Reproducible artifact build (regenerate-and-diff, or manifest + digest)

Generated from pattern-library/registry.json — do not edit by hand; change the registry and run bun run patterns:build.

Category: Derivation & Provenance · Tier: deep · Maturity: proven (verified 2026-10-10 @ 91f61a76-dirty) · Risk: low — the check is cheap; the failure mode is a generator added without one

Committed generated artifacts are proven current by the gate: regenerate-and-diff (missing and orphan outputs included) when the generator can run there, an SLSA-shaped manifest of input/output digests plus a pinned toolchain when it cannot — each artifact labelled bit-for-bit or input-addressed.

When to use: Use for any generated output committed to the repo or shipped as a file: generated docs and indexes, snapshots, compiled binaries, vendored builds.

Avoid when

• The output is rebuilt on every deploy and never committed — the deploy itself is the regeneration
• The generator is nondeterministic and its output cannot be made stable — record its inputs (input-addressed) instead of diffing bytes

Alternatives

• Signed provenance (SLSA L2+, in-toto) — prefer when third parties consume and must independently verify the artifact
• Byte-diffing a pinned-container rebuild in the gate — prefer when the toolchain can run in CI cheaply — stronger than a manifest, which only proves the files match what was hashed

Docs

• docs/blueprint/integrity/derivation.md#reproducible-artifact-build — Which proof each case gets, and bit-for-bit vs input-addressed (GitHub · GitLab)

Code

• scripts/patterns/build-derived.ts — Regenerate-and-diff with orphan detection (GitHub · GitLab)
• scripts/mcp/build-public-excerpts.ts — Single-file byte-compared snapshot (GitHub · GitLab)
• scripts/wasm/build.sh — Pinned-digest container build that writes the manifest (GitHub · GitLab)
• src/lib/wasm/kernel/build-manifest.json — Image digest, bindgen version, input and output sha256 (GitHub · GitLab)

Tests

• src/lib/wasm/kernel-manifest.test.ts — Recomputes every digest; states its own limits (GitHub · GitLab)
• src/lib/server/perf/snapshot.gate.test.ts — Refuses a snapshot without gitSha or a production build (GitHub · GitLab)
• src/lib/server/mcp/patterns/excerpts.test.ts (GitHub · GitLab)

Invariants

• A committed artifact is checked by the gate; a generator with no check is an unbound mirror.
• --check fails on missing and orphaned outputs, not only on changed bytes.
• Generators read neither the clock nor the network and iterate in a declared order.
• A manifest pins its toolchain by digest, not by tag, and carries no wall-clock time.
• Each artifact is labelled with the proof it actually has — bit-for-bit, manifest-matched, or input-addressed.

Emulation notes

• Choose the proof by asking whether the gate can run the generator; only fall back to a manifest when it cannot, because a manifest proves "files match what was hashed", not "a rebuild would match".
• Write the manifest last, after every output is in place, so an interrupted build cannot leave a manifest describing outputs that never landed.
• Say the limits in the check's own header, as kernel-manifest.test.ts does — the next reader will otherwise assume it proves semantics.

Machine-readable record: reproducible-artifact-build in pattern-library/registry.json.