`git rev-parse HEAD` is a provenance failure.It happens before dependency and compilation work; route it separately.
Choose one honest source path.
Transfer the tag with metadata and verify HEAD offline.
Set DSH_CLIENT_COMMIT_HASH only for an authenticated snapshot.
A new local commit or invented hash makes provenance false.
Prove all four boundaries.
tag, full commit, transfer digest
lockfile, store, native platform
Node range, pnpm 11.7.0
build record and output digest
A build exit code is not an air-gap attestation.
Rehearse with networking disabled and preserve the complete evidence record.
Keep the complete offline runbook.
The canonical guide includes Git-bundle transfer, Windows environment commands, dependency closure, acceptance evidence, unsafe shortcuts, and regression gates.
Read the complete guide