ci: derive the hashed requirements export at run time instead of gating a committed copy

.github/workflows/ci.yml

@@ -21,8 +21,13 @@ jobs:
         run: |
           python -m pip install --upgrade pip uv==0.13.6
           uv lock --check
+          # The requirements export is derived from uv.lock at run time and is never
+          # committed: a committed copy would be a second source of truth that a
+          # lock-only dependency update cannot regenerate, so the export would fail
+          # its own gate before anything was installed. uv lock --check above already
+          # proves the lock matches the manifests, and the clean-environment job below
+          # installs from this run-time export, so it is exercised end to end.
           uv export --all-extras --format requirements.txt --locked --no-emit-project --no-header --output-file "$RUNNER_TEMP/requirements.lock"
-          diff -u requirements.lock "$RUNNER_TEMP/requirements.lock"
           uv sync --frozen --all-extras
       - name: Test suite
         run: uv run pytest --cov=biofirm --cov-report=term-missing --cov-fail-under=90
@@ -43,7 +48,7 @@ jobs:
       - name: Install and run outside checkout
         run: |
           python -m venv "$RUNNER_TEMP/biofirm-clean"
-          uv pip install --python "$RUNNER_TEMP/biofirm-clean/bin/python" --requirement requirements.lock
+          uv pip install --python "$RUNNER_TEMP/biofirm-clean/bin/python" --requirement "$RUNNER_TEMP/requirements.lock"
           uv pip install --python "$RUNNER_TEMP/biofirm-clean/bin/python" --no-deps dist/*.whl
           "$RUNNER_TEMP/biofirm-clean/bin/python" - <<'PY'
           import json

.gitignore

@@ -181,3 +181,6 @@ cython_debug/
 
 # Virtual Environment
 venv/
+
+# Hashed requirements export — derived from uv.lock at run time, never committed
+requirements.lock

CONTRIBUTING.md

@@ -6,8 +6,8 @@ marked as such; do not treat it as an implementation contract.
 
 ## Development setup
 
-Biofirm supports Python 3.11 and 3.12. The committed `uv.lock` and
-`requirements.lock` provide a hash-locked environment:
+Biofirm supports Python 3.11 and 3.12. The committed `uv.lock` provides a
+hash-locked environment:
 
 ```bash
 uv sync --frozen --all-extras
@@ -26,7 +26,9 @@ python -m pip install -e ".[dev,analysis,visualization,documents]"
 ### Dependency pins
 
 The runtime dependencies in `pyproject.toml` are exact pins, and the committed
-lock files carry the hashes CI diffs. Each runtime pin is the newest release
+`uv.lock` carries the hashes CI verifies with `uv lock --check`. The hashed
+requirements export is derived from the lock at run time and is not committed.
+Each runtime pin is the newest release
 that satisfies every Python version this project supports (3.11 and 3.12)
 together with `inferactively-pymdp`:
 
@@ -43,7 +45,7 @@ report what it reaches under each supported Python, and restoring the pin:
 ```bash
 uv lock --upgrade-package jax
 uv export --all-extras --format requirements.txt --locked --no-emit-project \
-  --no-header --output-file requirements.lock
+  --no-header --output-file /tmp/biofirm-requirements.lock
 ```
 
 A pin that needs Python 3.12 cannot be adopted while 3.11 stays in the support

README.md

@@ -16,8 +16,9 @@ biofirm validate
 ```
 
 For a hash-locked development environment, install `uv` and run
-`uv sync --frozen --all-extras`; the committed `uv.lock` and
-`requirements.lock` cover Python 3.11 and 3.12 with platform markers.
+`uv sync --frozen --all-extras`; the committed `uv.lock` covers Python 3.11 and
+3.12 with platform markers, and CI derives the hashed requirements export from
+it at run time rather than reading a committed copy.
 
 All offline commands use the packaged configuration unless `--config` is
 provided. Live research is the only network-enabled path and requires both an