[schlessera]

Closes #2408

What changed

• Procedure (docs/decisions/ci-utility.md): records the maintainer's 2026-10-18 option-1 ruling.
  • Trigger: a merge that changes any audited producer.
  • Owner: the frozen owner must be a delivered main commit.
  • Audit: a re-audit reviews the changed behaviour and the combined set's guarantees; recomputing a digest is not an audit.
  • One update PR: it moves the owner, refreshes the digests and fixture provenance together, and records two mutation receipts.
  • Fallback: while drift is unreviewed, the binding stays off and proof runs fresh.
• First re-audit, at delivered main af0547c2d4d197ed3766f2817cf56eb5f0486ab4:
  • const owner (tests/frozen-generated-source.ts) moves from 498270fbd to af0547c2d.
  • const auditedProducer (scripts/generated-build-inputs.ts): four digests are refreshed and scripts/build-execution.ts is added. All 12 entries equal both the owner blob and the current bytes.
  • The three test producer lists (generated-build-inputs, generated-theme-inputs, inclusion-inputs) gain build-execution.ts.
  • No producer file changes in this PR.

Audit record

Drift since 498270fbd, reviewed against the binding's guarantees: cleaned package output, the frozen Tailwind compile, the build finishing before browser execution, checked exits and the fresh receipt.

Producer	Change	Effect on the guarantees
scripts/build.ts	#2449 moved the build body into scripts/build-execution.ts and added an env-gated isolated-operation branch	Body equivalent: same dist removal, tsc and Tailwind arguments and cwd, theme/token/hooks copies, bin modes, receipt events, dependency-level scheduling and exit codes (now returned and assigned to process.exitCode). The subset flag is still passed as directories !== undefined. The body now lives in build-execution.ts, so that file joins the audited set.
scripts/ci-proof.ts	#2433 runs candidate validation before selection validation; #2197 adds a selected-proof receipt log line	None: no build or browser command change.
scripts/check-pr.ts	#2372 adds the Linux sandbox-setup precheck	None: the removed lines are two imports. The command inventory and bun run build before browser/layout are unchanged.
.github/workflows/ci.yml	#2176 candidate-validation step; #2435 artifact paths; #2415 third browser shard and 20-minute bound; #2398 draft aggregate name	None: browser/layout jobs still install, plan and then run ci-proof <category> --shard. No environment reaches the build.

Isolated build operation: build.ts dynamically imports ci-build-operation.ts only when BRAIN_CI_BUILD_OPERATION=isolated-v1.

• No workflow or script sets that variable, and ci.yml maps no vars to it.
• Even with the flag set, attemptCiBuild returns to the audited executeBuild path unless its separate qualification policy is complete. ci: skip unchanged workspace builds by a complete input stamp instead of rebuilding in every runtime hook #2319 keeps that deferred (export async function attemptCiBuild, scripts/ci-build-operation.ts:93).
• The independent review notes that a runner-supplied environment could set the flag without editing a pinned file. In that case the unqualified policy still selects the ordinary rebuild.
• Qualifying the isolated operation (ci: skip unchanged workspace builds by a complete input stamp instead of rebuilding in every runtime hook #2319) therefore needs its own re-audit of that closure.

Remaining drift: none in the audited set. Separately filed: #2459. observedBuildContext (scripts/build-repeat-observation.ts) has its own diagnostic list, which also omits build-execution.ts. Fixing it changes an audited producer, so it follows its own re-audit.

Validation

• Binding restored: generatedCssInputs returns null for packages/ui-react/dist/styles.css, packages/ui-kit/dist/styles.css and packages/ui-react/dist/theme.css on a checkout of current main af0547c2d. On this branch, each binds its source stylesheet with 13 producer inputs.

• Verification suites: bun run test tests/generated-theme-inputs.test.ts tests/generated-build-inputs.test.ts tests/inclusion-inputs.test.ts passes 20, fails 0. These suites include the real locked offline compiler controls.

• Mutation receipts, both restored byte-identically (cmp):

  Mutation	Fails at
  Producer-digest bypass (digest comparison removed in generatedCssInputs)	Negative controls tests/generated-build-inputs.test.ts:29 ("producer, execution-order, receipt and package-script drift refuse generated stylesheet binding") and tests/generated-theme-inputs.test.ts:23 ("command, input, execution-order drift and extra callers refuse the generated theme binding")
  Corrupt positive ownership (owner moved to 3f6008994, a main commit where every producer exists but ci-proof.ts predates test(ci): enforce candidate validation before aggregate planning #2433)	Six positive controls, e.g. UNCHANGED_PRODUCER_RETAINS_BINDING expected packages/ui-react/src/styles.css, received undefined, and the theme binding expected packages/ui-react/src/theme.css, received undefined

  A first attempt at the second mutation used the old owner 498270fbd. It failed reading the missing build-execution.ts blob instead of on the positive assertion, so it was discarded as a receipt.

• Preflight: bun run check:pr --base origin/main at 1170e46f9 passes 970 fast and 222 affected tests, 0 failures. It ran in a clean mount namespace (74 mounts) because the host has 3,689 leaked Docker Desktop mounts, which the fix(ci): refuse slow Linux sandbox setup before local preflight #2372 sandbox precheck correctly refuses.

• Independent gpt-6-astra review: it verified build-body equivalence, default-path import coverage, build-before-browser ordering and exit checks, and all 12 digests against the owner blob and HEAD. It found no remaining 498270 reference. Its one finding is the pre-existing ci: build repeat observation omits the moved build body #2459.

• Hosted: this PR's ready run is the confirmation.

No changeset: no shipped package files changed.

🤖 Generated with Claude Code