stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity

up

Browse Source
This commit is contained in:
StellaOps Bot
2025-11-27 21:09:47 +02:00
parent e901d31acf
commit cfa2274d31
15 changed files with 123 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/modules/scanner/deterministic-execution.md
View File

@@ -10,7 +10,9 @@ This note collects the invariants required for reproducible Scanner runs and rep
- Concurrency cap: `scanner:determinism:concurrencyLimit=1` (worker clamps `MaxConcurrentJobs` to this) or `SCANNER__DETERMINISM__CONCURRENCYLIMIT=1`.
- Feed/policy pins: `scanner:determinism:feedSnapshotId=<frozen-feed>` and `scanner:determinism:policySnapshotId=<rev>` to stamp submissions and reject mismatched runtime policies.
- Log filtering: `scanner:determinism:filterLogs=true` to strip timestamps/PIDs before hashing.
- Evidence: worker emits `determinism.json` into the surface manifest (view `replay`) summarising fixed clock, seed, concurrency cap, feed/policy pins, and per-payload hashes so replay kits can assert settings.
- Evidence: worker emits `determinism.json` into the surface manifest (view `replay`) summarising fixed clock, seed, concurrency cap, feed/policy pins, per-payload hashes, and a Merkle root over payload hashes for quick verification.
- Sealed replay intake: worker reads `replay.bundle.uri` + `replay.bundle.sha256` (and `determinism.feed`/`determinism.policy` pins) from job metadata; stores bundle pins in analysis so downstream stages stay hermetic. Stage: `ingest-replay` runs before image resolution.
- Surface manifest includes `replayBundle` (uri + sha256 + pins) so offline kits can verify sealed inputs without scheduler context.
## Ordering
- Sort inputs (images, layers, files, findings) deterministically before processing/serialization.