"""Record runtime checkout identity separately from the reviewed source origin."""

import subprocess


def checkout_provenance(repo):
    """Require a Git checkout; never label changed-source runs as historical evidence."""
    revision = subprocess.check_output(
        ["git", "-C", str(repo), "rev-parse", "HEAD"], text=True
    ).strip()
    dirty = subprocess.check_output(
        ["git", "-C", str(repo), "status", "--porcelain", "--untracked-files=normal"],
        text=True,
    )
    return dict(checkout_revision=revision, checkout_dirty=bool(dirty))