audit: bind D4 to frozen source revision

1 files changed, 13 insertions, 4 deletions

diff --git a/experiments/analyze_kp_dynamic_projection_confirmation.py b/experiments/analyze_kp_dynamic_projection_confirmation.py
index 12522ec..2eec89a 100644
--- a/experiments/analyze_kp_dynamic_projection_confirmation.py
+++ b/experiments/analyze_kp_dynamic_projection_confirmation.py
@@ -2,6 +2,7 @@
 """Audit the frozen D4 paired five-seed test confirmation."""
 import argparse
 import glob
+import hashlib
 import json
 import math
 import os
@@ -11,6 +12,9 @@ import statistics
 CONDITIONS = ("clean_kp", "dynamic")
 SEEDS = tuple(range(10, 15))
 T_CRITICAL_ONE_SIDED_95_DF4 = 2.131846786
+EXPECTED_SOURCE_COMMIT = "0008f2cd96c06bea98f43560867d93967c597711"
+EXPECTED_FULL_GATE_SHA256 = (
+    "48957573e6feb18e5c2dd0c6785bbd20f37126dd33e8bb7cb357190d236b4937")
 
 
 def numeric_leaves(value):
@@ -41,8 +45,11 @@ def main():
     parser.add_argument(
         "--out", default="results/kp_dynamic_projection_confirmation_gate.json")
     args = parser.parse_args()
-    with open(args.full_gate) as handle:
-        full_gate = json.load(handle)
+    with open(args.full_gate, "rb") as handle:
+        full_gate_bytes = handle.read()
+    if hashlib.sha256(full_gate_bytes).hexdigest() != EXPECTED_FULL_GATE_SHA256:
+        raise ValueError("D4 D3 prerequisite gate provenance drift")
+    full_gate = json.loads(full_gate_bytes)
     if (full_gate.get("protocol") != "kp_dynamic_neutral_projection_full_v1"
             or full_gate.get("status") != "passed"
             or full_gate.get("independent_confirmation_opened") is not True):
@@ -205,8 +212,10 @@ def main():
                 if hardware["peak_memory_allocated_bytes"] > int(
                         2.5 * 1024 ** 3):
                     failures.append(f"seed{seed}:peak_memory")
-    if len(source_commits) != 1:
-        raise ValueError("all D4 runs must share one source revision")
+    if source_commits != {EXPECTED_SOURCE_COMMIT}:
+        raise ValueError(
+            "all D4 runs must use the frozen source revision; "
+            f"observed={sorted(source_commits)}")
 
     accuracies = {
         condition: [float(records[(seed, condition)]["final"]["accuracy"])