| # Separate immutable source/model and input overlay |
|
|
| Source archive and every model/runtime URL remain fixed to |
| 3888c6cf29bacaf2ec5a1d7ce4e5ad1ab1109823. Download sourceArchive.path from that |
| revision; download inputArchive.path from the SAME immutable revision as this |
| APP_RELEASE_PAIRING.json. The input commit is separately recorded by the staging |
| receipt. No self-referencing future CID is embedded in these files. |
|
|
| Check both archive SHA values and every manifest member before executing code. |
| Use a data-only tar extractor, extract source/ and release-input/ side by side, |
| This public-mode overlay has no private marker. From source/, install the captured overlay |
| at its canonical path so build-info and Vite hash the same configured input: |
|
|
| test ! -e web/background-release |
| cp -R ../release-input/input web/background-release |
| npm ci --prefix web --ignore-scripts |
| npm ci --prefix tools/browser-build --ignore-scripts |
| node --input-type=module -e 'import {buildBrowserApp} from "./web/scripts/build.mjs"; console.log(await buildBrowserApp("web/background-release", "../review-app"))' |
| |
| Use this input overlay, not the historical fixture inside the source archive. |
| The paired build inventory records this candidate; this recipe alone claims no |
| fresh install, model inference or public-ready acceptance. Registry access or a |
| populated npm cache is required; no browser token is provided. |
| The repository is still private during preparation; original private inputs remain retained. This public-mode artifact has no private marker. Supported devices, |
| human/general quality, physical print, anonymous HF/Pages and rollback/publication |
| approval remain separate. |
|
|
