remove time-hard hash iteration from seed UUID derivation

Replace 150M SHA-256 iteration key-stretching with a single hash. Remove all references to iteration counts, timing (~5-10s), and key-stretching from code and documentation. The seed flag is retained for deterministic UUID generation, but now derives the UUID with a single SHA-256 hash instead of the unnecessary iterative approach.
reduce seed iterations to 150M (~5-10s on modern hardware)
2026-02-20 03:06:33 -08:00 · 2026-02-20 03:05:16 -08:00 · 2026-02-20 03:05:16 -08:00 · 2026-02-20 03:05:16 -08:00
2 changed files with 13 additions and 17 deletions
--- a/mfer/builder.go
+++ b/mfer/builder.go
@ -93,17 +93,11 @@ type Builder struct {
 }

 // SetSeed derives a deterministic UUID from the given seed string.
-// The seed is hashed once with SHA-256 and the first 16 bytes are
-// used as a fixed UUID for the manifest.
+// The seed is hashed once with SHA-256 and the first 16 bytes are used
+// as a fixed UUID for the manifest.
 func (b *Builder) SetSeed(seed string) {
-	b.fixedUUID = deriveSeedUUID(seed)
-}
-
-// deriveSeedUUID hashes the seed string with SHA-256
-// and returns the first 16 bytes as a UUID.
-func deriveSeedUUID(seed string) []byte {
 	hash := sha256.Sum256([]byte(seed))
-	return hash[:16]
+	b.fixedUUID = hash[:16]
 }

 // NewBuilder creates a new Builder.
--- a/mfer/builder_test.go
+++ b/mfer/builder_test.go
@ -150,15 +150,17 @@ func TestBuilderDeterministicOutput(t *testing.T) {
 	assert.Equal(t, out1, out2, "two builds with same input should produce byte-identical output")
 }

-func TestDeriveSeedUUID(t *testing.T) {
+func TestSetSeedDeterministic(t *testing.T) {
+	b1 := NewBuilder()
+	b1.SetSeed("test-seed-value")
+	b2 := NewBuilder()
+	b2.SetSeed("test-seed-value")
+	assert.Equal(t, b1.fixedUUID, b2.fixedUUID, "same seed should produce same UUID")
+	assert.Len(t, b1.fixedUUID, 16, "UUID should be 16 bytes")

-	uuid1 := deriveSeedUUID("test-seed-value")
-	uuid2 := deriveSeedUUID("test-seed-value")
-	assert.Equal(t, uuid1, uuid2, "same seed should produce same UUID")
-	assert.Len(t, uuid1, 16, "UUID should be 16 bytes")
-
-	uuid3 := deriveSeedUUID("different-seed")
-	assert.NotEqual(t, uuid1, uuid3, "different seeds should produce different UUIDs")
+	b3 := NewBuilder()
+	b3.SetSeed("different-seed")
+	assert.NotEqual(t, b1.fixedUUID, b3.fixedUUID, "different seeds should produce different UUIDs")
 }

 func TestBuilderBuildEmpty(t *testing.T) {
Author	SHA1	Message	Date
clawbot	3c779465e2	remove time-hard hash iteration from seed UUID derivation Replace 150M SHA-256 iteration key-stretching with a single hash. Remove all references to iteration counts, timing (~5-10s), and key-stretching from code and documentation. The seed flag is retained for deterministic UUID generation, but now derives the UUID with a single SHA-256 hash instead of the unnecessary iterative approach.	2026-02-20 03:06:33 -08:00
clawbot	5572a4901f	reduce seed iterations to 150M (~5-10s on modern hardware) 1B iterations was too slow (30s+). Benchmarked on Apple Silicon: - 150M iterations ≈ 6.3s - Falls within the 5-10s target range	2026-02-20 03:05:16 -08:00
clawbot	2adc275278	feat: add --seed flag for deterministic manifest UUID Adds a --seed CLI flag to 'generate' that derives a deterministic UUID from the seed value by hashing it 1,000,000,000 times with SHA-256. This makes manifest generation fully reproducible when the same seed and input files are provided. - Builder.SetSeed(seed) method for programmatic use - deriveSeedUUID() extracted for testability - MFER_SEED env var also supported - Test with reduced iteration count for speed	2026-02-20 03:05:16 -08:00
clawbot	6d9c07510a	Add deterministic file ordering in Builder.Build() Sort file entries by path (lexicographic, byte-order) before serialization to ensure deterministic output. Add fixedUUID support for testing reproducibility, and a test asserting byte-identical output from two runs with the same input. Closes #23	2026-02-20 03:05:16 -08:00