SHA-256 over data-cap's own installed version plus the path and raw bytes of
every file a real run would discover -- no parsing, no linking, no AST. Still
pays for the glob walk itself (a fingerprint has to know which files matter),
but nothing after it.
Paths are deduplicated and sorted before hashing, so the result never depends
on filesystem enumeration order. The tool version is folded in because an
engine upgrade can change what the same source produces. Each file's own path
is hashed alongside its content so that renaming a file, or moving identical
content between two paths, changes the fingerprint.
SHA-256 over
data-cap's own installed version plus the path and raw bytes of every file a real run would discover -- no parsing, no linking, no AST. Still pays for the glob walk itself (a fingerprint has to know which files matter), but nothing after it.Paths are deduplicated and sorted before hashing, so the result never depends on filesystem enumeration order. The tool version is folded in because an engine upgrade can change what the same source produces. Each file's own path is hashed alongside its content so that renaming a file, or moving identical content between two paths, changes the fingerprint.