Content-addressing

The artifact-level hash is a Merkle root over the composition and the section directory:

artifact_hash  :=  SHA-256(
    composition_signature                ∥   // Composition signature
    section_directory_canonical_form         // deterministic-CBOR section directory
)

Each section additionally carries a content_hash (SHA-256 over its encoded body) when CONTENT_HASHED-flagged. Two semantically equivalent compositions produce byte-equivalent .oxbin files, hence an identical artifact_hash. This holds because every section uses deterministic encoding (RFC 8949 deterministic CBOR for structural sections) plus per-section canonical-form rules (canonicalization is part of the oxc-oxbin format contract). The payoff:

• Distributed caching — re-running ox build on the same inputs is a cache hit on artifact_hash.
• Selective invalidation — a TBox change touches only the events content hash; downstream caches invalidate at section granularity.
• Content-addressed distribution — an .oxbin can be named by its artifact_hash in a CAS/Nix/IPFS-style registry.
• Tamper detection — any byte changed after ox build is caught at load.