trust: deterministic replay harness with the model call as the sole recorded nondeterministic input

[JSONbored]

Context

Parent: #8828 (Phase 4 — trust surface). A contributor challenge ("why did you close me?") should be answerable by re-deriving the decision. Hosted inference is not bit-deterministic even at temperature 0, so the model call is treated as the ONE irreducible nondeterministic input, recorded verbatim; everything downstream must replay bit-exactly.

Requirements

• Audit the decision path for hidden nondeterminism: wall-clock reads, map/object iteration order, live GitHub API fetches during evaluation. Snapshot every external input (GitHub API responses included) into the decision record at decision time.
• A replay harness (operator CLI) that takes a persisted decision record and re-executes the deterministic pipeline — rule evaluation, CI parsing, gate logic, disposition — asserting bit-identical verdict and reason codes.
• Where the recorded model output is fed back in, replay MUST NOT re-query the model; a separate optional mode re-queries and reports an action-match rate (never labeled "reproducibility" — the docs state why).
• CI smoke: replay a small fixed corpus every run; full-corpus replay rides the golden-corpus job (sibling sub-issue).
• Divergence found by replay is a bug by definition: the harness exits non-zero with a structured diff of the first divergent stage.

Test Coverage Requirements

99%+ patch coverage, branch-counted, on the harness and any determinism fixes it forces; a seeded regression test per nondeterminism class found in the audit.

Expected Outcome

Every decision can be re-derived from its record; challenges get "replayed, same verdict, here is the clause" or "replayed, divergence found, bug filed" — nothing in between.

[linear-code]

JSO-6118

[JSONbored]

Design locked for the v1 deterministic core (implementation next):

Replay contract — mirror the golden corpus exactly: evaluateGateCheck(advisory, policy) is the pure pipeline the harness re-executes. Decision records bump to v4 with replayInput: { findings, policy, policyCloseKind } captured at the evaluation that fed the finalize (the INPUT advisory findings + the resolved gateCheckPolicy, not the evaluation output — the corpus (#8832) already proves this pair replays byte-stably).

Replayed stages + divergence contract: (1) conclusion + ordered blockerCodes from re-evaluation; (2) blockerClass via first-blocker-code / neutralHoldReasonCode (pure over the evaluation); (3) reasonCode recomputed from the same expression the finalize uses (blockerClass | policy_close: | conclusion) and compared bit-exactly against the record. action is compared as PINNED (plan-state dependent, not re-derived in v1 — documented). First divergent stage reported as a structured diff, non-zero exit.

Harness: scripts/replay-decision.ts — stdin record JSON (or a file), pure imports only, no DB/model access in replay mode by construction (the no-requery guarantee is structural, not a flag check). CI smoke = a vitest suite replaying test/fixtures/decision-records/*.json — runs on every PR like the corpus.

Deliberate v1 exclusions (this issue stays open until they land): the optional re-query/action-match mode (blocked on persisting the full prompt text — v4 only carries the digest; needs its own privacy/size call) and the full nondeterminism audit beyond the evaluate path (wall-clock reads in staleness rules must be recorded as nowMs in replayInput when those rules join the replay scope).