Hello Vercel team,

I'm investigating an unexpected integrity mismatch in an isolated Vercel CLI deployment.

Environment:

• Vercel CLI: 64.0.2
• Node.js configuration: 22.x
• Build region: iad1
• Custom install command with a SHA256 integrity check before pnpm installation

Observed error:

1
PR81_CREDENTIAL_CANARY_DIAGNOSTIC:{"status":"STOP_NO_RETRY","stage":"source_verify","code":"source_drift","file":"vercel.json"}

The first node seal.mjs --check fails before pnpm is executed.

I independently downloaded vercel.json and source-manifest.json from the Vercel deployment source archive. Both match the original Git files byte-for-byte.

However, the remote build process reports an integrity mismatch for vercel.json.

The same Vercel CLI version was tested locally on Node.js 22 and 24, and the mismatch could not be reproduced.

Questions:

1. Can Vercel modify or regenerate vercel.json between source upload and execution of the custom install command?
2. How can I inspect the actual vercel.json bytes and resolved file path inside the remote build worker?
3. Is there a supported approach to verify the original deployment configuration without disabling file integrity protection?

The production website is unaffected. No database credentials were accessed during the failed build.

I can provide the deployment ID privately to Vercel staff if needed.

Thank you for your help!