docs(agents): rebuild-and-compare, and what a dry run cannot guard #41

Merged

jlxq0 merged 1 commit from docs/rebuild-and-compare into main

2026-09-01 18:32:24 +00:00

jlxq0 commented

2026-09-01 18:30:41 +00:00

Owner

Written from recovering the source of v0.2.5 and v0.2.6 (#14). Three of the four method points cost a wrong claim first, and the entries carry the corrected versions rather than the ones I originally reported.

The binary's sha256 is the only comparison that means anything, because it is over content with no timestamp in it.
A matching config digest means the build did not happen. The config carries 23 history entries each with its own created, so an honest rebuild changes it by construction. Cache detector, not provenance check. This is the inverse of what I first claimed.
A rebuild identifies a tree, not a commit. 8555a9c and c0a9353 share tree 29637c1.
Use --no-cache, and read the duration. The first candidate run was rc=0 after 2.5s against a genuine 79.4s with the compile CACHED. A cache hit and a reproduction have identical output and exit code, and the duration lives in ~/Library/Logs/mantis-build-slot.log, not on the wrapper's stderr, which is always empty.

And the class the calibration exposed: a dry run against a known state validates the method and not the application. CI built v0.2.14 so this machine held no cache for it, which is precisely the property the real subject lacked.

With the test that follows: ask of any second comparison what would have to be true for it to disagree with the first. If nothing, it is not a second comparison. The config digest could only pass in the case it was offered to rule out, and that recurred inside the correction to the thing it was correcting.

Docs only, no version bump. Gate: fmt rc=0, test rc=0.

Written from recovering the source of `v0.2.5` and `v0.2.6` (#14). **Three of the four method points cost a wrong claim first**, and the entries carry the corrected versions rather than the ones I originally reported. - **The binary's `sha256` is the only comparison that means anything**, because it is over content with no timestamp in it. - **A matching config digest means the build did not happen.** The config carries 23 history entries each with its own `created`, so an honest rebuild changes it by construction. Cache detector, not provenance check. This is the inverse of what I first claimed. - **A rebuild identifies a tree, not a commit.** `8555a9c` and `c0a9353` share tree `29637c1`. - **Use `--no-cache`, and read the duration.** The first candidate run was `rc=0 after 2.5s` against a genuine 79.4s with the compile `CACHED`. A cache hit and a reproduction have identical output and exit code, and the duration lives in `~/Library/Logs/mantis-build-slot.log`, not on the wrapper's stderr, which is always empty. And the class the calibration exposed: **a dry run against a known state validates the method and not the application.** CI built `v0.2.14` so this machine held no cache for it, which is precisely the property the real subject lacked. With the test that follows: **ask of any second comparison what would have to be true for it to disagree with the first.** If nothing, it is not a second comparison. The config digest could only pass in the case it was offered to rule out, and that recurred *inside* the correction to the thing it was correcting. Docs only, no version bump. Gate: `fmt` rc=0, `test` rc=0.

jlxq0 added 1 commit

2026-09-01 18:30:41 +00:00

docs(agents): rebuild-and-compare, and what a dry run cannot guard

CI / tag-ancestry (pull_request) Successful in 3s

Details

CI / cargo (pull_request) Successful in 58s

Details

CI / docker (pull_request) Successful in 14s

Details

aed805b53c

Written from recovering the source of v0.2.5 and v0.2.6, and three of the four
method points cost a wrong claim first.

The binary's sha256 is the only comparison that means anything, because it is
over content with no timestamp in it. A COPY layer's digest is over a tar
carrying per-entry mtime and mode. And a matching config digest is the inverse
of how it first looked: the config carries 23 history entries each with its own
created time, so an honest rebuild changes it by construction and a match can
only happen when the layers are the originals. It is a cache detector, not a
provenance check.

A rebuild identifies a tree, not a commit. 8555a9c and c0a9353 share tree
29637c1, so the obvious write-up names one commit and is overprecise.

Use --no-cache and check the duration. The first candidate run finished rc=0
after 2.5s against a genuine 79.4s, with the compile CACHED. A cache hit and a
reproduction have the same output and the same exit code, and the duration is
recorded in ~/Library/Logs/mantis-build-slot.log rather than on stderr, which
is always empty.

And the class the calibration exposed: a dry run against a known state
validates the method and not the application. CI built v0.2.14, so this machine
held no cache for it, which is exactly the property the real subject lacked. A
dry run cannot guard the run that matters wherever the two differ.

With the test that follows from it: ask of any second comparison what would
have to be true for it to disagree with the first. If nothing, it is not a
second comparison. The config digest could only pass in the case it was offered
to rule out.

Refs #14

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>