dds

# 0.10.0 — CI provenance carried: `reuse_verdicts.py` + `stamp_artifact.py`

The two artifact-provenance steps of the `dds-check` workflow — reusing
a prior run's judged verdicts for an identical tree, and stamping the
risk-walk artifact with the tree it attests — are no longer inlined
Python in each consumer's `dds-check.yml`. They ship as carried,
hash-verified instrument assets, run from the verified snapshot exactly
like `witness.py`, `batch_judge.py`, and `check_join.py`.

Nothing changed in *what* the workflow does; the logic moved into the
package so it is versioned, hash-pinned, and maintained in one place.

## Update your `.github/workflows/dds-check.yml`

Replace the inlined `python3 - <<'EOF' … EOF` heredoc in each of these
two steps with a call to the carried script from the verified snapshot
(`$RUNNER_TEMP/dds-check-verified/assets/…`, the same path the other
instrument steps already use).

### 1. "Reuse judged verdicts from a prior run of this tree"

```yaml
      - name: Reuse judged verdicts from a prior run of this tree
        id: reuse
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TREE=$(git rev-parse 'HEAD^{tree}')
          echo "tree=$TREE" >> "$GITHUB_OUTPUT"
          python3 "$RUNNER_TEMP/dds-check-verified/assets/reuse_verdicts.py" "$TREE"
```

`reuse_verdicts.py` takes the tree sha as its one argument and reads
`GITHUB_REPOSITORY` / `GITHUB_OUTPUT` from the environment. Its
behaviour is identical: an exact-tree hit writes `.dds-verdicts.json`
and sets `hit=true` / `reused_from`; a different-tree prior writes
`.dds-seed.json`; otherwise the judged leg runs fresh.

### 2. "Stamp the artifact with its input tree"

```yaml
      - name: Stamp the artifact with its input tree
        if: always()
        env:
          GITHUB_SHA: ${{ github.sha }}
          REUSED_FROM: ${{ steps.reuse.outputs.reused_from }}
        run: |
          python3 "$RUNNER_TEMP/dds-check-verified/assets/stamp_artifact.py"
```

`stamp_artifact.py` reads `GITHUB_SHA` (and optional `REUSED_FROM`) from
the environment and no-ops when there is no artifact to stamp.

## Leave the lock-verify step inline

The "Verify the materialized skills against the lock" step stays an
inline heredoc **by design**: it runs *before* the verified snapshot
exists and validates the package's own bytes against `apm.lock.yaml`.
Carrying it inside the package it verifies would collapse that trust
chain — the verifier must not be one of the files it is verifying.

## Confirm

Run the workflow on a PR. The reuse step logs the same
`reusing … verdicts` / `seeding … ` / `runs fresh` line as before, and
the uploaded `dds-check.json` still carries `sha` / `tree` (and
`verdicts_reused_from_run` on a reuse). No behavioural change is
expected — this is a mechanical extraction.