Scanner Release Determinism Checklist

Audience: Scanner release engineers and the release-determinism gate owners.
Purpose: Ensure every Scanner release ships a reproducibility bundle so that any operator can independently confirm a scan replays bit-for-bit.

What to publish

determinism.json generated by the harness (scores, non-deterministic artefacts, thresholds).
surface/determinism.json copied from worker surface manifests (pins + runtime toggles + payload hashes).
Canonical artefacts per run (run_i/*.json) and diffs for divergent runs.

Where to publish

Object store bucket configured for releases (same as reports), prefix: determinism/<release>/.
CAS-style paths: cas://determinism/<head>/<sha>.tar.zst for bundle archives.
Link from release notes and offline kit manifests.

How to generate

Run determinism harness (SCAN-DETER-186-009) against release image with frozen clock/seed/concurrency and pinned feeds/policy.
Export bundle using the harness CLI (pending) or the helper script scripts/scanner/determinism-run.sh.
Copy worker-emitted determinism.json from surface manifest cache into surface/determinism.json inside the bundle for cross-checks.
Sign bundles with DSSE (determinism predicate) and, if enabled, submit to Rekor.

Acceptance gates

Overall score >= 0.95 and per-image score >= 0.90.
All bundle files present: determinism.json, surface/determinism.json, run_*, diffs/ (may be empty when fully deterministic).
Hashes in surface/determinism.json match hashes in determinism.json baseline artefacts.

References