~11 min · frozen-base, git, evidence, comparability
Level 0Cold Iron
0 XP0/36 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete
Freeze the Repository
A repository-backed Open Run freezes exact input bytes, not a moving branch or a Git history. For a Git base, Anvil takes the tracked files as they exist in the working tree at Fire time. It includes local modifications to tracked files, excludes untracked files, and carries no commit history. A plain-directory base contributes its visible files.
Before publishing that snapshot, compose-time exclusion patterns are applied. Then a secret scan checks contents and key-material filenames; a hit refuses Fire with file and class information but never exposes the secret text. Dad can revise exclusions on the same refused run and try Fire again.
The freeze is staged in a unique directory and published only inside the winning composing-to-fired transition. The run records a manifest digest and a base_frozen event, and every joined yard receives the same base/ working copy. File-count and byte ceilings keep this benchmark-sized.
The frozen base is task input, not a contestant submission. Judge packs receive its exact path/sha256/bytes manifest and a path-safe read endpoint for manifest members, without receiving the office repository path.
Freeze tracked working-tree bytes, not “a commit.” The manifest is the comparable base every seat and judge can verify.
Code
Freeze order — a secret hit refuses the Fire itself·python
import hashlib
class SecretFound(Exception):
pass
def freeze(tracked, untracked, exclude, secret_classes):
"""Tracked only, after exclusions, and only past the secret scan."""
staged = {p: b for p, b in tracked.items()
if not any(p.startswith(x) for x in exclude)}
hits = [(p, cls) for p in staged for cls, probe in secret_classes.items()
if probe(p, staged[p])]
if hits:
# The secret string is never shown — only the file and the class.
raise SecretFound(f"{[(p, c) for p, c in hits]} — Fire refused")
manifest = [{"path": p, "sha256": hashlib.sha256(b).hexdigest()[:12],
"bytes": len(b)} for p, b in sorted(staged.items())]
return {"manifest": manifest, "event": "base_frozen",
"excluded_untracked": sorted(untracked)}
SECRETS = {"key-material": lambda p, b: p.endswith(".pem") or b"BEGIN" in b}
out = freeze({"src/app.py": b"print(1)\n"}, {"fixture.bin"},
exclude=["node_modules/"], secret_classes=SECRETS)
print(out["manifest"], "| left out (untracked):", out["excluded_untracked"])
try:
freeze({"id.pem": b"-----BEGIN KEY-----"}, set(), [], SECRETS)
except SecretFound as exc:
print(exc)
Given a Git worktree with one modified tracked file, one untracked fixture, one excluded directory, and one secret hit, state exactly what each freeze step does.
Hint
Working-tree bytes of tracked files are real; untracked files are not silently overlaid.
Progress
Progress is local-only — sign in to sync across devices.