Output comparison

Required

• Build the same input to the same bytes

  Required

  Build the same commit twice in two clean folders and compare the SHA-256 hash of every output file. Every hash must match.

• Write a manifest of the whole output

  Required

  Every build writes one JSON manifest that lists the path, size in bytes and SHA-256 hash of every output file, sorted by path. Keep it with the release.

• Prove a refactor changes nothing

  Required

  Compare the manifest from before a change with the one from after it. Any difference fails a change that does not name its expected paths.

• Explain every difference in an intended change

  Required

  A change that should alter output lists its expected paths or patterns. The diff report shows changed, added and removed files. Any file outside the list fails the change.

• Keep the previous release's manifest

  Required

  Keep the manifest and live snapshot of each of the last five releases. Diff every new release against the one before it, and roll back to a release whose manifest you know.

Recommended

• Mask volatile parts narrowly

  Recommended

  Replace each part that must change on every build with a fixed marker before hashing. Use a named list of at most 10 patterns, each with a maximum match count per file.

• Compare the live system before and after each deploy

  Recommended

  Before and after each deploy, fetch every public address with fixed request headers. Record status, key headers and a body hash. The live diff must match the local diff.

Optional

• Compare environments with the same release

  Optional

  The same release on staging and production gives the same bytes at every address. The only exceptions are a named list of environment values.