{"record":{"id":"2b8ede058888b9f5","repo":"ruvnet/ruflo","slug":"build-evidence-belongs-to-a-different-source-state","errorCode":null,"errorMessage":"build evidence belongs to a different source state","messagePattern":"build evidence belongs to a different source state","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/codex/src/harness/in-memory-run-receipt-reference.ts","lineNumber":37,"sourceCode":"}\n\nfunction validateRun(run: RunEvidence): void {\n  if (!run.executionId.trim() || !run.sessionId.trim() || !run.workloadId.trim()) {\n    throw new Error('run execution, session, and workload identity are required');\n  }\n  if (!DIGEST.test(run.sourceState.sourceStateId)) throw new Error('run sourceStateId is invalid');\n  if (!DIGEST.test(run.commandDigest) || !DIGEST.test(run.evidenceDigest)) {\n    throw new Error('run command and evidence digests must be canonical sha256 values');\n  }\n  if (!Number.isSafeInteger(run.exitCode)) throw new Error('run exitCode must be a safe integer');\n  const started = timestamp(run.startedAt, 'startedAt');\n  const completed = timestamp(run.completedAt, 'completedAt');\n  if (completed < started) throw new Error('run completedAt precedes startedAt');\n  if (\n    run.buildEvidence !== undefined\n    && run.buildEvidence.sourceStateId !== run.sourceState.sourceStateId\n  ) {\n    throw new Error('build evidence belongs to a different source state');\n  }\n}\n\n/**\n * Unsigned, non-durable, content-addressed in-memory conformance ledger.\n *\n * Exact retries converge on one receipt. Reusing an execution ID with changed\n * evidence is refused rather than rewriting history. These receipts are local\n * debugging evidence and cannot authorize enforce mode or release.\n */\nexport class InMemoryRunReceiptReference {\n  readonly referenceOnly = true;\n  private readonly receipts = new Map<string, RunReceipt>();\n  private readonly executionReceipts = new Map<string, string>();\n\n  constructor(private readonly now: () => number = Date.now) {}\n\n  recordRun(run: RunEvidence): RunReceipt {","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/codex/src/harness/in-memory-run-receipt-reference.ts#L19-L55","documentation":"When run.buildEvidence is provided, validateRun requires buildEvidence.sourceStateId to equal run.sourceState.sourceStateId. The ledger refuses to attach build evidence produced against a different repository snapshot than the run executed in, because the receipt would then claim a reproducibility the run does not have.","triggerScenarios":"Reusing a cached BuildEvidence object after the worktree changed between build and run; building in one worktree or commit and running in another; a concurrent write shifting the source state between the build-evidence capture and the run capture.","commonSituations":"CI caching build evidence keyed only by branch name; multi-worktree setups where build and run check out different commits; long-lived local caches invalidated after a rebase or partial stash.","solutions":["Recompute build evidence from the exact source state the run executes against and copy that snapshot's sourceStateId","Omit run.buildEvidence when no same-state build evidence exists — the field is optional","Pre-check buildEvidence.sourceStateId === run.sourceState.sourceStateId before recordRun"],"exampleFix":"// before: cached build evidence from an earlier snapshot\nreceipt.recordRun({ ..., sourceState, buildEvidence: cachedBuild });\n\n// after: only attach evidence bound to the run's snapshot\nreceipt.recordRun({ ..., sourceState, buildEvidence: cachedBuild.sourceStateId === sourceState.sourceStateId ? cachedBuild : undefined });","handlingStrategy":"validation","validationCode":"function buildEvidenceMatches(build: { sourceStateId: string } | undefined, run: { sourceState: { sourceStateId: string } }): boolean {\n  return build === undefined || build.sourceStateId === run.sourceState.sourceStateId;\n}","typeGuard":"function isSameSourceStateBuild(build: unknown, sourceStateId: string): build is { sourceStateId: string } {\n  if (build === undefined) return true;\n  if (typeof build !== 'object' || build === null) return false;\n  return (build as { sourceStateId?: unknown }).sourceStateId === sourceStateId;\n}","tryCatchPattern":"try {\n  ledger.recordRun(run);\n} catch (error) {\n  if (error instanceof Error && error.message === 'build evidence belongs to a different source state') {\n    run.buildEvidence = undefined; // drop stale build evidence rather than recording a false claim\n    ledger.recordRun(run);\n  } else throw error;\n}","preventionTips":["Cache build evidence keyed by sourceStateId, not by branch or commit alone","Capture build evidence and run evidence against the same worktree snapshot","Treat a mismatch as a reproducibility red flag: investigate before dropping the field"],"tags":["validation","source-state","build-evidence","run-receipt"],"backgroundTag":"source-state-mismatch","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}