Compatibility

Scope

This document records the execution contract and environments for which the repository has concrete evidence. It is not a general support matrix, a production-readiness statement, or a performance-portability claim.

The documented public interface is ./poc.sh. Direct execution of the Python modules or Java fixture on the host is outside the supported path.

Host interface

Component	Requirement
Bash	Required to run poc.sh. No minimum Bash version has been established.
Docker	A Docker CLI connected to a Linux Docker Engine is required. No minimum Engine version has been established.
Docker Compose	The plugin-style docker compose interface is required. This does not require a version number beginning with 2; no minimum plugin version has been established.
Git	Optional for execution. When available, the launcher records the observed commit and worktree state. Without Git, source revision metadata is caller-asserted or unavailable.
jq	Used by CI and optional inspection examples; it is not required by poc.sh.
Output directory	The repository must permit creation of a real, writable, non-symlink .runs/ directory that Docker can bind mount.
Container identity	AQUILA_UID and AQUILA_GID, whether supplied or derived from id, must be positive decimal values from 1 through 2,147,483,647.

The build uses --pull and pinned registry digests. A first build therefore requires registry access unless every required manifest and layer is already available locally. Runtime networking is disabled separately.

Pinned container runtime

Component	Fixed value
Dockerfile frontend	docker/dockerfile:1.18@sha256:dabfc0969b935b2080555ace70ee69a5261af8a8f1b4df97b9e7fbcf6722eddf
Python image	python:3.13.14-slim-bookworm@sha256:67a1e1f215ccda113cfc024e8639049257e88f273898f595b61476d128d387e8
Java image	eclipse-temurin:25.0.3_9-jdk-noble@sha256:735baf2edc6cd6485240144a84fa4db142b9a6f47b4eb4080f31058d200f9813
Python runtime	CPython 3.13.14
Java runtime	Eclipse Temurin 25.0.3+9
Java compilation target	Java 25, classfile major version 69
Python dependencies	Python standard library only; no third-party Python packages are installed.

The implementation requires a Linux container and Linux process facilities, including /proc, process groups, signals, file descriptors, and filesystem permission semantics. The pinned base-image references are multi-architecture OCI indexes, but index availability is not execution evidence for every architecture.

Runtime posture and bounds

The Compose service requests, and the runtime manifest verifies where observable:

• a non-root process;
• no Linux capabilities;
• no-new-privileges;
• a read-only application filesystem;
• no externally visible network interface;
• a 1 GiB container memory limit;
• a 512-process container limit;
• a 1,024-file-descriptor container limit; and
• a 512 MiB /tmp tmpfs with noexec, nosuid, and nodev.

The process controller separately applies the fixed stage limits declared in poc/definition.json:

Limit	Value
Wall timeout	90 seconds
CPU time	90 seconds
Resident memory	512 MiB
Processes	64
Threads	256
File descriptors	512
One unit's output	64 MiB
Complete run output	1 GiB
Host available-memory floor	1 GiB
Output-filesystem free-space floor	256 MiB

These are experiment safety boundaries, not production capacity or service-level objectives.

Exercised environments

Environment	Evidence
Local final Python review, 2026-08-15	Commit 0564bc9c619a4827a014c8920c8e30818f31c7a8 completed the 39 contracts, real canary, complete four-unit POC, four official negative cases, artifact probes, and independent check on Debian 13.6 under WSL2 x86_64, Docker Engine 29.7.2, Docker Compose v5.3.1, Buildx 0.36.0-desktop.1, and Bash 5.2.37. The built runtime was linux/amd64.
GitHub Actions configuration	The workflow targets the floating ubuntu-latest runner and gates build, test, complete run, independent check, and the compact public outcome. It has no operating-system, architecture, Docker, or Compose version matrix.

Observed tool versions are evidence of known execution, not minimum supported versions. Host Python and Java installations are not dependencies of the public containerized path.

Documentation-only tooling

Building or previewing the VitePress site is a separate authoring workflow. It requires Node.js >=22.12 <23 and an npm implementation that can consume the committed lockfile. The repository fixes VitePress 2.0.0-alpha.19 and Vue 3.5.41 exactly; the prerelease is intentionally contained within the static documentation boundary and does not enter the POC image or runtime.

The verified documentation install and build commands are:

npm ci --ignore-scripts
npm run docs:check

The POC commands do not require Node.js, npm, VitePress, Vue, PlantUML, Java, or Graphviz on the host. Java and its inspection tools remain supplied by the pinned container for the POC itself; PlantUML and Graphviz are authoring tools only when diagram sources change.

Not established

The repository does not currently establish compatibility with:

• native Windows containers;
• direct host execution;
• Docker Compose v1 or the docker-compose command;
• Podman or another Docker-compatible implementation;
• rootless or remote Docker configurations as distinct tested environments;
• a complete arm64, ppc64le, or other non-amd64 POC run; or
• any particular timing, throughput, capacity, or production behavior across hosts.

When reporting a portability result, include the exact commit, Docker Engine and Compose versions, host operating system and architecture, command, exit status, public output, runtime manifest, and smallest relevant standard-error log. See CONTRIBUTING.md and TROUBLESHOOTING.md.