drift: delivery/RULES.md#14 — nothing compares recorded input-hashes against the repo (fleet freshness unobservable)

[elronbandel]

Which rule

• Document: .agents/delivery/RULES.md
• Rule number / section: rule 14 ("Fail dirty"), supported by rule 13 ("Carried-forward images")
• Rule text (pasted verbatim):

14. Fail dirty. An image whose recorded build-input hash is absent, unreadable, or different from the repository's computed hash MUST be treated as changed.

Evidence of drift

• File: containers/scripts/ — the hash is computable (feat(scripts): fleet-hash — deterministic build-input hashes over the bake graph #298) and now recorded at push (feat(release): stamp eval.input-hash on every pushed image #303), but nothing implements the comparison: no code reads eval.input-hash back from the registry and classifies an image as changed/unchanged. The fleet's freshness is still unobservable except by hand-inspecting GHCR (the pain feat(release): end-of-run fleet inventory report (completeness + freshness) #233 documented: v0.1.0 shipped ~6,400 silently stale combo images).
• What the rule demands: a mechanical judgment — recorded hash vs repository hash — with absent/unreadable failing dirty.
• What the code does: nothing; rule 13's retag decision (rung 5) has no input to act on.

Expected fix direction

• Update the code to satisfy the rule (this is the default for drift)
• Add a mechanical check so this drift can't recur silently

Rung 4 of the ratified migration path (#292): containers/scripts/fleet-status.sh — for every static bake target, derive the registry ref from the graph's context column (the dot-safe join key), read the label via imagetools inspect --format '{{json .Image}}' (labels live in the per-arch image config, never the index — #239's measured failure), and classify fresh / stale / unlabeled / absent, where everything non-fresh is "changed" per rule 14. Plus a dispatchable workflow reporting the fleet's freshness. Combo freshness derives from leaf hashes by implication (rung 5), not from per-combo reads.

Scope

• Fleet-wide (many artifacts violate the same rule — bulk fix via sub-agents)