[Jerryvic911]

Closes #232
Closes #232

Problem

Every first-party manifest entry has sourceCommit: null, so an operator cannot tie deployed bytecode back to reviewed source. Nothing separated "unknown history" from "proven source", and re-recording a contract silently wiped any commit that had been recorded.

Changes

Schema and validation

• Adds an optional provenance field to deployments/schema/v1.json. Schema stays at v1, since adding an optional field does not need a bump.
• Every first-party (non-external) contract must carry provenance, with one of two statuses:
  • source-verified: sourceCommit is a full 40-hex commit that rebuilds to artifactHash.
  • unverifiable: historical record, sourceCommit is null, and a reason is required.
• The validator rejects:
  • a source-verified record with a null commit;
  • an unverifiable record with a commit;
  • a malformed or all-zero commit;
  • any deploy-script record that is unverifiable.

Recording

• record for deploy-script records now needs --source-commit as HEAD or a full hash. Short hashes and branch names are rejected, and the commit must exist in the repo.
• It refuses a dirty working tree (previously only a warning).
• It rebuilds the commit and refuses to write the record unless the build reproduces the artifact hash.
• Re-recording unchanged bytecode keeps its existing provenance. Changed bytecode resets to unverifiable unless a commit is supplied. Previously sourceCommit and version were overwritten with null.

Verification

• New verify-source command: checks out each source-verified commit in a throwaway git worktree, rebuilds it, and compares the artifact hash.
• EVM uses Hardhat. For contracts with Solidity immutables (for example ERC6538Registry), the build is compared against the deployed code everywhere except the immutable slots.
• Stellar builds the whole workspace and optimizes the wasm, as stellar/deploy.sh does.
• Solana and CKB have no reproducible build here, so they cannot be marked source-verified.

Backfill

• New attest command marks a historical record source-verified only if a commit reproduces its recorded hash. --search tries the commits that touched the chain's sources before the deployment.
• The three existing records (EVM, Solana, CKB) are marked unverifiable with a reason. manifest.json is regenerated.

Docs are updated in deployments/README.md.

Testing

• npm run typecheck, npm test and npm run check in scripts/deployment-manifest.
• 20 new tests in test/provenance.test.ts use a real temporary git repo and a fake builder. They cover commit resolution, dirty-tree detection, a matching and a differing build, null, malformed and unknown commits, worktree cleanup, immutable handling, and the validation rules.
• Existing fixtures in units.test.ts and check.e2e.test.ts gained the new field.

Not tested / limitations

• The real Hardhat (EVM) and Cargo plus stellar contract optimize (Stellar) builders have not been run end to end. Only the logic around them is tested, with a fake builder.
• I did not run the backfill search against the Horizen testnet records, so they stay unverifiable. No commit was claimed without a reproduced hash.
• No CI step runs verify-source yet, because the CI job has no Rust or Stellar toolchain. This is a possible follow-up.
• The e2e tests in check.e2e.test.ts do not run on Windows because of the tsx spawn and line endings. That predates this change and is not touched here.

[drips-wave]

@Jerryvic911 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[truthixify]

The provenance model is fail-closed and matches #232: deployment-script records require an existing full commit, source-verified claims are rebuilt before write, unverifiable history is explicit, and immutable EVM code is checked outside compiler-declared slots. Local verification passed: typecheck, 63 tests, and manifest check.