Reject stale native runtime build provenance before release staging

tools/embeddinggemma2/test_runtime_provenance.py

@@ -0,0 +1,39 @@
+from pathlib import Path
+import tempfile
+import unittest
+
+import runtime_provenance as provenance
+
+
+class ProvenanceTests(unittest.TestCase):
+    def test_line_endings_equivalent_but_changed_source_rejected(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            for name in provenance.INPUTS:
+                path = root / name
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(b"first\nsecond\n")
+            manifest = {"build_provenance": provenance.fingerprint(root)}
+            for name in provenance.INPUTS:
+                (root / name).write_bytes(b"first\r\nsecond\r\n")
+            provenance.verify(manifest, root)
+            (root / provenance.INPUTS[0]).write_bytes(b"different source\n")
+            with self.assertRaisesRegex(ValueError, "stale"):
+                provenance.verify(manifest, root)
+
+    def test_missing_old_inventory_rejected_and_inputs_bounded(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            for name in provenance.INPUTS:
+                path = root / name
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(b"source\n")
+            with self.assertRaisesRegex(ValueError, "missing or stale"):
+                provenance.verify({"worker_sha256": "old-valid-hash"}, root)
+            (root / provenance.INPUTS[0]).write_bytes(b"x" * (1024 * 1024 + 1))
+            with self.assertRaisesRegex(ValueError, "oversized"):
+                provenance.fingerprint(root)
+
+
+if __name__ == "__main__":
+    unittest.main()