mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 13:26:40 +00:00
HalldrixandClaude Opus 4.8
eec5d2af64
write-build-stamp.mjs rewrites the stamp's `builtAt` clock on every build, so the whole-file hash moved under a receipt that had just recorded it. Two builds overlapping on one tree failed with "Build inputs changed during compilation" for a difference the build machinery itself made, and the caller turned that into SystemExit(1). Hash the stamp's provenance identity instead, key-sorted so a cosmetic re-serialisation is not a change. The clock is excluded from that comparison but recorded as `stampClock` — the value the bake actually embedded, captured from the same read that produces __HERMES_INSTALL_STAMP__ — because packaging copies the live stamp into the bundle after the receipt is written. Re-reading the stamp at record time would certify a clock the output never contained, and productCurrent would then report a bundle current whose packaged clock disagrees with its baked main, which is exactly what detectBundleSwap must never do. recordProduct still compares the prepared inputs, so a clock-only restamp cannot throw. productCurrent additionally requires the recorded clock to match, so a restamp between bake and packaging is a rebuild rather than a silent divergence. A receipt predating the field compares by hash alone until the next build rewrites it; the release packaging path never consults productCurrent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>