Building VM Images

Overview

Capsem image builds are profile-led.

• config/profiles/<profile_id>/profile.toml is the profile ledger.
• Profile sibling files own packages, MCP declarations, rule files, detection files, tips, build-time hooks, and packaged guest root seed files.
• capsem-admin validates profile-owned inputs and materializes the generated backend build workspace.
• The Python builder backend renders Docker templates and emits assets, build ledgers, and OBOMs only when invoked by the admin build rail. Do not add product truth directly to the backend image-spec path.

Source Layout

Read config/README.md before changing this layout.