# Symbol manifest and bundles

Purpose
- Publish debug symbols and source maps for reachability and runtime overlays.
- Keep symbol artifacts deterministic and offline friendly.

Symbol manifest v1
- schema: stellaops.symbols/manifest@v1
- artifactDigest: build or container digest
- entries: debug bundles with debugId, os, arch, format, hash, path, size
- sourceMaps: optional sourcemap entries
- toolchain and provenance metadata
- Manifest JSON is canonicalized and DSSE-signed.

DebugId derivation (examples)
- ELF: build-id (or SHA-256 of .text fallback)
- PE/COFF: pdbGuid:pdbAge
- Mach-O: LC_UUID
- JVM: jar SHA-256 + class and method signature
- Node/TS: asset SHA-256 + sourceMap URL

Packaging guidance
- Deterministic tarball: stable ordering, mtime=0, uid=gid=0.
- Include manifest.json and manifest.json.sha256.
- Optional OCI artifact media type: application/vnd.stella.symbols.manifest.v1+json.

Upload and resolve APIs
- POST /v1/symbols/upload with signed manifest and blobs.
- GET /v1/symbols/resolve for lookup by tenant, os, arch, debugId.
- POST /v1/lookup/addresses for symbolization of addresses.

Offline bundles
- Bundle includes the signed manifest, blobs, and optional transparency proofs.
- Content-addressed CAS prefixes are used for reproducibility.

Related references
- docs/specs/SYMBOL_MANIFEST_v1.md
- docs/specs/symbols/bundle-guide.md