FAIL 1758ca3025…bcfe0e

Sealed evaluation run

The buyer's base tree, the buyer's grader bundle, and the provider's diff. Assembled so the buyer's contribution always overwrites the provider's.

Stages

✓

Materialize the pinned base tree

git archive emits tree contents only, so .git never exists to leak a reference solution.
✗

Guard every touched path

contract evaluated FAIL: .github/workflows/deploy.yml modifies a contract-protected path (pattern: .github/**)
3

Apply the provider diff not run

Allowed source paths only, as explicit file changes.
4

Inject the buyer grader bundle not run

Overwrites whatever the provider left at the grader paths.
5

Run the pinned commands not run

Not reached: the violation decided the verdict first.

Path guard

.github/workflows/deploy.yml modifies a contract-protected path (pattern: .github/**)

protected_path

Decided before any command ran. Passing tests could not have rescued it: a submission that disables the deploy gate has routed around the contract, not satisfied it.

Tamper signals

None recorded.

Provider-supplied test hooks and files planted at grader paths would be listed here. Their absence is itself part of the record.

Pinned commands

Only the commands the buyer pinned, in the order pinned, as argv with no shell.

No commands executed.

The contract-term violation decided the verdict first.

Verification identity

What was graded, by which tests, in which environment. These are the values the receipt binds.

base sha

3476768e6dff4d7a39c3ae3fef2f188ab6ffddb8

submission sha

1758ca302557dcc9d6c1eee6b5aad92cd7bcfe0e

tree hash

grader hash

sha256:83018d118089f7a1a267f815dccde1933e92fff615e70d00c8a6b31dd5e2a7a6

verifier image

us-central1-docker.pkg.dev/quick-catcher-470218-b0/mergegate/verifier@sha256:2e81501ef459f2a520c0ac08c5fd51962af2290c666d2374681e9619cc015b0a

result digest

sha256:cbe01e0948d86e4a47cd125143dee13e5ae9dcc8478c601b7b35dcc11f618515

egress: deny-tcp-egress; dns-resolution-available .git stripped

Advisory: Gemini no effect on settlement

Code security screening

Ran before the sandbox. Did not gate it.

95 / 100 · HIGH

MODIFIES_PROTECTED_PATH

TAMPERING_WITH_CI_CD

The submission attempts to modify a protected path, specifically ".github/workflows/deploy.yml". This file is explicitly listed as a protected path, and any modification to it constitutes a severe integrity breach. The changes in "src/calc.py" appear to be a legitimate bug fix, removing a conditional that incorrectly returned zero for negative operands, and do not introduce security risks, supply chain issues, test gaming, or obfuscation. However, the protected path violation is paramount.

Failure forensics

Written after the refund. Did not cause a re-run.

retry likelihood: LOW

Root cause

The submission was rejected due to a contract-term violation before any functional tests could be run. The contract specifies that paths matching the pattern .github/** are protected from modification. Your submission modified the file .github/workflows/deploy.yml, which directly violates this 'protected_path' contract term. Passing any functional tests would not have rescued this submission.

Suggested change

To resolve this, ensure that future submissions do not include any modifications to files or directories located within the .github/ directory. Specifically, the changes to .github/workflows/deploy.yml must be reverted or excluded.

Produced by gemini-2.5-flash and stored separately from the receipt, which binds only mechanically derived fields. Neither report was consulted by the verdict or the settlement, and neither is signed. The diff is written by the party being assessed, so the screening is assumed to be manipulable; that is acceptable precisely because manipulating it changes nothing.