ci: verify built wheel outside checkout

.github/workflows/ci.yml

@@ -44,6 +44,26 @@ jobs:
         run: python -m pip install --disable-pip-version-check build
       - name: Build wheel
         run: python -m build --wheel
+      - name: Install and verify built wheel
+        shell: bash
+        working-directory: ${{ runner.temp }}
+        run: |
+          python -m venv wheel-smoke-venv
+          wheel-smoke-venv/bin/python -m pip install --no-deps "$GITHUB_WORKSPACE"/dist/*.whl
+          wheel-smoke-venv/bin/simulation-invariant inspect "$GITHUB_WORKSPACE" README.md --max-bytes 16 > wheel-smoke.json
+          wheel-smoke-venv/bin/python - <<'PY'
+          import json
+          from pathlib import Path
+
+          packet = json.loads(Path("wheel-smoke.json").read_text(encoding="utf-8"))
+          assert packet["type"] == "simulation_bounded_observation_packet"
+          assert packet["presented_range"] == {"start": 0, "end": 16}
+          assert packet["utf8_text"] == "# Simulation_Inv"
+          assert packet["write_authority"] == "NONE"
+          assert packet["execution_authority"] == "NONE"
+          assert packet["presentation_receipt"]["write_authority"] == "NONE"
+          assert packet["presentation_receipt"]["execution_authority"] == "NONE"
+          PY
       - name: Upload wheel evidence
         uses: actions/upload-artifact@v4
         with:

tests/test_ci_workflow.py

@@ -37,3 +37,14 @@ def test_wheel_build_waits_for_tests() -> None:
     text = _workflow_text()
     build_section = text.split("  build-wheel:\n", 1)[1]
     assert "    needs: test\n" in build_section
+
+
+def test_built_wheel_is_verified_outside_checkout() -> None:
+    text = _workflow_text()
+    build_section = text.split("  build-wheel:\n", 1)[1]
+    assert "working-directory: ${{ runner.temp }}" in build_section
+    assert "pip install --no-deps \"$GITHUB_WORKSPACE\"/dist/*.whl" in build_section
+    assert "wheel-smoke-venv/bin/simulation-invariant inspect" in build_section
+    assert 'packet["type"] == "simulation_bounded_observation_packet"' in build_section
+    assert 'packet["write_authority"] == "NONE"' in build_section
+    assert 'packet["execution_authority"] == "NONE"' in build_section