product-vamp/docs/composer/dependency_proof.md

Independent inputs and reproducibility

Production consumes canonical source music, relevant versioned production data, role settings and joint-actions-1. Optional targets, comparison outputs and completed parts are not runtime musical inputs. The separate development fitter is allowed to inspect explicit targets; that is development influence, not a runtime read. Failed fitted artifacts are not promoted.

input_audit.composition records actual reads and rejects paths outside production data, generator code, the Python runtime, the current role's concrete cache and a narrowly shared _resources catalog cache. The latter contains only compiled generic production catalogs, keyed by content and decoder semantics, with a payload checksum. Other roles' concrete caches remain forbidden. Tests also cover corrupted catalog regeneration.

The explicit audition.dependency_check passed for all six roles on an independently authored one-bar source using real production catalogs:

• Alone/cold versus reversed order/warm.
• Serial versus two spawned processes/cold.
• Deliberately invalid optional targets present versus removed/cold.
• Rebuilding after an electric-only setting change.

Evidence, actual read paths and all six hashes: build/solo_reference_comparison/repair/dependency-final/dependency.json. The changed electric register produced hash bf16a8b06e38ab50384d98a1fdd6bf13d62eddc1eaf350dd91d2186ca39d92ee, proving the exercised setting changed music rather than only invalidating a cache. Example unchanged solo document hashes:

• Acoustic: 6ded04c27b1ee638644b0717be095ff1af5820da17b89876e5c89f1e18901997.
• Electric: 56b7bc09146facb91c0dc0ffe71dbdd0239d23d5fab5955c2b3fe7e03b94a882.

This is a dependency test, not a whole-song musical or performance assessment. Separate full-source checks in repair/asset-verification.json establish that all four selected event streams and TAB match reparsed exports, source vocal/head documents are unchanged, and the source/reference/published-baseline hashes remain unchanged.

The complete All of Me acoustic solo also has identical musical document hash in the independent cold benchmark, warm own-role cache build and two-worker full production build: adcc372315aa10cae8a956cc5002700859c81cdcf4eeaa59b4ae6f8b41161baf. This strengthens the synthetic proof for that full source/role; it does not claim an isolated cold/warm benchmark for every role.

Canonical ordering is independent of requested-role order and worker completion. Ties resolve through stable musical content keys. Catalog/report/cache implementation changes invalidate affected cached representations without intentionally changing the semantic generation version. Timing and observed-read diagnostics remain outside the musical document.

Deletion tests cannot detect target-derived material already embedded in code/data. Review new rule provenance and the explicit learned-feature whitelist separately. The development vocabulary is target-guided, and these examples are not claimed as unseen generalization evidence.