Both runners now re-derive the recorded source identity after the run
(source_provenance.final_source_check) and only then mark the receipt
complete. A changed source, or a recheck that fails, rewrites the receipt
as invalid and raises:
- V1: in-run receipts carry run_status=INCOMPLETE; finish_receipt sets
COMPLETE or INVALID_SOURCE_CHANGED (+ source_recheck/source_after).
- V3: completed stays False, invalid=SOURCE_CHANGED_DURING_RUN, no
screening_pass; the assessor requires source_recheck UNCHANGED (frozen
mode still accepts receipts from before the field existed).
Interrupted runs keep INCOMPLETE / completed=False. Host tests cover
unchanged, changed and failed rechecks and incomplete runs. No threshold
or solver change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- test_dfg_re20: the dirty-checkout test now supplies all three git
responses (HEAD:src, HEAD, status) and asserts the call order, so it
reaches the clean-checkout rejection instead of StopIteration.
- run_dfg_re20: --output inside the source checkout is refused before
provenance, plan writing or any CUDA work (receipts would dirty the
recorded source); tested with the checkout root and nested paths.
- source_provenance.historical_files: validates all paths first and
reports an unreadable blob as HistoryUnavailable, not a raw
CalledProcessError; tested with a failing git show.
No physics thresholds changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- test_refined_dfg::test_source_pin runs its mismatch negative controls
first (now including window mode) so missing history cannot skip them.
- test_re100: renamed to test_manifest_matches_its_pinned_commit, plus an
explicit record that today's src differs from the pin.
- Structural manifest checks run before any history-dependent check.
- Real tamper test: a flipped digest raises via verify_manifest, and a
path absent at the commit raises ValueError.
- A blobless clone (tree present, blob missing) is reported as unavailable
history, not as a missing path.
- All history skips go through history_unavailable(): fatal when
CELERIS_REQUIRE_HISTORY=1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The a135252 manifest is historical qualification: it pins the committed
corrected tree at a135252. The guard is correct; the four tests used the
current working tree as the 'pinned' fixture, so 87c3a31's jets.py change
broke them. Fixtures are now materialized from a135252 with git; the
corrected acceptance, baseline rejection, four tamper rejections and the
reversed-header baseline control are unchanged. A new test records that
the guard refuses today's src where it differs from the pin.
Missing history skips with the reason, or fails when
CELERIS_REQUIRE_HISTORY=1 (release gating) via history_unavailable().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Historical-evidence pins (dfg_re100 / jet_circle_cv / refined_dfg manifests)
now compare each recorded digest with the file at the recorded commit, read
with git, instead of with today's working tree. Missing history (no git,
shallow clone, installed copy) raises HistoryUnavailable and the test is
reported as skipped with that reason, never passed. Receipt/plan logic tests
take the selected manifest directly, so their assertions run again; the
pinned modes' mismatch rejections stay as negative controls.
V1 (run_jet_circle_cv) keeps its pinned mode and gains --current-checkout:
it records HEAD, the src tree and per-file hashes labelled as current
checkout, never as the frozen qualification, and requires a clean tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
TRON