feat(cf11): bounded offline lock divergence diagnostics

Merged
TH
12d ago
+395-0

Scope / motivation\nIssue #214 documents non-retained independent FHIR lock divergence. Add commandf pkg compare-locks --first-lock FILE --second-lock FILE to attribute a captured pair offline without weakening the protected CF11 equality assertion, changing the resolver, or making any registry request. It requires validated v2 locks and compares roots, resolved edges, package exact identity, raw SHA-256 and declared dependencies, while excluding transport source strings. Deterministic JSON reports at most 32 package-diff examples but retain the complete mismatch count and exit status 2 on any divergence (0 equivalent, 1 invalid/unreadable). No original archive or cache verification is claimed; upstream issue #214 stays OPEN.\n\n## Actually executed on the authorized macbook / Rust 1.97.1\n- cargo test --locked -p commandf-pkg --lib lock_compare::tests: 6/6 PASS\n- cargo test --locked -p commandf --test cf11_lock_comparison: 2/2 PASS, offline blocked HTTP proxies\n- cargo clippy --locked -p commandf-pkg --lib -- -D warnings: PASS\n- cargo clippy --locked -p commandf --all-targets -- -D warnings: PASS\n- cargo test --locked -p commandf-pkg --test resolution: 9/9 PASS\n- cargo fmt --all -- --check and git diff --check: PASS\n- Commit signed with registered SSH key and DCO Signed-off-by.\n\n## Safety / qualification\nNo .github, AF-02, Cargo manifests/lock, donor, source pin, workflow, or ruleset changes. This diagnostic is not a resolution of external registry drift. Exact-head GitHub CI and ordinary merge policy remain mandatory. Jev, Pstack, Graft, and Alibaba model review are NOT_RUN unless independently evidenced; optional review output is not permission to override checks.

Summary by cubic

Adds commandf pkg compare-locks --first-lock FILE --second-lock FILE to attribute differences between two validated v2 lockfiles offline, without making registry requests or weakening the CF11 equality assertion.

  • Compares roots, resolved edges, package exact identity, raw SHA-256, and declared dependencies; transport source strings are excluded.
  • Reports deterministic JSON with up to 32 package-diff examples and the complete mismatch count.
  • Returns exit code 0 for equivalent, 2 for divergence, 1 for invalid or unreadable input.
  • Makes no archive or cache verification claims; issue #214 remains open.