Repository navigation
fix: consolidate AETHER reproducibility repair and evidence chain - #10
Merged
Merged
Conversation
fix: repair AETHER frozen build and verification chain
This was referenced Jul 25, 2026
qt314wink
marked this pull request as ready for review
July 28, 2026 12:29
There was a problem hiding this comment.
Pull request overview
This PR consolidates AETHER’s build verification and reproducible-build evidence chain onto current main, promoting the previously repaired frozen-install/lint workflow and adding a second workflow that captures two-build reproducibility artifacts plus a static WebGL evidence inventory.
Changes:
- Adds a dedicated “reproducible build evidence” GitHub Actions workflow that runs two production builds and compares raw vs narrowly-normalized manifests.
- Introduces two Node scripts to (a) normalize Next build outputs for comparison and (b) generate a static WebGL evidence inventory report.
- Documents verification/evidence expectations in
docs/verification/**and expands README verification notes; pins ESLint dev dependencies and adds.eslintrc.json.
Reviewed changes
Copilot reviewed 11 out of 12 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/reproducible-build.yml |
New workflow to run two builds, compare manifests, and upload reproducibility evidence artifacts. |
.github/workflows/verify-aether-v0.yml |
Verification workflow for frozen install + lint/typecheck/build with retained evidence artifacts. |
tests/normalize-next-build.mjs |
Normalizes Next build outputs to support narrowly-scoped reproducibility comparisons. |
tests/webgl-evidence.mjs |
Produces a static WebGL evidence inventory JSON + console summary. |
docs/verification/REPRODUCIBLE_BUILD_EVIDENCE.md |
Documents the reproducible-build evidence chain and normalization boundaries. |
docs/verification/FROZEN_BUILD_REPAIR.md |
Receipt documenting the frozen-install/lint repair and its verification evidence. |
docs/verification/WEBGL_SMOKE_TEST.md |
Manual WebGL smoke-test plan to be executed outside CI. |
docs/verification/ACCESSIBILITY_CHECKLIST.md |
Manual accessibility verification checklist for the current v0 behavior. |
README.md |
Adds npm run lint to validation and documents verification workflow intent/status. |
package.json |
Pins ESLint and eslint-config-next to support next lint deterministically. |
.eslintrc.json |
Adds Next-recommended ESLint configuration for core web vitals + TypeScript. |
Comments suppressed due to low confidence (3)
.github/workflows/reproducible-build.yml:82
- Same issue as build A: the raw manifest generation does not exclude
.next/trace, despite the receipt/docs listing it as excluded.
find .next -type f \
! -path '.next/cache/*' \
! -name 'BUILD_ID' \
! -name '*.trace' \
-print0 \
.github/workflows/reproducible-build.yml:103
- If the normalized manifest diff fails, this step exits before writing
normalized_manifest_exit_code, so the later execution receipt reports-1instead of the real exit code. Capturing and persisting the exit code (like the raw diff step) makes the evidence receipt accurate even on failures.
run: |
diff -u artifacts/build-a.normalized.sha256 artifacts/build-b.normalized.sha256 \
| tee artifacts/build-normalized.diff
echo "normalized_manifest_exit_code=0" >> "$GITHUB_ENV"
.github/workflows/reproducible-build.yml:47
verify-aether-v0.ymlusesnpm ci --ignore-scriptsfor the frozen install gate, but this workflow runs install scripts. If the intent is a consistent, bounded frozen-install contract, align these flags (or explicitly document why scripts are required here).
- name: Frozen install
run: npm ci --no-audit --no-fund
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| 7. create a deterministic build archive and SHA-256 digest | ||
| 8. retain verification evidence as a GitHub Actions artifact | ||
|
|
||
| A frozen installation cannot currently complete because this branch does not contain `package-lock.json`. The workflow reports that as a blocking failure and does not silently fall back to `npm install`. Adding or repairing the lockfile requires separate approval because the lockfile is outside the default verification-only scope. |
Comment on lines
+50
to
+51
| id: 'canvas-accessible-name', | ||
| status: /<canvas[^>]*aria-label=/.test(source) ? 'proven' : 'missing', |
Comment on lines
+25
to
+30
| const excluded = (relativePath) => | ||
| relativePath === 'BUILD_ID' || | ||
| relativePath === 'trace' || | ||
| relativePath.endsWith('.trace') || | ||
| relativePath.startsWith(`cache${sep}`) || | ||
| relativePath.startsWith('cache/'); |
Comment on lines
+61
to
+67
| find .next -type f \ | ||
| ! -path '.next/cache/*' \ | ||
| ! -name 'BUILD_ID' \ | ||
| ! -name '*.trace' \ | ||
| -print0 \ | ||
| | sort -z \ | ||
| | xargs -0 sha256sum > artifacts/build-a.raw.sha256 |
| - name: Set up Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '22' |
This was referenced Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Promote one consolidated AETHER reproducibility chain to current
maininstead of merging or cherry-picking overlapping PRs independently.Provenance
main.This PR is the only promotion candidate.
Exact diff classes
Inherited verified repair
.eslintrc.jsonpackage-lock.jsonpackage.json.github/workflows/verify-aether-v0.ymldocs/verification/FROZEN_BUILD_REPAIR.mdNew evidence layer
.github/workflows/reproducible-build.ymldocs/verification/REPRODUCIBLE_BUILD_EVIDENCE.mdtests/normalize-next-build.mjstests/webgl-evidence.mjsVerified CI on head
f4ce9eaaVerify AETHER v0— passedAETHER Reproducible Build Evidence— passedThe committed lockfile was consumed without regeneration; frozen install, typecheck, noninteractive lint, two production builds, and narrowly normalized manifest comparison completed successfully.
Non-goals
No files under
src/**, no shaders, uniforms, tokens, gallery behavior, deployment configuration, pricing, or secrets are changed.Approval gate
Keep draft. Static WebGL findings remain distinct from runtime proof, and issue #9 remains the separate browser-lifecycle remediation path. Jennipher must approve the exact inherited-versus-new inventory before merge.
Rollback
Close the PR. Current
mainremains unchanged.