stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 12 Releases Wiki Activity
Files
8abbf9574d81c62b8cf7688bba367a777d8b3aa0
git.stella-ops.org/docs/modules/scanner/operations/release-determinism.md
StellaOps Bot 8abbf9574d up
2025-11-27 21:10:06 +02:00

1.6 KiB
Raw Blame History

Scanner Release Determinism Checklist

Completes SCAN-DETER-186-010 by ensuring every release ships a reproducibility bundle.

What to publish

  • determinism.json generated by the harness (scores, non-deterministic artefacts, thresholds).
  • surface/determinism.json copied from worker surface manifests (pins + runtime toggles + payload hashes).
  • Canonical artefacts per run (run_i/*.json) and diffs for divergent runs.

Where to publish

  • Object store bucket configured for releases (same as reports), prefix: determinism/<release>/.
  • CAS-style paths: cas://determinism/<head>/<sha>.tar.zst for bundle archives.
  • Link from release notes and offline kit manifests.

How to generate

  1. Run determinism harness (SCAN-DETER-186-009) against release image with frozen clock/seed/concurrency and pinned feeds/policy.
  2. Export bundle using the harness CLI (pending) or the helper script scripts/scanner/determinism-run.sh.
  3. Copy worker-emitted determinism.json from surface manifest cache into surface/determinism.json inside the bundle for cross-checks.
  4. Sign bundles with DSSE (determinism predicate) and, if enabled, submit to Rekor.

Acceptance gates

  • Overall score >= 0.95 and per-image score >= 0.90.
  • All bundle files present: determinism.json, surface/determinism.json, run_*, diffs/ (may be empty when fully deterministic).
  • Hashes in surface/determinism.json match hashes in determinism.json baseline artefacts.

References

  • docs/modules/scanner/determinism-score.md
  • docs/modules/scanner/deterministic-execution.md
  • docs/replay/DETERMINISTIC_REPLAY.md