Sealed evaluation run
The buyer's base tree, the buyer's grader bundle, and the provider's diff. Assembled so the buyer's contribution always overwrites the provider's.
Stages
-
ā
Materialize the pinned base treegit archive emits tree contents only, so .git never exists to leak a reference solution.
-
ā
Guard every touched pathcontract evaluated FAIL: .github/workflows/deploy.yml modifies a contract-protected path (pattern: .github/**)
-
3
Apply the provider diff not runAllowed source paths only, as explicit file changes.
-
4
Inject the buyer grader bundle not runOverwrites whatever the provider left at the grader paths.
-
5
Run the pinned commands not runNot reached: the violation decided the verdict first.
Path guard
.github/workflows/deploy.yml modifies a contract-protected path (pattern: .github/**)
Decided before any command ran. Passing tests could not have rescued it: a submission that disables the deploy gate has routed around the contract, not satisfied it.
Tamper signals
None recorded.
Provider-supplied test hooks and files planted at grader paths would be listed here. Their absence is itself part of the record.
Pinned commands
Only the commands the buyer pinned, in the order pinned, as argv with no shell.
No commands executed.
The contract-term violation decided the verdict first.
Verification identity
What was graded, by which tests, in which environment. These are the values the receipt binds.