source-integrity-spans-hashing-through-detection
IN derived (depth 3)
Source integrity forms a complete end-to-end pipeline with no gap between measurement and verification: collision-resistant SHA-256 hashing with additive backfill computes integrity markers without overwriting existing hashes, while comprehensive staleness detection with CI gating and nonzero exit codes consumes those markers to catch all source drift.
Summary
The system's source integrity checking has no blind spots — it covers the entire path from computing file hashes to flagging when sources have changed. SHA-256 hashing safely fingerprints source files without ever losing previously recorded hashes, and the CI staleness gate reliably catches every case where source material has drifted, so nothing slips through undetected between those two stages.
Justifications
SL — Hash computation (depth-1) and drift detection (depth-2) are independently sound; combining reveals the complete pipeline from source file → hash → comparison → CI signal with no missing link.
Antecedents (all must be IN):
- source-tracking-is-collision-resistant-and-safe — Source integrity tracking uses full 64-character SHA-256 digests with exact string comparison for collision resistance, and backfills hashes additively without overwriting existing values — ensuring high-fidelity drift detection with no accidental data loss
- staleness-gate-catches-all-drift — The staleness CI gate detects all forms of source material drift without false negatives.
Dependents
These beliefs depend on this one:
- source-pipeline-is-end-to-end-fail-safe — The complete source integrity pipeline from path resolution through hash computation to staleness detection is end-to-end fail-safe: convention-based resolution returns None on missing files rather than raising exceptions, collision-resistant SHA-256 hashing backfills additively without overwriting, and staleness detection catches all drift with CI-ready exit codes — no stage in the pipeline raises exceptions on adverse conditions, and each stage's output gracefully feeds the next.