From c6c1907f78e716d425ca0f4e7f420d4308c9c247 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Mon, 7 Sep 2026 18:52:46 +0000
Subject: [PATCH] Repair inconsistent Seriatim build input state

---
 tasks/build.yml   | 16 ++++++++++++++++
 tests/integration |  8 ++++++++
 2 files changed, 24 insertions(+)

diff --git a/tasks/build.yml b/tasks/build.yml
index 289976e..0b6b9c6 100644
--- a/tasks/build.yml
+++ b/tasks/build.yml
@@ -20,6 +20,7 @@
 - name: Calculate desired Seriatim build fingerprint
   ansible.builtin.set_fact:
     seriatim_desired_fingerprint: "{{ seriatim_build_inputs | hash('sha256') }}"
+    seriatim_stored_build_inputs: ""
     seriatim_stored_fingerprint: ""
     seriatim_stored_checksum: ""
 
@@ -50,6 +51,14 @@
   register: seriatim_stored_fingerprint_result
   when: seriatim_fingerprint_state_stat.stat.exists
 
+- name: Read stored Seriatim build inputs
+  ansible.builtin.slurp:
+    src: "{{ seriatim_build_state_dir }}/build-inputs.json"
+  register: seriatim_stored_build_inputs_result
+  when:
+    - seriatim_build_inputs_state_stat.stat.isreg | default(false)
+    - seriatim_build_inputs_state_stat.stat.readable | default(false)
+
 - name: Read stored Seriatim checksum
   ansible.builtin.slurp:
     src: "{{ seriatim_build_state_dir }}/binary.sha256"
@@ -58,11 +67,15 @@
 
 - name: Record stored Seriatim state values
   ansible.builtin.set_fact:
+    seriatim_stored_build_inputs: >-
+      {{ seriatim_stored_build_inputs_result.content | b64decode | trim }}
     seriatim_stored_fingerprint: >-
       {{ seriatim_stored_fingerprint_result.content | b64decode | trim }}
     seriatim_stored_checksum: >-
       {{ seriatim_stored_checksum_result.content | b64decode | trim }}
   when:
+    - seriatim_build_inputs_state_stat.stat.isreg | default(false)
+    - seriatim_build_inputs_state_stat.stat.readable | default(false)
     - seriatim_fingerprint_state_stat.stat.exists
     - seriatim_checksum_state_stat.stat.exists
 
@@ -83,6 +96,9 @@
          or not seriatim_build_inputs_state_stat.stat.exists
          or not seriatim_fingerprint_state_stat.stat.exists
          or not seriatim_checksum_state_stat.stat.exists
+         or seriatim_stored_build_inputs != seriatim_build_inputs
+         or (seriatim_stored_build_inputs | hash('sha256')) != seriatim_stored_fingerprint
+         or (seriatim_stored_build_inputs | hash('sha256')) != seriatim_desired_fingerprint
          or seriatim_stored_fingerprint != seriatim_desired_fingerprint
          or seriatim_stored_checksum != (seriatim_installed_binary_stat.stat.checksum | default(''))
          or (seriatim_installed_version_result.rc | default(1)) != 0
diff --git a/tests/integration b/tests/integration
index 37e6c8b..e9cb4b1 100755
--- a/tests/integration
+++ b/tests/integration
@@ -58,6 +58,14 @@ run_converge
 run_converge | tee "$test_tmp/default-repeat.log"
 require_clean_recap "$test_tmp/default-repeat.log"
 
+printf '%s\n' 'corrupt build inputs' |
+  sudo tee /usr/local/src/seriatim.ansible-build-state/build-inputs.json >/dev/null
+run_converge | tee "$test_tmp/build-input-repair.log"
+require_changed_recap "$test_tmp/build-input-repair.log"
+"$playbook" -i "$inventory" tests/verify.yml
+run_converge | tee "$test_tmp/build-input-repair-repeat.log"
+require_clean_recap "$test_tmp/build-input-repair-repeat.log"
+
 baseline_binary=$(binary_digest)
 baseline_state=$(state_digest)
 for scenario in \