SHA-256 over the raw bytes of every schema file and every usage-scan-
surface file (the same file sets assembleProject()/computeScanSurface()
touch), plus env-cap's own installed version -- zero AST parsing or
linking. Still requires the discovery/glob walk itself (fingerprinting has
to know which files matter), but skips everything after it. Deterministic:
file paths are deduplicated and sorted before hashing, so the result never
depends on filesystem enumeration order.
Not a timestamp, and never compared as one -- a fresh mtime doesn't prove
content is unchanged (a checkout, a rebase, or a touch can all bump it
with no real edit), and content is the only thing that actually
invalidates a cached evidence artifact.
SHA-256 over the raw bytes of every schema file and every usage-scan- surface file (the same file sets
assembleProject()/computeScanSurface()touch), plus env-cap's own installed version -- zero AST parsing or linking. Still requires the discovery/glob walk itself (fingerprinting has to know which files matter), but skips everything after it. Deterministic: file paths are deduplicated and sorted before hashing, so the result never depends on filesystem enumeration order.