Record execution environments; do not grade them

TCKDB accepts an execution-environment manifest at whatever fidelity an uploader can honestly supply, and the reproducibility rubric never scores it. A described runtime — a short description plus optional module names, carrying no digests — is a first-class accepted tier alongside the byte-pinned container, conda-lock, and HPC-module tiers. The manifest is recorded as provenance under context_json['execution_environment'], and rerunnable is reached on the completeness of deposited evidence alone: preserved inputs, an execution-parameter snapshot, the upstream dependency graph, and no warnings about artifact bytes that could not be read.

The accessibility argument is decisive and comes first. A computational chemist who runs module load gaussian/16 against a shared cluster install cannot produce a SHA-256 of that binary, does not know which BLAS it was linked against, and cannot generate a resolved-environment digest for a filesystem they do not administer. That is the common case, not the exception. Gating the top grade on such data would make the grade a measure of local tooling rather than of evidence quality, and would have made rerunnable unreachable for essentially every real upload. Worse, a required field that an honest person cannot fill gets filled with a best guess, which the content-addressing machinery would then canonicalize, digest, and dedupe against as though it were verified — a fabricated digest is strictly worse than an absent one, because absence is honest and the guess is a false positive the integrity layer would faithfully protect. Refusing to record a bare-metal or site-install environment at all is the same failure in a different direction: it stores nothing where genuinely useful, comparable provenance was available.

The scientific argument points the same way. What determines a computed number is already recorded as typed rows: level of theory, the input geometry and parameters, applied energy corrections per atom and per bond, Melius BAC components, and frequency scale factors per level of theory. Those are the values themselves, not a pointer to an environment that could regenerate them, and values are the stronger evidence. For workflow-tool-derived products, workflow_tool_release.git_commit pins the code state — and therefore the declared dependency set, the correction tables, and the rotor treatment — without anyone producing a lockfile. What a byte-pinned environment adds on top is determinism in the last digits: BLAS summation order and FMA rounding move a converged SCF energy by roughly 1e-8 Hartree, some five orders of magnitude below the ~1.6 mHartree that is chemical accuracy, and far below the intrinsic error of the method being used. Low-frequency torsional modes and flat transition-state surfaces are genuinely more sensitive than that, but a frozen environment does not remove that sensitivity — it only makes it reproducible, where the better response is to flag the calculation as numerically fragile.

Consistent with this, integrity checking on stored manifests is framed as corruption and drift detection, not as verification against a suspect uploader. A manifest that fails to revalidate indicates a bug, a partial write, or an out-of-band edit on our side; the revalidates flag records that fact without penalising the depositor's grade. Reviewers in TCKDB are editors and peer reviewers — they confirm that work meets a standard and that no mistake was made — and the data model must not encode an assumption of bad faith that the review model does not hold. The manifest's real value is discrimination rather than proof: two records claiming the same software_release but carrying different manifest digests demonstrably ran in different environments, which is worth surfacing to anyone comparing them.