30 lines
1.6 KiB
Markdown
30 lines
1.6 KiB
Markdown
# Scanner Release Determinism Checklist
|
|
|
|
> Completes SCAN-DETER-186-010 by ensuring every release ships a reproducibility bundle.
|
|
|
|
## What to publish
|
|
- `determinism.json` generated by the harness (scores, non-deterministic artefacts, thresholds).
|
|
- `surface/determinism.json` copied from worker surface manifests (pins + runtime toggles + payload hashes).
|
|
- Canonical artefacts per run (`run_i/*.json`) and diffs for divergent runs.
|
|
|
|
## Where to publish
|
|
- Object store bucket configured for releases (same as reports), prefix: `determinism/<release>/`.
|
|
- CAS-style paths: `cas://determinism/<head>/<sha>.tar.zst` for bundle archives.
|
|
- Link from release notes and offline kit manifests.
|
|
|
|
## How to generate
|
|
1. Run determinism harness (`SCAN-DETER-186-009`) against release image with frozen clock/seed/concurrency and pinned feeds/policy.
|
|
2. Export bundle using the harness CLI (pending) or the helper script `scripts/scanner/determinism-run.sh`.
|
|
3. Copy worker-emitted `determinism.json` from surface manifest cache into `surface/determinism.json` inside the bundle for cross-checks.
|
|
4. Sign bundles with DSSE (determinism predicate) and, if enabled, submit to Rekor.
|
|
|
|
## Acceptance gates
|
|
- Overall score >= 0.95 and per-image score >= 0.90.
|
|
- All bundle files present: `determinism.json`, `surface/determinism.json`, `run_*`, `diffs/` (may be empty when fully deterministic).
|
|
- Hashes in `surface/determinism.json` match hashes in `determinism.json` baseline artefacts.
|
|
|
|
## References
|
|
- docs/modules/scanner/determinism-score.md
|
|
- docs/modules/scanner/deterministic-execution.md
|
|
- docs/replay/DETERMINISTIC_REPLAY.md
|