[jadenfix]

Summary

• fail closed when report outputs alias any read input through a direct path, symlink, or hard link
• protect backtest, state, and price parquet inputs plus metrics and provenance JSON
• add direct regression coverage for the reproduced data-loss case
• add a deterministic provider-free demo with source-pinned GIF, MP4, and poster
• verify source blobs, artifact hashes, metadata, frames, and full media decode in CI

Reproduction

At base 9e8928d03fce03d2265bcd664a5fae5f95fff384, after the seeded offline demo:

python -m src.cli report --symbol DEMO \
  --output artifacts/demo/data/binance_DEMO_1h.parquet

exited 0 and replaced the parquet input with HTML. Its SHA256 changed from 0796f3ef1ed985cc8c665e90b0e24b907f11c9776c38235c652e05664a7fa826 to 79e7e88beefe8b0d8960bf3b7a573ee1ee78e3a53fa2ecad574195fa2989b27f.

Verification

• 20 tests passed
• exact seeded CLI workflow passed
• python scripts/verify_demo.py passed for 3 media files and 20 source inputs
• full ffmpeg decode passed for GIF, MP4, and poster
• git diff --check 9e8928d03fce03d2265bcd664a5fae5f95fff384...HEAD passed
• fresh remote clone is clean and byte-identical to the recorded media

Scope

The demo uses deterministic fictional seeded prices and makes no exchange request, places no order, and claims no live, profit, latency, or performance result. Metrics are fixture outputs only.

[jadenfix]

Exact-head CI receipt for 0db4371b6f559b69fc1d82e9dc8417221916c28b:

• Workflow run 38491667832 completed failure.
• Both Python 3.11 and 3.12 jobs installed successfully, and the test phase passed (20 tests).
• The seeded provider-free demo completed successfully.
• The failure is isolated to python scripts/verify_demo.py: the default shallow actions/checkout@v4 clone does not contain captured source commit 0f4b8dc8ae02c4742f820bb4b3633db39f1d8301, so git rev-parse 0f4b8dc...^{tree} fails before media verification.
• A fresh full remote clone at this exact head passes the verifier for 3 media files and 20 source inputs, passes git diff --check 9e8928d...HEAD, and remains clean.
• The branch is frozen for exact-head review; this PR is not merge-ready until the shallow-checkout verifier gate is repaired and rerun green.

No live exchange request or order was made; the demo remains deterministic fictional fixture scope only.

[jadenfix]

Final exact-head verification receipt

Identity

• PR: Protect report inputs and add source-pinned offline demo #4
• Base: 9e8928d03fce03d2265bcd664a5fae5f95fff384
• Base tree: c8ca3c06cd5644a2eecc9124d2858cbaa9f0ccc0
• Head: 5b1dc891acf71d22ba20d75d15d9d9f7a27c08c2
• Head tree: 63f12e2065e8d91c840ef46160ca2bf2d9c75582
• Captured source: 0f4b8dc8ae02c4742f820bb4b3633db39f1d8301
• Captured source tree: 5aa5d61d71063ef1fac5ebc7fc76d9ec64bca251
• Source manifest SHA256: 98b0e944e2e8c3463c61de103d1b5889936d206dc6123029559cf41bfdfacfaf

Reproduced defect and repair

At the base commit, the real command

python -m src.cli report --symbol DEMO --output <artifacts>/binance_DEMO_1h.parquet

exited 0 and replaced the price parquet with HTML. The input SHA256 changed from 0796f3ef1ed985cc8c665e90b0e24b907f11c9776c38235c652e05664a7fa826 to 79e7e88beefe8b0d8960bf3b7a573ee1ee78e3a53fa2ecad574195fa2989b27f.

The repaired guard exits 1 before mutation and preserves the original SHA256 across direct paths, symlink aliases, and hard-link aliases. Protected read inputs are the backtest, state, and price parquet files plus metrics and provenance JSON.

Verification

• Fresh remote clone at the exact head: clean checkout.
• 20 passed.
• Exact seeded offline CLI demo passed.
• python scripts/verify_demo.py: 3 media artifacts and 20 source inputs verified.
• GIF, MP4, and poster all fully decoded.
• git diff --check 9e8928d...HEAD: passed.
• Hosted workflow 38492375777: success.
  • Python 3.11 job 115620367378: success.
  • Python 3.12 job 115620366814: success.
  • Tests, seeded demo, and media/source verifier succeeded in both jobs.

Media

Artifact	Bytes	SHA256	Git blob
GIF	1,261,445	5cd1ec4a06ad89f309a548fb8074c4a95507dfd29d20bdacc055609f0827f297	5af07565d4926eecddbc1015ba51d691ddc726a5
MP4	387,191	473a25ce097e610ecc1793a1960419a45908378814f7a837049105b7fc91ec97	fc06ae2ca3d7edd471d9b027f66c123f2025bdd8
Poster	80,377	697da100279567cc4a356e7fb96ae19a445f314b6de9747373036d50629aab61	86024d883864717659344467b0862782afea3caf

GIF: 800×450, 10.0 s, 120 frames. MP4: H.264, 1280×720, 10.0 s, 240 frames. Poster: PNG, 1280×720.

Scope and residual note

This is deterministic fictional seeded data executed entirely offline. It makes no exchange/provider request, places no order, and makes no live, profit, latency, or market-performance claim. Fixture metrics are not market evidence.

The repository already contains a chatgpt-style mode-160000 gitlink at the base commit without a tracked .gitmodules mapping. Checkout cleanup logs a warning, but it does not dirty the checkout and did not fail either final hosted job. This PR does not alter that unrelated pre-existing state.

Owner: /root/stochastic_site_demo. Status: draft, staged/unmerged; do not merge outside the sole-merger protocol.

[jadenfix]

Independent exact-head verification: CLEAR (staged only; no merge performed).

Frozen identity

• Base: 9e8928d03fce03d2265bcd664a5fae5f95fff384
• Base tree: c8ca3c06cd5644a2eecc9124d2858cbaa9f0ccc0
• Head: 5b1dc891acf71d22ba20d75d15d9d9f7a27c08c2
• Head tree: 63f12e2065e8d91c840ef46160ca2bf2d9c75582
• Captured source: 0f4b8dc8ae02c4742f820bb4b3633db39f1d8301
• Captured source tree: 5aa5d61d71063ef1fac5ebc7fc76d9ec64bca251
• Source-manifest SHA256: 98b0e944e2e8c3463c61de103d1b5889936d206dc6123029559cf41bfdfacfaf

Independent reproduction and repair check

On the base commit, after the real offline demo, python -m src.cli report --symbol DEMO --output <artifacts>/binance_DEMO_1h.parquet exited 0 and replaced the parquet with HTML. SHA256 changed exactly from 0796f3ef1ed985cc8c665e90b0e24b907f11c9776c38235c652e05664a7fa826 to 79e7e88beefe8b0d8960bf3b7a573ee1ee78e3a53fa2ecad574195fa2989b27f.

At the frozen head, I independently exercised 15/15 rejection cases: direct path, symlink alias, and hard-link alias for each of the backtest parquet, states parquet, price parquet, metrics JSON, and provenance JSON. Every case exited 1 with the guard error, and every protected input retained its original bytes.

Gates and remote-byte verification

• Fresh remote clone, exact detached head; checkout clean before and after verification.
• python -m pytest tests -q: 20 passed.
• Exact seeded offline CLI workflow: passed.
• python scripts/verify_demo.py: verified 3 media files and 20 source inputs.
• The manifest covers every tracked src/**/*.py file at captured source; every listed blob matches both the captured commit and current head.
• git diff --check 9e8928d...HEAD: passed.
• Black check for both capture/verifier scripts: passed.
• All 11 changed working-tree files hash to their exact Git blobs at the remote PR head.
• Hosted workflow 38492375777: success. Python 3.11 job 115620367378 and Python 3.12 job 115620366814 both passed install, tests, real seeded demo, and source/media verifier.

Media and claim review

• GIF: 1,261,445 bytes; SHA256 5cd1ec4a06ad89f309a548fb8074c4a95507dfd29d20bdacc055609f0827f297; blob 5af07565d4926eecddbc1015ba51d691ddc726a5; 800×450, 10.0 s, 120 frames.
• MP4: 387,191 bytes; SHA256 473a25ce097e610ecc1793a1960419a45908378814f7a837049105b7fc91ec97; blob fc06ae2ca3d7edd471d9b027f66c123f2025bdd8; H.264, 1280×720, 10.0 s, 240 frames.
• Poster: 80,377 bytes; SHA256 697da100279567cc4a356e7fb96ae19a445f314b6de9747373036d50629aab61; blob 86024d883864717659344467b0862782afea3caf; PNG, 1280×720.
• All three artifacts fully decoded. I visually inspected stable and transition frames across the full sequence plus the poster: readable, internally consistent, and explicitly labeled as seeded fictional/provider-free/no-orders/no-performance-claim.
• README, receipt, and media make no live-provider, trading, profit, latency, or market-performance claim. Displayed metrics are truthfully limited to the generated fixture.

Reviewer: /root/review_stochastic_site_pr4. Merge authority remains with the sole-merger protocol. I did not merge, push, close, retarget, or otherwise mutate this PR.