fix(artifact): reject ambiguous duplicate resource filenames in FHIR inspection

Closed
TH
9d ago
+50-2

Defect — issue #204

The same exact SHA-256-verified FHIR NPM archive was interpreted inconsistently by the V2 core: inspect_package checked duplicate canonical url|version identities but did not check repeat resource filenames, so commandf inspect could list two different noncanonical resources from two tar members named package/Patient-example.json. The existing diff_package_archives detects duplicated filenames and fails closed via StructuralDiffError::DuplicateResourceFilename. This discrepancy risks presenting an ambiguous resource inventory as a successful inspection even though structural diff will refuse the archive.

Narrow repair

  • inspect_package now checks a BTreeSet of archive member filenames before publishing each parsed resource and emits a typed ArtifactError::DuplicateResourceFilename { file } on duplicates (no absolute host path).
  • artifact_diff::load_side maps precisely that earlier inspection failure back to the existing StructuralDiffError::DuplicateResourceFilename public contract, preserving the current failing-closed CLI and test type. The existing raw-JSON scan's duplicate guard remains as defense in depth.
  • Tests create a synthetic tar.gz with the exact same file name but distinct noncanonical Patient IDs and demand deterministic failure from direct inspection on repeated executions. A separate positive test shows distinct noncanonical filenames remain accepted. The pre-existing structural_diff_fail_closed::duplicate_package_resource_filename_fails_closed must still pass.

Boundary, evidence, and review

This is a small V2 deterministic artifact-plane bug fix, not any consumer-contract inference, clinical result, semantic engine change, oracle repin, new model or cloud dependency. No protected AF-02 authority, GitHub workflow, branch rules, package lock or donor source modified.

Before adoption: run exact-head Rustfmt, Clippy, integration and workspace tests and all required GitHub Actions CI; collect an independent, eligible, last-push-valid human Code Owner APPROVED review, resolve review threads, use normal merge commit and verify post-main. Existing GitHub reviewer-access blocker #195 remains active; bot COMMENTED or NEUTRAL is not approval. Issue #204 must stay open until canonical integration. First candidate 72fdc06fb133365b660f77e9ba7f24f6e020ecba based on current main f82565cca917d119e1c774b2c470e2ac20e0d6dd; CI qualification must use the live head, not an ancestor.

Summary by cubic

Fixes FHIR archive inspection so packages with duplicate resource filenames fail closed instead of producing an ambiguous inventory.

Previously inspect_package only rejected duplicate canonical url|version identities, so an archive with two tar members named package/Patient-example.json could be listed as successfully inspected even though structural diff would refuse it. Now inspection rejects duplicate filenames with a typed ArtifactError::DuplicateResourceFilename, and artifact_diff::load_side maps that error to the existing StructuralDiffError::DuplicateResourceFilename contract so the CLI behavior is unchanged.

  • Adds the new error variant and the filename set check in artifact_inspect.rs.
  • Adds tests proving deterministic rejection on repeated runs and acceptance of distinct noncanonical filenames.
  • Applies the pinned CI rustfmt to the guard without changing executable behavior.