Function capped_by_working_tree 

pub fn capped_by_working_tree(
    state: ProofState,
    working_tree: &str,
) -> ProofState

What a state may still be once the tree the run measured is taken into account.

proven is “a passing run recorded against this exact commit with a clean tree” (ADR 0041), and docs/EVIDENCE.md says why the tree is half of that: “A dirty tree is recorded as dirty for exactly this reason: it is the one case where the commit does not describe what ran.” A run measured against a tree that was not its commit is therefore capped at inputs_unchanged: a pass, joined to a commit, with no claim that the commit is what it saw. A weaker state is never strengthened here, and unknown — git could not be asked — is treated as not clean, because not knowing is not proof.

use majordomus_cli::evidence::{capped_by_working_tree, ProofState};

// a clean tree changes nothing
assert_eq!(
    capped_by_working_tree(ProofState::Proven, "clean"),
    ProofState::Proven
);
// a dirty one costs the strongest state, and only that one
assert_eq!(
    capped_by_working_tree(ProofState::Proven, "dirty"),
    ProofState::InputsUnchanged
);
assert_eq!(
    capped_by_working_tree(ProofState::Proven, "unknown"),
    ProofState::InputsUnchanged
);
assert_eq!(
    capped_by_working_tree(ProofState::Stale, "dirty"),
    ProofState::Stale
);