c34fb7256d
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
SDK Publish & Sign / sdk-publish (push) Has been cancelled
sdk-generator-smoke / sdk-smoke (push) Has been cancelled
2.2 KiB
2.2 KiB
Scanner Deterministic Execution Invariants
Imposed rule: Deterministic mode must pin clock, RNG, feeds, policy, tooling, and concurrency; any nondeterministic output is a test failure.
This note collects the invariants required for reproducible Scanner runs and replays.
Runtime switches (config/env)
- Clock:
scanner:determinism:fixedClock=true,scanner:determinism:fixedInstantUtc=2024-01-01T00:00:00ZorSCANNER__DETERMINISM__FIXEDCLOCK=true,SCANNER__DETERMINISM__FIXEDINSTANTUTC=.... - RNG:
scanner:determinism:rngSeed=1337orSCANNER__DETERMINISM__RNGSEED=1337. - Concurrency cap:
scanner:determinism:concurrencyLimit=1(worker clampsMaxConcurrentJobsto this) orSCANNER__DETERMINISM__CONCURRENCYLIMIT=1. - Feed/policy pins:
scanner:determinism:feedSnapshotId=<frozen-feed>andscanner:determinism:policySnapshotId=<rev>to stamp submissions and reject mismatched runtime policies. - Log filtering:
scanner:determinism:filterLogs=trueto strip timestamps/PIDs before hashing. - Evidence: worker emits
determinism.jsoninto the surface manifest (viewreplay) summarising fixed clock, seed, concurrency cap, feed/policy pins, and per-payload hashes so replay kits can assert settings.
Ordering
- Sort inputs (images, layers, files, findings) deterministically before processing/serialization.
- Canonical JSON writers: sorted keys, UTF-8, stable float formatting.
Hashing & manifests
- Compute SHA-256 for each artefact; aggregate into Merkle root for replay bundles.
- Record tool/policy/feed hashes in
replay.yaml; include analyzer versions.
Outputs to verify
- SBOM (CycloneDX/SPDX), findings, VEX, reachability graphs, logs.
- Optional entropy reports (
entropy.report.json,layer_summary.json). determinism.jsonwhen harness is run.
CI/bench hooks
bench:determinismruns replay with fixed switches; fails on hash deltas.stella replay run --sealed --fixed-clock ... --seed 1337 --single-threadedfor local.
Offline/air-gap
- All inputs from bundle; no egress.
- Rekor lookups skipped; rely on bundled proofs.
References
docs/replay/DETERMINISTIC_REPLAY.mddocs/replay/TEST_STRATEGY.mddocs/modules/scanner/determinism-score.md