fix(operations): require clean candidate provenance (#18)

scripts/run-capacity-gate.sh

@@ -24,6 +24,19 @@ if [[ -n "$CPUSET" ]]; then
 fi
 
 cd "$ROOT"
+export RENDEZVOUS_EVIDENCE_COMMIT="$(git rev-parse HEAD)"
+if [[ -n "$(git status --porcelain)" ]]; then
+    export RENDEZVOUS_EVIDENCE_TREE_STATE=dirty
+else
+    export RENDEZVOUS_EVIDENCE_TREE_STATE=clean
+fi
+if [[ "$PROFILE" == candidate && "$RENDEZVOUS_EVIDENCE_TREE_STATE" != clean ]]; then
+    printf 'Candidate evidence requires a clean source tree.\n' >&2
+    exit 2
+fi
+export RENDEZVOUS_EVIDENCE_CPUSET="${CPUSET:-unrestricted}"
+export RENDEZVOUS_EVIDENCE_COMMAND="RENDEZVOUS_CAPACITY_PROFILE=$PROFILE RENDEZVOUS_CAPACITY_CPUSET=${CPUSET:-unrestricted} ./scripts/run-capacity-gate.sh"
+
 dotnet restore "$ROOT/Rendezvous.slnx" --locked-mode
 dotnet build "$ROOT/Rendezvous.slnx" --configuration Release --no-restore
 
@@ -36,16 +49,6 @@ arguments=(
     dotnet run --project "$PROJECT" --configuration Release --no-build --
     --profile "$PROFILE" --output "$OUTPUT"
 )
-export RENDEZVOUS_EVIDENCE_COMMIT="${RENDEZVOUS_EVIDENCE_COMMIT:-$(git rev-parse HEAD)}"
-if [[ -z "${RENDEZVOUS_EVIDENCE_TREE_STATE:-}" ]]; then
-    if [[ -n "$(git status --porcelain)" ]]; then
-        export RENDEZVOUS_EVIDENCE_TREE_STATE=dirty
-    else
-        export RENDEZVOUS_EVIDENCE_TREE_STATE=clean
-    fi
-fi
-export RENDEZVOUS_EVIDENCE_CPUSET="${CPUSET:-unrestricted}"
-export RENDEZVOUS_EVIDENCE_COMMAND="RENDEZVOUS_CAPACITY_PROFILE=$PROFILE RENDEZVOUS_CAPACITY_CPUSET=${CPUSET:-unrestricted} ./scripts/run-capacity-gate.sh"
 if [[ -n "$CPUSET" ]]; then
     taskset -c "$CPUSET" "${arguments[@]}"
 else