# Constraint-Binding Task Sources

Every fixture tarball in `benchmarks/constraint-binding/fixtures/` is
generated by `scripts/fetch-fixtures.sh` from a specific OSS commit. Fixtures
are **gitignored**; this file is the source of truth. `sha256` is the hash of
the produced `.tar.gz` (reproducible via `git archive --format=tar | gzip -n`).

Run `bash scripts/fetch-fixtures.sh --verify-only` in CI to detect upstream
drift or mirror corruption.

## License policy

Only permissive licenses are allowed for fixture sources: MIT, BSD (2/3),
Apache 2.0, ISC, CC0. GPL-family sources are rejected. The `license` column
records the spdx_id returned by the GitHub API at fixture-creation time.

## Table

Columns: `task-id | repo | sha | subpath | sha256 | license`

| task-id | repo | sha | subpath | sha256 | license |
|---------|------|-----|---------|--------|---------|
| schema-then-query-001 | https://github.com/prisma/prisma-examples | 663c23ca1a6c6f03d2ad0c67868020b560a172e4 | databases/turso | de86f10a22619212b8098f03cb813dae259b556515e52c40b6b7c979a9800be3 | Apache-2.0 |
| rename-then-update-callers-001 | https://github.com/sindresorhus/is-plain-obj | 97f38e8836f86a642cce98fc6ab3058bc36df181 | . | ff44ff6c44872cf3cfd59f7f62ee19f586eef96ecf01f2904a9407feece55b03 | MIT |
| contract-change-then-client-001 | https://github.com/feross/simple-get | e7a74115ca9dd28720f186275c5a67df81985426 | . | 6d208d19be4d09d0a9d249e255a9db1d85376700e34aa28f2262002265f4f726 | MIT |
| lift-then-reuse-001 | https://github.com/feross/queue-microtask | 2a5e7b9874c5f075e62975862e5e4a673f149786 | . | 5b92963c012911b5f3d9a183626d847808c1e3195111c413127b8371410d01d2 | MIT |

## Pending (for PR 3b)

Phase 3a ships the four pilot tasks above to validate the harness end-to-end.
PR 3b will grow the table to 20 rows (5 per pattern). Candidate sources under
review for PR 3b are tracked in the Linear ticket and will be added here with
pinned SHAs and license checks before any fixture is generated.

## Regenerating a sha256 column

When a task lands with `pending`, the first run of
`bash scripts/fetch-fixtures.sh <task-id>` prints the actual hash. Update the
row with that hash and re-run `--verify-only` to confirm the table matches the
artifact bit-for-bit.

## Drift response

If `--verify-only` reports a mismatch:
1. Check whether the upstream repo force-pushed. `gh api repos/OWNER/REPO/commits/SHA` will 404 if the SHA is no longer reachable.
2. If the SHA still exists but the tarball differs, investigate `git archive` reproducibility (gzip tooling version, tar format). Regenerate and re-record only after confirming the content is functionally identical.
3. If the SHA is gone, either pin to a new SHA (updates the task schema fingerprint) or mirror the old commit to a long-term store (GitHub release artifact on this repo) and update `repo` to point there.
