Then the packages.

A quality-control kit for the R and Python packages analysts rely on. It takes the approved package list, rebuilds every package from its original source code inside the exact workspace people use, tests each one there, and writes down what passed and what failed - so "these packages work here" is a documented fact, not a hope.

A manifest-driven R package pipeline - fetch, check, build - as a plugin: estate-agnostic naming throughout, so it drops into anyone's CI or runs by hand inside the container it validates, in the working directory. Same stages, cache layout, check flags and evidence CSV as the source pipeline; gone is the machinery around them - no podman, no mounts, no registry, no arch matrix. One run validates this container, this architecture, one R version.

build-packages.sh manifest pipeline README.md run.R walkthrough.qmd

• The container to validate, with R at the requested version (/opt/R/<ver> or PATH)
• A compiler toolchain (gcc, g++, gfortran, make) - preflight names anything missing
• Network for fetch and check (the dependency closure installs live, as in CI)
• ~20 GB free in the working directory

# from R, via the rxedn catalogue
rxedn::rxedn_install_module("repo.extract.ndexr.io")

# the extraction lands at <domains_dir>/repo.extract.ndexr.io/package-build/

No archive to unpack and no checksum to compare: rxedn publishes each repo as an immutable <host>-<sha7>.tar.gz and records its sha256 in the catalogue index, so the commit is the identity. Pull it, and the files are simply there.

cd package-build

# from R (Workbench session) - session-core-aware, R version = the session's R:
#   source('run.R'); kickoff('preflight'); kickoff('all', background = TRUE)

./build-packages.sh --r-version 4.6.1 --stage preflight   # shell lane - seconds
./build-packages.sh --r-version 4.6.1 --stage all         # hours; PKG_REPO=<dated snapshot> to pin

Output stays put, in ./pkg-cache/bin/<arch>/<rver>/ (evidence in ./pkg-cache/evidence/) - nothing is copied out.

A factory for the analyst workspace itself. From a written recipe it builds the standard RStudio/Posit environment data scientists log into, then runs every approved package through that environment as proof. The result is a workspace that can be recreated identically anywhere, and packages with evidence that they work in it.

The session container and the pipeline that qualifies R packages through it: a RHEL 9 Posit Workbench/Connect session image (four R, three Pythons, the full system-library floor) plus a builder container that compiles the declared set from source against exactly that image - fetch, install, check, test, build - ending in binaries and per-package evidence. A session and source builder only: no Kubernetes, no Helm, no orchestration, no registry assumptions, no credentials.

build-image.sh containers manifest pipeline README.md run-stage.sh run.R

• A build host with podman or docker - image builds cannot happen inside a Workbench session
• ~30 GB free (the session image carries four R + three Python runtimes, TeX, chromium)
• Network for the image build (Posit CDN, dnf) and for fetch/install (PKG_REPO)
• Hours for the first image build; the package stages resume from ./pkg-cache

# from R, via the rxedn catalogue
rxedn::rxedn_install_module("repo.extract.ndexr.io")

# the extraction lands at <domains_dir>/repo.extract.ndexr.io/rhel-posit-pipeline/

No archive to unpack and no checksum to compare: rxedn publishes each repo as an immutable <host>-<sha7>.tar.gz and records its sha256 in the catalogue index, so the commit is the identity. Pull it, and the files are simply there.

cd rhel-posit-pipeline

# from R (RStudio on the build host) - session-core-aware:
#   source('run.R'); build_image(); kickoff('all', background = TRUE)

./build-image.sh                                   # the two containers
./run-stage.sh --r-version 4.6.1 --stage fetch     # then install, check, test, build

Output stays put, in ./pkg-cache/bin/<arch>/<rver>/ (evidence in ./pkg-cache/evidence/) + the session image in the local engine - nothing is copied out.

Package build

Carried in manifest/ , verbatim - the declared set this extraction will build. It travels in the repo, so a copy taken to a machine with no route back here still knows the full list.

RHEL Posit container + package pipeline

Carried in manifest/ , verbatim - the declared set this extraction will build. It travels in the repo, so a copy taken to a machine with no route back here still knows the full list.