# pom's pipeline. Design: wiki [[sando-bento-boundary]].
#
# pom is the first product Sando ships without building. It runs on astra
# (aarch64) and on the Hetzner box (x86_64), and `build::run` compiles only on
# one configured host, so Sando could never build half of this release without
# breaking its own never-cross-compile rule. Bento already fans out native
# builds across both machines. So Bento builds and packages; Sando decides
# whether a thing advances a stage, and performs the advance.
#
# There is deliberately no `build_host` here. Absent is not "build anywhere" —
# it declares the product intake-only, and `build::run` refuses rather than
# picking a machine. Naming a build host for a product Sando must not build
# would be a claim the code would then be free to act on. Ship pom with
# `POST /apps/pom/intake`.

topology_path = "../pom-topology.toml"

# Never shared with another product: two products publishing into one release
# root would publish into each other's content-addressed history, and the
# digest that names a bundle says nothing about which product it belongs to.
workdir = "/srv/sando/pom/work"
release_root = "/srv/sando/pom/releases"
logs_root = "/srv/sando/pom/logs"

# The bin the systemd unit's ExecStart points at, and the file the node-side
# install wrapper installs. pom ships one binary.
bin_names = ["pom"]

# No `platform` key. A Sando-built product inherits its platform from its config
# because there is only one answer; pom has two, and the trustworthy answer for
# a given bundle is the one in that bundle's own artifact record. Each node
# declares what it runs (see pom-topology.toml) and a bundle is only ever placed
# on a node whose platform it matches.

# No [[migration_check]] and no [[test_target]] beyond the defaults, and neither
# is reachable: pom's tiers configure no `cargo_test` and no `migration_dry_run`
# (see pom-topology.toml). Both gates are artifact-scoped, which the boundary
# assigns to the builder, and an accepted artifact has no worktree for them to
# read — they would refuse rather than run. pom has no postgres schema at all;
# its SQLite migrations are compiled into the binary.

# No [[companion]]: pom is a single binary with no contract-coupled service
# shipping alongside it.