[antoinetoussaint-byte]

Attached Next applications could not build from source-dir: . or a custom directory, declared sibling npm packages/archives were absent from the Docker context, and the SSR recipe assumed .next/standalone/server.js. The recipe now projects declared inputs with their relative layout and packages the application's actual configured standalone output, including .next-build and nested tracing-root servers. Static exports refuse pre-existing output before invoking the build, so a successful no-op cannot publish stale files.

The same delivery refreshes the build/SSR substrate to Node 24.22.1-alpine3.24@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 and reuses the exact nginx 1.31.7-alpine@sha256:892bb2152464f0c5d8972593a5f5afaf8054552580b699d95f8ff4af08c2d33d change from existing #181 (21761d4). Both indexes include linux/amd64 and linux/arm64. Read-only inspection of both Node platforms found Alpine 3.24.3 and libssl3/libcrypto3 3.5.9-r0; this is base provenance, not final-image security qualification. The development runtime companion is separate and unchanged.

Core is pinned to published v0.19.13, origin 224633233e5ddfc303ebf05d6e766fdfbc9c57e1, module sum h1:PdBd4JZhNSr/IRlm2Xic6R3vsZyPRhhCC2NDmquXh3E=. All seven reviewed effective-environment correction files at Core 0772bc0 are byte-identical in the published module. Normal builds therefore retain exact-key last-wins handling and complete winner metadata without depending on a local workfile. The module also updates proto-companion code and transitive dependencies; this is not a claim of whole-module equivalence.

This is a fix at the Next packaging owner. It reuses the existing manifest/lock readers, ordinary npm installs, Core OUTPUT/TREE recipe transport and destination preparation, the existing Docker ignore matcher, and installed Next configuration/build metadata. It adds no Core protocol, import inference, dependency resolver, registry, hosted npm-start fallback, runtime launcher, or NYL label scheme. Package-parent containment is supported; dependency cycles, absent/absolute inputs, symlinks, output/source overlap and unowned staging collisions are refused. TREE verification catches added as well as changed files. Unrelated caller output survives. Full-source install layering intentionally trades dependency-cache reuse for correct npm lifecycle scripts.

Documentation updated in templates/agent/README.md.tmpl and .claude/skills/verify-changes/SKILL.md: declared-input/output contracts, pin ownership, freshness, cache tradeoff and the additional real-framework checks. This is the single source-delivery successor to merged #183; it preserves that history and combines the accepted packaging, freshness and base changes rather than splitting a stack.

Validation:

• With GOWORK=off and Core v0.19.13: go build ./..., go vet ./..., go mod tidy -diff, and 196 tests pass using go test -json -skip 'TestNextjsLifecycle_Matrix/(docker|nix)' -count=1 ./....
• Published Core's affected environment/carrier/render tests pass under -race, including duplicate 134 bindings, metadata precedence, distinct aliases and genuine size-limit refusals.
• Retained packaging evidence: actual default/custom-source Load/Build tests, declared sibling/archive/copied-leaf/parent projection and npm installs, exact consumer closure, real Next 16.4.1 root/nested standalone builds and static export. The static stale-output regression fails against the prior helper and passes after correction; missing/mismatched/nonstandalone output refusals are covered. Those opt-in compiler/consumer checks retain their original source attribution rather than being claimed as rerun for every dependency change.
• Affected recipe/template/multiarchitecture/identity and served-README checks pass for the new image pins. Accepted local native artifacts and earlier failure evidence remain frozen; new source artifacts are identified by source/binary/SBOM hashes, never the unchanged local version string alone.

Limits: local Docker/Nix lifecycle arms were excluded to avoid the active Blue engine allocation. CreateToRun, manifest-render and actual-native-owner lifecycle opt-ins were not run in the ordinary local suite; native discovery and proto-companion conformance run in hosted CI. No fresh ownerdeath fixture or local engine operation was performed. Blue owns actual maintained image builds, GAR/GHCR digest mapping, final-runner scans/Node measurements, and health/page/static-asset proof. Those final-image gates are still outstanding; a copied deps-stage apk record is not final-runner inventory. A new agent version must be published through maintained codefly publish patch after qualification; these local 0.0.169 artifacts are not a new release.

Current delivery head is 37819f787303a79798ecad1bb845650a76cee698. The maintained native-only build with GOWORK=off produced binary SHA256 c727f29aa881b0e3cbc3acde83964c14d5f0118938a3683cc98472281c67b3ff and SBOM SHA256 8b64c4ea0ee62b6a3d24980f0e70f7df039fdf78ce68ead2f544c971f8df1180; actual Go metadata and the SBOM identify Core v0.19.13, with no replacement. The initial local no-space failure is retained; the retry passed after clearing only this task's disposable Go build cache.

Hosted run 40769464360 at that exact head passed build, tests, manifest guard and effective-inputs conformance. Sync conformance failed because published Core selects ghcr.io/codefly-dev/proto:0.0.21, whose public manifest currently returns 404 MANIFEST_UNKNOWN. Core's existing maintained companion publisher is active; no downgrade, skip, duplicate publisher or blind retry is used. Merge is held until that dependency is available and exact-head conformance passes.