feat(receipts): bind receipts to patch identity

[solomonneas]

Summary

Verification receipts now bind a passing command to the Git state it checked. Each new receipt records:

• baseline_commit
• tree_fingerprint
• changes_patch_sha256

The verify run retains the exact patch bytes as changes.patch. Both fresh and reused receipts use the same capture path.

Fingerprint and untracked-file policy

The tree fingerprint is the object ID returned by Git plumbing against a temporary index:

1. git read-tree HEAD
2. git add -A
3. git write-tree

The temporary index includes tracked state and every non-ignored untracked file. Gitignored files are excluded. The caller's real index is unchanged. Capture rechecks both HEAD and the generated tree after writing the patch. If either changes or patch collection fails, the receipt records null identity fields and does not print a derived binding.

changes_patch_sha256 is SHA-256 over the retained changes.patch bytes. A clean tree is represented by a zero-byte patch, whose digest is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.

Schema compatibility

New verification receipts use schema_version: 2. The fields are additive, deterministic, and written through the existing sorted-key serializer. Existing stored receipts without a schema version or identity fields still load and display. Identity lines are omitted when the three binding values are unavailable.

Tests

• identical trees produce identical fingerprints
• tracked or relevant untracked changes produce a different fingerprint
• ignored untracked files do not affect the fingerprint or patch
• patch hashes match an independent SHA-256 calculation
• clean trees retain a zero-byte patch
• the temporary index preserves staged content in the real index
• patch-collection failures produce explicit null identity fields
• legacy receipts load and display without identity fields
• fresh and reused receipt displays render the binding
• issue work loop: enforce capture-before-retry for failed verify runs #475 capture-before-retry tests pass with the new receipt fields

Verification

./scripts/verify

• receipt: 20260726-213137-work-verify-042161
• exit code: 0
• result: 4383 passed, 3 skipped
• coverage: 82.79%

Sample receipt excerpt:

schema_version: 2
baseline_commit: 872a96c06333e0b0c4ab09a9603fb5ad64729833
tree_fingerprint: 6e37153141287f2ed84709298c21cff8675322a0
changes_patch_sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
status: completed
exit_code: 0
verified tree 6e37153141287f2ed84709298c21cff8675322a0 = baseline 872a96c06333e0b0c4ab09a9603fb5ad64729833 + patch e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Closes #485.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 07ae76f9-f60a-4332-b7eb-eb0b20a7ca8b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/485-receipt-patch-identity

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}