The determinism gate is path-filtered, but requirements-lock.txt (which pins the numpy/scipy versions that *produce* the proof hash) was not in the filter — so a dependency bump could silently drift the hash without re-running the gate. That's how the 1.26.4 pin diverged from the published ca58956c hash unnoticed. Add requirements-lock.txt to both the push and pull_request path filters so this PR (and any future lock change) actually re-runs verify.py. Co-Authored-By: claude-flow <ruv@ruv.net> |
||
|---|---|---|
| .. | ||
| workflows | ||
| dependabot.yml | ||