Harden vendored-mode trust in patch-service artifacts

[Mikola Lysenko (mikolalysenko)]

Summary

These are pre-existing gaps in how vendored mode trusts and records artifacts from the patch service (patch.socket.dev). They were found while root-causing #248's CI flake, and each was reproduced with a failing test before it was fixed. The companion PR for outage idempotence (vendored re-runs that churn locks after a 503) is separate.

1. Stale ledger fingerprint after a rebuild (gem / maven / nuget).
   • When a wired artifact was missing and got rebuilt, the vendor ledger kept the old fingerprint: the gem file inventory, the maven/nuget artifact.sha256, and the nuget lock record. As a result:
     • vex/verify reported tamper;
     • repair could fail;
     • vendor --revert left packages.lock.json pinned to the patched contentHash;
     • the run was labelled already_vendored.
   • The rebuild branches now return a refreshed entry built from the new bytes, and the persist step carries the wiring forward. It saves the entry only over a predecessor with the same uuid.
2. Service archives accepted without checking the patch (maven / nuget / pypi / npm). Served bytes that passed the SRI were trusted even if they didn't contain the patched files. Every patched member is now checked against the record's afterHashes before anything is written:
   • auto falls back and warns vendor_prebuilt_layout_mismatch;
   • service refuses.
3. An integrity mismatch fell back under auto. This affected golang, composer, pypi, npm and gem (the .gem and the stub gemspec). It broke the documented rule that tampered bytes are always a hard failure. They now fail closed with vendor_prebuilt_integrity_mismatch, as cargo already did.
4. --vendor-source service failed open. With no API client it quietly built locally. It now refuses with vendor_prebuilt_required. The cargo wired-copy rebuild also follows --vendor-source now: offline or no client refuses, and online uses the prebuilt crate.

CLI_CONTRACT.md and CHANGELOG.md ([Unreleased], Fixed) are updated.

Test plan

• A regression test per issue and per backend. Each one fails when its fix is temporarily reverted:
  • rebuild refreshes the ledger, then --revert restores the lock (nuget), and the artifact is Healthy afterwards;
  • served archive missing the patched files → refused under service, falls back under auto;
  • IntegrityMismatch under auto hard-fails, per backend;
  • service with no client, and service with --offline, both refuse;
  • a rebuild over a ledger entry with another uuid leaves the ledger untouched.
• Existing tests that pinned the old behaviour are updated. Service fixtures now serve real archives.
• cargo test -p socket-patch-cli -p socket-patch-core --no-fail-fast: 7760 passed, 0 failed.
• cargo clippy -p socket-patch-cli -p socket-patch-core --all-targets -- -D warnings: clean.

Not in this PR

• When a maven/nuget rebuild recreates a whole uuid directory, it doesn't rewrite the uuid marker file. This predates these changes.
• cargo/composer/golang rebuilds still return no ledger entry. That's harmless, because those entries record no fingerprint.
• npm_common.rs also changes in the outage-idempotence PR. The hunk here is small and separate, so expect at most a trivial merge.

🤖 Generated with Claude Code

---

Note

High Risk
Changes fail-closed behavior for tampered or unpatched service artifacts and mutates vendor ledger persistence on rebuilds across many ecosystems, affecting verify, repair, and revert flows.

Overview
Hardens vendored-mode trust in patch-service artifacts and fixes ledger drift when missing committed copies are rebuilt.

Artifact rebuilds now refresh ledger fingerprints (gem inventory, maven/nuget sha256, nuget lock pin) while preserving wiring via carry_forward_wiring; the CLI only persists a rebuilt entry when a same-uuid predecessor exists, so revert cannot be left with an orphan artifact.

Prebuilt downloads must carry patched files: members are checked against afterHash before use (vendor_prebuilt_layout_mismatch under auto, refuse under service). Integrity mismatches no longer fall back to local builds under auto for npm, pypi, composer, gem, and golang (vendor_prebuilt_integrity_mismatch). --vendor-source=service without an API client now refuses instead of building locally; cargo wired-copy rebuilds follow the same service/offline rules as a fresh vendor.

CHANGELOG and CLI_CONTRACT.md document the new refusal codes and fallback table; repair/vendor paths and broad regression tests cover revert, uuid-mismatch, and service fixtures with real archives.

^{Reviewed by Cursor Bugbot for commit 032ab2b. Configure here.}