuildCapabilities.image_inputs` declares
+unique roles, default fully qualified sha256-pinned references and agent-owned
+recipe variants for the loaded service. A role can name `scratch`. Declarations
+must reflect the service's CGO, native library and runtime package requirements.
+Generated bindings alone do not advertise implementation.
+
+The CLI resolves environment defaults, service-type selections and explicit
+service selections into `DockerBuildContext.image_bindings`. A replacement names
+its role, exact reference and supported variant. The agent validates these with
+`services.ResolveBuildImages` and renders from the returned values. Unknown or
+duplicate roles, mutable references, variant mismatches and replacement between
+scratch and a registry image refuse. No agent identity or release roster decides
+compatibility. `BuilderAgent.Build` refuses unsupported bindings before dispatch.
+
+Registry relocation preserves content digest and variant. A different base
+requires an explicit digest and the agent's supported recipe variant. Naming a
+variant asserts compatibility; it does not prove arbitrary image contents have
+that ABI or tooling. Image execution and target-platform qualification remain
+required before adoption. A Wolfi recipe requires an implementation in its agent;
+changing an Alpine image name cannot provide it.
+
+The CLI must verify the emitted recipe actually consumes the resolved references
+before fetching/building, retain the effective bindings with build evidence, and
+include them in cache/reuse decisions. Agent recipe files are never rewritten by
+the CLI. Builds without a selected image policy keep the existing contract and
+require no fleet update. This Core contract alone does not enable CLI or agent
+support or update any deployed image.
diff --git a/generated/go/codefly/services/builder/v0/builder.pb.go b/generated/go/codefly/services/builder/v0/builder.pb.go
index a14f7c5a..761634cc 100644
--- a/generated/go/codefly/services/builder/v0/builder.pb.go
+++ b/generated/go/codefly/services/builder/v0/builder.pb.go
@@ -4822,8 +4822,12 @@ type BuildCapabilitiesResponse struct {
 	BuildxSelection bool `protobuf:"varint,1,opt,name=buildx_selection,json=buildxSelection,proto3" json:"buildx_selection,omitempty"`
 	// execution_contracts lists artifact bindings honored by Build and Deploy.
 	ExecutionContracts []string `protobuf:"bytes,2,rep,name=execution_contracts,json=executionContracts,proto3" json:"execution_contracts,omitempty"`
-	unknownFields      protoimpl.UnknownFields
-	sizeCache          protoimpl.SizeCache
+	// image_inputs declares the loaded service's external image roles and
+	// supported recipe variants. Meaningful only with base-image-bindings/v1;
+	// it must reflect service settings, including native-library requirements.
+	ImageInputs   []*BuildImageInput `protobuf:"bytes,3,rep,name=image_inputs,json=imageInputs,proto3" json:"image_inputs,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *BuildCapabilitiesResponse) Reset() {
@@ -4870,6 +4874,13 @@ func (x *BuildCapabilitiesResponse) GetExecutionContracts() []string {
 	return nil
 }
 
+func (x *BuildCapabilitiesResponse) GetImageInputs() []*BuildImageInput {
+	if x != nil {
+		return x.ImageInputs
+	}
+	return nil
+}
+
 var File_codefly_services_builder_v0_builder_proto protoreflect.FileDescriptor
 
 const file_codefly_services_builder_v0_builder_proto_rawDesc = "" +
@@ -5194,10 +5205,11 @@ const file_codefly_services_builder_v0_builder_proto_rawDesc = "" +
 	"\x11ConfigureResponse\x12B\n" +
 	"\x05state\x18\x01 \x01(\v2,.codefly.services.builder.v0.ConfigureStatusR\x05state\x12%\n" +
 	"\x0eeffective_yaml\x18\x02 \x01(\tR\reffectiveYaml\"\x1a\n" +
-	"\x18BuildCapabilitiesRequest\"w\n" +
+	"\x18BuildCapabilitiesRequest\"\xc8\x01\n" +
 	"\x19BuildCapabilitiesResponse\x12)\n" +
 	"\x10buildx_selection\x18\x01 \x01(\bR\x0fbuildxSelection\x12/\n" +
-	"\x13execution_contracts\x18\x02 \x03(\tR\x12executionContracts*T\n" +
+	"\x13execution_contracts\x18\x02 \x03(\tR\x12executionContracts\x12O\n" +
+	"\fimage_inputs\x18\x03 \x03(\v2,.codefly.services.builder.v0.BuildImageInputR\vimageInputs*T\n" +
 	"\tSBOMScope\x12\x1a\n" +
 	"\x16SBOM_SCOPE_UNSPECIFIED\x10\x00\x12\x15\n" +
 	"\x11SBOM_SCOPE_SOURCE\x10\x01\x12\x14\n" +
@@ -5336,8 +5348,9 @@ var file_codefly_services_builder_v0_builder_proto_goTypes = []any{
 	(*DeploymentOutput)(nil),              // 90: codefly.services.builder.v0.DeploymentOutput
 	(*v01.Bom)(nil),                       // 91: codefly.services.agent.v0.Bom
 	(*v0.RunnableBuild)(nil),              // 92: codefly.base.v0.RunnableBuild
-	(*v01.Answer)(nil),                    // 93: codefly.services.agent.v0.Answer
-	(*v01.Question)(nil),                  // 94: codefly.services.agent.v0.Question
+	(*BuildImageInput)(nil),               // 93: codefly.services.builder.v0.BuildImageInput
+	(*v01.Answer)(nil),                    // 94: codefly.services.agent.v0.Answer
+	(*v01.Question)(nil),                  // 95: codefly.services.agent.v0.Question
 }
 var file_codefly_services_builder_v0_builder_proto_depIdxs = []int32{
 	3,   // 0: codefly.services.builder.v0.LoadStatus.state:type_name -> codefly.services.builder.v0.LoadStatus.Status
@@ -5428,41 +5441,42 @@ var file_codefly_services_builder_v0_builder_proto_depIdxs = []int32{
 	19,  // 85: codefly.services.builder.v0.ConfigureStatus.state:type_name -> codefly.services.builder.v0.ConfigureStatus.Status
 	76,  // 86: codefly.services.builder.v0.ConfigureStatus.failure:type_name -> codefly.base.v0.Failure
 	72,  // 87: codefly.services.builder.v0.ConfigureResponse.state:type_name -> codefly.services.builder.v0.ConfigureStatus
-	21,  // 88: codefly.services.builder.v0.Builder.Load:input_type -> codefly.services.builder.v0.LoadRequest
-	29,  // 89: codefly.services.builder.v0.Builder.Init:input_type -> codefly.services.builder.v0.InitRequest
-	25,  // 90: codefly.services.builder.v0.Builder.Create:input_type -> codefly.services.builder.v0.CreateRequest
-	32,  // 91: codefly.services.builder.v0.Builder.Update:input_type -> codefly.services.builder.v0.UpdateRequest
-	34,  // 92: codefly.services.builder.v0.Builder.Sync:input_type -> codefly.services.builder.v0.SyncRequest
-	38,  // 93: codefly.services.builder.v0.Builder.Build:input_type -> codefly.services.builder.v0.BuildRequest
-	74,  // 94: codefly.services.builder.v0.Builder.BuildCapabilities:input_type -> codefly.services.builder.v0.BuildCapabilitiesRequest
-	44,  // 95: codefly.services.builder.v0.Builder.Deploy:input_type -> codefly.services.builder.v0.DeploymentRequest
-	47,  // 96: codefly.services.builder.v0.Builder.Audit:input_type -> codefly.services.builder.v0.AuditRequest
-	54,  // 97: codefly.services.builder.v0.Builder.SBOM:input_type -> codefly.services.builder.v0.SBOMRequest
-	59,  // 98: codefly.services.builder.v0.Builder.Package:input_type -> codefly.services.builder.v0.PackageRequest
-	63,  // 99: codefly.services.builder.v0.Builder.RunnableBuildInputs:input_type -> codefly.services.builder.v0.RunnableBuildInputsRequest
-	66,  // 100: codefly.services.builder.v0.Builder.Upgrade:input_type -> codefly.services.builder.v0.UpgradeRequest
-	71,  // 101: codefly.services.builder.v0.Builder.Configure:input_type -> codefly.services.builder.v0.ConfigureRequest
-	93,  // 102: codefly.services.builder.v0.Builder.Communicate:input_type -> codefly.services.agent.v0.Answer
-	24,  // 103: codefly.services.builder.v0.Builder.Load:output_type -> codefly.services.builder.v0.LoadResponse
-	30,  // 104: codefly.services.builder.v0.Builder.Init:output_type -> codefly.services.builder.v0.InitResponse
-	27,  // 105: codefly.services.builder.v0.Builder.Create:output_type -> codefly.services.builder.v0.CreateResponse
-	33,  // 106: codefly.services.builder.v0.Builder.Update:output_type -> codefly.services.builder.v0.UpdateResponse
-	36,  // 107: codefly.services.builder.v0.Builder.Sync:output_type -> codefly.services.builder.v0.SyncResponse
-	41,  // 108: codefly.services.builder.v0.Builder.Build:output_type -> codefly.services.builder.v0.BuildResponse
-	75,  // 109: codefly.services.builder.v0.Builder.BuildCapabilities:output_type -> codefly.services.builder.v0.BuildCapabilitiesResponse
-	46,  // 110: codefly.services.builder.v0.Builder.Deploy:output_type -> codefly.services.builder.v0.DeploymentResponse
-	51,  // 111: codefly.services.builder.v0.Builder.Audit:output_type -> codefly.services.builder.v0.AuditResponse
-	56,  // 112: codefly.services.builder.v0.Builder.SBOM:output_type -> codefly.services.builder.v0.SBOMResponse
-	62,  // 113: codefly.services.builder.v0.Builder.Package:output_type -> codefly.services.builder.v0.PackageResponse
-	65,  // 114: codefly.services.builder.v0.Builder.RunnableBuildInputs:output_type -> codefly.services.builder.v0.RunnableBuildInputsResponse
-	69,  // 115: codefly.services.builder.v0.Builder.Upgrade:output_type -> codefly.services.builder.v0.UpgradeResponse
-	73,  // 116: codefly.services.builder.v0.Builder.Configure:output_type -> codefly.services.builder.v0.ConfigureResponse
-	94,  // 117: codefly.services.builder.v0.Builder.Communicate:output_type -> codefly.services.agent.v0.Question
-	103, // [103:118] is the sub-list for method output_type
-	88,  // [88:103] is the sub-list for method input_type
-	88,  // [88:88] is the sub-list for extension type_name
-	88,  // [88:88] is the sub-list for extension extendee
-	0,   // [0:88] is the sub-list for field type_name
+	93,  // 88: codefly.services.builder.v0.BuildCapabilitiesResponse.image_inputs:type_name -> codefly.services.builder.v0.BuildImageInput
+	21,  // 89: codefly.services.builder.v0.Builder.Load:input_type -> codefly.services.builder.v0.LoadRequest
+	29,  // 90: codefly.services.builder.v0.Builder.Init:input_type -> codefly.services.builder.v0.InitRequest
+	25,  // 91: codefly.services.builder.v0.Builder.Create:input_type -> codefly.services.builder.v0.CreateRequest
+	32,  // 92: codefly.services.builder.v0.Builder.Update:input_type -> codefly.services.builder.v0.UpdateRequest
+	34,  // 93: codefly.services.builder.v0.Builder.Sync:input_type -> codefly.services.builder.v0.SyncRequest
+	38,  // 94: codefly.services.builder.v0.Builder.Build:input_type -> codefly.services.builder.v0.BuildRequest
+	74,  // 95: codefly.services.builder.v0.Builder.BuildCapabilities:input_type -> codefly.services.builder.v0.BuildCapabilitiesRequest
+	44,  // 96: codefly.services.builder.v0.Builder.Deploy:input_type -> codefly.services.builder.v0.DeploymentRequest
+	47,  // 97: codefly.services.builder.v0.Builder.Audit:input_type -> codefly.services.builder.v0.AuditRequest
+	54,  // 98: codefly.services.builder.v0.Builder.SBOM:input_type -> codefly.services.builder.v0.SBOMRequest
+	59,  // 99: codefly.services.builder.v0.Builder.Package:input_type -> codefly.services.builder.v0.PackageRequest
+	63,  // 100: codefly.services.builder.v0.Builder.RunnableBuildInputs:input_type -> codefly.services.builder.v0.RunnableBuildInputsRequest
+	66,  // 101: codefly.services.builder.v0.Builder.Upgrade:input_type -> codefly.services.builder.v0.UpgradeRequest
+	71,  // 102: codefly.services.builder.v0.Builder.Configure:input_type -> codefly.services.builder.v0.ConfigureRequest
+	94,  // 103: codefly.services.builder.v0.Builder.Communicate:input_type -> codefly.services.agent.v0.Answer
+	24,  // 104: codefly.services.builder.v0.Builder.Load:output_type -> codefly.services.builder.v0.LoadResponse
+	30,  // 105: codefly.services.builder.v0.Builder.Init:output_type -> codefly.services.builder.v0.InitResponse
+	27,  // 106: codefly.services.builder.v0.Builder.Create:output_type -> codefly.services.builder.v0.CreateResponse
+	33,  // 107: codefly.services.builder.v0.Builder.Update:output_type -> codefly.services.builder.v0.UpdateResponse
+	36,  // 108: codefly.services.builder.v0.Builder.Sync:output_type -> codefly.services.builder.v0.SyncResponse
+	41,  // 109: codefly.services.builder.v0.Builder.Build:output_type -> codefly.services.builder.v0.BuildResponse
+	75,  // 110: codefly.services.builder.v0.Builder.BuildCapabilities:output_type -> codefly.services.builder.v0.BuildCapabilitiesResponse
+	46,  // 111: codefly.services.builder.v0.Builder.Deploy:output_type -> codefly.services.builder.v0.DeploymentResponse
+	51,  // 112: codefly.services.builder.v0.Builder.Audit:output_type -> codefly.services.builder.v0.AuditResponse
+	56,  // 113: codefly.services.builder.v0.Builder.SBOM:output_type -> codefly.services.builder.v0.SBOMResponse
+	62,  // 114: codefly.services.builder.v0.Builder.Package:output_type -> codefly.services.builder.v0.PackageResponse
+	65,  // 115: codefly.services.builder.v0.Builder.RunnableBuildInputs:output_type -> codefly.services.builder.v0.RunnableBuildInputsResponse
+	69,  // 116: codefly.services.builder.v0.Builder.Upgrade:output_type -> codefly.services.builder.v0.UpgradeResponse
+	73,  // 117: codefly.services.builder.v0.Builder.Configure:output_type -> codefly.services.builder.v0.ConfigureResponse
+	95,  // 118: codefly.services.builder.v0.Builder.Communicate:output_type -> codefly.services.agent.v0.Question
+	104, // [104:119] is the sub-list for method output_type
+	89,  // [89:104] is the sub-list for method input_type
+	89,  // [89:89] is the sub-list for extension type_name
+	89,  // [89:89] is the sub-list for extension extendee
+	0,   // [0:89] is the sub-list for field type_name
 }
 
 func init() { file_codefly_services_builder_v0_builder_proto_init() }
diff --git a/generated/go/codefly/services/builder/v0/docker.pb.go b/generated/go/codefly/services/builder/v0/docker.pb.go
index c514a428..79e474f5 100644
--- a/generated/go/codefly/services/builder/v0/docker.pb.go
+++ b/generated/go/codefly/services/builder/v0/docker.pb.go
@@ -152,6 +152,10 @@ type DockerBuildContext struct {
 	Cache *BuildCacheOptions `protobuf:"bytes,3,opt,name=cache,proto3" json:"cache,omitempty"`
 	// buildx_builder selects the caller-owned Buildx executor for in-agent builds.
 	BuildxBuilder string `protobuf:"bytes,4,opt,name=buildx_builder,json=buildxBuilder,proto3" json:"buildx_builder,omitempty"`
+	// image_bindings selects exact external images for agent-declared roles.
+	// Requires the live base-image-bindings/v1 execution contract. The agent
+	// renders these references; callers must never rewrite its Dockerfile.
+	ImageBindings []*BuildImageInput `protobuf:"bytes,5,rep,name=image_bindings,json=imageBindings,proto3" json:"image_bindings,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -214,6 +218,81 @@ func (x *DockerBuildContext) GetBuildxBuilder() string {
 	return ""
 }
 
+func (x *DockerBuildContext) GetImageBindings() []*BuildImageInput {
+	if x != nil {
+		return x.ImageBindings
+	}
+	return nil
+}
+
+// BuildImageInput names an external image and the recipe variant consuming it.
+// In capabilities it declares a role's default; in a build request it binds
+// that role to an immutable replacement. Roles and variants are agent-owned.
+type BuildImageInput struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// role is unique within the loaded service's image inputs.
+	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	// reference is a fully qualified image pinned by sha256 digest, or scratch.
+	Reference string `protobuf:"bytes,2,opt,name=reference,proto3" json:"reference,omitempty"`
+	// variant names the recipe's compatibility requirements, such as its OS/ABI
+	// and toolchain family. A different variant requires agent implementation;
+	// a registry relocation alone does not change it.
+	Variant       string `protobuf:"bytes,3,opt,name=variant,proto3" json:"variant,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BuildImageInput) Reset() {
+	*x = BuildImageInput{}
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BuildImageInput) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BuildImageInput) ProtoMessage() {}
+
+func (x *BuildImageInput) ProtoReflect() protoreflect.Message {
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BuildImageInput.ProtoReflect.Descriptor instead.
+func (*BuildImageInput) Descriptor() ([]byte, []int) {
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *BuildImageInput) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+func (x *BuildImageInput) GetReference() string {
+	if x != nil {
+		return x.Reference
+	}
+	return ""
+}
+
+func (x *BuildImageInput) GetVariant() string {
+	if x != nil {
+		return x.Variant
+	}
+	return ""
+}
+
 // DockerBuildResult captures Docker image references produced by a build.
 type DockerBuildResult struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -225,7 +304,7 @@ type DockerBuildResult struct {
 
 func (x *DockerBuildResult) Reset() {
 	*x = DockerBuildResult{}
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[1]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -237,7 +316,7 @@ func (x *DockerBuildResult) String() string {
 func (*DockerBuildResult) ProtoMessage() {}
 
 func (x *DockerBuildResult) ProtoReflect() protoreflect.Message {
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[1]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -250,7 +329,7 @@ func (x *DockerBuildResult) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DockerBuildResult.ProtoReflect.Descriptor instead.
 func (*DockerBuildResult) Descriptor() ([]byte, []int) {
-	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{1}
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *DockerBuildResult) GetImages() []string {
@@ -278,7 +357,7 @@ type RecipeFile struct {
 
 func (x *RecipeFile) Reset() {
 	*x = RecipeFile{}
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[2]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -290,7 +369,7 @@ func (x *RecipeFile) String() string {
 func (*RecipeFile) ProtoMessage() {}
 
 func (x *RecipeFile) ProtoReflect() protoreflect.Message {
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[2]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -303,7 +382,7 @@ func (x *RecipeFile) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecipeFile.ProtoReflect.Descriptor instead.
 func (*RecipeFile) Descriptor() ([]byte, []int) {
-	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{2}
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *RecipeFile) GetPath() string {
@@ -384,7 +463,7 @@ type DockerBuildRecipe struct {
 
 func (x *DockerBuildRecipe) Reset() {
 	*x = DockerBuildRecipe{}
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[3]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -396,7 +475,7 @@ func (x *DockerBuildRecipe) String() string {
 func (*DockerBuildRecipe) ProtoMessage() {}
 
 func (x *DockerBuildRecipe) ProtoReflect() protoreflect.Message {
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[3]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -409,7 +488,7 @@ func (x *DockerBuildRecipe) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DockerBuildRecipe.ProtoReflect.Descriptor instead.
 func (*DockerBuildRecipe) Descriptor() ([]byte, []int) {
-	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{3}
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *DockerBuildRecipe) GetName() string {
@@ -507,7 +586,7 @@ type GoModuleDownload struct {
 
 func (x *GoModuleDownload) Reset() {
 	*x = GoModuleDownload{}
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[4]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -519,7 +598,7 @@ func (x *GoModuleDownload) String() string {
 func (*GoModuleDownload) ProtoMessage() {}
 
 func (x *GoModuleDownload) ProtoReflect() protoreflect.Message {
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[4]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -532,7 +611,7 @@ func (x *GoModuleDownload) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GoModuleDownload.ProtoReflect.Descriptor instead.
 func (*GoModuleDownload) Descriptor() ([]byte, []int) {
-	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{4}
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *GoModuleDownload) GetModuleRoot() string {
@@ -578,7 +657,7 @@ type GitSourceDownload struct {
 
 func (x *GitSourceDownload) Reset() {
 	*x = GitSourceDownload{}
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[5]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -590,7 +669,7 @@ func (x *GitSourceDownload) String() string {
 func (*GitSourceDownload) ProtoMessage() {}
 
 func (x *GitSourceDownload) ProtoReflect() protoreflect.Message {
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[5]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -603,7 +682,7 @@ func (x *GitSourceDownload) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GitSourceDownload.ProtoReflect.Descriptor instead.
 func (*GitSourceDownload) Descriptor() ([]byte, []int) {
-	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{5}
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *GitSourceDownload) GetRepository() string {
@@ -655,7 +734,7 @@ type DockerBuildPlan struct {
 
 func (x *DockerBuildPlan) Reset() {
 	*x = DockerBuildPlan{}
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[6]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -667,7 +746,7 @@ func (x *DockerBuildPlan) String() string {
 func (*DockerBuildPlan) ProtoMessage() {}
 
 func (x *DockerBuildPlan) ProtoReflect() protoreflect.Message {
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[6]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -680,7 +759,7 @@ func (x *DockerBuildPlan) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DockerBuildPlan.ProtoReflect.Descriptor instead.
 func (*DockerBuildPlan) Descriptor() ([]byte, []int) {
-	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{6}
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *DockerBuildPlan) GetRecipes() []*DockerBuildRecipe {
@@ -739,7 +818,7 @@ type BuildCacheOptions struct {
 
 func (x *BuildCacheOptions) Reset() {
 	*x = BuildCacheOptions{}
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[7]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -751,7 +830,7 @@ func (x *BuildCacheOptions) String() string {
 func (*BuildCacheOptions) ProtoMessage() {}
 
 func (x *BuildCacheOptions) ProtoReflect() protoreflect.Message {
-	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[7]
+	mi := &file_codefly_services_builder_v0_docker_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -764,7 +843,7 @@ func (x *BuildCacheOptions) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use BuildCacheOptions.ProtoReflect.Descriptor instead.
 func (*BuildCacheOptions) Descriptor() ([]byte, []int) {
-	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{7}
+	return file_codefly_services_builder_v0_docker_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *BuildCacheOptions) GetImports() []string {
@@ -806,12 +885,17 @@ var File_codefly_services_builder_v0_docker_proto protoreflect.FileDescriptor
 
 const file_codefly_services_builder_v0_docker_proto_rawDesc = "" +
 	"\n" +
-	"(codefly/services/builder/v0/docker.proto\x12\x1bcodefly.services.builder.v0\"\xd1\x01\n" +
+	"(codefly/services/builder/v0/docker.proto\x12\x1bcodefly.services.builder.v0\"\xa6\x02\n" +
 	"\x12DockerBuildContext\x12+\n" +
 	"\x11docker_repository\x18\x01 \x01(\tR\x10dockerRepository\x12!\n" +
 	"\fimage_digest\x18\x02 \x01(\tR\vimageDigest\x12D\n" +
 	"\x05cache\x18\x03 \x01(\v2..codefly.services.builder.v0.BuildCacheOptionsR\x05cache\x12%\n" +
-	"\x0ebuildx_builder\x18\x04 \x01(\tR\rbuildxBuilder\"+\n" +
+	"\x0ebuildx_builder\x18\x04 \x01(\tR\rbuildxBuilder\x12S\n" +
+	"\x0eimage_bindings\x18\x05 \x03(\v2,.codefly.services.builder.v0.BuildImageInputR\rimageBindings\"]\n" +
+	"\x0fBuildImageInput\x12\x12\n" +
+	"\x04role\x18\x01 \x01(\tR\x04role\x12\x1c\n" +
+	"\treference\x18\x02 \x01(\tR\treference\x12\x18\n" +
+	"\avariant\x18\x03 \x01(\tR\avariant\"+\n" +
 	"\x11DockerBuildResult\x12\x16\n" +
 	"\x06images\x18\x01 \x03(\tR\x06images\"L\n" +
 	"\n" +
@@ -883,34 +967,36 @@ func file_codefly_services_builder_v0_docker_proto_rawDescGZIP() []byte {
 }
 
 var file_codefly_services_builder_v0_docker_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_codefly_services_builder_v0_docker_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_codefly_services_builder_v0_docker_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
 var file_codefly_services_builder_v0_docker_proto_goTypes = []any{
 	(RecipeContextRoot)(0),     // 0: codefly.services.builder.v0.RecipeContextRoot
 	(RecipeInventoryScope)(0),  // 1: codefly.services.builder.v0.RecipeInventoryScope
 	(*DockerBuildContext)(nil), // 2: codefly.services.builder.v0.DockerBuildContext
-	(*DockerBuildResult)(nil),  // 3: codefly.services.builder.v0.DockerBuildResult
-	(*RecipeFile)(nil),         // 4: codefly.services.builder.v0.RecipeFile
-	(*DockerBuildRecipe)(nil),  // 5: codefly.services.builder.v0.DockerBuildRecipe
-	(*GoModuleDownload)(nil),   // 6: codefly.services.builder.v0.GoModuleDownload
-	(*GitSourceDownload)(nil),  // 7: codefly.services.builder.v0.GitSourceDownload
-	(*DockerBuildPlan)(nil),    // 8: codefly.services.builder.v0.DockerBuildPlan
-	(*BuildCacheOptions)(nil),  // 9: codefly.services.builder.v0.BuildCacheOptions
-	nil,                        // 10: codefly.services.builder.v0.DockerBuildRecipe.BuildArgsEntry
+	(*BuildImageInput)(nil),    // 3: codefly.services.builder.v0.BuildImageInput
+	(*DockerBuildResult)(nil),  // 4: codefly.services.builder.v0.DockerBuildResult
+	(*RecipeFile)(nil),         // 5: codefly.services.builder.v0.RecipeFile
+	(*DockerBuildRecipe)(nil),  // 6: codefly.services.builder.v0.DockerBuildRecipe
+	(*GoModuleDownload)(nil),   // 7: codefly.services.builder.v0.GoModuleDownload
+	(*GitSourceDownload)(nil),  // 8: codefly.services.builder.v0.GitSourceDownload
+	(*DockerBuildPlan)(nil),    // 9: codefly.services.builder.v0.DockerBuildPlan
+	(*BuildCacheOptions)(nil),  // 10: codefly.services.builder.v0.BuildCacheOptions
+	nil,                        // 11: codefly.services.builder.v0.DockerBuildRecipe.BuildArgsEntry
 }
 var file_codefly_services_builder_v0_docker_proto_depIdxs = []int32{
-	9,  // 0: codefly.services.builder.v0.DockerBuildContext.cache:type_name -> codefly.services.builder.v0.BuildCacheOptions
-	10, // 1: codefly.services.builder.v0.DockerBuildRecipe.build_args:type_name -> codefly.services.builder.v0.DockerBuildRecipe.BuildArgsEntry
-	0,  // 2: codefly.services.builder.v0.DockerBuildRecipe.context_root:type_name -> codefly.services.builder.v0.RecipeContextRoot
-	6,  // 3: codefly.services.builder.v0.DockerBuildRecipe.go_module_downloads:type_name -> codefly.services.builder.v0.GoModuleDownload
-	7,  // 4: codefly.services.builder.v0.DockerBuildRecipe.git_source_downloads:type_name -> codefly.services.builder.v0.GitSourceDownload
-	5,  // 5: codefly.services.builder.v0.DockerBuildPlan.recipes:type_name -> codefly.services.builder.v0.DockerBuildRecipe
-	4,  // 6: codefly.services.builder.v0.DockerBuildPlan.files:type_name -> codefly.services.builder.v0.RecipeFile
-	1,  // 7: codefly.services.builder.v0.DockerBuildPlan.scope:type_name -> codefly.services.builder.v0.RecipeInventoryScope
-	8,  // [8:8] is the sub-list for method output_type
-	8,  // [8:8] is the sub-list for method input_type
-	8,  // [8:8] is the sub-list for extension type_name
-	8,  // [8:8] is the sub-list for extension extendee
-	0,  // [0:8] is the sub-list for field type_name
+	10, // 0: codefly.services.builder.v0.DockerBuildContext.cache:type_name -> codefly.services.builder.v0.BuildCacheOptions
+	3,  // 1: codefly.services.builder.v0.DockerBuildContext.image_bindings:type_name -> codefly.services.builder.v0.BuildImageInput
+	11, // 2: codefly.services.builder.v0.DockerBuildRecipe.build_args:type_name -> codefly.services.builder.v0.DockerBuildRecipe.BuildArgsEntry
+	0,  // 3: codefly.services.builder.v0.DockerBuildRecipe.context_root:type_name -> codefly.services.builder.v0.RecipeContextRoot
+	7,  // 4: codefly.services.builder.v0.DockerBuildRecipe.go_module_downloads:type_name -> codefly.services.builder.v0.GoModuleDownload
+	8,  // 5: codefly.services.builder.v0.DockerBuildRecipe.git_source_downloads:type_name -> codefly.services.builder.v0.GitSourceDownload
+	6,  // 6: codefly.services.builder.v0.DockerBuildPlan.recipes:type_name -> codefly.services.builder.v0.DockerBuildRecipe
+	5,  // 7: codefly.services.builder.v0.DockerBuildPlan.files:type_name -> codefly.services.builder.v0.RecipeFile
+	1,  // 8: codefly.services.builder.v0.DockerBuildPlan.scope:type_name -> codefly.services.builder.v0.RecipeInventoryScope
+	9,  // [9:9] is the sub-list for method output_type
+	9,  // [9:9] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
 }
 
 func init() { file_codefly_services_builder_v0_docker_proto_init() }
@@ -924,7 +1010,7 @@ func file_codefly_services_builder_v0_docker_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_codefly_services_builder_v0_docker_proto_rawDesc), len(file_codefly_services_builder_v0_docker_proto_rawDesc)),
 			NumEnums:      2,
-			NumMessages:   9,
+			NumMessages:   10,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/builder_pb2.py b/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/builder_pb2.py
index 1a2acf84..97a052b5 100644
--- a/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/builder_pb2.py
+++ b/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/builder_pb2.py
@@ -36,19 +36,19 @@
 from codefly.services.builder.v0 import deployment_pb2 as codefly_dot_services_dot_builder_dot_v0_dot_deployment__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n)codefly/services/builder/v0/builder.proto\x12\x1b\x63odefly.services.builder.v0\x1a\x1d\x63odefly/base/v0/service.proto\x1a(codefly/base/v0/artifact_execution.proto\x1a\x1d\x63odefly/base/v0/failure.proto\x1a\x1d\x63odefly/base/v0/network.proto\x1a\x1e\x63odefly/base/v0/runnable.proto\x1a\x1e\x63odefly/base/v0/endpoint.proto\x1a!codefly/base/v0/environment.proto\x1a#codefly/base/v0/configuration.proto\x1a+codefly/services/agent/v0/communicate.proto\x1a)codefly/services/agent/v0/cyclonedx.proto\x1a(codefly/services/builder/v0/docker.proto\x1a,codefly/services/builder/v0/deployment.proto\"\xcd\x01\n\nLoadStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.LoadStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"+\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\t\n\x05READY\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"\xec\x02\n\x0bLoadRequest\x12\'\n\x0f\x64\x65veloper_debug\x18\x01 \x01(\x08R\x0e\x64\x65veloperDebug\x12#\n\rdisable_catch\x18\x02 \x01(\x08R\x0c\x64isableCatch\x12<\n\x08identity\x18\x03 \x01(\x0b\x32 .codefly.base.v0.ServiceIdentityR\x08identity\x12N\n\rcreation_mode\x18\x04 \x01(\x0b\x32).codefly.services.builder.v0.CreationModeR\x0c\x63reationMode\x12\x42\n\tsync_mode\x18\x05 \x01(\x0b\x32%.codefly.services.builder.v0.SyncModeR\x08syncMode\x12=\n\x08runnable\x18\x06 \x01(\x0b\x32!.codefly.base.v0.RunnableLocationR\x08runnable\"0\n\x0c\x43reationMode\x12 \n\x0b\x63ommunicate\x18\x01 \x01(\x08R\x0b\x63ommunicate\",\n\x08SyncMode\x12 \n\x0b\x63ommunicate\x18\x01 \x01(\x08R\x0b\x63ommunicate\"\xe3\x01\n\x0cLoadResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.LoadStatusR\x05state\x12\x32\n\x07version\x18\x02 \x01(\x0b\x32\x18.codefly.base.v0.VersionR\x07version\x12\x37\n\tendpoints\x18\x03 \x03(\x0b\x32\x19.codefly.base.v0.EndpointR\tendpoints\x12\'\n\x0fgetting_started\x18\x04 \x01(\tR\x0egettingStarted\"\x0f\n\rCreateRequest\"\xd3\x01\n\x0c\x43reateStatus\x12\x46\n\x05state\x18\x01 \x01(\x0e\x32\x30.codefly.services.builder.v0.CreateStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07\x43REATED\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"\x8a\x01\n\x0e\x43reateResponse\x12?\n\x05state\x18\x01 \x01(\x0b\x32).codefly.services.builder.v0.CreateStatusR\x05state\x12\x37\n\tendpoints\x18\x02 \x03(\x0b\x32\x19.codefly.base.v0.EndpointR\tendpoints\"\xcf\x01\n\nInitStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.InitStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"_\n\x0bInitRequest\x12P\n\x16\x64\x65pendencies_endpoints\x18\x01 \x03(\x0b\x32\x19.codefly.base.v0.EndpointR\x15\x64\x65pendenciesEndpoints\"M\n\x0cInitResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.InitStatusR\x05state\"\xd3\x01\n\x0cUpdateStatus\x12\x46\n\x05state\x18\x01 \x01(\x0e\x32\x30.codefly.services.builder.v0.UpdateStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"\x0f\n\rUpdateRequest\"Q\n\x0eUpdateResponse\x12?\n\x05state\x18\x01 \x01(\x0b\x32).codefly.services.builder.v0.UpdateStatusR\x05state\"&\n\x0bSyncRequest\x12\x17\n\x07\x64ry_run\x18\x01 \x01(\x08R\x06\x64ryRun\"\xe0\x01\n\nSyncStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.SyncStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\">\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"r\n\x0cSyncResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.SyncStatusR\x05state\x12#\n\rchanged_files\x18\x02 \x03(\tR\x0c\x63hangedFiles\"{\n\x0c\x42uildContext\x12\x63\n\x14\x64ocker_build_context\x18\x01 \x01(\x0b\x32/.codefly.services.builder.v0.DockerBuildContextH\x00R\x12\x64ockerBuildContextB\x06\n\x04kind\"\xcb\x01\n\x0c\x42uildRequest\x12N\n\rbuild_context\x18\x01 \x01(\x0b\x32).codefly.services.builder.v0.BuildContextR\x0c\x62uildContext\x12)\n\x10output_directory\x18\x02 \x01(\tR\x0foutputDirectory\x12@\n\texecution\x18\x03 \x01(\x0b\x32\".codefly.base.v0.ArtifactExecutionR\texecution\"\xab\x02\n\x0b\x42uildResult\x12\x18\n\x07version\x18\x01 \x01(\tR\x07version\x12!\n\x0crunning_hash\x18\x02 \x01(\tR\x0brunningHash\x12\x19\n\x08\x61pi_hash\x18\x03 \x01(\tR\x07\x61piHash\x12`\n\x13\x64ocker_build_result\x18\x04 \x01(\x0b\x32..codefly.services.builder.v0.DockerBuildResultH\x00R\x11\x64ockerBuildResult\x12Z\n\x11\x64ocker_build_plan\x18\x05 \x01(\x0b\x32,.codefly.services.builder.v0.DockerBuildPlanH\x00R\x0f\x64ockerBuildPlanB\x06\n\x04kind\"\xdb\x01\n\x0b\x42uildStatus\x12\x45\n\x05state\x18\x01 \x01(\x0e\x32/.codefly.services.builder.v0.BuildStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"7\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x08\n\x04NOOP\x10\x03\"\xb7\x02\n\rBuildResponse\x12>\n\x05state\x18\x01 \x01(\x0b\x32(.codefly.services.builder.v0.BuildStatusR\x05state\x12@\n\x06result\x18\x02 \x01(\x0b\x32(.codefly.services.builder.v0.BuildResultR\x06result\x12\x34\n\x16\x63\x61\x63he_contract_version\x18\x03 \x01(\tR\x14\x63\x61\x63heContractVersion\x12%\n\x0e\x62uildx_builder\x18\x04 \x01(\tR\rbuildxBuilder\x12G\n\texecution\x18\x05 \x01(\x0b\x32).codefly.base.v0.ArtifactExecutionReceiptR\texecution\"\xd0\x01\n\x11\x43ompositionMember\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12G\n\x04role\x18\x02 \x01(\x0e\x32\x33.codefly.services.builder.v0.CompositionMember.RoleR\x04role\x12\x1c\n\tworkspace\x18\x03 \x01(\tR\tworkspace\"@\n\x04Role\x12\x14\n\x10ROLE_UNSPECIFIED\x10\x00\x12\x0f\n\x0bROLE_MODULE\x10\x01\x12\x11\n\rROLE_SOLUTION\x10\x02\"a\n\x15\x43ompositionProvenance\x12H\n\x07members\x18\x01 \x03(\x0b\x32..codefly.services.builder.v0.CompositionMemberR\x07members\"\xcc\x05\n\x11\x44\x65ploymentRequest\x12>\n\x0b\x65nvironment\x18\x01 \x01(\x0b\x32\x1c.codefly.base.v0.EnvironmentR\x0b\x65nvironment\x12G\n\ndeployment\x18\x02 \x01(\x0b\x32\'.codefly.services.builder.v0.DeploymentR\ndeployment\x12\x44\n\rconfiguration\x18\x03 \x01(\x0b\x32\x1e.codefly.base.v0.ConfigurationR\rconfiguration\x12_\n\x1b\x64\x65pendencies_configurations\x18\x04 \x03(\x0b\x32\x1e.codefly.base.v0.ConfigurationR\x1a\x64\x65pendenciesConfigurations\x12J\n\x10network_mappings\x18\x05 \x03(\x0b\x32\x1f.codefly.base.v0.NetworkMappingR\x0fnetworkMappings\x12\x63\n\x1d\x64\x65pendencies_network_mappings\x18\x06 \x03(\x0b\x32\x1f.codefly.base.v0.NetworkMappingR\x1b\x64\x65pendenciesNetworkMappings\x12@\n\texecution\x18\x07 \x01(\x0b\x32\".codefly.base.v0.ArtifactExecutionR\texecution\x12)\n\x10output_directory\x18\x08 \x01(\tR\x0foutputDirectory\x12i\n\x16\x63omposition_provenance\x18\t \x01(\x0b\x32\x32.codefly.services.builder.v0.CompositionProvenanceR\x15\x63ompositionProvenance\"\xe5\x01\n\x10\x44\x65ploymentStatus\x12J\n\x05state\x18\x01 \x01(\x0e\x32\x34.codefly.services.builder.v0.DeploymentStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"7\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x08\n\x04NOOP\x10\x03\"\xb7\x02\n\x12\x44\x65ploymentResponse\x12\x43\n\x05state\x18\x01 \x01(\x0b\x32-.codefly.services.builder.v0.DeploymentStatusR\x05state\x12\x44\n\rconfiguration\x18\x02 \x01(\x0b\x32\x1e.codefly.base.v0.ConfigurationR\rconfiguration\x12M\n\ndeployment\x18\x03 \x01(\x0b\x32-.codefly.services.builder.v0.DeploymentOutputR\ndeployment\x12G\n\texecution\x18\x04 \x01(\x0b\x32).codefly.base.v0.ArtifactExecutionReceiptR\texecution\"\x95\x01\n\x0c\x41uditRequest\x12)\n\x10include_outdated\x18\x01 \x01(\x08R\x0fincludeOutdated\x12 \n\x0c\x66\x61il_on_vuln\x18\x02 \x01(\x08R\nfailOnVuln\x12\x38\n\x18include_dev_dependencies\x18\x03 \x01(\x08R\x16includeDevDependencies\"\xc8\x02\n\x0c\x41uditFinding\x12N\n\x08severity\x18\x01 \x01(\x0e\x32\x32.codefly.services.builder.v0.AuditFinding.SeverityR\x08severity\x12\x0e\n\x02id\x18\x02 \x01(\tR\x02id\x12\x18\n\x07package\x18\x03 \x01(\tR\x07package\x12\'\n\x0f\x63urrent_version\x18\x04 \x01(\tR\x0e\x63urrentVersion\x12#\n\rfixed_version\x18\x05 \x01(\tR\x0c\x66ixedVersion\x12\x18\n\x07summary\x18\x06 \x01(\tR\x07summary\x12\x10\n\x03url\x18\x07 \x01(\tR\x03url\"D\n\x08Severity\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x07\n\x03LOW\x10\x01\x12\n\n\x06MEDIUM\x10\x02\x12\x08\n\x04HIGH\x10\x03\x12\x0c\n\x08\x43RITICAL\x10\x04\"\x85\x01\n\x0bOutdatedDep\x12\x18\n\x07package\x18\x01 \x01(\tR\x07package\x12\x18\n\x07\x63urrent\x18\x02 \x01(\tR\x07\x63urrent\x12\x1f\n\x0blatest_safe\x18\x03 \x01(\tR\nlatestSafe\x12!\n\x0clatest_major\x18\x04 \x01(\tR\x0blatestMajor\"\xee\x01\n\x0b\x41uditStatus\x12\x45\n\x05state\x18\x01 \x01(\x0e\x32/.codefly.services.builder.v0.AuditStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"J\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\t\n\x05\x43LEAN\x10\x01\x12\x0c\n\x08\x46INDINGS\x10\x02\x12\t\n\x05\x45RROR\x10\x03\x12\x0f\n\x0bUNSUPPORTED\x10\x04\"\x8c\x02\n\rAuditResponse\x12>\n\x05state\x18\x01 \x01(\x0b\x32(.codefly.services.builder.v0.AuditStatusR\x05state\x12\x45\n\x08\x66indings\x18\x02 \x03(\x0b\x32).codefly.services.builder.v0.AuditFindingR\x08\x66indings\x12\x44\n\x08outdated\x18\x03 \x03(\x0b\x32(.codefly.services.builder.v0.OutdatedDepR\x08outdated\x12\x12\n\x04tool\x18\x04 \x01(\tR\x04tool\x12\x1a\n\x08language\x18\x05 \x01(\tR\x08language\"\xd4\x01\n\x0cImageSubject\x12\x1c\n\treference\x18\x01 \x01(\tR\treference\x12\x16\n\x06\x64igest\x18\x02 \x01(\tR\x06\x64igest\x12\x1a\n\x08platform\x18\x03 \x01(\tR\x08platform\x12\x12\n\x04role\x18\x04 \x01(\tR\x04role\x12\x18\n\x07service\x18\x05 \x01(\tR\x07service\x12\x44\n\x06source\x18\x06 \x01(\x0e\x32,.codefly.services.builder.v0.ImageSourceKindR\x06source\"\xe4\x01\n\tImageSBOM\x12\x16\n\x06\x64igest\x18\x01 \x01(\tR\x06\x64igest\x12\x1a\n\x08platform\x18\x02 \x01(\tR\x08platform\x12\x45\n\x08subjects\x18\x03 \x03(\x0b\x32).codefly.services.builder.v0.ImageSubjectR\x08subjects\x12\x30\n\x03\x62om\x18\x04 \x01(\x0b\x32\x1e.codefly.services.agent.v0.BomR\x03\x62om\x12\x12\n\x04tool\x18\x05 \x01(\tR\x04tool\x12\x16\n\x06sha256\x18\x06 \x01(\tR\x06sha256\"\xcc\x01\n\x0bSBOMRequest\x12\x38\n\x18include_dev_dependencies\x18\x01 \x01(\x08R\x16includeDevDependencies\x12<\n\x05scope\x18\x02 \x01(\x0e\x32&.codefly.services.builder.v0.SBOMScopeR\x05scope\x12\x45\n\x08subjects\x18\x03 \x03(\x0b\x32).codefly.services.builder.v0.ImageSubjectR\x08subjects\"\xe1\x01\n\nSBOMStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.SBOMStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"?\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0c\n\x08\x43OMPLETE\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"\x99\x03\n\x0cSBOMResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.SBOMStatusR\x05state\x12\x30\n\x03\x62om\x18\x02 \x01(\x0b\x32\x1e.codefly.services.agent.v0.BomR\x03\x62om\x12\x12\n\x04tool\x18\x03 \x01(\tR\x04tool\x12\x1a\n\x08language\x18\x04 \x01(\tR\x08language\x12\x16\n\x06sha256\x18\x05 \x01(\tR\x06sha256\x12>\n\x06images\x18\x06 \x03(\x0b\x32&.codefly.services.builder.v0.ImageSBOMR\x06images\x12<\n\x05scope\x18\x07 \x01(\x0e\x32&.codefly.services.builder.v0.SBOMScopeR\x05scope\x12R\n\x0fno_image_reason\x18\x08 \x01(\x0e\x32*.codefly.services.builder.v0.NoImageReasonR\rnoImageReason\"C\n\rPackageTarget\x12\x0e\n\x02os\x18\x01 \x01(\tR\x02os\x12\"\n\x0c\x61rchitecture\x18\x02 \x01(\tR\x0c\x61rchitecture\"\\\n\x0ePackageSubject\x12\x1c\n\tpublisher\x18\x01 \x01(\tR\tpublisher\x12\x12\n\x04name\x18\x02 \x01(\tR\x04name\x12\x18\n\x07version\x18\x03 \x01(\tR\x07version\"\x90\x02\n\x0ePackageRequest\x12\x44\n\x07targets\x18\x01 \x03(\x0b\x32*.codefly.services.builder.v0.PackageTargetR\x07targets\x12)\n\x10output_directory\x18\x02 \x01(\tR\x0foutputDirectory\x12#\n\rartifact_name\x18\x03 \x01(\tR\x0c\x61rtifactName\x12!\n\x0cinclude_sbom\x18\x04 \x01(\x08R\x0bincludeSbom\x12\x45\n\x07subject\x18\x05 \x01(\x0b\x32+.codefly.services.builder.v0.PackageSubjectR\x07subject\"\xc6\x02\n\x0fPackageArtifact\x12\x45\n\x04kind\x18\x01 \x01(\x0e\x32\x31.codefly.services.builder.v0.PackageArtifact.KindR\x04kind\x12\x12\n\x04path\x18\x02 \x01(\tR\x04path\x12\x42\n\x06target\x18\x03 \x01(\x0b\x32*.codefly.services.builder.v0.PackageTargetR\x06target\x12\x16\n\x06sha256\x18\x04 \x01(\tR\x06sha256\x12\x1d\n\nmedia_type\x18\x05 \x01(\tR\tmediaType\x12\x18\n\x07\x63ommand\x18\x06 \x03(\tR\x07\x63ommand\"C\n\x04Kind\x12\x14\n\x10KIND_UNSPECIFIED\x10\x00\x12\x0e\n\nEXECUTABLE\x10\x01\x12\x0b\n\x07\x41RCHIVE\x10\x02\x12\x08\n\x04SBOM\x10\x03\"\xe6\x01\n\rPackageStatus\x12G\n\x05state\x18\x01 \x01(\x0e\x32\x31.codefly.services.builder.v0.PackageStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\">\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"\x9f\x01\n\x0fPackageResponse\x12@\n\x05state\x18\x01 \x01(\x0b\x32*.codefly.services.builder.v0.PackageStatusR\x05state\x12J\n\tartifacts\x18\x02 \x03(\x0b\x32,.codefly.services.builder.v0.PackageArtifactR\tartifacts\"G\n\x1aRunnableBuildInputsRequest\x12)\n\x10output_directory\x18\x01 \x01(\tR\x0foutputDirectory\"\xfe\x01\n\x19RunnableBuildInputsStatus\x12S\n\x05state\x18\x01 \x01(\x0e\x32=.codefly.services.builder.v0.RunnableBuildInputsStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\">\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"\xa1\x01\n\x1bRunnableBuildInputsResponse\x12L\n\x05state\x18\x01 \x01(\x0b\x32\x36.codefly.services.builder.v0.RunnableBuildInputsStatusR\x05state\x12\x34\n\x05\x62uild\x18\x02 \x01(\x0b\x32\x1e.codefly.base.v0.RunnableBuildR\x05\x62uild\"b\n\x0eUpgradeRequest\x12#\n\rinclude_major\x18\x01 \x01(\x08R\x0cincludeMajor\x12\x17\n\x07\x64ry_run\x18\x02 \x01(\x08R\x06\x64ryRun\x12\x12\n\x04only\x18\x03 \x03(\tR\x04only\"M\n\rUpgradeChange\x12\x18\n\x07package\x18\x01 \x01(\tR\x07package\x12\x12\n\x04\x66rom\x18\x02 \x01(\tR\x04\x66rom\x12\x0e\n\x02to\x18\x03 \x01(\tR\x02to\"\xdf\x01\n\rUpgradeStatus\x12G\n\x05state\x18\x01 \x01(\x0e\x32\x31.codefly.services.builder.v0.UpgradeStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"7\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\x08\n\x04NOOP\x10\x02\x12\t\n\x05\x45RROR\x10\x03\"\xbe\x01\n\x0fUpgradeResponse\x12@\n\x05state\x18\x01 \x01(\x0b\x32*.codefly.services.builder.v0.UpgradeStatusR\x05state\x12\x44\n\x07\x63hanges\x18\x02 \x03(\x0b\x32*.codefly.services.builder.v0.UpgradeChangeR\x07\x63hanges\x12#\n\rlockfile_diff\x18\x03 \x01(\tR\x0clockfileDiff\"\xa9\x01\n\x0c\x43onfigChange\x12\x12\n\x04path\x18\x01 \x01(\tR\x04path\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value\x12<\n\x02op\x18\x03 \x01(\x0e\x32,.codefly.services.builder.v0.ConfigChange.OpR\x02op\"1\n\x02Op\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x07\n\x03SET\x10\x01\x12\n\n\x06\x41PPEND\x10\x02\x12\t\n\x05UNSET\x10\x03\"W\n\x10\x43onfigureRequest\x12\x43\n\x07\x63hanges\x18\x01 \x03(\x0b\x32).codefly.services.builder.v0.ConfigChangeR\x07\x63hanges\"\xd9\x01\n\x0f\x43onfigureStatus\x12I\n\x05state\x18\x01 \x01(\x0e\x32\x33.codefly.services.builder.v0.ConfigureStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"~\n\x11\x43onfigureResponse\x12\x42\n\x05state\x18\x01 \x01(\x0b\x32,.codefly.services.builder.v0.ConfigureStatusR\x05state\x12%\n\x0e\x65\x66\x66\x65\x63tive_yaml\x18\x02 \x01(\tR\reffectiveYaml\"\x1a\n\x18\x42uildCapabilitiesRequest\"w\n\x19\x42uildCapabilitiesResponse\x12)\n\x10\x62uildx_selection\x18\x01 \x01(\x08R\x0f\x62uildxSelection\x12/\n\x13\x65xecution_contracts\x18\x02 \x03(\tR\x12\x65xecutionContracts*T\n\tSBOMScope\x12\x1a\n\x16SBOM_SCOPE_UNSPECIFIED\x10\x00\x12\x15\n\x11SBOM_SCOPE_SOURCE\x10\x01\x12\x14\n\x10SBOM_SCOPE_IMAGE\x10\x02*v\n\rNoImageReason\x12\x1f\n\x1bNO_IMAGE_REASON_UNSPECIFIED\x10\x00\x12\x1c\n\x18NO_IMAGE_REASON_NO_IMAGE\x10\x01\x12&\n\"NO_IMAGE_REASON_EXTERNALLY_MANAGED\x10\x02*y\n\x0fImageSourceKind\x12!\n\x1dIMAGE_SOURCE_KIND_UNSPECIFIED\x10\x00\x12\x1e\n\x1aIMAGE_SOURCE_KIND_REGISTRY\x10\x01\x12#\n\x1fIMAGE_SOURCE_KIND_DOCKER_DAEMON\x10\x02\x32\xaf\x0c\n\x07\x42uilder\x12]\n\x04Load\x12(.codefly.services.builder.v0.LoadRequest\x1a).codefly.services.builder.v0.LoadResponse\"\x00\x12]\n\x04Init\x12(.codefly.services.builder.v0.InitRequest\x1a).codefly.services.builder.v0.InitResponse\"\x00\x12\x63\n\x06\x43reate\x12*.codefly.services.builder.v0.CreateRequest\x1a+.codefly.services.builder.v0.CreateResponse\"\x00\x12\x63\n\x06Update\x12*.codefly.services.builder.v0.UpdateRequest\x1a+.codefly.services.builder.v0.UpdateResponse\"\x00\x12]\n\x04Sync\x12(.codefly.services.builder.v0.SyncRequest\x1a).codefly.services.builder.v0.SyncResponse\"\x00\x12`\n\x05\x42uild\x12).codefly.services.builder.v0.BuildRequest\x1a*.codefly.services.builder.v0.BuildResponse\"\x00\x12\x84\x01\n\x11\x42uildCapabilities\x12\x35.codefly.services.builder.v0.BuildCapabilitiesRequest\x1a\x36.codefly.services.builder.v0.BuildCapabilitiesResponse\"\x00\x12k\n\x06\x44\x65ploy\x12..codefly.services.builder.v0.DeploymentRequest\x1a/.codefly.services.builder.v0.DeploymentResponse\"\x00\x12`\n\x05\x41udit\x12).codefly.services.builder.v0.AuditRequest\x1a*.codefly.services.builder.v0.AuditResponse\"\x00\x12]\n\x04SBOM\x12(.codefly.services.builder.v0.SBOMRequest\x1a).codefly.services.builder.v0.SBOMResponse\"\x00\x12\x66\n\x07Package\x12+.codefly.services.builder.v0.PackageRequest\x1a,.codefly.services.builder.v0.PackageResponse\"\x00\x12\x8a\x01\n\x13RunnableBuildInputs\x12\x37.codefly.services.builder.v0.RunnableBuildInputsRequest\x1a\x38.codefly.services.builder.v0.RunnableBuildInputsResponse\"\x00\x12\x66\n\x07Upgrade\x12+.codefly.services.builder.v0.UpgradeRequest\x1a,.codefly.services.builder.v0.UpgradeResponse\"\x00\x12l\n\tConfigure\x12-.codefly.services.builder.v0.ConfigureRequest\x1a..codefly.services.builder.v0.ConfigureResponse\"\x00\x12[\n\x0b\x43ommunicate\x12!.codefly.services.agent.v0.Answer\x1a#.codefly.services.agent.v0.Question\"\x00(\x01\x30\x01\x62\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n)codefly/services/builder/v0/builder.proto\x12\x1b\x63odefly.services.builder.v0\x1a\x1d\x63odefly/base/v0/service.proto\x1a(codefly/base/v0/artifact_execution.proto\x1a\x1d\x63odefly/base/v0/failure.proto\x1a\x1d\x63odefly/base/v0/network.proto\x1a\x1e\x63odefly/base/v0/runnable.proto\x1a\x1e\x63odefly/base/v0/endpoint.proto\x1a!codefly/base/v0/environment.proto\x1a#codefly/base/v0/configuration.proto\x1a+codefly/services/agent/v0/communicate.proto\x1a)codefly/services/agent/v0/cyclonedx.proto\x1a(codefly/services/builder/v0/docker.proto\x1a,codefly/services/builder/v0/deployment.proto\"\xcd\x01\n\nLoadStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.LoadStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"+\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\t\n\x05READY\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"\xec\x02\n\x0bLoadRequest\x12\'\n\x0f\x64\x65veloper_debug\x18\x01 \x01(\x08R\x0e\x64\x65veloperDebug\x12#\n\rdisable_catch\x18\x02 \x01(\x08R\x0c\x64isableCatch\x12<\n\x08identity\x18\x03 \x01(\x0b\x32 .codefly.base.v0.ServiceIdentityR\x08identity\x12N\n\rcreation_mode\x18\x04 \x01(\x0b\x32).codefly.services.builder.v0.CreationModeR\x0c\x63reationMode\x12\x42\n\tsync_mode\x18\x05 \x01(\x0b\x32%.codefly.services.builder.v0.SyncModeR\x08syncMode\x12=\n\x08runnable\x18\x06 \x01(\x0b\x32!.codefly.base.v0.RunnableLocationR\x08runnable\"0\n\x0c\x43reationMode\x12 \n\x0b\x63ommunicate\x18\x01 \x01(\x08R\x0b\x63ommunicate\",\n\x08SyncMode\x12 \n\x0b\x63ommunicate\x18\x01 \x01(\x08R\x0b\x63ommunicate\"\xe3\x01\n\x0cLoadResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.LoadStatusR\x05state\x12\x32\n\x07version\x18\x02 \x01(\x0b\x32\x18.codefly.base.v0.VersionR\x07version\x12\x37\n\tendpoints\x18\x03 \x03(\x0b\x32\x19.codefly.base.v0.EndpointR\tendpoints\x12\'\n\x0fgetting_started\x18\x04 \x01(\tR\x0egettingStarted\"\x0f\n\rCreateRequest\"\xd3\x01\n\x0c\x43reateStatus\x12\x46\n\x05state\x18\x01 \x01(\x0e\x32\x30.codefly.services.builder.v0.CreateStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07\x43REATED\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"\x8a\x01\n\x0e\x43reateResponse\x12?\n\x05state\x18\x01 \x01(\x0b\x32).codefly.services.builder.v0.CreateStatusR\x05state\x12\x37\n\tendpoints\x18\x02 \x03(\x0b\x32\x19.codefly.base.v0.EndpointR\tendpoints\"\xcf\x01\n\nInitStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.InitStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"_\n\x0bInitRequest\x12P\n\x16\x64\x65pendencies_endpoints\x18\x01 \x03(\x0b\x32\x19.codefly.base.v0.EndpointR\x15\x64\x65pendenciesEndpoints\"M\n\x0cInitResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.InitStatusR\x05state\"\xd3\x01\n\x0cUpdateStatus\x12\x46\n\x05state\x18\x01 \x01(\x0e\x32\x30.codefly.services.builder.v0.UpdateStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"\x0f\n\rUpdateRequest\"Q\n\x0eUpdateResponse\x12?\n\x05state\x18\x01 \x01(\x0b\x32).codefly.services.builder.v0.UpdateStatusR\x05state\"&\n\x0bSyncRequest\x12\x17\n\x07\x64ry_run\x18\x01 \x01(\x08R\x06\x64ryRun\"\xe0\x01\n\nSyncStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.SyncStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\">\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"r\n\x0cSyncResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.SyncStatusR\x05state\x12#\n\rchanged_files\x18\x02 \x03(\tR\x0c\x63hangedFiles\"{\n\x0c\x42uildContext\x12\x63\n\x14\x64ocker_build_context\x18\x01 \x01(\x0b\x32/.codefly.services.builder.v0.DockerBuildContextH\x00R\x12\x64ockerBuildContextB\x06\n\x04kind\"\xcb\x01\n\x0c\x42uildRequest\x12N\n\rbuild_context\x18\x01 \x01(\x0b\x32).codefly.services.builder.v0.BuildContextR\x0c\x62uildContext\x12)\n\x10output_directory\x18\x02 \x01(\tR\x0foutputDirectory\x12@\n\texecution\x18\x03 \x01(\x0b\x32\".codefly.base.v0.ArtifactExecutionR\texecution\"\xab\x02\n\x0b\x42uildResult\x12\x18\n\x07version\x18\x01 \x01(\tR\x07version\x12!\n\x0crunning_hash\x18\x02 \x01(\tR\x0brunningHash\x12\x19\n\x08\x61pi_hash\x18\x03 \x01(\tR\x07\x61piHash\x12`\n\x13\x64ocker_build_result\x18\x04 \x01(\x0b\x32..codefly.services.builder.v0.DockerBuildResultH\x00R\x11\x64ockerBuildResult\x12Z\n\x11\x64ocker_build_plan\x18\x05 \x01(\x0b\x32,.codefly.services.builder.v0.DockerBuildPlanH\x00R\x0f\x64ockerBuildPlanB\x06\n\x04kind\"\xdb\x01\n\x0b\x42uildStatus\x12\x45\n\x05state\x18\x01 \x01(\x0e\x32/.codefly.services.builder.v0.BuildStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"7\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x08\n\x04NOOP\x10\x03\"\xb7\x02\n\rBuildResponse\x12>\n\x05state\x18\x01 \x01(\x0b\x32(.codefly.services.builder.v0.BuildStatusR\x05state\x12@\n\x06result\x18\x02 \x01(\x0b\x32(.codefly.services.builder.v0.BuildResultR\x06result\x12\x34\n\x16\x63\x61\x63he_contract_version\x18\x03 \x01(\tR\x14\x63\x61\x63heContractVersion\x12%\n\x0e\x62uildx_builder\x18\x04 \x01(\tR\rbuildxBuilder\x12G\n\texecution\x18\x05 \x01(\x0b\x32).codefly.base.v0.ArtifactExecutionReceiptR\texecution\"\xd0\x01\n\x11\x43ompositionMember\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12G\n\x04role\x18\x02 \x01(\x0e\x32\x33.codefly.services.builder.v0.CompositionMember.RoleR\x04role\x12\x1c\n\tworkspace\x18\x03 \x01(\tR\tworkspace\"@\n\x04Role\x12\x14\n\x10ROLE_UNSPECIFIED\x10\x00\x12\x0f\n\x0bROLE_MODULE\x10\x01\x12\x11\n\rROLE_SOLUTION\x10\x02\"a\n\x15\x43ompositionProvenance\x12H\n\x07members\x18\x01 \x03(\x0b\x32..codefly.services.builder.v0.CompositionMemberR\x07members\"\xcc\x05\n\x11\x44\x65ploymentRequest\x12>\n\x0b\x65nvironment\x18\x01 \x01(\x0b\x32\x1c.codefly.base.v0.EnvironmentR\x0b\x65nvironment\x12G\n\ndeployment\x18\x02 \x01(\x0b\x32\'.codefly.services.builder.v0.DeploymentR\ndeployment\x12\x44\n\rconfiguration\x18\x03 \x01(\x0b\x32\x1e.codefly.base.v0.ConfigurationR\rconfiguration\x12_\n\x1b\x64\x65pendencies_configurations\x18\x04 \x03(\x0b\x32\x1e.codefly.base.v0.ConfigurationR\x1a\x64\x65pendenciesConfigurations\x12J\n\x10network_mappings\x18\x05 \x03(\x0b\x32\x1f.codefly.base.v0.NetworkMappingR\x0fnetworkMappings\x12\x63\n\x1d\x64\x65pendencies_network_mappings\x18\x06 \x03(\x0b\x32\x1f.codefly.base.v0.NetworkMappingR\x1b\x64\x65pendenciesNetworkMappings\x12@\n\texecution\x18\x07 \x01(\x0b\x32\".codefly.base.v0.ArtifactExecutionR\texecution\x12)\n\x10output_directory\x18\x08 \x01(\tR\x0foutputDirectory\x12i\n\x16\x63omposition_provenance\x18\t \x01(\x0b\x32\x32.codefly.services.builder.v0.CompositionProvenanceR\x15\x63ompositionProvenance\"\xe5\x01\n\x10\x44\x65ploymentStatus\x12J\n\x05state\x18\x01 \x01(\x0e\x32\x34.codefly.services.builder.v0.DeploymentStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"7\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x08\n\x04NOOP\x10\x03\"\xb7\x02\n\x12\x44\x65ploymentResponse\x12\x43\n\x05state\x18\x01 \x01(\x0b\x32-.codefly.services.builder.v0.DeploymentStatusR\x05state\x12\x44\n\rconfiguration\x18\x02 \x01(\x0b\x32\x1e.codefly.base.v0.ConfigurationR\rconfiguration\x12M\n\ndeployment\x18\x03 \x01(\x0b\x32-.codefly.services.builder.v0.DeploymentOutputR\ndeployment\x12G\n\texecution\x18\x04 \x01(\x0b\x32).codefly.base.v0.ArtifactExecutionReceiptR\texecution\"\x95\x01\n\x0c\x41uditRequest\x12)\n\x10include_outdated\x18\x01 \x01(\x08R\x0fincludeOutdated\x12 \n\x0c\x66\x61il_on_vuln\x18\x02 \x01(\x08R\nfailOnVuln\x12\x38\n\x18include_dev_dependencies\x18\x03 \x01(\x08R\x16includeDevDependencies\"\xc8\x02\n\x0c\x41uditFinding\x12N\n\x08severity\x18\x01 \x01(\x0e\x32\x32.codefly.services.builder.v0.AuditFinding.SeverityR\x08severity\x12\x0e\n\x02id\x18\x02 \x01(\tR\x02id\x12\x18\n\x07package\x18\x03 \x01(\tR\x07package\x12\'\n\x0f\x63urrent_version\x18\x04 \x01(\tR\x0e\x63urrentVersion\x12#\n\rfixed_version\x18\x05 \x01(\tR\x0c\x66ixedVersion\x12\x18\n\x07summary\x18\x06 \x01(\tR\x07summary\x12\x10\n\x03url\x18\x07 \x01(\tR\x03url\"D\n\x08Severity\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x07\n\x03LOW\x10\x01\x12\n\n\x06MEDIUM\x10\x02\x12\x08\n\x04HIGH\x10\x03\x12\x0c\n\x08\x43RITICAL\x10\x04\"\x85\x01\n\x0bOutdatedDep\x12\x18\n\x07package\x18\x01 \x01(\tR\x07package\x12\x18\n\x07\x63urrent\x18\x02 \x01(\tR\x07\x63urrent\x12\x1f\n\x0blatest_safe\x18\x03 \x01(\tR\nlatestSafe\x12!\n\x0clatest_major\x18\x04 \x01(\tR\x0blatestMajor\"\xee\x01\n\x0b\x41uditStatus\x12\x45\n\x05state\x18\x01 \x01(\x0e\x32/.codefly.services.builder.v0.AuditStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"J\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\t\n\x05\x43LEAN\x10\x01\x12\x0c\n\x08\x46INDINGS\x10\x02\x12\t\n\x05\x45RROR\x10\x03\x12\x0f\n\x0bUNSUPPORTED\x10\x04\"\x8c\x02\n\rAuditResponse\x12>\n\x05state\x18\x01 \x01(\x0b\x32(.codefly.services.builder.v0.AuditStatusR\x05state\x12\x45\n\x08\x66indings\x18\x02 \x03(\x0b\x32).codefly.services.builder.v0.AuditFindingR\x08\x66indings\x12\x44\n\x08outdated\x18\x03 \x03(\x0b\x32(.codefly.services.builder.v0.OutdatedDepR\x08outdated\x12\x12\n\x04tool\x18\x04 \x01(\tR\x04tool\x12\x1a\n\x08language\x18\x05 \x01(\tR\x08language\"\xd4\x01\n\x0cImageSubject\x12\x1c\n\treference\x18\x01 \x01(\tR\treference\x12\x16\n\x06\x64igest\x18\x02 \x01(\tR\x06\x64igest\x12\x1a\n\x08platform\x18\x03 \x01(\tR\x08platform\x12\x12\n\x04role\x18\x04 \x01(\tR\x04role\x12\x18\n\x07service\x18\x05 \x01(\tR\x07service\x12\x44\n\x06source\x18\x06 \x01(\x0e\x32,.codefly.services.builder.v0.ImageSourceKindR\x06source\"\xe4\x01\n\tImageSBOM\x12\x16\n\x06\x64igest\x18\x01 \x01(\tR\x06\x64igest\x12\x1a\n\x08platform\x18\x02 \x01(\tR\x08platform\x12\x45\n\x08subjects\x18\x03 \x03(\x0b\x32).codefly.services.builder.v0.ImageSubjectR\x08subjects\x12\x30\n\x03\x62om\x18\x04 \x01(\x0b\x32\x1e.codefly.services.agent.v0.BomR\x03\x62om\x12\x12\n\x04tool\x18\x05 \x01(\tR\x04tool\x12\x16\n\x06sha256\x18\x06 \x01(\tR\x06sha256\"\xcc\x01\n\x0bSBOMRequest\x12\x38\n\x18include_dev_dependencies\x18\x01 \x01(\x08R\x16includeDevDependencies\x12<\n\x05scope\x18\x02 \x01(\x0e\x32&.codefly.services.builder.v0.SBOMScopeR\x05scope\x12\x45\n\x08subjects\x18\x03 \x03(\x0b\x32).codefly.services.builder.v0.ImageSubjectR\x08subjects\"\xe1\x01\n\nSBOMStatus\x12\x44\n\x05state\x18\x01 \x01(\x0e\x32..codefly.services.builder.v0.SBOMStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"?\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0c\n\x08\x43OMPLETE\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"\x99\x03\n\x0cSBOMResponse\x12=\n\x05state\x18\x01 \x01(\x0b\x32\'.codefly.services.builder.v0.SBOMStatusR\x05state\x12\x30\n\x03\x62om\x18\x02 \x01(\x0b\x32\x1e.codefly.services.agent.v0.BomR\x03\x62om\x12\x12\n\x04tool\x18\x03 \x01(\tR\x04tool\x12\x1a\n\x08language\x18\x04 \x01(\tR\x08language\x12\x16\n\x06sha256\x18\x05 \x01(\tR\x06sha256\x12>\n\x06images\x18\x06 \x03(\x0b\x32&.codefly.services.builder.v0.ImageSBOMR\x06images\x12<\n\x05scope\x18\x07 \x01(\x0e\x32&.codefly.services.builder.v0.SBOMScopeR\x05scope\x12R\n\x0fno_image_reason\x18\x08 \x01(\x0e\x32*.codefly.services.builder.v0.NoImageReasonR\rnoImageReason\"C\n\rPackageTarget\x12\x0e\n\x02os\x18\x01 \x01(\tR\x02os\x12\"\n\x0c\x61rchitecture\x18\x02 \x01(\tR\x0c\x61rchitecture\"\\\n\x0ePackageSubject\x12\x1c\n\tpublisher\x18\x01 \x01(\tR\tpublisher\x12\x12\n\x04name\x18\x02 \x01(\tR\x04name\x12\x18\n\x07version\x18\x03 \x01(\tR\x07version\"\x90\x02\n\x0ePackageRequest\x12\x44\n\x07targets\x18\x01 \x03(\x0b\x32*.codefly.services.builder.v0.PackageTargetR\x07targets\x12)\n\x10output_directory\x18\x02 \x01(\tR\x0foutputDirectory\x12#\n\rartifact_name\x18\x03 \x01(\tR\x0c\x61rtifactName\x12!\n\x0cinclude_sbom\x18\x04 \x01(\x08R\x0bincludeSbom\x12\x45\n\x07subject\x18\x05 \x01(\x0b\x32+.codefly.services.builder.v0.PackageSubjectR\x07subject\"\xc6\x02\n\x0fPackageArtifact\x12\x45\n\x04kind\x18\x01 \x01(\x0e\x32\x31.codefly.services.builder.v0.PackageArtifact.KindR\x04kind\x12\x12\n\x04path\x18\x02 \x01(\tR\x04path\x12\x42\n\x06target\x18\x03 \x01(\x0b\x32*.codefly.services.builder.v0.PackageTargetR\x06target\x12\x16\n\x06sha256\x18\x04 \x01(\tR\x06sha256\x12\x1d\n\nmedia_type\x18\x05 \x01(\tR\tmediaType\x12\x18\n\x07\x63ommand\x18\x06 \x03(\tR\x07\x63ommand\"C\n\x04Kind\x12\x14\n\x10KIND_UNSPECIFIED\x10\x00\x12\x0e\n\nEXECUTABLE\x10\x01\x12\x0b\n\x07\x41RCHIVE\x10\x02\x12\x08\n\x04SBOM\x10\x03\"\xe6\x01\n\rPackageStatus\x12G\n\x05state\x18\x01 \x01(\x0e\x32\x31.codefly.services.builder.v0.PackageStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\">\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"\x9f\x01\n\x0fPackageResponse\x12@\n\x05state\x18\x01 \x01(\x0b\x32*.codefly.services.builder.v0.PackageStatusR\x05state\x12J\n\tartifacts\x18\x02 \x03(\x0b\x32,.codefly.services.builder.v0.PackageArtifactR\tartifacts\"G\n\x1aRunnableBuildInputsRequest\x12)\n\x10output_directory\x18\x01 \x01(\tR\x0foutputDirectory\"\xfe\x01\n\x19RunnableBuildInputsStatus\x12S\n\x05state\x18\x01 \x01(\x0e\x32=.codefly.services.builder.v0.RunnableBuildInputsStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\">\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\x12\x0f\n\x0bUNSUPPORTED\x10\x03\"\xa1\x01\n\x1bRunnableBuildInputsResponse\x12L\n\x05state\x18\x01 \x01(\x0b\x32\x36.codefly.services.builder.v0.RunnableBuildInputsStatusR\x05state\x12\x34\n\x05\x62uild\x18\x02 \x01(\x0b\x32\x1e.codefly.base.v0.RunnableBuildR\x05\x62uild\"b\n\x0eUpgradeRequest\x12#\n\rinclude_major\x18\x01 \x01(\x08R\x0cincludeMajor\x12\x17\n\x07\x64ry_run\x18\x02 \x01(\x08R\x06\x64ryRun\x12\x12\n\x04only\x18\x03 \x03(\tR\x04only\"M\n\rUpgradeChange\x12\x18\n\x07package\x18\x01 \x01(\tR\x07package\x12\x12\n\x04\x66rom\x18\x02 \x01(\tR\x04\x66rom\x12\x0e\n\x02to\x18\x03 \x01(\tR\x02to\"\xdf\x01\n\rUpgradeStatus\x12G\n\x05state\x18\x01 \x01(\x0e\x32\x31.codefly.services.builder.v0.UpgradeStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"7\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\x08\n\x04NOOP\x10\x02\x12\t\n\x05\x45RROR\x10\x03\"\xbe\x01\n\x0fUpgradeResponse\x12@\n\x05state\x18\x01 \x01(\x0b\x32*.codefly.services.builder.v0.UpgradeStatusR\x05state\x12\x44\n\x07\x63hanges\x18\x02 \x03(\x0b\x32*.codefly.services.builder.v0.UpgradeChangeR\x07\x63hanges\x12#\n\rlockfile_diff\x18\x03 \x01(\tR\x0clockfileDiff\"\xa9\x01\n\x0c\x43onfigChange\x12\x12\n\x04path\x18\x01 \x01(\tR\x04path\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value\x12<\n\x02op\x18\x03 \x01(\x0e\x32,.codefly.services.builder.v0.ConfigChange.OpR\x02op\"1\n\x02Op\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x07\n\x03SET\x10\x01\x12\n\n\x06\x41PPEND\x10\x02\x12\t\n\x05UNSET\x10\x03\"W\n\x10\x43onfigureRequest\x12\x43\n\x07\x63hanges\x18\x01 \x03(\x0b\x32).codefly.services.builder.v0.ConfigChangeR\x07\x63hanges\"\xd9\x01\n\x0f\x43onfigureStatus\x12I\n\x05state\x18\x01 \x01(\x0e\x32\x33.codefly.services.builder.v0.ConfigureStatus.StatusR\x05state\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x32\n\x07\x66\x61ilure\x18\x03 \x01(\x0b\x32\x18.codefly.base.v0.FailureR\x07\x66\x61ilure\"-\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\t\n\x05\x45RROR\x10\x02\"~\n\x11\x43onfigureResponse\x12\x42\n\x05state\x18\x01 \x01(\x0b\x32,.codefly.services.builder.v0.ConfigureStatusR\x05state\x12%\n\x0e\x65\x66\x66\x65\x63tive_yaml\x18\x02 \x01(\tR\reffectiveYaml\"\x1a\n\x18\x42uildCapabilitiesRequest\"\xc8\x01\n\x19\x42uildCapabilitiesResponse\x12)\n\x10\x62uildx_selection\x18\x01 \x01(\x08R\x0f\x62uildxSelection\x12/\n\x13\x65xecution_contracts\x18\x02 \x03(\tR\x12\x65xecutionContracts\x12O\n\x0cimage_inputs\x18\x03 \x03(\x0b\x32,.codefly.services.builder.v0.BuildImageInputR\x0bimageInputs*T\n\tSBOMScope\x12\x1a\n\x16SBOM_SCOPE_UNSPECIFIED\x10\x00\x12\x15\n\x11SBOM_SCOPE_SOURCE\x10\x01\x12\x14\n\x10SBOM_SCOPE_IMAGE\x10\x02*v\n\rNoImageReason\x12\x1f\n\x1bNO_IMAGE_REASON_UNSPECIFIED\x10\x00\x12\x1c\n\x18NO_IMAGE_REASON_NO_IMAGE\x10\x01\x12&\n\"NO_IMAGE_REASON_EXTERNALLY_MANAGED\x10\x02*y\n\x0fImageSourceKind\x12!\n\x1dIMAGE_SOURCE_KIND_UNSPECIFIED\x10\x00\x12\x1e\n\x1aIMAGE_SOURCE_KIND_REGISTRY\x10\x01\x12#\n\x1fIMAGE_SOURCE_KIND_DOCKER_DAEMON\x10\x02\x32\xaf\x0c\n\x07\x42uilder\x12]\n\x04Load\x12(.codefly.services.builder.v0.LoadRequest\x1a).codefly.services.builder.v0.LoadResponse\"\x00\x12]\n\x04Init\x12(.codefly.services.builder.v0.InitRequest\x1a).codefly.services.builder.v0.InitResponse\"\x00\x12\x63\n\x06\x43reate\x12*.codefly.services.builder.v0.CreateRequest\x1a+.codefly.services.builder.v0.CreateResponse\"\x00\x12\x63\n\x06Update\x12*.codefly.services.builder.v0.UpdateRequest\x1a+.codefly.services.builder.v0.UpdateResponse\"\x00\x12]\n\x04Sync\x12(.codefly.services.builder.v0.SyncRequest\x1a).codefly.services.builder.v0.SyncResponse\"\x00\x12`\n\x05\x42uild\x12).codefly.services.builder.v0.BuildRequest\x1a*.codefly.services.builder.v0.BuildResponse\"\x00\x12\x84\x01\n\x11\x42uildCapabilities\x12\x35.codefly.services.builder.v0.BuildCapabilitiesRequest\x1a\x36.codefly.services.builder.v0.BuildCapabilitiesResponse\"\x00\x12k\n\x06\x44\x65ploy\x12..codefly.services.builder.v0.DeploymentRequest\x1a/.codefly.services.builder.v0.DeploymentResponse\"\x00\x12`\n\x05\x41udit\x12).codefly.services.builder.v0.AuditRequest\x1a*.codefly.services.builder.v0.AuditResponse\"\x00\x12]\n\x04SBOM\x12(.codefly.services.builder.v0.SBOMRequest\x1a).codefly.services.builder.v0.SBOMResponse\"\x00\x12\x66\n\x07Package\x12+.codefly.services.builder.v0.PackageRequest\x1a,.codefly.services.builder.v0.PackageResponse\"\x00\x12\x8a\x01\n\x13RunnableBuildInputs\x12\x37.codefly.services.builder.v0.RunnableBuildInputsRequest\x1a\x38.codefly.services.builder.v0.RunnableBuildInputsResponse\"\x00\x12\x66\n\x07Upgrade\x12+.codefly.services.builder.v0.UpgradeRequest\x1a,.codefly.services.builder.v0.UpgradeResponse\"\x00\x12l\n\tConfigure\x12-.codefly.services.builder.v0.ConfigureRequest\x1a..codefly.services.builder.v0.ConfigureResponse\"\x00\x12[\n\x0b\x43ommunicate\x12!.codefly.services.agent.v0.Answer\x1a#.codefly.services.agent.v0.Question\"\x00(\x01\x30\x01\x62\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
 _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'codefly.services.builder.v0.builder_pb2', _globals)
 if not _descriptor._USE_C_DESCRIPTORS:
   DESCRIPTOR._loaded_options = None
-  _globals['_SBOMSCOPE']._serialized_start=11057
-  _globals['_SBOMSCOPE']._serialized_end=11141
-  _globals['_NOIMAGEREASON']._serialized_start=11143
-  _globals['_NOIMAGEREASON']._serialized_end=11261
-  _globals['_IMAGESOURCEKIND']._serialized_start=11263
-  _globals['_IMAGESOURCEKIND']._serialized_end=11384
+  _globals['_SBOMSCOPE']._serialized_start=11139
+  _globals['_SBOMSCOPE']._serialized_end=11223
+  _globals['_NOIMAGEREASON']._serialized_start=11225
+  _globals['_NOIMAGEREASON']._serialized_end=11343
+  _globals['_IMAGESOURCEKIND']._serialized_start=11345
+  _globals['_IMAGESOURCEKIND']._serialized_end=11466
   _globals['_LOADSTATUS']._serialized_start=522
   _globals['_LOADSTATUS']._serialized_end=727
   _globals['_LOADSTATUS_STATUS']._serialized_start=684
@@ -193,8 +193,8 @@
   _globals['_CONFIGURERESPONSE']._serialized_end=10906
   _globals['_BUILDCAPABILITIESREQUEST']._serialized_start=10908
   _globals['_BUILDCAPABILITIESREQUEST']._serialized_end=10934
-  _globals['_BUILDCAPABILITIESRESPONSE']._serialized_start=10936
-  _globals['_BUILDCAPABILITIESRESPONSE']._serialized_end=11055
-  _globals['_BUILDER']._serialized_start=11387
-  _globals['_BUILDER']._serialized_end=12970
+  _globals['_BUILDCAPABILITIESRESPONSE']._serialized_start=10937
+  _globals['_BUILDCAPABILITIESRESPONSE']._serialized_end=11137
+  _globals['_BUILDER']._serialized_start=11469
+  _globals['_BUILDER']._serialized_end=13052
 # @@protoc_insertion_point(module_scope)
diff --git a/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/docker_pb2.py b/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/docker_pb2.py
index c90fbc7e..09e7b645 100644
--- a/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/docker_pb2.py
+++ b/generated/python/codefly-cli/codefly_cli/codefly/services/builder/v0/docker_pb2.py
@@ -24,7 +24,7 @@
 
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(codefly/services/builder/v0/docker.proto\x12\x1b\x63odefly.services.builder.v0\"\xd1\x01\n\x12\x44ockerBuildContext\x12+\n\x11\x64ocker_repository\x18\x01 \x01(\tR\x10\x64ockerRepository\x12!\n\x0cimage_digest\x18\x02 \x01(\tR\x0bimageDigest\x12\x44\n\x05\x63\x61\x63he\x18\x03 \x01(\x0b\x32..codefly.services.builder.v0.BuildCacheOptionsR\x05\x63\x61\x63he\x12%\n\x0e\x62uildx_builder\x18\x04 \x01(\tR\rbuildxBuilder\"+\n\x11\x44ockerBuildResult\x12\x16\n\x06images\x18\x01 \x03(\tR\x06images\"L\n\nRecipeFile\x12\x12\n\x04path\x18\x01 \x01(\tR\x04path\x12\x16\n\x06\x64igest\x18\x02 \x01(\tR\x06\x64igest\x12\x12\n\x04mode\x18\x03 \x01(\rR\x04mode\"\x81\x05\n\x11\x44ockerBuildRecipe\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x1e\n\ndockerfile\x18\x02 \x01(\tR\ndockerfile\x12\x18\n\x07\x63ontext\x18\x03 \x01(\tR\x07\x63ontext\x12\"\n\x0c\x64ockerignore\x18\x04 \x01(\tR\x0c\x64ockerignore\x12\x14\n\x05image\x18\x05 \x01(\tR\x05image\x12\x1c\n\tplatforms\x18\x06 \x03(\tR\tplatforms\x12\\\n\nbuild_args\x18\x07 \x03(\x0b\x32=.codefly.services.builder.v0.DockerBuildRecipe.BuildArgsEntryR\tbuildArgs\x12\x16\n\x06target\x18\x08 \x01(\tR\x06target\x12Q\n\x0c\x63ontext_root\x18\t \x01(\x0e\x32..codefly.services.builder.v0.RecipeContextRootR\x0b\x63ontextRoot\x12]\n\x13go_module_downloads\x18\n \x03(\x0b\x32-.codefly.services.builder.v0.GoModuleDownloadR\x11goModuleDownloads\x12`\n\x14git_source_downloads\x18\x0b \x03(\x0b\x32..codefly.services.builder.v0.GitSourceDownloadR\x12gitSourceDownloads\x1a<\n\x0e\x42uildArgsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\"X\n\x10GoModuleDownload\x12\x1f\n\x0bmodule_root\x18\x01 \x01(\tR\nmoduleRoot\x12#\n\rproxy_context\x18\x02 \x01(\tR\x0cproxyContext\"r\n\x11GitSourceDownload\x12\x1e\n\nrepository\x18\x01 \x01(\tR\nrepository\x12\x16\n\x06\x63ommit\x18\x02 \x01(\tR\x06\x63ommit\x12%\n\x0emirror_context\x18\x03 \x01(\tR\rmirrorContext\"\xa6\x02\n\x0f\x44ockerBuildPlan\x12H\n\x07recipes\x18\x01 \x03(\x0b\x32..codefly.services.builder.v0.DockerBuildRecipeR\x07recipes\x12=\n\x05\x66iles\x18\x02 \x03(\x0b\x32\'.codefly.services.builder.v0.RecipeFileR\x05\x66iles\x12\x16\n\x06\x64igest\x18\x03 \x01(\tR\x06\x64igest\x12)\n\x10\x63ontract_version\x18\x04 \x01(\tR\x0f\x63ontractVersion\x12G\n\x05scope\x18\x05 \x01(\x0e\x32\x31.codefly.services.builder.v0.RecipeInventoryScopeR\x05scope\"\x8b\x01\n\x11\x42uildCacheOptions\x12\x18\n\x07imports\x18\x01 \x03(\tR\x07imports\x12\x18\n\x07\x65xports\x18\x02 \x03(\tR\x07\x65xports\x12\x14\n\x05scope\x18\x03 \x01(\tR\x05scope\x12\x12\n\x04mode\x18\x04 \x01(\tR\x04mode\x12\x18\n\x07\x62\x61\x63kend\x18\x05 \x01(\tR\x07\x62\x61\x63kend*y\n\x11RecipeContextRoot\x12#\n\x1fRECIPE_CONTEXT_ROOT_UNSPECIFIED\x10\x00\x12\x1f\n\x1bRECIPE_CONTEXT_ROOT_SERVICE\x10\x01\x12\x1e\n\x1aRECIPE_CONTEXT_ROOT_OUTPUT\x10\x02*\x83\x01\n\x14RecipeInventoryScope\x12&\n\"RECIPE_INVENTORY_SCOPE_UNSPECIFIED\x10\x00\x12\"\n\x1eRECIPE_INVENTORY_SCOPE_EMITTED\x10\x01\x12\x1f\n\x1bRECIPE_INVENTORY_SCOPE_TREE\x10\x02\x62\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(codefly/services/builder/v0/docker.proto\x12\x1b\x63odefly.services.builder.v0\"\xa6\x02\n\x12\x44ockerBuildContext\x12+\n\x11\x64ocker_repository\x18\x01 \x01(\tR\x10\x64ockerRepository\x12!\n\x0cimage_digest\x18\x02 \x01(\tR\x0bimageDigest\x12\x44\n\x05\x63\x61\x63he\x18\x03 \x01(\x0b\x32..codefly.services.builder.v0.BuildCacheOptionsR\x05\x63\x61\x63he\x12%\n\x0e\x62uildx_builder\x18\x04 \x01(\tR\rbuildxBuilder\x12S\n\x0eimage_bindings\x18\x05 \x03(\x0b\x32,.codefly.services.builder.v0.BuildImageInputR\rimageBindings\"]\n\x0f\x42uildImageInput\x12\x12\n\x04role\x18\x01 \x01(\tR\x04role\x12\x1c\n\treference\x18\x02 \x01(\tR\treference\x12\x18\n\x07variant\x18\x03 \x01(\tR\x07variant\"+\n\x11\x44ockerBuildResult\x12\x16\n\x06images\x18\x01 \x03(\tR\x06images\"L\n\nRecipeFile\x12\x12\n\x04path\x18\x01 \x01(\tR\x04path\x12\x16\n\x06\x64igest\x18\x02 \x01(\tR\x06\x64igest\x12\x12\n\x04mode\x18\x03 \x01(\rR\x04mode\"\x81\x05\n\x11\x44ockerBuildRecipe\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x1e\n\ndockerfile\x18\x02 \x01(\tR\ndockerfile\x12\x18\n\x07\x63ontext\x18\x03 \x01(\tR\x07\x63ontext\x12\"\n\x0c\x64ockerignore\x18\x04 \x01(\tR\x0c\x64ockerignore\x12\x14\n\x05image\x18\x05 \x01(\tR\x05image\x12\x1c\n\tplatforms\x18\x06 \x03(\tR\tplatforms\x12\\\n\nbuild_args\x18\x07 \x03(\x0b\x32=.codefly.services.builder.v0.DockerBuildRecipe.BuildArgsEntryR\tbuildArgs\x12\x16\n\x06target\x18\x08 \x01(\tR\x06target\x12Q\n\x0c\x63ontext_root\x18\t \x01(\x0e\x32..codefly.services.builder.v0.RecipeContextRootR\x0b\x63ontextRoot\x12]\n\x13go_module_downloads\x18\n \x03(\x0b\x32-.codefly.services.builder.v0.GoModuleDownloadR\x11goModuleDownloads\x12`\n\x14git_source_downloads\x18\x0b \x03(\x0b\x32..codefly.services.builder.v0.GitSourceDownloadR\x12gitSourceDownloads\x1a<\n\x0e\x42uildArgsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\"X\n\x10GoModuleDownload\x12\x1f\n\x0bmodule_root\x18\x01 \x01(\tR\nmoduleRoot\x12#\n\rproxy_context\x18\x02 \x01(\tR\x0cproxyContext\"r\n\x11GitSourceDownload\x12\x1e\n\nrepository\x18\x01 \x01(\tR\nrepository\x12\x16\n\x06\x63ommit\x18\x02 \x01(\tR\x06\x63ommit\x12%\n\x0emirror_context\x18\x03 \x01(\tR\rmirrorContext\"\xa6\x02\n\x0f\x44ockerBuildPlan\x12H\n\x07recipes\x18\x01 \x03(\x0b\x32..codefly.services.builder.v0.DockerBuildRecipeR\x07recipes\x12=\n\x05\x66iles\x18\x02 \x03(\x0b\x32\'.codefly.services.builder.v0.RecipeFileR\x05\x66iles\x12\x16\n\x06\x64igest\x18\x03 \x01(\tR\x06\x64igest\x12)\n\x10\x63ontract_version\x18\x04 \x01(\tR\x0f\x63ontractVersion\x12G\n\x05scope\x18\x05 \x01(\x0e\x32\x31.codefly.services.builder.v0.RecipeInventoryScopeR\x05scope\"\x8b\x01\n\x11\x42uildCacheOptions\x12\x18\n\x07imports\x18\x01 \x03(\tR\x07imports\x12\x18\n\x07\x65xports\x18\x02 \x03(\tR\x07\x65xports\x12\x14\n\x05scope\x18\x03 \x01(\tR\x05scope\x12\x12\n\x04mode\x18\x04 \x01(\tR\x04mode\x12\x18\n\x07\x62\x61\x63kend\x18\x05 \x01(\tR\x07\x62\x61\x63kend*y\n\x11RecipeContextRoot\x12#\n\x1fRECIPE_CONTEXT_ROOT_UNSPECIFIED\x10\x00\x12\x1f\n\x1bRECIPE_CONTEXT_ROOT_SERVICE\x10\x01\x12\x1e\n\x1aRECIPE_CONTEXT_ROOT_OUTPUT\x10\x02*\x83\x01\n\x14RecipeInventoryScope\x12&\n\"RECIPE_INVENTORY_SCOPE_UNSPECIFIED\x10\x00\x12\"\n\x1eRECIPE_INVENTORY_SCOPE_EMITTED\x10\x01\x12\x1f\n\x1bRECIPE_INVENTORY_SCOPE_TREE\x10\x02\x62\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -33,26 +33,28 @@
   DESCRIPTOR._loaded_options = None
   _globals['_DOCKERBUILDRECIPE_BUILDARGSENTRY']._loaded_options = None
   _globals['_DOCKERBUILDRECIPE_BUILDARGSENTRY']._serialized_options = b'8\001'
-  _globals['_RECIPECONTEXTROOT']._serialized_start=1697
-  _globals['_RECIPECONTEXTROOT']._serialized_end=1818
-  _globals['_RECIPEINVENTORYSCOPE']._serialized_start=1821
-  _globals['_RECIPEINVENTORYSCOPE']._serialized_end=1952
+  _globals['_RECIPECONTEXTROOT']._serialized_start=1877
+  _globals['_RECIPECONTEXTROOT']._serialized_end=1998
+  _globals['_RECIPEINVENTORYSCOPE']._serialized_start=2001
+  _globals['_RECIPEINVENTORYSCOPE']._serialized_end=2132
   _globals['_DOCKERBUILDCONTEXT']._serialized_start=74
-  _globals['_DOCKERBUILDCONTEXT']._serialized_end=283
-  _globals['_DOCKERBUILDRESULT']._serialized_start=285
-  _globals['_DOCKERBUILDRESULT']._serialized_end=328
-  _globals['_RECIPEFILE']._serialized_start=330
-  _globals['_RECIPEFILE']._serialized_end=406
-  _globals['_DOCKERBUILDRECIPE']._serialized_start=409
-  _globals['_DOCKERBUILDRECIPE']._serialized_end=1050
-  _globals['_DOCKERBUILDRECIPE_BUILDARGSENTRY']._serialized_start=990
-  _globals['_DOCKERBUILDRECIPE_BUILDARGSENTRY']._serialized_end=1050
-  _globals['_GOMODULEDOWNLOAD']._serialized_start=1052
-  _globals['_GOMODULEDOWNLOAD']._serialized_end=1140
-  _globals['_GITSOURCEDOWNLOAD']._serialized_start=1142
-  _globals['_GITSOURCEDOWNLOAD']._serialized_end=1256
-  _globals['_DOCKERBUILDPLAN']._serialized_start=1259
-  _globals['_DOCKERBUILDPLAN']._serialized_end=1553
-  _globals['_BUILDCACHEOPTIONS']._serialized_start=1556
-  _globals['_BUILDCACHEOPTIONS']._serialized_end=1695
+  _globals['_DOCKERBUILDCONTEXT']._serialized_end=368
+  _globals['_BUILDIMAGEINPUT']._serialized_start=370
+  _globals['_BUILDIMAGEINPUT']._serialized_end=463
+  _globals['_DOCKERBUILDRESULT']._serialized_start=465
+  _globals['_DOCKERBUILDRESULT']._serialized_end=508
+  _globals['_RECIPEFILE']._serialized_start=510
+  _globals['_RECIPEFILE']._serialized_end=586
+  _globals['_DOCKERBUILDRECIPE']._serialized_start=589
+  _globals['_DOCKERBUILDRECIPE']._serialized_end=1230
+  _globals['_DOCKERBUILDRECIPE_BUILDARGSENTRY']._serialized_start=1170
+  _globals['_DOCKERBUILDRECIPE_BUILDARGSENTRY']._serialized_end=1230
+  _globals['_GOMODULEDOWNLOAD']._serialized_start=1232
+  _globals['_GOMODULEDOWNLOAD']._serialized_end=1320
+  _globals['_GITSOURCEDOWNLOAD']._serialized_start=1322
+  _globals['_GITSOURCEDOWNLOAD']._serialized_end=1436
+  _globals['_DOCKERBUILDPLAN']._serialized_start=1439
+  _globals['_DOCKERBUILDPLAN']._serialized_end=1733
+  _globals['_BUILDCACHEOPTIONS']._serialized_start=1736
+  _globals['_BUILDCACHEOPTIONS']._serialized_end=1875
 # @@protoc_insertion_point(module_scope)
diff --git a/proto/codefly/services/builder/v0/builder.proto b/proto/codefly/services/builder/v0/builder.proto
index 09daa302..34888203 100644
--- a/proto/codefly/services/builder/v0/builder.proto
+++ b/proto/codefly/services/builder/v0/builder.proto
@@ -959,6 +959,10 @@ message BuildCapabilitiesResponse {
   bool buildx_selection = 1;
   // execution_contracts lists artifact bindings honored by Build and Deploy.
   repeated string execution_contracts = 2;
+  // image_inputs declares the loaded service's external image roles and
+  // supported recipe variants. Meaningful only with base-image-bindings/v1;
+  // it must reflect service settings, including native-library requirements.
+  repeated BuildImageInput image_inputs = 3;
 }
 
 // Builder is responsible for:
diff --git a/proto/codefly/services/builder/v0/docker.proto b/proto/codefly/services/builder/v0/docker.proto
index f63e9268..3274e534 100644
--- a/proto/codefly/services/builder/v0/docker.proto
+++ b/proto/codefly/services/builder/v0/docker.proto
@@ -12,6 +12,24 @@ message DockerBuildContext {
   BuildCacheOptions cache = 3;
   // buildx_builder selects the caller-owned Buildx executor for in-agent builds.
   string buildx_builder = 4;
+  // image_bindings selects exact external images for agent-declared roles.
+  // Requires the live base-image-bindings/v1 execution contract. The agent
+  // renders these references; callers must never rewrite its Dockerfile.
+  repeated BuildImageInput image_bindings = 5;
+}
+
+// BuildImageInput names an external image and the recipe variant consuming it.
+// In capabilities it declares a role's default; in a build request it binds
+// that role to an immutable replacement. Roles and variants are agent-owned.
+message BuildImageInput {
+  // role is unique within the loaded service's image inputs.
+  string role = 1;
+  // reference is a fully qualified image pinned by sha256 digest, or scratch.
+  string reference = 2;
+  // variant names the recipe's compatibility requirements, such as its OS/ABI
+  // and toolchain family. A different variant requires agent implementation;
+  // a registry relocation alone does not change it.
+  string variant = 3;
 }
 
 // DockerBuildResult captures Docker image references produced by a build.

From a8097533023a301e3f5e0deec9d3e9e2e1ede07c Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Thu, 29 Oct 2026 11:31:32 -0400
Subject: [PATCH 2/3] test(contract): keep image bindings explicitly optional

---
 agents/contract/contract_test.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/agents/contract/contract_test.go b/agents/contract/contract_test.go
index 7273644d..13f4222d 100644
--- a/agents/contract/contract_test.go
+++ b/agents/contract/contract_test.go
@@ -11,7 +11,8 @@ import (
 )
 
 func TestOperationSupportDoesNotAdvertiseExecutorAdoption(t *testing.T) {
-	require.Equal(t, []string{artifactexecution.Contract, RuntimeInitDependencyMappings, "codefly.dev/docker-build-recipe/v4", "codefly.dev/docker-build-recipe/v5", "codefly.dev/docker-build-recipe/v6", ConfigurationValueTemplate, RuntimeInitImage, DeploymentCompositionProvenance, RuntimeStartedArtifact, RuntimeBackendDeclaration}, SupportedOperationContracts())
+	require.Equal(t, []string{"base-image-bindings/v1", artifactexecution.Contract, RuntimeInitDependencyMappings, "codefly.dev/docker-build-recipe/v4", "codefly.dev/docker-build-recipe/v5", "codefly.dev/docker-build-recipe/v6", ConfigurationValueTemplate, RuntimeInitImage, DeploymentCompositionProvenance, RuntimeStartedArtifact, RuntimeBackendDeclaration}, SupportedOperationContracts())
+	require.NotContains(t, Current().Capabilities, "base-image-bindings/v1")
 	require.NotContains(t, Current().Capabilities, artifactexecution.Contract)
 	require.NotContains(t, Current().Capabilities, RuntimeInitDependencyMappings)
 	require.NotContains(t, Current().Capabilities, RuntimeInitImage)
@@ -29,7 +30,7 @@ func TestOperationSupportDoesNotAdvertiseExecutorAdoption(t *testing.T) {
 	// supported_backends unset look like one that can run nowhere on this host.
 	require.NotContains(t, Current().Capabilities, RuntimeBackendDeclaration)
 	SupportedOperationContracts()[0] = "changed"
-	require.Equal(t, []string{artifactexecution.Contract, RuntimeInitDependencyMappings, "codefly.dev/docker-build-recipe/v4", "codefly.dev/docker-build-recipe/v5", "codefly.dev/docker-build-recipe/v6", ConfigurationValueTemplate, RuntimeInitImage, DeploymentCompositionProvenance, RuntimeStartedArtifact, RuntimeBackendDeclaration}, SupportedOperationContracts())
+	require.Equal(t, []string{"base-image-bindings/v1", artifactexecution.Contract, RuntimeInitDependencyMappings, "codefly.dev/docker-build-recipe/v4", "codefly.dev/docker-build-recipe/v5", "codefly.dev/docker-build-recipe/v6", ConfigurationValueTemplate, RuntimeInitImage, DeploymentCompositionProvenance, RuntimeStartedArtifact, RuntimeBackendDeclaration}, SupportedOperationContracts())
 }
 
 func TestCheck(t *testing.T) {

From ee256031e91c8eb62da5d8847fde40fb304309a2 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Thu, 29 Oct 2026 12:58:48 -0400
Subject: [PATCH 3/3] chore(release): prepare core v0.19.18

---
 version/info.codefly.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version/info.codefly.yaml b/version/info.codefly.yaml
index 18b02220..74a59248 100644
--- a/version/info.codefly.yaml
+++ b/version/info.codefly.yaml
@@ -1 +1 @@
-version: 0.19.17
+version: 0.19.18