DL-368

The microVM guest root filesystem derives FROM the published ghcr.io/rigelbuild/compass-agent OCI image, pinned by digest in guest-image/agent-oci.lock and fetched as per-layer fixed-output derivations keyed by the lock’s descriptor digests, with the nix boot layer (compass-guestd /sbin/init, /lib/modules from the same kernel derivation, /sbin/modprobe, writable resolv.conf) overlaid and a derivation-time userland contract check (/bin/sh, nft, getent, awk, compass-agent) — closing the root-vs-agent-image nixpkgs pin divergence and NARROWING the two-sources-of-truth split to a bounded lag: the lock trails each agent publish by one pin-bump cycle, and deploy-time digest equality between the container backends and the guest is not enforced (a compass-stack skew warning makes it observable). Provenance is ENFORCED, not documented: the pin tool and the nix eval reject any repo but the compass-agent publish lane’s and any tag not git-<sha12>. Per-workload guest agent images stay ruled out (no image field on the provision request, and the boot path never reads one); the boot contract (erofs lower on /dev/vda, fixed UUID, initrd module set, deterministic pack) is frozen

Status: Active (Matt, 2026-09-13)

Record: ../../infra/runtime/compass-guest-image-artifact/design.md#approach