test(cf11): diagnose exact-version FHIR registry archive identity
Scope
Adds a read-only, standalone investigation script and offline positive/negative
tests for exact-version raw FHIR archive byte identity on two registry endpoints.
Addresses evidence capture for #214. This is a diagnostic candidate, not a fix
for the historical Linux CI mismatches.
- Fixed HTTPS endpoints, disabled redirects and environment proxies,
platform TLS verification, 30-second timeout, 128-MiB archive bound - Exact package name/version and lowercase SHA-256 lock validation
- Distinct fail-closed states for cross-registry source conflict, disagreement
with a local expected lock digest, unavailable endpoint and invalid input - Streaming SHA-256 from an automatically deleted temporary archive
- Explicitly does not change resolver behavior, CF11 proof checks, AF-02
protected governance paths, Cargo manifests/locks or branch rules
Observed evidence
- Mac local: 13/13 offline unittest cases passed (plus four subtests);
pytest: 13 passed, 4 subtests passed. - Direct Mac live probe on existing IPS closure: 9 exact package identities;
7 SOURCE_BYTES_IDENTICAL and 2 SOURCE_IDENTITY_CONFLICT. - The mismatches are hl7.fhir.uv.ips@2.0.1 and hl7.fhir.r4.core@4.0.1,
consistent with the independent byte evidence on #214. - The expected nonzero exit code 2 was observed for conflicting archive
digests, rather than incorrectly treating the condition as a PASS. - Diff whitespace check passed. Full Rust workspace qualification on main
remains blocked on macOS by distinct #215; this helper is Python/curl only.
Review and governance status
- Created from unchanged canonical main f82565cca917d119e1c774b2c470e2ac20e0d6dd.
- Commit created natively by GitHub, signature verified=true, valid;
author-identical DCO Signed-off-by included. - Alibaba OpenCodeReview v1.12.13 delegate preview: 1/3 files selected
as reviewable (the Python implementation); this is rule/delegation evidence
only, not an independent model-review PASS. - Jev native review NOT_RUN on Mac (not installed/qualified and paid API
spending not implicitly authorized). Do not substitute bots for it. - CI must be assessed on the final exact SHA, and an eligible independent human
Code Owner must submit actual APPROVED review after last push (#195). - Normal merge commit only if all genuinely applicable gates pass; no
force-push, squash, rebase or branch protection bypass. - Historical CF11 mismatches remain unresolved; #214 stays OPEN.
No release or project-completion claim.
Summary by cubic
Adds read-only diagnostic scripts that capture exact-version FHIR archive byte-identity evidence for #214 without changing resolver behavior, CF11 proof checks, Cargo manifests/locks, or branch rules.
The registry probe downloads each bounded archive (128 MiB max) to a temporary file, streams SHA-256, and fails closed with distinct exit codes: identical sources matching the lock (0), cross-registry digest conflicts or lock disagreement (2), unavailable endpoints (3), and invalid input (4). An offline --compare-lock mode contrasts two saved lockfiles (digest, dependencies, roots, schema) without network, redacting raw source URLs and failing closed (exit 2 for any semantic or provenance difference, 4 for invalid input). Network --all mode caps at 16 exact identities, fails before any download beyond that, and probes in deterministic sorted order.
A companion script, cf11_archive_payload_diff.py, compares two saved archive byte streams offline to distinguish envelope differences from changed payloads. It hashes regular-file and directory TAR/PAX metadata, so identical payloads with differing permissions or ownership report ARCHIVE_METADATA_DIVERGENCE instead of being classed as compression-only differences. The digest and TAR parser read the same single bounded stream, so a local evidence file replaced between passes can no longer produce a misattributed cross-snapshot diagnosis, and compressed limits hold even when a file grows after stat. It bounds compressed/decompressed size, manifest and member counts, rejects duplicate and unsafe paths, rejects any nonzero trailing bytes after the TAR end marker—including concatenated gzip members—while allowing normal zero-filled padding, and reports digest or semantic divergence while redacting filenames, manifest URLs, and local paths; any byte difference exits 2.
A live run on the current IPS closure found 7 of 9 package identities identical between sources; the two conflicts (hl7.fhir.uv.ips@2.0.1, hl7.fhir.r4.core@4.0.1) match the independent byte evidence in #214.