Close the build over declared inputs

A useful input inventory includes source revision, compiler and linker, build scripts, package artifacts, base filesystem, target architecture, configuration, and generated-code dependencies. For AI infrastructure, include tokenizer assets, operator generators, native kernels, and any model files incorporated into the release. A version string without a concrete artifact identity can leave part of this set mutable. Local include paths and system libraries can also leak into a build even when the application's package graph is locked. Identify the actual files and tools consulted rather than infer closure from one manifest.

An isolated filesystem and restricted environment can prevent accidental reads from the host, but a container image alone does not prove hermeticity. The action may still contact a network service, read injected environment variables, use host-mounted files, or depend on the current time. Build-system sandbox guarantees have a defined scope and configuration. Test the boundary by removing incidental tools and varying allowed host conditions, while checking which inputs are recorded. A failed build can reveal an implicit dependency that previously went unnoticed because every developer machine happened to provide it.

A network fetch during the action introduces response bytes and availability into the input set. An approved prefetch stage can retain verified artifacts before an isolated action executes; alternatively a controlled fetch must be explicitly identified and recorded under the build contract. Disabling network after dependency installation does not erase code or assets already obtained. Time, locale, filesystem iteration order, absolute paths, and random seeds can also affect output. Decide which are semantic inputs and which incidental variations the build should normalize, then verify that relevant tools honor the chosen settings.

Credentials deserve separate treatment. Access to fetch an approved private dependency should not imply that the action can read or export unrelated secrets. Avoid embedding credentials into outputs, logs, or shared caches, and scope the mechanism granting access to the intended stage. A secret that changes output bytes becomes a reconstruction and leakage problem, not a harmless invisible configuration. Signing may be deliberately separated from an otherwise reproducible payload build; document which artifact layer is being compared. Input closure, action isolation, and a signing authority's approval remain distinct mechanisms even when one pipeline orchestrates them.

Retain input manifests and build configuration so another controlled environment can attempt reconstruction. Observe file and network access where supported, remove undeclared dependencies, and test cache misses as well as cache hits. A shared cache can hide missing inputs by returning an output created under a different environment. Reassess the boundary when adding a plugin, native extension, or model conversion step. A build that deterministically incorporates a harmful declared input can still be hermetic; source and dependency review, provenance, and execution policy address different claims.

The function lab is a small analogy for an omitted parameter. For each separate view, Reset, set both coefficient a and position x, predict y, then inspect. Compare a=1, x=1 with a=2, x=1: the same x gives different y because a changed. This quadratic instrument is not a build sandbox, compiler, or network monitor. It makes the logical issue explicit: if the declared input list mentions only x, changing a appears mysterious even though the full function is deterministic. A real build inventory must discover the corresponding hidden tools or response bytes through actual evidence.