feat: add stapeln.toml layer-based container definition\n\nConverted from existing Containerfile to stapeln format.\nIncludes Chainguard base, security hardening, SBOM generation.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

stapeln.toml

@@ -0,0 +1,105 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# stapeln.toml — Layer-based container build for http-capability-gateway
+#
+# stapeln builds containers as composable layers (German: "to stack").
+# Each layer is independently cacheable, verifiable, and signable.
+
+[metadata]
+name = "http-capability-gateway"
+version = "0.1.0"
+description = "http-capability-gateway container service"
+author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
+license = "PMPL-1.0-or-later"
+registry = "ghcr.io/hyperpolymath"
+
+[build]
+containerfile = "Containerfile"
+context = "."
+runtime = "podman"
+
+# ── Layer Definitions ──────────────────────────────────────────
+
+[layers.base]
+description = "Chainguard Wolfi minimal base"
+from = "cgr.dev/chainguard/wolfi-base:latest"
+cache = true
+verify = true
+
+[layers.elixir-toolchain]
+description = "Elixir/OTP runtime"
+extends = "base"
+packages = ["erl27-elixir-1.18", "erlang-27", "git", "build-base"]
+cache = true
+
+[layers.elixir-deps]
+description = "Mix dependency fetch"
+extends = "elixir-toolchain"
+env = { MIX_ENV = "prod" }
+commands = [
+    "mix local.hex --force",
+    "mix local.rebar --force",
+    "mix deps.get --only prod",
+    "mix compile",
+]
+cache-key = "mix.lock"
+cache = true
+
+[layers.build]
+description = "http-capability-gateway Elixir release"
+extends = "elixir-deps"
+commands = ["mix release"]
+artifacts = [
+    { src = "_build/prod/rel/http-capability-gateway", dst = "/app/http-capability-gateway/" },
+]
+
+[layers.runtime]
+description = "Minimal runtime"
+from = "cgr.dev/chainguard/wolfi-base:latest"
+packages = ["ca-certificates", "curl"]
+copy-from = [
+    { layer = "build", src = "/app/", dst = "/app/" },
+]
+entrypoint = ["["bin/http_capability_gateway", "start"]"]
+user = "gateway"
+expose = [4000]
+env = { MIX_ENV = "prod" }
+
+# ── Security ───────────────────────────────────────────────────
+
+[security]
+non-root = true
+read-only-root = false
+no-new-privileges = true
+cap-drop = ["ALL"]
+seccomp-profile = "default"
+
+[security.signing]
+algorithm = "ML-DSA-87"
+provider = "cerro-torre"
+
+[security.sbom]
+format = "spdx-json"
+output = "sbom.spdx.json"
+include-deps = true
+
+# ── Verification ───────────────────────────────────────────────
+
+[verify]
+vordr = true
+svalinn = true
+scan-on-build = true
+fail-on = ["critical", "high"]
+
+# ── Targets ────────────────────────────────────────────────────
+
+[targets.development]
+layers = ["base", "elixir-toolchain", "build"]
+env = { LOG_LEVEL = "debug" }
+
+[targets.production]
+layers = ["runtime"]
+env = { LOG_LEVEL = "info" }
+
+[targets.test]
+layers = ["base", "elixir-toolchain", "build"]
+env = { LOG_LEVEL = "debug" }