Bind eval results to exact provenance

[vriesd]

Phase 3 binds real eval results to independently computed source, package, evaluator, host, actor, instruction, and transcript evidence.

What changed

• Hashes working source content and source commit independently.
• Binds exact tarball bytes and a typed unpacked archive manifest, with traversal, duplicate, and unsupported-entry rejection.
• Hashes evaluator inputs and effective host configuration, including reviewer model and step policy.
• Preserves requested manager and reviewer identities separately from raw completed-message observations.
• Keeps reviewer lineage and child-endpoint failures explicit.
• Hashes actual delivered guidance bytes and rejects malformed instruction Unicode.
• Retains canonical transcript evidence after path, key, short-field, and credential redaction.
• Integrates the provenance boundary into every real runner result before Phase 4 v2 emission.

Verification

• Final paid packed happy-path passed on OpenCode 1.18.6 with observed manager and reviewer, two delivered guidance digests, and a clean redaction scan.
• bun run check passes 462 tests with one intentional live-host skip and zero failures.
• Four-model Interrogate recheck found no unresolved blocker.
• Flow contribution commit and push preflights passed. Gitleaks was unavailable, so the optional local secret scan was skipped.

The host exposes actual provider and model fields but not independent family, gateway, and revision. The evidence records that limitation; Phase 4 must not fabricate a full actual ModelIdentity.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84667cbf0c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Record only completed guidance deliveries

When a flow_guidance call is pending or ends in error, this branch still adds it to guidanceLoads; run.ts then hashes the empty output or error message as if those bytes were delivered instructions. Aborted and tool-error attempts therefore receive incorrect instruction provenance. Restrict delivery records to completed calls with an observed output, while retaining failed calls only in the transcript.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Fail closed when any completed turn lacks identity

When a session contains multiple completed assistant messages and only some expose model fields, the fieldless messages are discarded before this uniqueness check, so one observed message labels the entire actor as observed. On hosts with partial metadata—or if metadata disappears on a later turn—this can attribute unobserved work to the earlier model identity. Return field-unavailable whenever identities.length !== completed.length before accepting a unique identity.

Useful? React with 👍 / 👎.