Struct DeterminismState 

pub struct DeterminismState {
    pub sde: i64,
    pub compile_time_allowlist: Vec<(String, String)>,
    pub runtime_allowlist: Vec<(String, String)>,
}

Fields

sde: i64

compile_time_allowlist: Vec<(String, String)>

runtime_allowlist: Vec<(String, String)>

Implementations

impl DeterminismState

pub fn seed_from_commit(commit_ts: i64) -> Result<Self>

Seed from a commit timestamp (seconds since UNIX epoch). All built- in compile-time allow-list entries listed in the spec’s contract table are added here.

Returns Err when commit_ts is negative — a negative epoch would propagate a bogus SOURCE_DATE_EPOCH into child processes (where shells / build tools may misinterpret it) and almost always indicates a corrupted commit graph or a test passing a sentinel like -1. Fail-fast is the correct UX for a determinism API.

Compile-time allow-list scope

Each entry below corresponds to an artifact pattern the crate::determinism_report verification harness will actually see in dist/. Entries are matched by *.ext suffix or exact filename against the basename of every file the harness walks under the per-run worktree’s dist/ tree. Pattern names that do not match any real emitter output are dead code (silently never resolve) — keep this list aligned with what stages actually drop into dist/.

Notably absent (and intentionally so):

• docker-manifest-descriptor / docker-image-blob: the docker stage is in crate::determinism_runner::SIDE_EFFECT_STAGES and skipped by the harness; the only docker file that lands in dist/ is a .digest text file written by buildx (a deterministic sha256). No need for an allow-list entry.
• apple-notarization-receipt: the notarize stage mutates existing artifacts in-place (staples) rather than emitting new files; no separate “receipt” artifact lands in dist/.
• The NSIS installer (*-setup.exe / *_setup.exe) is GATED, not allow-listed. makensis honors SOURCE_DATE_EPOCH for the embedded build timestamp, so two builds over identical inputs are byte-identical — proven by stage-nsis::nsis_setup_is_byte_reproducible_across_time. Under the A′ shard routing the installer now lands in dist/windows/ on the Windows determinism shard (it builds the windows-msvc payload binary), so the harness DOES see and byte-compare it. The classifier keys on the setup.exe name tail so the installer is attributed to nsis while the raw anodize.exe binary is not (see determinism_harness::artifacts::infer_stage_from_path). A real drift here is a regression, not an excused non-determinism.
• The macOS .app bundle is GATED, not allow-listed. It is pure file assembly (Info.plist + binary copy) at a fixed mtime / SOURCE_DATE_EPOCH, so it is byte-reproducible — proven by stage-appbundle::appbundle_is_byte_reproducible_across_time. Under A′ it is produced on the macOS determinism shard (which holds the darwin payload binary), so the harness byte-compares it directly.

pub fn export_env(&self, cmd: &mut Command)

Export SOURCE_DATE_EPOCH onto a std::process::Command so child subprocesses (cargo, tar, sbom tools, etc.) see the reproducible epoch.

pub fn resolve_reason(&self, artifact: &str) -> Option<&str>

Resolve the allow-list reason for an artifact name. Compile-time entries win on collision per the spec’s “Operator escape / Precedence on collision” section. Returns None when the artifact is not in either list.

pub fn append_runtime(&mut self, artifact: String, reason: String)

Append a runtime allow-list entry. Caller is the CLI flag handler for --allow-nondeterministic <name>=<reason>.

Trait Implementations

impl Clone for DeterminismState

fn clone(&self) -> DeterminismState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DeterminismState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DeterminismState

fn default() -> DeterminismState

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for DeterminismState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for DeterminismState

impl PartialEq for DeterminismState

fn eq(&self, other: &DeterminismState) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for DeterminismState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for DeterminismState