Reproducible source evidence

This page is generated by bun run evidence:sync. Its inputs are copied from the Stacks repository and verified byte-for-byte against evidence/stacks/evidence.lock.json. It reports inventory, not quality or conformance.

EvidenceImmutable revision
Evidence-producing Stacks commit6008859d6e3d75e115261d6b7de76826324788da
Audited Stacks source treebf1245e336ab14551e22cb7d88284f93e649a1a2
RFC repositorycda56fb8f967ca9f7522b119425a3f438f7f2fe9
Source digestsha256:2d2f35689576a8d546acd5f13c69029aeb6609bca7506b953271d8f03c82ee8e

The source manifest classifies Stacks as a reference implementation with an unverified protocol claim. No package count or unit test upgrades that claim.

Package provenance

PackageVersionManifest path
@stacksjs/config0.70.161storage/framework/core/config/package.json
@stacksjs/desktop0.70.161storage/framework/core/desktop/package.json
@stacksjs/env0.70.161storage/framework/core/env/package.json
stacks0.70.52package.json
stacks0.70.161storage/framework/core/package.json

The root workspace and published framework package intentionally remain separate rows. Consumers must identify an exact source revision and package manifest rather than treating one repository-wide version string as authoritative.

Classified inventory

CategoryFilesBytes
assets-and-data80512,072,026
configuration248688,648
documentation4774,047,580
generated27169,642
source2,0268,458,161
tests4642,660,743
vendored-protocol1374,212

Total: 4,060 files and 28,171,012 bytes across 90 versioned package manifests. Generated, test, docs, configuration, vendored protocol, and source files are deliberately separate.

Driver evidence

The runtime-linked registry contains 27 individual records across database, queue, cache, storage, mail, realtime, and deployment.

StatusDrivers
supported11
partial9
experimental3
unsupported4

“Supported” requires checked-in automated evidence. “Partial” lacks live-service or parity evidence, “experimental” lacks a compatibility commitment or complete matrix, and “unsupported” must fail loudly. Service versions and CI-run URLs belong in per-run conformance reports rather than this static inventory.

AI authoring context

The evidence revision includes Stacks.js's deterministic buddy ai:context contract. It summarizes application intent, conventions, scripts, dependency names, and representative source paths within an explicit character budget. Dependency trees, lockfiles, build output, caches, environment files, credentials, and private keys are excluded. The emitted token estimate is a transparent character heuristic for comparing prompt size, not a tokenizer bill, correctness score, or performance benchmark.

Environment encryption

The pinned source writes the experimental encrypted:v2 envelope proposed in RFC 0005: ephemeral-static X25519, HKDF-SHA-256, and AES-256-GCM with authenticated metadata. The legacy format is read only for migration. Broad production recommendation remains blocked on RFC ratification and independent review.

Craft desktop evidence

The generated Craft matrix has 0 stable targets. macOS arm64/x64, Linux x64, and Windows x64 are experimental unpackaged bundles; unlisted targets are unsupported. Stable publication is mechanically blocked until platform signing/notarization and retained native install, launch, update, rollback, and uninstall evidence exist. See #2059, #2062, and #2063.

Refresh procedure

  1. Check out the intended Stacks revision with its dependencies available.
  2. In Stacks, run all protocol evidence checks and intentionally refresh the source manifest for the selected immutable revision.
  3. In this repository, run bun run evidence:sync -- --source ../stacks.
  4. Review the lock, generated page, capability changes, and limitation changes.
  5. Run bun run evidence:check and bun run build before committing.