Treat feedback as observed evidence

“Tests pass” is a claim until the owner has observed the command, exit status and relevant source state. A test result from an earlier patch is stale even if it was genuine. Formatting is different from parsing, and both are different from static type checking or behavioral acceptance.

The collector hashes money.py together with the sealed acceptance and check scripts, then records exact command vectors and exit codes. The gate accepts only current owner-observed records. The digest identifies bytes in this lab; it is not a signature, security attestation or proof that arbitrary JSON came from a trustworthy runner.

Required checks have distinct purposes. The unit command exercises valid/invalid input behavior. The syntax command compiles the file without importing it. Ruff checks the selected file’s formatting; mypy checks its strict static types. Neither promises functional correctness or absence of malicious behavior.

Core replay uses the Python standard library. The optional quality run requires the pinned local Ruff/mypy tools in the README. Missing tools are recorded as not run, never silently shown as passed. The supplied final replay receipt was actually collected with all four tools available.

from dataclasses import dataclass
import hashlib
import re

class WorkflowError(ValueError):
    pass

def repo_path(raw):
    if not isinstance(raw, str) or not raw or len(raw) > 160 or not re.fullmatch(r"[A-Za-z0-9_./-]+", raw):
        raise WorkflowError("invalid repository path")
    parts = raw.split("/")
    if any(part in ("", ".", "..", ".git", "private", "secrets") or part.startswith(".env") for part in parts):
        raise WorkflowError("path outside the declared source snapshot")
    return raw

def snapshot_digest(files):
    if not isinstance(files, dict) or not files or len(files) > 20:
        raise WorkflowError("expected a bounded source snapshot")
    for path, text in files.items():
        repo_path(path)
        if not isinstance(text, str) or len(text) > 20000:
            raise WorkflowError("invalid source text")
    result = bytearray(b"coderigor.workflow.snapshot.v1\x00")
    for path, text in sorted(files.items()):
        for value in (path.encode("utf-8"), text.encode("utf-8")):
            result.extend(len(value).to_bytes(8, "big"))
            result.extend(value)
    return hashlib.sha256(result).hexdigest()

first = snapshot_digest({"money.py":"fixed", "acceptance.py":"sealed"})
reordered = snapshot_digest({"acceptance.py":"sealed", "money.py":"fixed"})
edited = snapshot_digest({"money.py":"later edit", "acceptance.py":"sealed"})
print("order independent", first == reordered)
print("later edit stale", first != edited)

Checks must correspond to the bytes being reviewed. Editing money.py after a successful run invalidates that source digest. Editing the acceptance suite also changes the snapshot and needs a separate review. Length-prefixed path/text framing prevents ambiguous concatenation, and sorting paths makes insertion order irrelevant.

Duplicates, unexpected checks and wrong command vectors are visible reasons for rejection. A provenance string is useful metadata only when the collector controls its origin. Reading "observed" from an agent-authored file does not make it an independent observation.

reports = [{"name":"unit", "exit":0, "origin":"agent claim"},
           {"name":"syntax", "exit":0, "origin":"observed"}]
for report in reports:
    print(report["name"], report["exit"] == 0 and report["origin"] == "observed")

Implement the check gate and invalidate a once-green report with a later edit. Do not confuse a source hash with a trusted runner. Next review the actual patch and its scope before combining these signals into a final decision.