1"""Provenance helpers: code commit, environment identity, artifact manifests."""2from __future__ import annotations3import json, os, platform, subprocess4from .contracts import dir_manifest, sha256_text, utcnow56def code_commit(repo_root) -> str:7 try:8 r = subprocess.run(["git", "-C", repo_root, "rev-parse", "HEAD"], capture_output=True, text=True, timeout=20)9 dirty = subprocess.run(["git", "-C", repo_root, "status", "--porcelain"], capture_output=True, text=True, timeout=20).stdout.strip()10 return r.stdout.strip() + ("-dirty" if dirty else "")11 except Exception: # noqa: BLE00112 return "unknown"1314def node_environment(node, ssh_fn) -> dict:15 cmd = ("export PATH=/opt/homebrew/bin:$PATH; echo claude=$(claude --version 2>/dev/null | head -1); echo os=$(sw_vers -productVersion); echo arch=$(uname -m); "16 "echo py=$(~/wp29/venv/bin/python -c 'import sys,numpy,pandas,scipy,statsmodels; print(sys.version.split()[0], numpy.__version__, pandas.__version__, scipy.__version__, statsmodels.__version__)' 2>/dev/null); "17 "echo gate=$(shasum -a 256 ~/wp29/gates/pgar_gate.py 2>/dev/null | cut -c1-16); echo host=$(hostname)")18 r = ssh_fn(node, cmd)19 d = {"node": node}20 for l in r.stdout.splitlines():21 if "=" in l:22 k, v = l.split("=", 1); d[k] = v.strip()23 d["environment_id"] = sha256_text(json.dumps(d, sort_keys=True))[:16]24 d["recorded_utc"] = utcnow()25 return d2627def artifact_manifest(local_out_dir) -> dict:28 return {"root": local_out_dir, "files": dir_manifest(local_out_dir), "recorded_utc": utcnow()}29