diff --git a/crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs b/crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs
index 289287c6f..275f36bfd 100644
--- a/crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs
+++ b/crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs
@@ -12,24 +12,12 @@
 //! assert EVERY physical copy is patched (and later restored) AND that the
 //! JSON summary counts every copy.
 
+use crate::common::{binary, git_sha256};
+
 use std::ffi::OsStr;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Write `node_modules/.../<name>/{package.json,index.js}` at the given
 /// `pkg_dir` (which already encodes the nesting), returning the index.js path.
 fn write_copy(pkg_dir: &Path, name: &str, version: &str, index_bytes: &[u8]) -> PathBuf {
diff --git a/crates/socket-patch-cli/tests/cli/covgap_api_client.rs b/crates/socket-patch-cli/tests/cli/covgap_api_client.rs
index b388afef6..023b1a39d 100644
--- a/crates/socket-patch-cli/tests/cli/covgap_api_client.rs
+++ b/crates/socket-patch-cli/tests/cli/covgap_api_client.rs
@@ -6,6 +6,8 @@
 //! stderr *text* — the "you configured the sha512- storage hash, not the
 //! token" hint — which only a spawned process can observe.
 
+use crate::common::binary;
+
 use std::process::Command;
 
 use wiremock::matchers::{method, path};
@@ -13,10 +15,6 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 
-fn binary() -> std::path::PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// Parse the command's stdout as JSON, failing with the raw bytes on error
 /// (same discipline as `api_client_errors_e2e::json_stdout`).
 fn json_stdout(out: &std::process::Output) -> serde_json::Value {
diff --git a/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs b/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
index 9bfbd4efe..3ea873f35 100644
--- a/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
@@ -11,20 +11,12 @@
 //! like SOCKET_DRY_RUN — an ambient SOCKET_DRY_RUN=true turned every
 //! apply below into a silent no-op and failed the on-disk assertions.
 
-use std::path::Path;
+use crate::common::git_sha256;
 
-use sha2::{Digest, Sha256};
+use std::path::Path;
 
 use crate::common;
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn write_root(root: &Path) {
     std::fs::write(
         root.join("package.json"),
diff --git a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
index 2c99bcefd..d21512967 100644
--- a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
+++ b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
@@ -15,38 +15,10 @@ use std::path::Path;
 /// another red.
 const PENDING_PRIVATE_HELPERS: &[&str] = &[
     "apply/apply_network.rs",
-    "apply/in_process_npm_multicopy.rs",
     "cli/api_client_errors_e2e.rs",
-    "cli/covgap_api_client.rs",
-    "cli/output_modes_e2e.rs",
-    "cli/telemetry_e2e.rs",
-    "cli_scan_silent.rs",
-    "covgap_commands_scan_mod.rs",
     "diff_created_file_e2e.rs",
-    "docker_e2e_npm.rs",
-    "docker_e2e_nuget.rs",
-    "docker_e2e_pypi.rs",
-    "e2e_embedded_vex.rs",
-    "e2e_gem.rs",
-    "e2e_hosted_production.rs",
-    "e2e_npm.rs",
-    "e2e_pypi.rs",
-    "e2e_redirect_gem_build.rs",
-    "e2e_redirect_gradle_build.rs",
-    "e2e_redirect_npm_build.rs",
-    "e2e_redirect_pnpm_build.rs",
-    "e2e_scan.rs",
-    "e2e_vendor_composer_build.rs",
-    "e2e_vendor_npm_build.rs",
-    "e2e_vendor_pnpm_build.rs",
-    "e2e_vendor_pypi_build.rs",
-    "e2e_vex_lockfile/cargo.rs",
-    "e2e_vex_lockfile/maven.rs",
-    "e2e_vex_lockfile/uv.rs",
-    "e2e_vex_lockfile/yarn.rs",
     "e2e_vex_redirect.rs",
     "e2e_vex_vendor.rs",
-    "get/get_batch_paths_e2e.rs",
     "get/global_packages_e2e.rs",
     "in_process_agent_reapply.rs",
     "in_process_alternate_installers.rs",
@@ -59,28 +31,16 @@ const PENDING_PRIVATE_HELPERS: &[&str] = &[
     "in_process_pypi_multi_release.rs",
     "in_process_remote_ecosystems_apply.rs",
     "in_process_remove_repair_lifecycle.rs",
-    "mode_migration_cargo.rs",
     "mode_migration_npm.rs",
-    "remove/covgap_commands_remove.rs",
     "remove_rollback_api_overrides.rs",
-    "repair/coverage_fix_repair_vendor_predelete.rs",
     "repair/covgap_commands_repair.rs",
     "repair/covgap_commands_repair_vendor.rs",
     "repair/repair_invariants.rs",
-    "repair/repair_vendor_e2e.rs",
-    "repair/repair_vendor_flavors_e2e.rs",
-    "rollback/rollback_invariants.rs",
     "rollback/rollback_multicopy_blob_gate.rs",
     "scan/covgap_commands_fetch_stage.rs",
-    "scan/covgap_commands_scan_vendor_flow.rs",
-    "scan/scan_invariants.rs",
-    "scan/scan_paths_e2e.rs",
-    "scan/scan_sync_e2e.rs",
-    "scan/scan_vendor_step_error_e2e.rs",
     "scan_rollout_e2e.rs",
     "scan_vendor_e2e.rs",
     "vendor_ecosystem_fixtures/mod.rs",
-    "vendor_jvm_cli.rs",
     "vex_e2e_common/mod.rs",
     "vlt_e2e_common/mod.rs",
     "vlt_hosted_common/mod.rs",
diff --git a/crates/socket-patch-cli/tests/cli/telemetry_e2e.rs b/crates/socket-patch-cli/tests/cli/telemetry_e2e.rs
index b628df9ec..639278b80 100644
--- a/crates/socket-patch-cli/tests/cli/telemetry_e2e.rs
+++ b/crates/socket-patch-cli/tests/cli/telemetry_e2e.rs
@@ -8,7 +8,9 @@
 //! count). Each test runs the released binary in a tempdir against
 //! the mock URI.
 
-use std::path::{Path, PathBuf};
+use crate::common::binary;
+
+use std::path::Path;
 use std::process::Command;
 
 use wiremock::matchers::{method, path};
@@ -16,10 +18,6 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 
 const ORG_SLUG: &str = "telemetry-test-org";
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 fn write_root_package_json(root: &Path) {
     std::fs::write(
         root.join("package.json"),
diff --git a/crates/socket-patch-cli/tests/cli_scan_silent.rs b/crates/socket-patch-cli/tests/cli_scan_silent.rs
index dbe392c89..c0dc62c0a 100644
--- a/crates/socket-patch-cli/tests/cli_scan_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_scan_silent.rs
@@ -15,33 +15,24 @@
 //! `get_api_client_with_overrides` in core for every command and is
 //! out of scope for `scan`'s `--silent` gating.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
 use socket_patch_cli::args::GLOBAL_ARG_ENV_VARS;
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn write_root(root: &Path) {
     std::fs::write(
         root.join("package.json"),
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index f85c2eeb4..a598a3577 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -32,37 +32,28 @@
 //! `cli_scan_silent.rs` pattern) so ambient developer/CI configuration
 //! cannot reroute the branch under test. Network tests use wiremock.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 #[path = "common/pty_io.rs"]
 mod pty_io;
 #[path = "vlt_hosted_common/mod.rs"]
 mod vlt_hosted_common;
 #[path = "vlt_hosted_common/vendored.rs"]
 mod vlt_vendored;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
 use socket_patch_cli::args::{GLOBAL_ARG_ENV_VARS, LOCAL_ARG_ENV_VARS};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 const OLD_UUID: &str = "99999999-9999-4999-8999-999999999999";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn write_root_package_json(root: &Path) {
     std::fs::write(
         root.join("package.json"),
diff --git a/crates/socket-patch-cli/tests/docker_e2e_npm.rs b/crates/socket-patch-cli/tests/docker_e2e_npm.rs
index 072880d53..451f05a22 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_npm.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_npm.rs
@@ -25,6 +25,10 @@
 
 #![cfg(feature = "docker-e2e")]
 
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
+
 #[path = "docker_vendor_common/mod.rs"]
 mod docker_vendor_common;
 
@@ -33,7 +37,6 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 use std::time::Duration;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -50,16 +53,6 @@ const GHSA: &str = "GHSA-agent-npm-real";
 const PATCHED_BYTES: &[u8] =
     b"/* SOCKET-PATCH-E2E-MARKER */\nmodule.exports = function () { return {}; };\n";
 
-/// Git-SHA256: SHA256("blob <len>\0" ++ content). Matches the binary's
-/// content-addressable hashing for fetched blobs.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Coverage instrumentation hook. The CI coverage-docker job sets
 /// SOCKET_PATCH_COV_BIN (host path to an llvm-cov-instrumented
 /// socket-patch binary) and SOCKET_PATCH_COV_PROFRAW_DIR (host dir
diff --git a/crates/socket-patch-cli/tests/docker_e2e_nuget.rs b/crates/socket-patch-cli/tests/docker_e2e_nuget.rs
index cca26cc7d..ee4816763 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_nuget.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_nuget.rs
@@ -15,6 +15,10 @@
 
 #![cfg(feature = "docker-e2e")]
 
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
+
 use std::process::Command;
 
 use base64::Engine;
@@ -61,14 +65,6 @@ fn cov_docker_args() -> Vec<String> {
     ]
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Plain SHA-256 of the bytes (what `sha256sum` in the container
 /// reports). Used to verify the patched file's EXACT contents, not just
 /// that it contains the marker substring.
diff --git a/crates/socket-patch-cli/tests/docker_e2e_pypi.rs b/crates/socket-patch-cli/tests/docker_e2e_pypi.rs
index 435177ea7..583df9d59 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_pypi.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_pypi.rs
@@ -17,6 +17,10 @@
 
 #![cfg(feature = "docker-e2e")]
 
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
+
 use std::process::Command;
 
 use base64::Engine;
@@ -63,14 +67,6 @@ fn cov_docker_args() -> Vec<String> {
     ]
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Plain SHA256 (NOT git-blob) of the content — used as an independent
 /// oracle for the on-disk file after apply. The marker grep alone only
 /// proves the marker is *somewhere* in the file; comparing the full
diff --git a/crates/socket-patch-cli/tests/e2e_embedded_vex.rs b/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
index 2d2da4261..4ca9b2aaa 100644
--- a/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
+++ b/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
@@ -10,6 +10,10 @@
 //! All offline: `apply` runs against a pre-seeded `.socket/blobs/` cache,
 //! and the `scan` cases find zero installed packages so no API call fires.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::binary;
+
 use std::collections::HashMap;
 use std::path::Path;
 use std::process::Command;
@@ -20,10 +24,6 @@ use socket_patch_core::manifest::schema::{
     PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
-
 /// Build a `Command` for the CLI with the entire `SOCKET_*` environment
 /// scrubbed from the child process.
 ///
diff --git a/crates/socket-patch-cli/tests/e2e_gem.rs b/crates/socket-patch-cli/tests/e2e_gem.rs
index 320eb5dda..9399b9949 100644
--- a/crates/socket-patch-cli/tests/e2e_gem.rs
+++ b/crates/socket-patch-cli/tests/e2e_gem.rs
@@ -18,15 +18,17 @@
 //! cargo test -p socket-patch-cli --test e2e_gem -- --ignored
 //! ```
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use common::cache_env;
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -42,10 +44,6 @@ const GEM_PURL: &str = "pkg:gem/activestorage@5.2.0?platform=ruby";
 // Helpers
 // ---------------------------------------------------------------------------
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 fn has_command(cmd: &str) -> bool {
     let mut probe = Command::new(cmd);
     probe.arg("--version");
@@ -57,15 +55,6 @@ fn has_command(cmd: &str) -> bool {
         .is_ok()
 }
 
-/// Compute Git SHA-256: `SHA256("blob <len>\0" ++ content)`.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn git_sha256_file(path: &Path) -> String {
     let content = std::fs::read(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
     git_sha256(&content)
diff --git a/crates/socket-patch-cli/tests/e2e_hosted_production.rs b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
index 424861f20..6c7ca6f07 100644
--- a/crates/socket-patch-cli/tests/e2e_hosted_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
@@ -81,6 +81,10 @@
 //!   cargo test -p socket-patch-cli --test e2e_hosted_production -- --ignored
 //! ```
 
+#[path = "common/mod.rs"]
+mod common;
+use common::binary;
+
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
@@ -267,10 +271,6 @@ macro_rules! soft_skip {
 // CLI invocation
 // ---------------------------------------------------------------------------
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 fn has_command(cmd: &str) -> bool {
     // `go` has no `--version` — it takes `go version` as a subcommand and
     // errors with "flag provided but not defined: -version" otherwise. Probing
diff --git a/crates/socket-patch-cli/tests/e2e_npm.rs b/crates/socket-patch-cli/tests/e2e_npm.rs
index c0ca6f4a1..63de6c636 100644
--- a/crates/socket-patch-cli/tests/e2e_npm.rs
+++ b/crates/socket-patch-cli/tests/e2e_npm.rs
@@ -13,13 +13,14 @@
 //! cargo test -p socket-patch-cli --test e2e_npm -- --ignored
 //! ```
 
-use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
 
-use sha2::{Digest, Sha256};
+use std::path::Path;
+use std::process::{Command, Output};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use common::cache_env;
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -38,10 +39,6 @@ const AFTER_HASH: &str = "043f04d19e884aa5f8371428718d2a3f27a0d231afe77a2620ac63
 // Helpers
 // ---------------------------------------------------------------------------
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 fn has_command(cmd: &str) -> bool {
     let mut probe = Command::new(cmd);
     probe.arg("--version");
@@ -53,15 +50,6 @@ fn has_command(cmd: &str) -> bool {
         .is_ok()
 }
 
-/// Compute Git SHA-256: `SHA256("blob <len>\0" ++ content)`.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn git_sha256_file(path: &Path) -> String {
     let content = std::fs::read(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
     git_sha256(&content)
diff --git a/crates/socket-patch-cli/tests/e2e_pypi.rs b/crates/socket-patch-cli/tests/e2e_pypi.rs
index d4b6a2007..5c23ed778 100644
--- a/crates/socket-patch-cli/tests/e2e_pypi.rs
+++ b/crates/socket-patch-cli/tests/e2e_pypi.rs
@@ -13,14 +13,16 @@
 //! cargo test -p socket-patch-cli --test e2e_pypi -- --ignored
 //! ```
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
-use sha2::{Digest, Sha256};
 use socket_patch_cli::args::{GLOBAL_ARG_ENV_VARS, LOCAL_ARG_ENV_VARS};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use common::cache_env;
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -33,10 +35,6 @@ const PYPI_PURL_PREFIX: &str = "pkg:pypi/pydantic-ai@0.0.36";
 // Helpers
 // ---------------------------------------------------------------------------
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 fn has_python3() -> bool {
     Command::new("python3")
         .arg("--version")
@@ -47,15 +45,6 @@ fn has_python3() -> bool {
         .unwrap_or(false)
 }
 
-/// Compute Git SHA-256: `SHA256("blob <len>\0" ++ content)`.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn git_sha256_file(path: &Path) -> String {
     let content = std::fs::read(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
     git_sha256(&content)
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
index 5e7a985e1..e0db00e48 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
@@ -95,6 +95,10 @@
 //! below the arm's floor; everything after that is hard — no live network is
 //! involved at all.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::binary;
+
 use std::io::Write as _;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output, Stdio};
@@ -106,8 +110,7 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 
 #[path = "common/bundler_e2e.rs"]
 mod bundler_e2e;
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use common::cache_env;
 #[path = "vex_e2e_common/mod.rs"]
 mod vex_e2e_common;
 
@@ -147,10 +150,6 @@ const TINY_LIB: &str = "module TinyDep\n  VALUE = \"tiny-ok\"\nend\n";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 /// Run the socket-patch binary with the ambient `SOCKET_*` surface scrubbed
 /// (a developer's `SOCKET_DRY_RUN=1` must not steer the assertions) and
 /// `VIRTUAL_ENV` (crawler discovery input) removed.
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gradle_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_gradle_build.rs
index 9fc9f8c24..f98f1f00b 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_gradle_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_gradle_build.rs
@@ -18,8 +18,11 @@
 //! case is DSL-specific; toolchain selection is `gradle_build_common`'s
 //! `SOCKET_PATCH_GRADLE_E2E_*` knobs.
 
-#[path = "common/hermetic.rs"]
-mod hermetic;
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
+
+use common::hermetic;
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -86,10 +89,6 @@ fn purl() -> String {
     jvm_fixture_repo::victim_purl(VICTIM_VERSION)
 }
 
-fn git_sha256(bytes: &[u8]) -> String {
-    socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes(bytes)
-}
-
 fn central_file(path: &str) -> Vec<u8> {
     jvm_fixture_repo::repository()
         .remove(path)
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
index d1513aba2..c03e29c3a 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
@@ -58,6 +58,10 @@
 //! cannot reach the registry — unless `SOCKET_PATCH_NPM_E2E_REQUIRED` is set;
 //! every assertion after that is hard.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::binary;
+
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
@@ -100,10 +104,6 @@ const PURL_UNINSTALLED: &str = "pkg:npm/left-pad@9.9.9";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 /// Run the socket-patch binary with a scrubbed environment: every ambient
 /// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't
 /// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input).
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
index 14d960245..d6402b32c 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
@@ -111,7 +111,7 @@ const PATCHED_SHA512: &str = "sha512-PATCHEDpatchedPATCHEDpatched0123456789==";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-fn binary() -> PathBuf {
+fn socket_bin() -> PathBuf {
     std::env::var_os("SOCKET_PATCH_PNPM_E2E_SOCKET_BIN")
         .map(PathBuf::from)
         .unwrap_or_else(|| PathBuf::from(env!("CARGO_BIN_EXE_socket-patch")))
@@ -210,7 +210,7 @@ fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
 
 /// [`run_socket`] with extra env applied after the scrub.
 fn run_socket_env(cwd: &Path, args: &[&str], env: &[(String, String)]) -> (i32, String, String) {
-    let mut cmd = hermetic::command(&binary());
+    let mut cmd = hermetic::command(&socket_bin());
     cmd.args(args).current_dir(cwd);
     hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv, hermetic::Extra::Pnpm]);
     for (k, v) in env {
@@ -614,7 +614,7 @@ async fn redirect_scanned_pnpm_project(
         off_runtime(|| {
             let api = hosted_patch_api(PURL, &patched);
             let out = run_vex(
-                &binary(),
+                &socket_bin(),
                 &proj,
                 &VexRun {
                     patch_server_url: Some(server.uri()),
@@ -925,7 +925,7 @@ fn assert_manifestless_hosted_vex(
     tag: &str,
 ) {
     off_runtime(|| {
-        let bin = binary();
+        let bin = socket_bin();
         let api = hosted_patch_api(purl, patched);
         let with_origin = |run: VexRun| VexRun {
             patch_server_url: Some(patch_server.to_string()),
diff --git a/crates/socket-patch-cli/tests/e2e_scan.rs b/crates/socket-patch-cli/tests/e2e_scan.rs
index 6c9071807..10285fc69 100644
--- a/crates/socket-patch-cli/tests/e2e_scan.rs
+++ b/crates/socket-patch-cli/tests/e2e_scan.rs
@@ -27,13 +27,14 @@
 //! cargo test -p socket-patch-cli --test e2e_scan -- --ignored
 //! ```
 
-use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
 
-use sha2::{Digest, Sha256};
+use std::path::Path;
+use std::process::{Command, Output};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use common::cache_env;
 
 // ---------------------------------------------------------------------------
 // Constants (shared with e2e_npm; duplicated here because Rust integration
@@ -62,10 +63,6 @@ const FAKE_OLD_UUID: &str = "11111111-1111-4111-8111-111111111111";
 // Helpers
 // ---------------------------------------------------------------------------
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 fn has_command(cmd: &str) -> bool {
     let mut probe = Command::new(cmd);
     probe.arg("--version");
@@ -90,14 +87,6 @@ fn require_npm() {
     );
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn git_sha256_file(path: &Path) -> String {
     let content = std::fs::read(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
     git_sha256(&content)
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
index 648dd9c71..dd2a68c01 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
@@ -58,18 +58,20 @@
 //! assertion after that is hard. `SOCKET_PATCH_COMPOSER_E2E_VERSION` pins
 //! the release a CI leg expects.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use common::cache_env;
 #[path = "composer_e2e_common/mod.rs"]
 mod composer_e2e_common;
 #[path = "vex_e2e_common/mod.rs"]
@@ -94,10 +96,6 @@ const FIXTURE_VERSION: &str = "3.0.2";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 /// Run the socket-patch binary with a scrubbed environment: every ambient
 /// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't
 /// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input).
@@ -125,15 +123,6 @@ fn composer(cwd: &Path, args: &[&str], home: &Path, cache: &Path) -> Output {
     composer_e2e_common::composer(cwd, args, home, cache)
 }
 
-/// Git-blob SHA-256 (`sha256("blob <len>\0" ++ bytes)`) — the hash format
-/// socket-patch records in manifests.
-fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Write `.socket/manifest.json` + the after-hash blob (with a vulnerability
 /// so the VEX leg has a statement to emit) so vendor runs fully offline.
 fn stage_patch_with_vuln(proj: &Path, purl: &str, file_key: &str, before: &[u8], after: &[u8]) {
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs
index 7563f4e84..ca9126054 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs
@@ -35,13 +35,16 @@
 //! cannot reach the registry — unless `SOCKET_PATCH_NPM_E2E_REQUIRED` is
 //! set; every assertion after that is hard.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -65,10 +68,6 @@ const ORG: &str = "test-org";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 /// Run the socket-patch binary with a scrubbed environment: every ambient
 /// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't
 /// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input).
@@ -96,15 +95,6 @@ fn npm(cwd: &Path, args: &[&str]) -> Output {
     npm_e2e_common::npm(cwd, args)
 }
 
-/// Git-blob SHA-256 (`sha256("blob <len>\0" ++ bytes)`) — the hash format
-/// socket-patch records in manifests.
-fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Standard base64 — the encoding of a view response's inline `blobContent`.
 fn b64(bytes: &[u8]) -> String {
     use base64::Engine as _;
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs
index a0c2de7c1..4aae4fd63 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs
@@ -62,20 +62,22 @@
 //! wiring reverted with ledger + tarball kept (`vendor_unwired`,
 //! `--no-verify` too), and a lock-only revert that pnpm itself re-wires.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output, Stdio};
 
-use sha2::{Digest, Sha256};
+use sha2::Digest;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
-#[path = "common/hermetic.rs"]
-mod hermetic;
+use common::cache_env;
+use common::hermetic;
 #[path = "vex_e2e_common/mod.rs"]
 mod vex_e2e_common;
 use vex_e2e_common::{
@@ -99,7 +101,7 @@ const PNPM_TERTIARY: &str = "pnpm@11";
 
 /// The binary under test; the pinned-matrix workflow runs a prebuilt copy
 /// (`SOCKET_PATCH_PNPM_E2E_SOCKET_BIN`, shared with the hosted suite).
-fn binary() -> PathBuf {
+fn socket_bin() -> PathBuf {
     std::env::var_os("SOCKET_PATCH_PNPM_E2E_SOCKET_BIN")
         .map(PathBuf::from)
         .unwrap_or_else(|| PathBuf::from(env!("CARGO_BIN_EXE_socket-patch")))
@@ -214,7 +216,7 @@ fn corepack(cwd: &Path, pm: &str, args: &[&str]) -> Output {
 }
 
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = hermetic::command(&binary());
+    let mut cmd = hermetic::command(&socket_bin());
     cmd.current_dir(cwd);
     hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv, hermetic::Extra::Pnpm]);
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &[]);
@@ -226,13 +228,6 @@ fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
     )
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn stage_patch(proj: &Path, purl: &str, file_key: &str, before: &[u8], after: &[u8]) {
     let socket = proj.join(".socket");
     std::fs::create_dir_all(socket.join("blobs")).unwrap();
@@ -900,7 +895,7 @@ fn assert_manifestless_vendored_vex(
     tag: &str,
 ) {
     off_runtime(|| {
-        let bin = binary();
+        let bin = socket_bin();
         let api = PatchApi::start(vec![(
             UUID.to_string(),
             patch_view(
@@ -1197,10 +1192,14 @@ fn run_unsupported_lock_refusal(pm: &str) {
 
     let api = PatchApi::empty();
     strip_manifest(&proj);
-    let out = run_vex(&binary(), &proj, &VexRun::online(&api));
+    let out = run_vex(&socket_bin(), &proj, &VexRun::online(&api));
     assert_ne!(out.code, Some(0), "{pm}: nothing is wired: {out}");
     assert_absent(out.doc.as_ref(), &purl);
-    let out = run_vex(&binary(), &proj, &VexRun::online(&api).via(VexVia::Vendor));
+    let out = run_vex(
+        &socket_bin(),
+        &proj,
+        &VexRun::online(&api).via(VexVia::Vendor),
+    );
     assert_absent(out.doc.as_ref(), &purl);
     api.assert_no_requests();
     eprintln!("VEX-CELL vendored [{pm}] refused: not attested");
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs
index ab8daa70b..a1ace5364 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs
@@ -54,18 +54,20 @@
 //! older releases, whose lanes run in the `vendored_uv_*` tests. The pip
 //! capstones below keep their own `uv` discovery.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use common::cache_env;
 #[path = "vex_e2e_common/uv.rs"]
 mod uv_vex;
 #[path = "vex_e2e_common/mod.rs"]
@@ -111,10 +113,6 @@ const ORACLE: &str = "import six; print(six.SOCKET_PATCHED)";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 /// Run socket-patch with ambient `SOCKET_*` + `VIRTUAL_ENV` scrubbed
 /// (`VIRTUAL_ENV` is a python-crawler discovery input and must not leak from
 /// the developer's shell).
@@ -240,13 +238,6 @@ fn assert_tool_ok(out: &Output, context: &str) {
     );
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Locate `<venv>/lib/python3.X/site-packages` (PEP-405 Unix layout).
 fn site_packages(venv: &Path) -> PathBuf {
     let lib = venv.join("lib");
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
index d577832d4..15b222c76 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
@@ -51,6 +51,8 @@
 
 //! manifest-less lockfile-wired project.
 
+use crate::common::binary;
+
 use crate::vex_e2e_common;
 
 use std::collections::HashMap;
@@ -83,10 +85,6 @@ const PATCHED_RS: &[u8] = b"// serde patched\npub fn f() {}\n";
 
 // ── harness ───────────────────────────────────────────────────────────
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
-
 /// A project under `<tmp>/app` plus a private (empty unless a test fills
 /// it) cargo home.
 struct Fx {
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
index 8a2199546..8fcd4c679 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
@@ -41,6 +41,8 @@
 //! alive by a ledger under `--no-verify`, and agent-mode (`apply`) patches,
 //! which have no lockfile wiring to discover.
 
+use crate::common::binary;
+
 #[path = "../prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -74,10 +76,6 @@ const CVE: &str = "CVE-2026-7100";
 
 // ── process plumbing ─────────────────────────────────────────────────────
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
-
 /// The CLI with every ambient `SOCKET_*` variable scrubbed (explicit flags
 /// are the only source of truth), telemetry/config/token off, and the
 /// ecosystem stores the crawlers read pinned to `store` — an ambient
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
index 0a1aff5de..5c33c952c 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
@@ -39,6 +39,8 @@
 //! Plus the embedded entry points (`scan --mode hosted --vex`, `scan --mode vendored
 //! --vex`, `apply --vex`).
 
+use crate::common::binary;
+
 use crate::vex_e2e_common;
 
 use std::collections::HashMap;
@@ -672,10 +674,6 @@ impl Api {
 
 // ── running the CLI ─────────────────────────────────────────────────────
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
-
 /// The CLI with the ambient `SOCKET_*` / python / uv discovery environment
 /// scrubbed and uv's cache pointed into `p.home`.
 fn cli(p: &Proj) -> Command {
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
index dc87b825a..ba46ca696 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
@@ -43,6 +43,8 @@
 //!
 //! Runs on every OS; no toolchain, no network.
 
+use crate::common::binary;
+
 use crate::vex_e2e_common;
 
 use std::collections::HashMap;
@@ -514,10 +516,6 @@ fn write_vendor_ledger(cwd: &Path, flavor: Flavor, rel: &str, rec: PatchRecord)
 
 // ── CLI ──────────────────────────────────────────────────────────────────
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
-
 /// The CLI with the ambient `SOCKET_*` environment scrubbed (explicit flags
 /// are the sole source of truth), no token, no socket-cli config, telemetry
 /// off.
diff --git a/crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs b/crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs
index 77b00b329..bf9fa8f1b 100644
--- a/crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs
@@ -9,16 +9,14 @@
 //! with `.expect(1)` so a wrong URL (which would otherwise 404 → look
 //! like an empty result) is caught instead of silently passing.
 
+use crate::common::binary;
+
 use std::collections::HashSet;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID_A: &str = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
 const UUID_B: &str = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
diff --git a/crates/socket-patch-cli/tests/mode_migration_cargo.rs b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
index 287c771cf..f3df21e24 100644
--- a/crates/socket-patch-cli/tests/mode_migration_cargo.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
@@ -38,6 +38,10 @@
 //! the fixture build (a failure instead under
 //! `SOCKET_PATCH_CARGO_E2E_REQUIRED=1`); all assertions after that are hard.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -69,10 +73,6 @@ const GHSA: &str = "GHSA-migr-cargo-test";
 const PATCH_SUFFIX: &str =
     "\n/// Socket-patch capstone marker (added by the patch).\npub fn socket_patched() -> u32 { 1 }\n";
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) {
     run_socket_env(cwd, args, cargo_home, &[])
 }
@@ -129,10 +129,6 @@ fn assert_build_ok(tag: &str, out: &Output) {
     );
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    compute_git_sha256_from_bytes(content)
-}
-
 fn sha256_hex(bytes: &[u8]) -> String {
     hex::encode(Sha256::digest(bytes))
 }
diff --git a/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs b/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
index eed5d5dd8..99d3e2198 100644
--- a/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
+++ b/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
@@ -13,6 +13,8 @@
 //! remove_invariants.rs / remove_duality_invariants.rs /
 //! interactive_prompts_e2e.rs.
 
+use crate::common::binary;
+
 use std::path::{Path, PathBuf};
 
 use crate::common;
@@ -1893,10 +1895,6 @@ mod pty {
     use portable_pty::{native_pty_system, CommandBuilder, PtySize};
     use std::time::Duration;
 
-    fn binary() -> PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
     /// Spawn the binary inside a PTY, send `input`, collect all output
     /// until exit (watchdog-killed after `timeout`).
     fn run_in_pty(args: &[&str], cwd: &Path, input: &str, timeout: Duration) -> (i32, String) {
diff --git a/crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs b/crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs
index af5116321..148054e85 100644
--- a/crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs
+++ b/crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs
@@ -6,17 +6,14 @@
 //! forensic bytes must come back. Gem fixtures modeled on
 //! repair_vendor_e2e's.
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const BEFORE: &[u8] = b"before\n";
 const AFTER: &[u8] = b"after\n";
@@ -29,14 +26,6 @@ const GEM_PURL: &str = "pkg:gem/padlock@1.2.0";
 const GEM_ENCODED: &str = "pkg%3Agem%2Fpadlock%401.2.0";
 const GEMSPEC_STUB: &[u8] = b"Gem::Specification.new do |s|\n  s.name = \"padlock\"\n  s.version = \"1.2.0\"\n  s.summary = \"repair fixture\"\n  s.authors = [\"socket-patch e2e\"]\n  s.require_paths = [\"lib\"]\nend\n";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn gem_copy_rel() -> String {
     format!(".socket/vendor/gem/{GEM_UUID}/{GEM_NAME}-{GEM_VERSION}")
 }
diff --git a/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs b/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
index 131aa524e..4a5551f05 100644
--- a/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
@@ -9,6 +9,8 @@
 //! empty-wiring revert refusal. Their fixture pair is hand-written, modeled
 //! byte-for-byte on real `bundle lock` output (bundler 4.0.15).
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 
 use sha2::{Digest, Sha256};
@@ -18,10 +20,6 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 use crate::npm_e2e_common;
 use crate::vex_e2e_common;
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 const PURL: &str = "pkg:npm/left-pad@1.3.0";
@@ -30,14 +28,6 @@ const BEFORE: &[u8] = b"before\n";
 const AFTER: &[u8] = b"after\n";
 const AFTER_B64: &str = "YWZ0ZXIK";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn sha256_hex(bytes: &[u8]) -> String {
     hex::encode(Sha256::digest(bytes))
 }
diff --git a/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs b/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
index 699b79d78..7149fb5a1 100644
--- a/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
@@ -21,9 +21,10 @@
 //! lockfile, so vendoring proceeds offline from the installed copy + the
 //! view-fetched patch content.
 
+use crate::common::git_sha256;
+
 use std::path::{Path, PathBuf};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -42,14 +43,6 @@ const BEFORE: &[u8] = b"before\n";
 const AFTER: &[u8] = b"after\n";
 const AFTER_B64: &str = "YWZ0ZXIK";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// The three npm flavors this file parameterizes over. Each knows how to lay
 /// down its pre-vendor lockfile and how to prove the vendor lock rewrite
 /// survived a repair. The bun arm is further parameterized over the text
diff --git a/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs b/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
index f0831c770..55760c8b2 100644
--- a/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
+++ b/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
@@ -4,15 +4,11 @@
 //! installed packages. Nothing reaches a real registry; network cases hit an
 //! unroutable localhost port.
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// A `rollback` command with the full `SOCKET_*` environment scrubbed and the
 /// working directory pinned. All tests build their child process through here
 /// so none can be satisfied by ambient environment instead of the code path.
@@ -39,15 +35,6 @@ fn rollback_cmd(cwd: &Path) -> Command {
     cmd
 }
 
-/// Git-SHA256: SHA256("blob <len>\0" ++ content).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 const MANIFEST_JSON: &str = r#"{
   "patches": {
     "pkg:npm/__rollback_test__@1.0.0": {
diff --git a/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
index 9770945e2..62de0897b 100644
--- a/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
+++ b/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
@@ -1,21 +1,18 @@
 //! Scan vendoring previews, lock failures and corrupt legacy manifests.
 
+use crate::common::{binary, git_sha256};
+
 #[path = "../prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::fs::OpenOptions;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
 use fs2::FileExt;
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 const PURL: &str = "pkg:npm/left-pad@1.3.0";
@@ -27,14 +24,6 @@ const AFTER: &[u8] = b"after\n";
 /// base64 of AFTER, inlined as the view response's blobContent.
 const AFTER_B64: &str = "YWZ0ZXIK";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// A vendorable npm project: root package.json, a v3 package-lock with a
 /// registry-resolved left-pad entry, and the installed package.
 fn write_fixture(root: &Path) {
diff --git a/crates/socket-patch-cli/tests/scan/scan_invariants.rs b/crates/socket-patch-cli/tests/scan/scan_invariants.rs
index f2b3b6140..44ae7b34b 100644
--- a/crates/socket-patch-cli/tests/scan/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan/scan_invariants.rs
@@ -7,16 +7,14 @@
 //! depending on the live Socket API. The real-API end-to-end suite
 //! lives in `e2e_scan.rs` (gated behind `#[ignore]`).
 
-use std::path::{Path, PathBuf};
+use crate::common::binary;
+
+use std::path::Path;
 use std::process::Command;
 
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 
 /// Write a minimal npm fixture under `<root>/node_modules/<name>/`.
diff --git a/crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs
index e743addb2..8f7846315 100644
--- a/crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs
@@ -20,16 +20,14 @@
 //!   under `--json` or `--vex`, or an unparseable glob is a usage error
 //!   (exit 2).
 
+use crate::common::binary;
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG: &str = "test-org";
 const ROOT_PURL: &str = "pkg:npm/root-dep@1.0.0";
 const APP_PURL: &str = "pkg:npm/app-dep@1.0.0";
diff --git a/crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs
index b46db1a25..2580f1e3c 100644
--- a/crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs
@@ -4,27 +4,16 @@
 //! full `scan -> get -> apply` pipeline against a mock API + a real
 //! file fixture.
 
-use std::path::{Path, PathBuf};
+use crate::common::{binary, git_sha256};
+
+use std::path::Path;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn write_npm_package(root: &Path, name: &str, version: &str, content: &[u8]) {
     let pkg_dir = root.join("node_modules").join(name);
     std::fs::create_dir_all(&pkg_dir).unwrap();
diff --git a/crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs
index 19031585e..0c604326c 100644
--- a/crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs
@@ -1,16 +1,13 @@
 //! A failed artifact download preserves the vendor envelope and unrelated ledger entries.
 
-use std::path::{Path, PathBuf};
+use crate::common::{binary, git_sha256};
+
+use std::path::Path;
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 /// The patch discovery selects; its view carries hashes but no content.
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
@@ -23,14 +20,6 @@ const UNSELECTED_UUID: &str = "33333333-3333-4333-8333-333333333333";
 const BEFORE: &[u8] = b"before\n";
 const AFTER: &[u8] = b"after\n";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// A vendorable npm project: root package.json, a v3 package-lock with a
 /// registry-resolved left-pad entry, and the installed package.
 fn write_fixture(root: &Path) {
diff --git a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
index 20fb20548..7cb93fa31 100644
--- a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
+++ b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
@@ -8,6 +8,10 @@
 //! update re-wires and reverts to pristine, a re-run needs no jar source,
 //! and a tampered ledger or an escaping symlink is refused.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -29,10 +33,6 @@ enum Shape {
     Gradle,
 }
 
-fn git_sha256(bytes: &[u8]) -> String {
-    socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes(bytes)
-}
-
 fn purl(name: &str) -> String {
     format!("pkg:maven/org.example/{name}@1.0")
 }