test(cf11): retain distinct archive digests for conflicting sources

Merged
TH
8d ago
+74-0

Purpose

Adds a small offline synthetic regression that reproduces the relevant
source-identity risk in #214 without modifying production resolver behavior,
provenance rules, protected AF-02 authority or live CF11 proof assertions.

Two fixtures declare the exact same package acme.example@1.0.0, same
manifest name/version/dependencies and resolve into separate caches.
One archive includes an additional synthetic JSON evidence file.

Assertions:

  • Both independent resolutions and their own cache verification succeed.
  • The same exact version and dependency graph must not collapse the
    different archive SHA-256 values.
  • The resulting lock bytes must differ.
  • Cross-cache verification must fail (neither lock may treat the other
    archive as its own).

These synthetic fixtures are not real FHIR registry attestations. Original
Linux mismatches cannot be attributed without historical failed lock bytes.

Qualification on Mac

  • cargo +1.97.1 test --locked -p commandf-pkg --test resolution --quiet:
    8/8 PASS, including this new test.
  • cargo +1.97.1 test --locked -p commandf-pkg --lib --quiet:
    75 PASS, 2 explicitly ignored.
  • cargo +1.97.1 fmt --all -- --check: PASS.
  • git diff --check: PASS.
  • Genuine Alibaba OCR v1.12.13 delegation preview selects one Rust
    test file (rule selection evidence, not an independent model review).
  • Jev external review: NOT_RUN on Mac; do not claim a PASS or imply any
    paid usage was authorized.

Merge gating

Exact GitHub-signed commit a41dc15c7616c11c289128a6c8f464b492d4f740
has verification.verified=true and author-matched DCO sign-off.
Re-run exact-head checks. Independent eligible human Code Owner review (#195)
and normal merge-commit semantics remain mandatory. Do not use self-review,
bot comments, stale approval, force-push or an AF-02 bypass.

This PR is not a project-completion claim; keep #214 OPEN.

Summary by cubic

Adds a regression test ensuring the resolver never collapses two independently verified archives with identical name, version, and dependencies but different raw bytes into one canonical identity.

  • Builds two synthetic packages with the same FHIR identity and dependency graph, differing only by an extra JSON evidence file.
  • Asserts both resolve and verify against their own caches, that their SHA-256 digests and lock bytes differ, and that cross-cache verification fails.
  • Test-only change; no resolver, provenance, or release behavior is modified.