test: run history-independent identity checks before the history lookup

tests/unit/test_validation_source_provenance.py

@@ -19,8 +19,8 @@ ORIGIN = "47b05bc8abfc957fe876b0c63bdb386e3c6cbaa5"
 
 
 def test_manifests_cover_current_source_and_preserve_origin(tmp_path):
-    names = tracked(ORIGIN)
-    origin = historical_tree(ORIGIN, tmp_path)
+    assert re100_helpers.PIN == run_jet_circle_cv.PIN == ORIGIN
+    manifests = {}
     for group, hashes_key, revision_key in (
         ("dfg_re100", "production_sha256", "commit"),
         ("jet_circle_cv", "files", "revision"),
@@ -31,18 +31,22 @@ def test_manifests_cover_current_source_and_preserve_origin(tmp_path):
             ).read_text()
         )
         assert manifest[revision_key] == ORIGIN
-        assert set(manifest[hashes_key]) == set(names)
         assert manifest["source_origin_commits"][-1] == ORIGIN
         assert (
             manifest["historical_checkpoints"]["production"]
             == "d79e3f6f0a424f5bcc3a1a6d610313e49daf97a2"
         )
         assert "not inherited from d79" in manifest["experiment"]
-        for name, expected in manifest[hashes_key].items():
+        manifests[group] = manifest[hashes_key]
+    # History-dependent checks last, so a missing commit masks nothing above.
+    names = tracked(ORIGIN)
+    origin = historical_tree(ORIGIN, tmp_path)
+    for group, hashes in manifests.items():
+        assert set(hashes) == set(names), group
+        for name, expected in hashes.items():
             assert (
                 hashlib.sha256((origin / name).read_bytes()).hexdigest() == expected
             ), name
-    assert re100_helpers.PIN == run_jet_circle_cv.PIN == ORIGIN
 
 
 def test_runtime_checkout_identity_is_separate_from_source_origin(tmp_path):