fix: harden portable release workspace provenance

Author: gawcista

scripts/release_gate.py

@@ -64,7 +64,7 @@ def _git_head_commit(checkout: Path) -> str:
 
 
 def _checkout_clean(checkout: Path) -> str | None:
-    """Return a description of any tracked difference from HEAD, else None."""
+    """Return a description of any non-ignored difference from HEAD, else None."""
     result = subprocess.run(
         ["git", "-C", str(checkout), "status", "--porcelain"],
         capture_output=True,
@@ -78,6 +78,20 @@ def _checkout_clean(checkout: Path) -> str | None:
     return None
 
 
+def _prepare_workspace(workspace: Path) -> None:
+    """Create an empty gate workspace or reject stale caller-owned state."""
+    if workspace.exists():
+        if not workspace.is_dir():
+            raise SystemExit(f"FAIL: release-gate workspace is not a directory: {workspace}")
+        if any(workspace.iterdir()):
+            raise SystemExit(
+                "FAIL: --work-dir must be absent or empty; refusing to reuse "
+                f"stale release-gate state under {workspace}"
+            )
+    else:
+        workspace.mkdir(parents=True)
+
+
 def _extract_head_archive(checkout: Path, target: Path) -> int:
     """Extract `git archive HEAD` into target; return the file count."""
     archive = subprocess.run(
@@ -96,7 +110,7 @@ def _extract_head_archive(checkout: Path, target: Path) -> int:
 
 
 def _snapshot_matches_head(checkout: Path, srctree: Path) -> list[str]:
-    """Prove every snapshot file is byte-identical to HEAD's blob."""
+    """Prove the snapshot file set and contents are identical to HEAD."""
     tree = subprocess.run(
         ["git", "-C", str(checkout), "ls-tree", "-r", "HEAD"],
         capture_output=True,
@@ -112,21 +126,29 @@ def _snapshot_matches_head(checkout: Path, srctree: Path) -> list[str]:
             for entry in tree.stdout.splitlines()
         )
     }
+    actual_names = {
+        path.relative_to(srctree).as_posix()
+        for path in srctree.rglob("*")
+        if path.is_file() or path.is_symlink()
+    }
+    expected_names = set(expected)
+    mismatches = expected_names.symmetric_difference(actual_names)
+    common_names = sorted(expected_names & actual_names)
     hashed = subprocess.run(
         ["git", "-C", str(checkout), "hash-object", "--stdin-paths"],
-        input="".join(str(srctree / name) + "\n" for name in expected),
+        input="".join(str(srctree / name) + "\n" for name in common_names),
         capture_output=True,
         text=True,
     )
     if hashed.returncode != 0:
         raise SystemExit("FAIL: git hash-object --stdin-paths failed")
     actual = hashed.stdout.splitlines()
-    mismatches = [
+    mismatches.update(
         name
-        for name, blob in zip(expected, actual)
+        for name, blob in zip(common_names, actual)
         if blob != expected[name]
-    ]
-    return mismatches
+    )
+    return sorted(mismatches)
 
 
 def _copy_snapshot_subtree(srctree: Path, rel_dir: str, target: Path) -> int:
@@ -240,7 +262,7 @@ def main(argv: list[str] | None = None) -> int:
         if owned_workspace
         else args.work_dir.resolve()
     )
-    workspace.mkdir(parents=True, exist_ok=True)
+    _prepare_workspace(workspace)
     print(f"workspace: {workspace}")
 
     srctree = workspace / "srctree"

scripts/release_gate_installed_check.py

@@ -18,6 +18,7 @@
 import importlib.util
 import json
 import os
+import re
 import subprocess
 import sys
 import sysconfig
@@ -56,7 +57,7 @@ def _venv_site_packages() -> list[Path]:
     for key in ("purelib", "platlib"):
         path = sysconfig.get_path(key)
         if path:
-            paths.append(Path(path))
+            paths.append(Path(path).resolve())
     return paths
 
 
@@ -66,6 +67,16 @@ def _check_import_provenance(report: dict[str, object]) -> bool:
     module_path = Path(valleyscope.__file__).resolve()
     site_packages = _venv_site_packages()
     report["venv_purelib_platlib"] = [str(path) for path in site_packages]
+    prefix = Path(sys.prefix).resolve()
+    if not site_packages or any(
+        not site_path.is_relative_to(prefix) for site_path in site_packages
+    ):
+        print(
+            "FAIL: purelib/platlib are not contained under this interpreter's "
+            f"sys.prefix {prefix}: {site_packages}",
+            file=sys.stderr,
+        )
+        return False
     if not _module_in_venv(module_path, site_packages):
         print(
             "FAIL: valleyscope resolves to "
@@ -229,10 +240,12 @@ def main(argv: list[str] | None = None) -> int:
     )
     parser.add_argument(
         "--commit",
-        default="unknown",
+        required=True,
         help="Full commit hash the gate is bound to (provenance identity).",
     )
     args = parser.parse_args(argv)
+    if re.fullmatch(r"[0-9a-f]{40}", args.commit) is None:
+        parser.error("--commit must be a full 40-character lowercase Git hash")
 
     checkout_root = args.checkout.resolve()
     sys.path[:] = [

tests/test_release_gate_probes.py

@@ -24,9 +24,13 @@
     _checkout_clean,
     _extract_head_archive,
     _audit_archive,
+    _prepare_workspace,
     _snapshot_matches_head,
 )
-from scripts.release_gate_installed_check import _module_in_venv
+from scripts.release_gate_installed_check import (
+    _check_import_provenance,
+    _module_in_venv,
+)
 
 NEEDS_GIT = pytest.mark.skipif(
     shutil.which("git") is None, reason="git is required for snapshot probes"
@@ -115,6 +119,20 @@ def test_archive_snapshot_matches_head(tmp_path: Path) -> None:
     assert (srctree / "tracked.txt").read_text() == "committed"
     assert _snapshot_matches_head(repo, srctree) == []
 
+    # Extra files from a reused workspace must invalidate snapshot identity.
+    (srctree / "stale.py").write_text("not from HEAD")
+    assert _snapshot_matches_head(repo, srctree) == ["stale.py"]
+
+
+def test_reused_nonempty_workspace_is_rejected(tmp_path: Path) -> None:
+    workspace = tmp_path / "release-gate"
+    _prepare_workspace(workspace)
+    assert workspace.is_dir()
+
+    (workspace / "stale-artifact.whl").write_text("stale")
+    with pytest.raises(SystemExit, match="absent or empty"):
+        _prepare_workspace(workspace)
+
 
 def test_user_site_valleyscope_cannot_satisfy_provenance(tmp_path: Path) -> None:
     venv_purelib = tmp_path / "venv" / "lib" / "python3.13" / "site-packages"
@@ -126,6 +144,20 @@ def test_user_site_valleyscope_cannot_satisfy_provenance(tmp_path: Path) -> None
     ) is True
 
 
+def test_site_packages_must_be_under_current_prefix(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    import valleyscope
+
+    source_root = Path(valleyscope.__file__).resolve().parent.parent
+    monkeypatch.setattr(sys, "prefix", str(tmp_path / "venv"))
+    monkeypatch.setattr(
+        "scripts.release_gate_installed_check._venv_site_packages",
+        lambda: [source_root],
+    )
+    assert _check_import_provenance({}) is False
+
+
 def test_pythonpath_injection_cannot_satisfy_provenance(tmp_path: Path) -> None:
     fake = tmp_path / "fake-pythonpath"
     (fake / "valleyscope").mkdir(parents=True)