test(cf11): signed offline lock identity difference diagnostic and tests

Merged
TH
7d ago
+275-0

CF11: bounded offline lock identity mismatch evidence

Does not change the protected CF11 workflow or assert that issue #214 is fixed.

Adds one standard-library Python diagnostic and one unittest file
under tools/ (two files, no dependencies, no AF-02 protected surface).
The instrument can compare independently acquired, already verified
commandf.lock files and emit deterministic machine-readable
differences of actual package name/version, SHA-256, declared
dependencies, roots, or package presence.

  • Source transport URL is excluded from the semantic comparator
    only as it already is in current protected CF11 GitHub CI;
    source-only variations are separately named in the report,
    without displaying local mirror paths. This never authenticates
    package publishers or treats unequal archive bytes as equivalent.
  • Exit 0: validated semantic identity equal; exit 1: validated
    mismatch; exit 2: malformed/unreadable/oversized or duplicate-key
    JSON input. The program never changes any lockfile.
  • Explicit maximum 4-MiB input, 10,000 packages, 100 reported
    differences; outputs count of truncated differences.
  • Strictly rejects duplicate package identities, duplicate JSON
    keys, unsupported schema, invalid SHA-256 or missing source.
  • No CI workflow was edited or silently relaxed. The diagnostic
    currently runs manually; future CI integration must be a
    separate protected-path authorized PR.

Actual authorized Mac reproducibility qualification

  • Built exact canonical base 9fb6ff251d53fa779847ad138921d9221349725a
    with pinned Rust 1.97.1, cargo build --locked.
  • Fresh isolated cache A and B: IPS 2.0.1 resolve and verify
    completed successfully in both, each with nine packages.
  • Both lockfiles identical byte-for-byte and semantically,
    SHA256 = 84e8d8132624b0f049e145f871bcefa68fa86cdb5306ed340b4c8e9e6eb8bb02.
  • A controlled copy with its IPS root package digest modified
    was identified correctly by diagnostic as a one-package
    SHA-256 mismatch and returned exit 1.
  • 11/11 no-network Python unittest cases PASS, including
    source-only differences, duplicate JSON keys, budgets,
    dependency mismatch, missing package and exit codes.
  • git diff --check PASS. Ruff not installed: NOT_RUN.
  • Detailed exact-head live source evidence is recorded in
    issue #214 comment 6099635094.
  • Earlier intermittent GitHub CI mismatches remain unexplained.
    No root-cause proof, durable frozen mirror, CI retry policy or
    issue closure is claimed.

Admission

Signed GitHub verified+DCO candidate head 2a2929eceb61400b9ce32baa6c37f3810f321ae5.
All exact-head GitHub technical and mandatory assurance checks
must actually succeed, followed by expected-head normal merge.
Human review approval not required under founder G53.

Summary by cubic

Adds an offline, fail-closed diagnostic that compares two independently verified CF11 lockfiles and reports deterministic differences (package identity, SHA-256, dependencies, roots, presence). It never modifies lockfiles and excludes transport-only source differences from the semantic comparison without exposing local paths. The protected CF11 workflow is unchanged.

  • Exit codes: 0 for semantic equality, 1 for mismatch, 2 for malformed/oversized input; duplicate JSON keys, duplicate package identities, and invalid digests are rejected.
  • Enforces a 4 MiB input limit, 10,000 packages, and 100 reported differences, with truncated count output.
  • Adds 11 offline unit tests covering positive, negative, provenance, and CLI exit-code cases.