fix(artifact): fail closed on duplicate FHIR resource filenames (signed DCO)

Merged
TH
8d ago
+50-2

Signed replacement for #205 — issue #204

This pull request supersedes the earlier unsigned PR #205 without rewriting its history. It contains the same verified files and behavior, but as one new signed, DCO-compliant commit created on the authorized Windows Abdulaziz computer using Git's SSH signing path and a real git commit -S -s.

  • Candidate SHA: d820913a41a8def8fbb12594b1727a58fa386d5c.
  • Canonical parent: f82565cca917d119e1c774b2c470e2ac20e0d6dd (the protected live V2 main).
  • GitHub commit verification: verified=true, reason=valid.
  • DCO footer: Signed-off-by: Abdulaziz M. Shehri <alshehriofficial@gmail.com>.
  • Exact content identity: Git tree 227d417028bd5388a85e03f6a424aa9ed130ac0f, byte-identical to the Git tree of original #205 head fd860930cb292e8d9b25113c3b573285e420bea4.
  • No rebase, squash, force push, history rewrite or changed protected file. A freshly staged patch against canonical main passed cargo fmt --all -- --check and git diff --cached --check before signed commit.

V2 core semantic repair

inspect_package used to reject duplicated canonical identities but not duplicate tar resource filenames. Two noncanonical Patient resources both named package/Patient-example.json could be reported as a valid inspection, while the same archive failed diff_package_archives as ambiguous. This candidate adds deterministic filename uniqueness in inspect_package and a stable typed ArtifactError::DuplicateResourceFilename. artifact_diff::load_side maps this specific earlier error to the existing StructuralDiffError::DuplicateResourceFilename public contract, preserving current fail-closed code. Synthetic tests demonstrate deterministic duplicate refusal and ordinary acceptance of distinct noncanonical filenames.

Evidence and pending governance

The identical content on #205 passed 15/15 technical GitHub checks, including pinned oracle rerun after a Maven Central plugin-resolution failure. This is relevant prior-tree evidence but not a substitute for all required checks on this signed SHA; independent new CI is mandatory.

This PR is still a candidate, not approved or merged. A genuinely independent and eligible human Code Owner must submit APPROVED after the last push, required discussions must be resolved, branch rules must permit normal merge commit only, and fresh-main CI must pass afterward. User continuation authorization does not override that rule. Bot COMMENTED or NEUTRAL is never a human approval. Do not close issue #204 until canonical integration.

Preserve the original #205 and its workflow attempts as an auditable historical record; it will be closed separately as superseded without merge once this replacement is established. No cloud compute cost, new dependencies, oracle pin modifications, AF-02 authority edits, clinical data or signed-proof runtime feature are introduced.

Summary by cubic

Fixes inspect_package so FHIR package archives with duplicate resource filenames are rejected deterministically, instead of passing inspection and only failing later in diff_package_archives.

  • Adds a typed ArtifactError::DuplicateResourceFilename raised when two resources share the same tar filename, even if they have distinct canonical identities.
  • Maps that error to the existing StructuralDiffError::DuplicateResourceFilename in artifact_diff::load_side to keep diff behavior fail-closed.
  • Adds tests confirming duplicate filenames are rejected consistently and distinct noncanonical filenames remain valid.