Ephemeral Shouldn't Mean Downloading ffmpeg Again

Description and use

Repeatedly downloading and compiling ffmpeg for each new environment wastes resources. Introducing a content-addressed Tool Shed cache reuses a single artifact across all environments, saving time and bandwidth, but raises security and privacy concerns.

Problem

Repeatedly downloading and compiling the same ffmpeg for each fresh Bench or Workshop wastes time and bandwidth.

Outcome

ffmpeg is built once and reused across all Benches and Workshops, saving time and bandwidth while maintaining recipe authority.

Workflow

• Define ffmpeg build as a recipe step with pinned package set and network profile.
• Compute a hash key from recipe inputs and sealed base.
• Check Tool Shed for existing bytes matching the key.
• If present, reuse cached artifact; if not, derive ffmpeg, store bytes in Tool Shed, and hand over environment.
• Launch Bench or Workshop using the ready environment without exposing the derivation path to the agent.
• Ensure supervisor verifies that all Tool Shed bytes originate from verified recipe executions.
• Delete or purge Tool Shed when desired without affecting recipe authority.

Evidence

Ten Benches that all need ffmpeg means ten identical downloads and ten identical builds.

Source

The Tool Shed is where the derived bytes live. It is content-addressed.

Source

A hash is identity, not safety.

Source