Sealed evaluation run
The buyer's base tree, the buyer's grader bundle, and the provider's diff. Assembled so the buyer's contribution always overwrites the provider's.
Stages
-
✓
Materialize the pinned base treegit archive emits tree contents only, so .git never exists to leak a reference solution.
-
✗
Guard every touched pathcontract evaluated FAIL: .github/workflows/deploy.yml modifies a contract-protected path (pattern: .github/**)
-
3
Apply the provider diff not runAllowed source paths only, as explicit file changes.
-
4
Inject the buyer grader bundle not runOverwrites whatever the provider left at the grader paths.
-
5
Run the pinned commands not runNot reached: the violation decided the verdict first.
Path guard
.github/workflows/deploy.yml modifies a contract-protected path (pattern: .github/**)
Decided before any command ran. Passing tests could not have rescued it: a submission that disables the deploy gate has routed around the contract, not satisfied it.
Tamper signals
None recorded.
Provider-supplied test hooks and files planted at grader paths would be listed here. Their absence is itself part of the record.
Pinned commands
Only the commands the buyer pinned, in the order pinned, as argv with no shell.
No commands executed.
The contract-term violation decided the verdict first.
Verification identity
What was graded, by which tests, in which environment. These are the values the receipt binds.
Code security screening
Ran before the sandbox. Did not gate it.
The submission contains modifications to a file within a protected path, specifically `.github/workflows/deploy.yml`. This action directly violates the contract terms that specify `.github/**` as protected. Altering CI/CD workflow configurations, even if seemingly to empty them, represents a significant integrity and security risk as it could disable or bypass critical automation. The changes to `src/calc.py` appear to be a functional bug fix that aligns with the described grader expectations and do not introduce any security concerns, supply chain risks, or test gaming. However, the breach of protected paths is a severe finding.
Failure forensics
Written after the refund. Did not cause a re-run.
Your submission failed because it attempted to modify a contract-protected file. The task's terms clearly state that files within the '.github/' directory (pattern: .github/**) are protected and cannot be altered. Your submission included changes to '.github/workflows/deploy.yml', which falls under this protected path, leading to the immediate rejection of your submission before any tests were executed. Passing tests would not have rescued it, as the failure was a contract violation.
To resolve this, ensure that your submission does not introduce any changes to files located within the '.github/' directory. Specifically, revert all modifications to '.github/workflows/deploy.yml' and ensure that no files matching the '.github/**' pattern are altered in your submission.
Produced by gemini-2.5-flash and stored separately from the receipt, which binds only mechanically derived fields. Neither report was consulted by the verdict or the settlement, and neither is signed. The diff is written by the party being assessed, so the screening is assumed to be manipulable; that is acceptable precisely because manipulating it changes nothing.