ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
    inputs:
      upstream_target_commit:
        description: "Optional 40-character OpenAI Agents commit for a canonical comparison candidate"
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Python ${{ matrix.python-version }} / Agents ${{ matrix.sdk-version }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
        sdk-version: ["0.20.0", "0.21.0"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Build the wheel for this Python cell
        run: |
          python -m pip install --disable-pip-version-check build==1.5.0
          python -m build --wheel --outdir build/test-dist
      - name: Install the packaged wheel and test dependencies
        shell: bash
        run: |
          set -euo pipefail
          wheel=(build/test-dist/*.whl)
          test "${#wheel[@]}" -eq 1
          python -m pip install --disable-pip-version-check \
            "${wheel[0]}" \
            'openai-agents==${{ matrix.sdk-version }}' \
            'jsonschema>=4.23' \
            'pytest>=8' \
            'pytest-asyncio>=0.24'
      - name: Run tests against the installed wheel
        env:
          EXPECTED_SDK_VERSION: ${{ matrix.sdk-version }}
        run: |
          python - <<'PY'
          import importlib.metadata
          import os
          from pathlib import Path
          import agentrunproof

          module = Path(agentrunproof.__file__).resolve()
          assert "site-packages" in module.parts, module
          assert importlib.metadata.version("openai-agents") == os.environ["EXPECTED_SDK_VERSION"]
          PY
          python -m pip check
          python -m pytest -q
      - name: Exercise the no-API-key built-in scenario
        run: |
          python -m agentrunproof probe basic-tool-session-parity --certificate build/basic.json
          python -m agentrunproof check-certificate build/basic.json

  quality:
    name: Static, package, and isolated install checks
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12.13"
          cache: pip
      - name: Install development dependencies
        run: python -m pip install --disable-pip-version-check -e '.[test,dev]'
      - name: Lint and type-check
        run: |
          ruff check .
          ruff format --check .
          mypy src
      - name: Build distributions
        run: python -m build
      - name: Check package metadata
        run: python -m twine check --strict dist/*
      - name: Audit distribution contents
        run: |
          python - <<'PY'
          import tarfile
          import zipfile
          from pathlib import Path

          wheel, = Path("dist").glob("*.whl")
          sdist, = Path("dist").glob("*.tar.gz")
          with zipfile.ZipFile(wheel) as archive:
              wheel_names = set(archive.namelist())
          assert any(name.endswith("agentrunproof/py.typed") for name in wheel_names)
          assert any(name.endswith("schemas/certificate-v1.schema.json") for name in wheel_names)
          with tarfile.open(sdist, "r:gz") as archive:
              sdist_names = set(archive.getnames())
          forbidden = ("/evidence/", "/build/", "/dist/")
          assert not any(any(part in f"/{name}/" for part in forbidden) for name in sdist_names)
          PY
      - name: Smoke-test wheel and sdist in separate environments
        shell: bash
        run: |
          set -euo pipefail
          wheel=(dist/*.whl)
          sdist=(dist/*.tar.gz)
          test "${#wheel[@]}" -eq 1
          test "${#sdist[@]}" -eq 1
          for kind in wheel sdist; do
            if [[ "$kind" == wheel ]]; then artifact="${wheel[0]}"; else artifact="${sdist[0]}"; fi
            environment="$RUNNER_TEMP/$kind-venv"
            workspace="$RUNNER_TEMP/$kind-cwd"
            python -m venv "$environment"
            "$environment/bin/python" -m pip install --disable-pip-version-check "$artifact"
            mkdir -p "$workspace"
            cd "$workspace"
            "$environment/bin/python" -m pip check
            "$environment/bin/agentrunproof" --version
            "$environment/bin/agentrunproof" list-scenarios
            "$environment/bin/agentrunproof" probe basic-tool-session-parity --certificate certificate.json
            "$environment/bin/agentrunproof" check-certificate certificate.json
            cd "$GITHUB_WORKSPACE"
          done
      - name: Write distribution checksums
        run: |
          cd dist
          sha256sum ./*.whl ./*.tar.gz > SHA256SUMS
      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: distributions
          path: dist/*
          if-no-files-found: error
          retention-days: 14

  history-evidence:
    name: Canonical historical evidence
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    needs: [test, quality]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12.13"
          cache: pip
      - name: Install evidence tooling
        run: python -m pip install --disable-pip-version-check -e '.[dev]'
      - name: Generate or reproduce canonical evidence
        shell: bash
        run: |
          set -euo pipefail
          committed_bundle="evidence/history/v1/bundle.json"
          committed_matrix="evidence/history/v1/matrix.json"
          if [[ ! -f "$committed_bundle" ]]; then
            python scripts/run_history_matrix.py \
              --canonical \
              --source-commit "$GITHUB_SHA" \
              --output-directory build/history-ci
          else
            python -m agentrunproof check-history-bundle "$committed_bundle"
            source_commit="$(python - <<'PY'
          import json
          print(json.load(open("evidence/history/v1/bundle.json", encoding="utf-8"))["source"]["commit"])
          PY
          )"
            source_tree="$(python - <<'PY'
          import json
          print(json.load(open("evidence/history/v1/bundle.json", encoding="utf-8"))["source"]["tree"])
          PY
          )"
            mapfile -t evidence_additions < <(
              git log --diff-filter=A --format=%H -- "$committed_bundle"
            )
            test "${#evidence_additions[@]}" -eq 1
            evidence_commit="${evidence_additions[0]}"
            git merge-base --is-ancestor "$evidence_commit" HEAD
            mapfile -t evidence_parents < <(
              git rev-list --parents -n 1 "$evidence_commit"
            )
            read -r -a evidence_parent_fields <<< "${evidence_parents[0]}"
            test "${#evidence_parent_fields[@]}" -eq 2
            test "${evidence_parent_fields[1]}" = "$source_commit"
            test "$(git rev-list --count "$source_commit..$evidence_commit")" = 1
            test "$(git rev-parse "$source_commit^{tree}")" = "$source_tree"
            git diff --name-only "$source_commit..$evidence_commit" | sort > "$RUNNER_TEMP/actual-evidence-files"
            printf '%s\n' "$committed_bundle" "$committed_matrix" | sort > "$RUNNER_TEMP/expected-evidence-files"
            diff -u "$RUNNER_TEMP/expected-evidence-files" "$RUNNER_TEMP/actual-evidence-files"
            git diff --exit-code "$evidence_commit" HEAD -- \
              "$committed_bundle" "$committed_matrix"

            source_worktree="$RUNNER_TEMP/agentrunproof-source"
            git worktree add --detach "$source_worktree" "$source_commit"
            python -m pip install --disable-pip-version-check --force-reinstall --no-deps -e "$source_worktree"
            (
              cd "$source_worktree"
              python scripts/run_history_matrix.py \
                --canonical \
                --source-commit "$source_commit" \
                --output-directory build/history-ci
            )
            cmp "$source_worktree/build/history-ci/matrix.json" "$GITHUB_WORKSPACE/$committed_matrix"
            cmp "$source_worktree/build/history-ci/bundle.json" "$GITHUB_WORKSPACE/$committed_bundle"
            mkdir -p "$GITHUB_WORKSPACE/build/history-ci"
            cp "$source_worktree"/build/history-ci/* "$GITHUB_WORKSPACE/build/history-ci/"
          fi
          python -m agentrunproof check-history-bundle build/history-ci/bundle.json
          python - <<'PY'
          import hashlib
          import json
          from pathlib import Path

          directory = Path("build/history-ci")
          bundle = json.loads((directory / "bundle.json").read_text(encoding="utf-8"))
          wheel = directory / bundle["wheel"]["path"]
          data = wheel.read_bytes()
          assert len(data) == bundle["wheel"]["size"]
          assert hashlib.sha256(data).hexdigest() == bundle["wheel"]["sha256"]
          PY
      - name: Download release-candidate distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: distributions
          path: build/distributions
      - name: Bind the release wheel when the source tree matches the evidence source
        shell: bash
        run: |
          set -euo pipefail
          source_commit="$(python - <<'PY'
          import json
          print(json.load(open("build/history-ci/bundle.json", encoding="utf-8"))["source"]["commit"])
          PY
          )"
          if git diff --quiet "$source_commit..HEAD" -- . \
            ':(exclude)evidence/history/v1/matrix.json' \
            ':(exclude)evidence/history/v1/bundle.json'; then
            release_wheels=(build/distributions/*.whl)
            canonical_wheels=(build/history-ci/*.whl)
            test "${#release_wheels[@]}" -eq 1
            test "${#canonical_wheels[@]}" -eq 1
            cmp "${release_wheels[0]}" "${canonical_wheels[0]}"
            python - <<'PY'
          import hashlib
          import json
          from pathlib import Path

          bundle = json.loads(Path("build/history-ci/bundle.json").read_text(encoding="utf-8"))
          expected = bundle["wheel"]
          for directory in (Path("build/distributions"), Path("build/history-ci")):
              wheel, = directory.glob("*.whl")
              data = wheel.read_bytes()
              assert wheel.name == expected["path"]
              assert len(data) == expected["size"]
              assert hashlib.sha256(data).hexdigest() == expected["sha256"]
          PY
          else
            echo "Current source differs from the immutable evidence source; release-wheel binding skipped."
          fi
      - name: Upload canonical evidence candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: history-evidence-${{ github.sha }}
          path: build/history-ci/*
          if-no-files-found: error
          retention-days: 30

  current-evidence:
    name: Canonical current counterexample evidence
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    needs: [test, quality]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12.13"
          cache: pip
      - name: Install evidence tooling
        run: python -m pip install --disable-pip-version-check -e '.[dev]'
      - name: Generate or reproduce canonical current evidence
        shell: bash
        run: |
          set -euo pipefail
          committed_directory="evidence/current/runstate-sibling-approval-isolation/v1"
          committed_bundle="$committed_directory/bundle.json"
          committed_certificate="$committed_directory/certificate.json"
          if [[ ! -f "$committed_bundle" ]]; then
            test ! -e "$committed_certificate"
            python scripts/run_current_certificate.py \
              --canonical \
              --source-commit "$GITHUB_SHA" \
              --output-directory build/current-ci
          else
            test -f "$committed_certificate"
            python -m agentrunproof check-current-bundle "$committed_bundle"
            source_commit="$(python - <<'PY'
          import json
          print(json.load(open(
              "evidence/current/runstate-sibling-approval-isolation/v1/bundle.json",
              encoding="utf-8",
          ))["source"]["commit"])
          PY
          )"
            source_tree="$(python - <<'PY'
          import json
          print(json.load(open(
              "evidence/current/runstate-sibling-approval-isolation/v1/bundle.json",
              encoding="utf-8",
          ))["source"]["tree"])
          PY
          )"
            mapfile -t evidence_additions < <(
              git log --diff-filter=A --format=%H -- "$committed_bundle"
            )
            test "${#evidence_additions[@]}" -eq 1
            evidence_commit="${evidence_additions[0]}"
            git merge-base --is-ancestor "$evidence_commit" HEAD
            mapfile -t evidence_parents < <(
              git rev-list --parents -n 1 "$evidence_commit"
            )
            read -r -a evidence_parent_fields <<< "${evidence_parents[0]}"
            test "${#evidence_parent_fields[@]}" -eq 2
            test "${evidence_parent_fields[1]}" = "$source_commit"
            test "$(git rev-list --count "$source_commit..$evidence_commit")" = 1
            test "$(git rev-parse "$source_commit^{tree}")" = "$source_tree"
            git diff --name-only "$source_commit..$evidence_commit" | sort \
              > "$RUNNER_TEMP/actual-current-evidence-files"
            printf '%s\n' "$committed_bundle" "$committed_certificate" | sort \
              > "$RUNNER_TEMP/expected-current-evidence-files"
            diff -u \
              "$RUNNER_TEMP/expected-current-evidence-files" \
              "$RUNNER_TEMP/actual-current-evidence-files"
            git diff --exit-code "$evidence_commit" HEAD -- \
              "$committed_bundle" "$committed_certificate"

            source_worktree="$RUNNER_TEMP/agentrunproof-current-source"
            git worktree add --detach "$source_worktree" "$source_commit"
            python -m pip install \
              --disable-pip-version-check \
              --force-reinstall \
              --no-deps \
              -e "$source_worktree"
            (
              cd "$source_worktree"
              python scripts/run_current_certificate.py \
                --canonical \
                --source-commit "$source_commit" \
                --output-directory build/current-ci
            )
            cmp \
              "$source_worktree/build/current-ci/certificate.json" \
              "$GITHUB_WORKSPACE/$committed_certificate"
            cmp \
              "$source_worktree/build/current-ci/bundle.json" \
              "$GITHUB_WORKSPACE/$committed_bundle"
            mkdir -p "$GITHUB_WORKSPACE/build/current-ci"
            cp "$source_worktree"/build/current-ci/* "$GITHUB_WORKSPACE/build/current-ci/"
          fi
          python -m agentrunproof check-current-bundle build/current-ci/bundle.json
          python - <<'PY'
          import hashlib
          import json
          from pathlib import Path

          directory = Path("build/current-ci")
          bundle = json.loads((directory / "bundle.json").read_text(encoding="utf-8"))
          wheel = directory / bundle["wheel"]["path"]
          data = wheel.read_bytes()
          assert len(data) == bundle["wheel"]["size"]
          assert hashlib.sha256(data).hexdigest() == bundle["wheel"]["sha256"]
          PY
      - name: Download release-candidate distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: distributions
          path: build/distributions
      - name: Bind the release wheel when package inputs match the current evidence source
        shell: bash
        run: |
          set -euo pipefail
          source_commit="$(python - <<'PY'
          import json
          print(json.load(open(
              "build/current-ci/bundle.json",
              encoding="utf-8",
          ))["source"]["commit"])
          PY
          )"
          if git diff --quiet "$source_commit..HEAD" -- \
            LICENSE README.md pyproject.toml src/agentrunproof; then
            release_wheels=(build/distributions/*.whl)
            canonical_wheels=(build/current-ci/*.whl)
            test "${#release_wheels[@]}" -eq 1
            test "${#canonical_wheels[@]}" -eq 1
            cmp "${release_wheels[0]}" "${canonical_wheels[0]}"
          else
            echo "Package inputs differ from the immutable current-evidence source; release-wheel binding skipped."
          fi
      - name: Upload canonical current evidence candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: current-evidence-${{ github.sha }}
          path: build/current-ci/*
          if-no-files-found: error
          retention-days: 30

  upstream-comparison:
    name: Upstream comparison contract and reproduction
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    needs: [test, quality]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12.13"
          cache: pip
      - name: Install evidence tooling
        run: python -m pip install --disable-pip-version-check -e '.[test,dev]'
      - name: Exercise the extensible comparison contract
        run: |
          python -m pytest -q \
            tests/test_current_comparison.py \
            tests/test_upstream_comparison_generator.py
          python -m agentrunproof check-upstream-bundle \
            evidence/upstream-comparison/v1/bundle.json
      - name: Reproduce committed comparison evidence when present
        id: reproduce
        shell: bash
        env:
          INPUT_UPSTREAM_TARGET_COMMIT: ${{ inputs.upstream_target_commit }}
        run: |
          set -euo pipefail
          committed_bundle="evidence/upstream-comparison/v2/bundle.json"
          if [[ ! -f "$committed_bundle" ]]; then
            target_commit="$INPUT_UPSTREAM_TARGET_COMMIT"
            if [[ -z "$target_commit" ]]; then
              echo "No canonical upstream comparison is committed; generation remains deferred."
              echo "ready=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            test "$GITHUB_REF" = refs/heads/main
            [[ "$target_commit" =~ ^[0-9a-f]{40}$ ]]
            target_id="openai-agents-python-${target_commit:0:8}"
            upstream_clone="$RUNNER_TEMP/openai-agents-python"
            git clone --filter=blob:none --no-checkout \
              https://github.com/openai/openai-agents-python.git "$upstream_clone"
            git -C "$upstream_clone" fetch origin \
              0b93ce8faa27d4631df399fe48856b52a8fd9897 \
              "$target_commit"
            baseline_checkout="$RUNNER_TEMP/upstream-openai-agents-python-0b93ce8"
            target_checkout="$RUNNER_TEMP/upstream-$target_id"
            git -C "$upstream_clone" worktree add --detach \
              "$baseline_checkout" 0b93ce8faa27d4631df399fe48856b52a8fd9897
            git -C "$upstream_clone" worktree add --detach \
              "$target_checkout" "$target_commit"
            python scripts/run_upstream_comparison.py \
              --canonical \
              --source-commit "$GITHUB_SHA" \
              --upstream-checkout "$baseline_checkout" \
              --additional-upstream-checkout "$target_id=$target_checkout" \
              --additional-run \
                "candidate-recursive,$target_id,runstate-recursive-agent-tool-approval-routing,PASS,candidate-recursive-certificate.json" \
              --additional-run \
                "candidate-serialized,$target_id,runstate-recursive-agent-tool-approval-serialization,PASS,candidate-serialized-certificate.json" \
              --output-directory build/upstream-comparison-ci
            python -m agentrunproof check-upstream-bundle \
              build/upstream-comparison-ci/bundle.json
            echo "ready=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          committed_directory="$(dirname "$committed_bundle")"
          python -m agentrunproof check-upstream-bundle "$committed_bundle"

          python - "$committed_bundle" > "$RUNNER_TEMP/comparison-metadata" <<'PY'
          import json
          import sys
          from pathlib import Path

          bundle_path = Path(sys.argv[1])
          bundle = json.loads(bundle_path.read_text(encoding="utf-8"))
          print("SOURCE", bundle["source"]["commit"], bundle["source"]["tree"], sep="\t")
          for target in bundle["targets"][1:]:
              print("TARGET", target["target_id"], target["commit"], sep="\t")
          for run in bundle["runs"][3:]:
              fields = (
                  run["run_id"],
                  run["target_id"],
                  run["scenario_id"],
                  run["expected_status"],
                  run["certificate"]["path"],
              )
              if any("," in field or "\t" in field or "\n" in field for field in fields):
                  raise SystemExit("comparison run metadata is not shell-safe")
              print("RUN", ",".join(fields), sep="\t")
          for run in bundle["runs"]:
              print("MEMBER", run["certificate"]["path"], sep="\t")
          PY

          IFS=$'\t' read -r kind source_commit source_tree < "$RUNNER_TEMP/comparison-metadata"
          test "$kind" = SOURCE
          mapfile -t evidence_additions < <(
            git log --diff-filter=A --format=%H -- "$committed_bundle"
          )
          test "${#evidence_additions[@]}" -eq 1
          evidence_commit="${evidence_additions[0]}"
          git merge-base --is-ancestor "$evidence_commit" HEAD
          read -r -a evidence_parent_fields <<< "$(
            git rev-list --parents -n 1 "$evidence_commit"
          )"
          test "${#evidence_parent_fields[@]}" -eq 2
          evidence_parent="${evidence_parent_fields[1]}"
          git merge-base --is-ancestor "$source_commit" "$evidence_parent"
          test "$(git rev-parse "$source_commit^{tree}")" = "$source_tree"

          python - "$committed_bundle" > "$RUNNER_TEMP/expected-upstream-evidence-files" <<'PY'
          import json
          import sys
          from pathlib import Path

          bundle_path = Path(sys.argv[1])
          bundle = json.loads(bundle_path.read_text(encoding="utf-8"))
          paths = [bundle_path, *(bundle_path.parent / run["certificate"]["path"] for run in bundle["runs"])]
          print("\n".join(sorted(str(path) for path in paths)))
          PY
          git diff --name-only "$evidence_parent..$evidence_commit" | sort \
            > "$RUNNER_TEMP/actual-upstream-evidence-files"
          diff -u \
            "$RUNNER_TEMP/expected-upstream-evidence-files" \
            "$RUNNER_TEMP/actual-upstream-evidence-files"
          git diff --exit-code "$evidence_commit" HEAD -- "$committed_directory"

          upstream_clone="$RUNNER_TEMP/openai-agents-python"
          git clone --filter=blob:none --no-checkout \
            https://github.com/openai/openai-agents-python.git "$upstream_clone"
          baseline_checkout=""
          generator_args=()
          while IFS=$'\t' read -r record target_id target_commit; do
            [[ "$record" = TARGET ]] || continue
            git -C "$upstream_clone" fetch origin "$target_commit"
            target_checkout="$RUNNER_TEMP/upstream-$target_id"
            git -C "$upstream_clone" worktree add --detach "$target_checkout" "$target_commit"
            if [[ "$target_id" = openai-agents-python-0b93ce8 ]]; then
              baseline_checkout="$target_checkout"
            else
              generator_args+=(--additional-upstream-checkout "$target_id=$target_checkout")
            fi
          done < "$RUNNER_TEMP/comparison-metadata"
          test -n "$baseline_checkout"
          while IFS=$'\t' read -r record run_spec; do
            [[ "$record" = RUN ]] || continue
            generator_args+=(--additional-run "$run_spec")
          done < "$RUNNER_TEMP/comparison-metadata"

          source_worktree="$RUNNER_TEMP/agentrunproof-upstream-source"
          git worktree add --detach "$source_worktree" "$source_commit"
          python -m pip install \
            --disable-pip-version-check \
            --force-reinstall \
            --no-deps \
            -e "$source_worktree"
          (
            cd "$source_worktree"
            python scripts/run_upstream_comparison.py \
              --canonical \
              --source-commit "$source_commit" \
              --upstream-checkout "$baseline_checkout" \
              --output-directory build/upstream-comparison-ci \
              "${generator_args[@]}"
          )
          generated_directory="$source_worktree/build/upstream-comparison-ci"
          python -m agentrunproof check-upstream-bundle "$generated_directory/bundle.json"
          cmp "$generated_directory/bundle.json" "$GITHUB_WORKSPACE/$committed_bundle"
          while IFS=$'\t' read -r record member; do
            [[ "$record" = MEMBER ]] || continue
            cmp \
              "$generated_directory/$member" \
              "$GITHUB_WORKSPACE/$committed_directory/$member"
          done < "$RUNNER_TEMP/comparison-metadata"
          mkdir -p build/upstream-comparison-ci
          cp "$generated_directory"/* build/upstream-comparison-ci/
          echo "ready=true" >> "$GITHUB_OUTPUT"
      - name: Download release-candidate distributions
        if: steps.reproduce.outputs.ready == 'true'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: distributions
          path: build/distributions
      - name: Bind the release wheel to the reproduced harness wheel
        if: steps.reproduce.outputs.ready == 'true'
        shell: bash
        run: |
          set -euo pipefail
          source_commit="$(python - <<'PY'
          import json
          print(json.load(open(
              "build/upstream-comparison-ci/bundle.json",
              encoding="utf-8",
          ))["source"]["commit"])
          PY
          )"
          if git diff --quiet "$source_commit..HEAD" -- \
            LICENSE README.md pyproject.toml src/agentrunproof; then
            release_wheels=(build/distributions/agentrunproof-*.whl)
            comparison_wheels=(build/upstream-comparison-ci/agentrunproof-*.whl)
            test "${#release_wheels[@]}" -eq 1
            test "${#comparison_wheels[@]}" -eq 1
            cmp "${release_wheels[0]}" "${comparison_wheels[0]}"
          else
            echo "Package inputs differ from the immutable comparison source; wheel binding skipped."
          fi
      - name: Upload reproduced canonical upstream comparison
        if: steps.reproduce.outputs.ready == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: upstream-comparison-${{ github.sha }}
          path: build/upstream-comparison-ci/*
          if-no-files-found: error
          retention-days: 30