diff --git a/chv-guest/build.sh b/chv-guest/build.sh
index 05e22a1..7a00e81 100755
--- a/chv-guest/build.sh
+++ b/chv-guest/build.sh
@@ -201,7 +201,7 @@ fi
 # 产物校验（干跑只打印，不执行校验命令的副作用部分）。
 if [ "$DRY_RUN" = "1" ]; then
   echo "DRY-RUN: test -s $OUT/vmlinux && test -s $OUT/disk.raw"
-  echo "DRY-RUN: python3 $SCRIPT_DIR/buildinfo.py $OUT $TAG $UBUNTU_VERSION $CODEX_VERSION $REPO_COMMIT <sha256> ${PLAYWRIGHT:-1}"
+  echo "DRY-RUN: python3 $SCRIPT_DIR/buildinfo.py $OUT $TAG $UBUNTU_VERSION $CODEX_VERSION $REPO_COMMIT <sha256> ${PLAYWRIGHT:-1} # 生成 $OUT/BUILDINFO.json 并校验 tag=$TAG"
 else
   test -s "$OUT/vmlinux" || { echo "内核产物为空：$OUT/vmlinux" >&2; exit 1; }
   test -s "$OUT/disk.raw" || { echo "磁盘产物为空：$OUT/disk.raw" >&2; exit 1; }
diff --git a/cloud/tests/test_chv_gaps.py b/cloud/tests/test_chv_gaps.py
index 7fb2abe..70d0bde 100644
--- a/cloud/tests/test_chv_gaps.py
+++ b/cloud/tests/test_chv_gaps.py
@@ -376,12 +376,31 @@ class BuildScriptTest(unittest.TestCase):
         for name in ("codex", "codex-code-mode-host"):
             p = os.path.join(self.bin_dir, name)
             with open(p, "w") as fh:
-                fh.write("#!/bin/sh\n")
+                # B-09：build.sh 会核对 codex --version 含 CODEX_VERSION，
+                # 假二进制须报出真实版本号。
+                fh.write("#!/bin/sh\necho \"codex-cli 0.164.0-alpha.9\"\n")
             os.chmod(p, 0o755)
         self.repo = os.path.join(self.dir, "repo")
         os.makedirs(os.path.join(self.repo, "cloud"))
         with open(os.path.join(self.repo, "host.py"), "w") as fh:
             fh.write("# host\n")
+        # B-09：REPO_COMMIT 须等于仓库 HEAD 短 hash 且工作树干净，
+        # 假仓库须是真 git 仓库。
+        subprocess.run(["git", "init", "-q", self.repo],
+                       check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "config",
+                        "user.email", "t@t"], check=True,
+                       capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "config",
+                        "user.name", "t"], check=True,
+                       capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "add", "-A"],
+                       check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "commit", "-qm",
+                        "init"], check=True, capture_output=True)
+        self.repo_commit = subprocess.run(
+            ["git", "-C", self.repo, "rev-parse", "--short", "HEAD"],
+            check=True, capture_output=True, text=True).stdout.strip()
         self.script = str(Path(__file__).resolve().parents[2]
                           / "chv-guest" / "build.sh")
 
@@ -393,7 +412,7 @@ class BuildScriptTest(unittest.TestCase):
         env.update({"CODEX_BIN_DIR": self.bin_dir,
                     "UBUNTU_VERSION": "24.04",
                     "CODEX_VERSION": "0.164.0-alpha.9",
-                    "REPO_COMMIT": "test123",
+                    "REPO_COMMIT": self.repo_commit,
                     # feat-chv-secfix（M4）：SHA256 必填，
                     # 干跑只验“已设”，用 FAKE 占位。
                     "UBUNTU_IMAGE_SHA256": "0" * 64,
@@ -411,7 +430,8 @@ class BuildScriptTest(unittest.TestCase):
         self.assertIn("virt-customize", r.stdout)
         self.assertIn("virt-get-kernel", r.stdout)
         self.assertIn("BUILDINFO", r.stdout)
-        self.assertIn("chv-guest-24.04-0.164.0-alpha.9-test123", r.stdout)
+        self.assertIn("chv-guest-24.04-0.164.0-alpha.9-%s"
+                      % self.repo_commit, r.stdout)
         self.assertFalse(os.path.exists(os.path.join(out_dir, "disk.raw")))
 
     def test_full_mode_without_kvm_fails_fast(self):
diff --git a/cloud/tests/test_chv_secfix.py b/cloud/tests/test_chv_secfix.py
index 7a34ef3..1f32a29 100644
--- a/cloud/tests/test_chv_secfix.py
+++ b/cloud/tests/test_chv_secfix.py
@@ -529,12 +529,31 @@ class BuildScriptTest(unittest.TestCase):
         for name in ("codex", "codex-code-mode-host"):
             p = os.path.join(self.bin_dir, name)
             with open(p, "w") as fh:
-                fh.write("#!/bin/sh\n")
+                # B-09：build.sh 会核对 codex --version 含 CODEX_VERSION，
+                # 假二进制须报出真实版本号。
+                fh.write("#!/bin/sh\necho \"codex-cli 0.164.0-alpha.9\"\n")
             os.chmod(p, 0o755)
         self.repo = os.path.join(self.dir, "repo")
         os.makedirs(os.path.join(self.repo, "cloud"))
         with open(os.path.join(self.repo, "host.py"), "w") as fh:
             fh.write("# host\n")
+        # B-09：REPO_COMMIT 须等于仓库 HEAD 短 hash 且工作树干净，
+        # 假仓库须是真 git 仓库。
+        subprocess.run(["git", "init", "-q", self.repo],
+                       check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "config",
+                        "user.email", "t@t"], check=True,
+                       capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "config",
+                        "user.name", "t"], check=True,
+                       capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "add", "-A"],
+                       check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo, "commit", "-qm",
+                        "init"], check=True, capture_output=True)
+        self.repo_commit = subprocess.run(
+            ["git", "-C", self.repo, "rev-parse", "--short", "HEAD"],
+            check=True, capture_output=True, text=True).stdout.strip()
         self.script = str(Path(__file__).resolve().parents[2]
                           / "chv-guest" / "build.sh")
 
@@ -546,7 +565,7 @@ class BuildScriptTest(unittest.TestCase):
         env.update({"CODEX_BIN_DIR": self.bin_dir,
                     "UBUNTU_VERSION": "24.04",
                     "CODEX_VERSION": "0.164.0-alpha.9",
-                    "REPO_COMMIT": "test123",
+                    "REPO_COMMIT": self.repo_commit,
                     "REPO_DIR": self.repo})
         if env_extra:
             env.update(env_extra)