A better build system

Build once.Keep the proof.

Oven turns a verified Rust compatibility closure into immutable Loafs, then lets normal Incan build, run, and test commands reuse direct-rustc plans without Cargo on the consumer path.

Why Oven exists See the Alpha flow Read the architecture Run the compiler suite

Alpha means explicit boundaries. A compatible Loaf is reproducible by the same toolchain and inputs.

One system, three ways in.

Use Oven through the surface that matches the question you are asking.

CLI Command line Build, run, and test through the normal Incan workflow. incan build → MODEL Programmatic surface See the typed compiler-facing contracts behind every plan. Read the architecture → PROOF Inspect the proof Explore stored evidence and the reason a plan was reused or rejected. incan oven store inspect →

Why Oven exists

The build result should explain itself.

Cargo can compile Incan's generated Rust. The limitation is the contract around that result: a mutable target tree and local fingerprints do not give Incan one durable answer for what was built, why it is compatible, or when it may be reused.

01 · ArtifactA Loaf is not a cache guess.

Its identity binds source, dependency lock, compiler, SDK, target, profile, features, artifacts, and integrity evidence.

02 · BoundaryPrepare once. Consume deliberately.

A publisher may pay the compatibility cost once. Normal commands only select and consume a verified result; a miss stays explicit.

03 · LifecycleRetention is part of correctness.

Bounded admission, atomic publication, and active leases keep reuse predictable under concurrency, crashes, and cleanup.

The innovation is not merely calling rustc directly. Oven makes a prepared compatibility closure a first-class Incan artifact—with an identity, a receipt, and an owned lifecycle.

Use · the normal workflow

Oven sits behind the commands you already know.

For a supported project, build, run, and test select a receipt-compatible Loaf and its stored direct-rustc plan.

$ incan build $ incan run $ incan test

Compatibility is selected, not guessed.

Compiler, target, SDK, feature selection, dependency lock, and relevant source all contribute to identity. Match them and Oven can reuse the sealed result without Cargo on the consumer path. Change one and the normal command reports a miss: prepare a new project result explicitly, or stop if the request sits outside the Alpha envelope.

Make first materialization explicitincan oven bake --project . --format jsonincan build --lib

What an explicit project bake publishes

incan oven bake --project . starts from the toolchain's immutable full-standard-library Loaf. When a project needs locked Rust or provider artifacts outside that base, the explicit bake may invoke Oven's bounded compatibility publisher once and publish a project-extension Loaf that names the exact base it extends.

For each discovered library or executable target and profile, the bake compiles caller-owned final output through direct rustc, seals checked .incnlib metadata and declared provider sidecars, and publishes a completed project-output Loaf for exact replay. Matching build, run, and test commands remain consumer-only and never invoke Cargo.

Use --features, --no-default-features, or --all-features to select the same public package-feature projection used by normal commands. incan oven store inspect --format json reads the store; incan oven store prune --dry-run --format json previews bounded reclamation.

How Oven builds and proves

The publisher pays the compatibility cost once. Oven fingerprints the inputs that made the result valid, seals the result and its receipt into one immutable Loaf, then lets a compatible consumer reuse it without Cargo. If those facts no longer match, Oven refuses reuse and tells you why. Alpha ships complete debug and release standard-library Loaf families plus a compiler-suite family. Explicit project bake can add receipt-bound project extensions and completed application, library, and test outputs without turning normal commands into Cargo frontends.

1. 01–02 · PublisherIdentify and prepare once.

   Fingerprint source, lock, compiler, SDK, target, profile, and build intent before paying the compatibility cost.

2. 03 · SealKeep the result and its explanation.

   Package the immutable artifact, direct-rustc plan, compatibility identity, and build receipt as one Loaf.

3. 04–05 · ConsumerReuse—or get a precise refusal.

   Match the requested environment, reuse locally without Cargo, and inspect the evidence behind the decision.

Publisher inputs

Sourcemain.incn

Dependency locklock.json

SDK + build identitycompiler · target · profile · features

LOAFLocked, Observable Artifact FormatImmutable · inspectable · reusable

Consumer outcomes

Compatibility checkInputs match the environment

Local reuseRun and test without Cargo

ArtifactsNative binary + files

ReceiptWhy this result exists

InspectExplore the evidence

What the proof remembersOne receipt answers: “Why does this artifact exist?”

Every Loaf is bound to its source, dependency lock, compiler, SDK, target, profile, feature projection, and build intent. Project outputs also name the exact base and extension authority that produced them. The proof travels with the result instead of disappearing into a build cache.

Why Oven refuses reuseA miss protects the guarantee.

A normal command refuses reuse and asks for an explicit bake—or stops—when the requested environment cannot honestly consume the sealed result.

• the toolchain, target, profile, or features differ;
• semantic lock, dependency, provider, or source evidence changed; or
• the request sits outside the Alpha envelope.

Inspect · the reason

The receipt separates what happened from why reuse was allowed.

Oven keeps preparation, execution, compatibility, and storage evidence distinct. The result is a proof you can inspect instead of a cache entry you have to reverse-engineer.

SelectionWhich Loaf matched?Source, lock, compiler, SDK, target, profile, features, and build intent.

ExecutionWhat did the replay prove?Prepared roots, passed and failed tests, artifacts, and phase timings remain separate.

StorageWhat can be reclaimed?Logical, physical, owned, reclaimable, and active-lease bytes are reported independently.

Evidence fields, limits, and benchmark rules

Do not combine cold publication and prepared replay into one headline number. The approximately-five-minute acceptance target applies to the prepared full-suite replay and is meaningful only with its commit, machine, toolchain, cache state, workload, and storage junctions.

Logical artifact bytesDeclared immutable payload lengths.

Policy physical bytesFilesystem allocation charged by Oven policy.

Owned bytesAllocation owned by the current envelope.

Reclaimable bytesInactive allocation policy may safely remove.

Active-lease bytesAllocation protected by running consumers.

The current Alpha handoff uses project-extension schema 9, packaged-library schema 6, completed-output schema 12, and project-inspection-authority schema 1. Completed outputs preserve source-current inspection authority for each target and profile; a changed semantic input misses instead of borrowing authority from another receipt lineage.

The developer store defaults to $INCAN_HOME/oven/store/v2 (or ~/.incan/oven/store/v2). Its everyday policy allows 8 GiB of aggregate physical allocation, with 6 GiB physical and 3 GiB logical per compatibility domain. The compiler-suite policy raises those limits to 16 GiB aggregate physical, 6 GiB domain physical, and 4 GiB domain logical. Oven may reclaim least-recently-used inactive entries, never an active lease, and never silently expands an operator-supplied limit.

Run the reproducible benchmark sequence →

Why Oven beats Cargo-only workflows

One build. A reusable result with receipts.

Cargo may resolve and compile a missing Rust compatibility closure only inside an explicit, bounded project bake. It is not the backend for normal commands. Oven owns selection, identity, storage, receipts, and the consumer path; caller-owned final outputs compile through direct rustc.

Cargo-centered IncanConcernOven Alpha

Each environment resolves and compiles its own generated graph.ProcessAn explicit bake prepares the supported closure once.

Target artifacts and mutable build state.OutputImmutable Loaf + build receipt.

Local target cache and Cargo fingerprints.ReuseExplicit compatibility identity.

Cargo explains build activity, not one Incan artifact contract.EvidenceOne inspectable proof spans selection, execution, and storage.

Alpha · available now

Useful proof today The current surface is deliberately narrow, but the core reuse contract is real.

• Full-standard-library Loaf families
• Project extensions and completed outputs
• Human-readable inspection
• No Cargo on the normal consumer path

Get started with Oven →

North star · planned

Proof that can travel These layers explain where Oven is going; they are not presented as shipped Alpha capabilities.

• Trust and signatures
• SBOM and broader provenance
• Portable publication
• Verification chains

Planned capabilities. Not available in Alpha.

Decide · the compatibility boundary

A matching receipt permits reuse. A mismatch stops it.

Oven does not infer that yesterday's artifact is “probably fine.” It compares the requested environment with the identity sealed into the Loaf, then returns an explicit reuse decision.

MatchReuse the sealed project result.The same source, semantic lock, compiler, SDK, target, profile, features, dependencies, and providers select the exact base, extension, completed output, and direct-rustc plan.

MissBake explicitly or stop with a reason.A changed compatibility fact—or a request outside the Alpha envelope—cannot silently fall back to hidden Cargo work.

Read the full architecture and ownership model →

Inspect the surface

$ incan oven store inspect $ incan oven store prune --dry-run $ incan oven bake --project . $ incan inspect oven --receipt receipt.json Open the CLI reference →

Alpha boundary

Early by design. Explicit by default.

Oven Alpha proves the maintained Incan workflow and the repository's own compiler suite. It does not yet claim:

• general Cargo compatibility for arbitrary Rust workspaces;
• every build script, procedural macro, target, or platform dependency shape;
• compressed or remotely distributed .loaf bundles;
• the authored Loaf.toml, resolved Oven.lock, workspace, or registry model proposed for later work; or
• broad ecosystem readiness from external-library bake-offs.

Those belong to 0.6-and-later releases and RFC work. If the Alpha envelope cannot authorize a normal command, Oven explains the miss and stops.

Incus is observing.
Always.

For the complete command surface, see the CLI reference.