Prove Your Rebuild Matches the Shipped Binary

The first sprint carried the lexical primitive alone: remove comments from Rust source and use the same tokenizer to check whether any remain. That was a good clean-context task because it had no tree traversal or release wiring, just string input, string output, and hard fixture cases. Review sent it into a re-plan, which exposed that real parsing errors had to become part of the interface rather than an exceptional crash path.

This sprint layered legal preservation onto the already-built Rust stripper. Its scope was narrow enough for a fresh agent: detect attribution at the head of a file, apply the vendored-location rule, and keep ordinary narration removable below that point. The gate went red and a fix ran, placing the stress at the boundary between aggressive stripping and conservative license handling.

The third sprint lifted the per-file behavior into a repository-shaped transform. It had a clear input and output directory contract, plus an allow-list copied from the archive script, so the agent could prove determinism, idempotence, and passthrough behavior without touching release production. The inherited parser-failure finding became a machine-readable skipped-file report here.

This final stripping sprint completed the non-Rust policy after the tree walk existed. The work was bounded to shell and configuration files plus a report for files whose comments were too much of the file's meaning to remove silently. It passed at its boundary, leaving the milestone with a complete transform and an explicit report shape for downstream release code.

The bridge sprint gave shell scripts a single command rather than asking them to reach into Rust library code. Its boundary was the invocation contract: source ref or tree in, output tree and report out, with leftover comments as failures and expected passthroughs as visible non-failures. It stayed green, which fits a sprint built on the already-proven transform.

This sprint handled the first hard composition problem in the milestone: the stripped tree had to remain buildable while the lock file stayed honest. The brief gave the agent a concrete reconciliation choice around the workspace member, plus the toolchain and build-flag placement. Review triggered a re-plan, marking this as the point where the release tree's shape had to be redrawn before later gates could trust it.

After the tree was configured, this sprint made buildability a testable property. It asked the agent to produce the stripped tree, check comments with the report in hand, then build and test inside that tree. The run shows an extra execution and review note, but no failed gate, so the difficulty was in tightening the proof rather than repairing a broken boundary.

This sprint turned reproducibility from configuration into a checked equality. The work was scoped to a host-target gate that builds the same stripped source in different locations under the producer's environment. That boundary let the expensive release targets remain out of the default gate while still proving the path and timestamp inputs mattered.

This sprint changed the archive builder's input contract without changing its security contract. The agent had to preserve deterministic zip assembly, compliance injection, metadata sealing, and the allow-list while swapping the snapshot source from the internal repository to the stripped tree. It stayed within that mechanical boundary and passed.

The final build milestone sprint composed the preceding pieces into the local release producer. Its scope was broad but well-fenced: produce one stripped tree, build inside it, archive that same tree, surface comment reports, and add the release-time double-build guard. It passed after the earlier build and archive contracts had already been proven.

The first customer-verification sprint carried a single missing value across the producer/archive boundary. It was sized for a fresh agent because it only had to resolve the build epoch once and thread that same value into binary builds and metadata. It passed cleanly, giving the verifier a machine-readable input before the script existed.

This was the milestone's main external-interface sprint: write the script a customer runs and keep its reproducibility inputs aligned with the producer. Its brief named the hard parts, including toolchain checks, path remapping from the customer's machine, signed-checksum anchoring, and mismatch behavior. Review forced a re-plan, which records that the script's design needed adjustment before packaging could depend on it.

This sprint was a narrow archive-policy change with a sharp trap: the verifier needed to ship with comments intact while other shell comments were normally stripped. The first gate failed and a fix ran, locating the difficulty at the distinction between deliberate customer documentation and heuristic passthrough. After repair, the allow-list and transform rule agreed.

This sprint connected all earlier customer pieces into an end-to-end release guard. It asked for a host-target routine test plus a full release-time check that unpacks the archive and runs the shipped verifier against the produced binary. The gate went red and was fixed, putting the stress at the exact point where the archive, signed material, and rebuilt binary had to agree.

The last sprint was nominally a small documentation and metadata reconciliation, but it was the noisiest boundary in the run. It had to remove rival rebuild instructions and make generated metadata, README prose, and script invocation describe one procedure. The gate failed more than once, a fix ran, and an investigate stage was opened before the work was rerun and passed.