test: explicitly repin validation to reviewed channel source

tests/unit/test_validation_source_provenance.py

@@ -0,0 +1,74 @@
+"""Explicit experimental repin and historical-source provenance contracts."""
+
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "tests/validation"))
+from source_provenance import checkout_provenance
+import re100_helpers
+import run_jet_circle_cv
+
+ORIGIN = "47b05bc8abfc957fe876b0c63bdb386e3c6cbaa5"
+
+
+def test_manifests_cover_current_source_and_preserve_origin():
+    names = subprocess.check_output(
+        ["git", "-C", str(ROOT), "ls-files", "src"], text=True
+    ).splitlines()
+    for group, hashes_key, revision_key in (
+        ("dfg_re100", "production_sha256", "commit"),
+        ("jet_circle_cv", "files", "revision"),
+    ):
+        manifest = json.loads(
+            (
+                ROOT / "tests/validation/data" / group / "source_manifest.json"
+            ).read_text()
+        )
+        assert manifest[revision_key] == ORIGIN
+        assert set(manifest[hashes_key]) == set(names)
+        assert manifest["source_origin_commits"][-1] == ORIGIN
+        assert (
+            manifest["historical_checkpoints"]["production"]
+            == "d79e3f6f0a424f5bcc3a1a6d610313e49daf97a2"
+        )
+        assert "not inherited from d79" in manifest["experiment"]
+        for name, expected in manifest[hashes_key].items():
+            assert (
+                hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == expected
+            ), name
+    assert re100_helpers.PIN == run_jet_circle_cv.PIN == ORIGIN
+
+
+def test_runtime_checkout_identity_is_separate_from_source_origin(tmp_path):
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    (tmp_path / "test.txt").write_text("tracked\n")
+    subprocess.run(["git", "-C", str(tmp_path), "add", "test.txt"], check=True)
+    subprocess.run(
+        [
+            "git",
+            "-C",
+            str(tmp_path),
+            "-c",
+            "user.name=Test",
+            "-c",
+            "user.email=test@example.invalid",
+            "commit",
+            "-qm",
+            "fixture",
+        ],
+        check=True,
+    )
+    expected = subprocess.check_output(
+        ["git", "-C", str(tmp_path), "rev-parse", "HEAD"], text=True
+    ).strip()
+    assert checkout_provenance(tmp_path) == dict(
+        checkout_revision=expected, checkout_dirty=False
+    )
+    (tmp_path / "test.txt").write_text("changed\n")
+    assert checkout_provenance(tmp_path) == dict(
+        checkout_revision=expected, checkout_dirty=True
+    )