up

2025-11-27 21:10:06 +02:00
parent cfa2274d31
commit 8abbf9574d
106 changed files with 7078 additions and 3197 deletions
--- a/docs/modules/scanner/operations/release-determinism.md
+++ b/docs/modules/scanner/operations/release-determinism.md
@@ -0,0 +1,29 @@
+# Scanner Release Determinism Checklist
+
+> Completes SCAN-DETER-186-010 by ensuring every release ships a reproducibility bundle.
+
+## What to publish
+- `determinism.json` generated by the harness (scores, non-deterministic artefacts, thresholds).
+- `surface/determinism.json` copied from worker surface manifests (pins + runtime toggles + payload hashes).
+- Canonical artefacts per run (`run_i/*.json`) and diffs for divergent runs.
+
+## Where to publish
+- Object store bucket configured for releases (same as reports), prefix: `determinism/<release>/`.
+- CAS-style paths: `cas://determinism/<head>/<sha>.tar.zst` for bundle archives.
+- Link from release notes and offline kit manifests.
+
+## How to generate
+1. Run determinism harness (`SCAN-DETER-186-009`) against release image with frozen clock/seed/concurrency and pinned feeds/policy.
+2. Export bundle using the harness CLI (pending) or the helper script `scripts/scanner/determinism-run.sh`.
+3. Copy worker-emitted `determinism.json` from surface manifest cache into `surface/determinism.json` inside the bundle for cross-checks.
+4. Sign bundles with DSSE (determinism predicate) and, if enabled, submit to Rekor.
+
+## Acceptance gates
+- Overall score >= 0.95 and per-image score >= 0.90.
+- All bundle files present: `determinism.json`, `surface/determinism.json`, `run_*`, `diffs/` (may be empty when fully deterministic).
+- Hashes in `surface/determinism.json` match hashes in `determinism.json` baseline artefacts.
+
+## References
+- docs/modules/scanner/determinism-score.md
+- docs/modules/scanner/deterministic-execution.md
+- docs/replay/DETERMINISTIC_REPLAY.md