socket-patch implementation review (living document, file by file): abstraction, duplication, mechanisms, tests

[Mikola Lysenko (mikolalysenko)]

Note

[agent] This is the second architecture thread for socket-patch, and it is a living document. It replaces #560, which reviewed the code module by module and is now closed. Its open items are carried over in the register below and summarized in Part 6. Scheduled routines keep this post and its Parts true of main, and every run posts a log entry as a comment at the end of the thread.

Progress: 202 problems tracked · 8 partly fixed · 27 already fixed · 15 in PR · 46 filed · 3 decision pending · 35 carried · 66 to verify · 2 rejected. On GitHub: 89 open and 114 closed arch-audit issues · 15 open and 79 merged arch-refactor PRs.

Coverage: 141/868 files audited (160,540 of 908,273 lines) · 48/868 swept.

• Register: the first comment below tracks every problem with its issue and status.
• Parts: 2 mechanisms · 3 duplication · 4 structure · 5 tests · 6 history.
• Log: after Part 6, each routine run adds one comment saying which files it read, what it found and which PRs it opened.
• Work items: issues labelled arch-audit · refactor PRs labelled arch-refactor · decisions needed
• Steering: reply here or on an issue. Maintainer replies are read on the next run and can reject findings, reorder work or settle decisions.

Rendered 2026-11-01 11:26 UTC (ledger bb72ce2a) from doc/ on the arch-audit/ledger branch.

socket-patch implementation review: file by file

Started 2026-10-29 against main @ b291caa.

Charter

The first thread asked what to cut and combine at the level of products and modules: modes × ecosystems × lockfile formats. This thread looks at the implementation: is each file's code as small, direct and honest as it can be? Nothing in the codebase is precious. The routines look for:

1. Needless abstraction and tiny functions. Single-caller functions are inlined unless their name earns its keep. One-line wrappers, one-impl traits, one-variant enums, forwarding layers and invariant-free newtypes are deleted.
2. Duplicated business logic. One rule should have one implementation (Part 3).
3. Unclear control flow. Mode flags, deep nesting, accumulate-then-decide result structs, swallowed-then-reraised errors.
4. Placement. Every function and type should live where a reader would look for it, and no two modules should cover the same concept (Part 4).
5. Common mechanisms. One way to handle errors, format output, read env and config, join paths, write files, call HTTP and spawn processes (Part 2).
6. Comments. History narration, restated code, stale text and bare issue numbers are deleted; why comments stay.
7. Tests. Tests that assert on their own mocks, recompute the expected value with the code under test, can't fail, or claim more than they check get fixed or deleted (Part 5).

How it works

• coverage/files.tsv on the ledger branch lists every .rs file under crates/: 868 files, ~908K lines at the start.

• Two auditors each read about 15K lines per run, in file order, and never change code:

  • audit-core covers crates/socket-patch-core/src;
  • audit-cli-tests covers the CLI crate and every test file.

  For each file they record its local cleanups (what to inline, delete or fix) in the manifest. Problems that span files go into the register and become arch-audit issues.

• The refactor routine alternates between two kinds of work:

  • sweeps: one PR per file or directory, applying the local cleanups, mostly deletions, with behavior unchanged;
  • structural PRs: the highest-leverage register item.

• When every file has been read once, the next pass starts with the files that changed most since they were last read.

Top problems

Filled in as the audit progresses. Each bullet carries its register token.

• Duplicated rules have already drifted into bugs.
  • The cargo build-cache cleaner and cargo disagree on which .cargo/config file wins A01 · in PR Read the cargo config chain once (#1832) #1849.
  • The cargo workspace glob has no character classes A02 · in PR Fix Cargo member globs with [..] classes (#1833) #1866.
  • Both bugs were shown by running the code.
  • The API client retries under two policies that disagree: a Retry-After: 60 ends a JSON call but is retried after 4 s by the vendor path A27 · in PR One serve GET and one vendor retry loop in api/client.rs (#1869) #1870.
  • Under the default --cwd . the npm crawler never reads a parent .yarnrc modules folder: the crawlers get cwd unabsolutized and walk lexical ancestors of . (executed) A45 · in PR Fix crawlers missing parent dirs under --cwd . (#1902) #1906.
• utils/ is a mix of ecosystem-specific code and true utilities. Some of it imports vendor::* A08 · to verify.
• Shared helpers exist but are bypassed or dead. A purl split is written ~12× A14 · filed Tracking: build and classify purls through one validated utils::purl API #748; copies listed in a comment, uuid shape 4× A15 · filed Validate patch UUIDs through one utils::uuid grammar instead of five #705; Check uuid shape through one helper; python_script's Uuid::parse_str also accepts braced, urn and unhyphenated forms #1845 closed as its duplicate, and the shared poetry-writer and credential-strip helpers have no caller while copies serve production A18 A20: 2 in PR.
• CLI commands carry second copies of shared engines. get <uuid> re-implements the agent download engine T01 · filed Route get <uuid> agent mode through download_and_apply_patches_into instead of a second copy of the engine #1835, five callers glue the Bun and vlt preflights by hand T05 · filed Run the Bun and vlt vendored preflights as one vendor_preflight with one per-purl refusal map #1839, remove and rollback render vendored reverts in two drifted loops T16 · filed remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert) #1861, and scan --prune reverts vendored entries by hand, dropping each failure's error T37 · filed scan --prune's vendored GC reverts entries by hand instead of through VendoredBackend::revert, and drops each revert's error and still-wired orphans #1910. The copies have drifted in user-visible text and JSON T02 T04: 2 filed.
• Disk and in-memory hosted scan are two hand-kept copies. The disk path repeats core's pipeline step for step T24 · to verify, and the two emit different redirect JSON blocks while core's doc claims one shape T29 · decision Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block) #1881. --vex embedding is written ~8× and only scan reports a skipped dry run T25 · filed Embed --vex through one helper: the step is hand-written 8 times, and only scan reports vex_skipped_dry_run under --json #1877.

The numbers

	Value
Rust files / lines (all crates, incl. tests)	868 / 908,212 at b291caa
Largest file	patch/redirect/mod.rs, 30,223 lines
Files over 5,000 lines	to measure
Single-caller private functions	to measure (per file in the manifest notes)
Deletable comment lines	to measure
Fake tests found / fixed	to measure

[Mikola Lysenko (mikolalysenko)]

Defect register

[agent] This comment is the living register for this thread. It is regenerated from the register/ files on the arch-audit/ledger branch on every push, so any edit made directly to it is overwritten. Its Status column drives every status shown in the Parts.

Progress: 213 problems tracked · 8 partly fixed · 27 already fixed · 15 in PR · 55 filed · 4 decision pending · 30 carried · 72 to verify · 2 rejected. On GitHub: 94 open and 114 closed arch-audit issues · 15 open and 79 merged arch-refactor PRs.

Coverage: 162/868 files audited (177,754 of 908,273 lines) · 48/868 swept.

• Status:

  • The normal path is to verify → filed #n → in PR #n → fixed (#n).
  • Rows carried over from socket-patch architecture (living document): review, defect register and refactoring log #560 start as carried while one of their issues is still open.
  • Other statuses: partly fixed (#n), already fixed (#n), decision #n, handed off and rejected.

• P: 1 = fix now; 2 = high-leverage simplification; 3 = later.

• IDs: A = core audit, T = CLI and tests audit, R = found by the refactor routine, E/C = carried over from socket-patch architecture (living document): review, defect register and refactoring log #560.

• Routines:

  • audit-core and audit-cli-tests read the code file by file, every 6 hours, staggered.
  • refactor runs every 2 hours and opens sweep or structural PRs.

  Their procedures are AUDIT.md and REFACTOR.md on the ledger branch.

Core audit (A rows)

Last updated 2026-11-01T12:54Z · main @ cbbbdb9 · main @ cbbbdb9 · owner: audit-core

ID	P	Problem	Issues	Status
A01	1	Cargo config chain walked 3× (source_replacement::config_layer_paths, cargo_build_cache prefers config.toml: wrong target dir, executed; vendor/cargo_config L160-200 drifts on symlinks and a config dir) plus 4 legacy-file picks.	#1832	in PR #1849
A02	1	cargo_workspace::wildcard_match has no [...] classes (executed); one of three segment glob matchers.	#1833	in PR #1866
A03	2	GOMODCACHE/GOPATH default ×2 (go_crawler, go_installed_tools), drifted on empty GOPATH and home fallback.	#1834	in PR #1876
A04	2	Callers re-derive utils::line_endings (vendor/common, python_lock, lock_fragments) plus 3 eol_eq copies.	#814, #815	filed #814; new sites added to the tracker's scope
A05	2	lock_fragments pairs fragments in three drifted loops; pdm/poetry each repeat the rewrite triad.	#1844	in PR #1898
A06	2	Lowercase-hex/sha256 validators re-written ~10×; vendor/jvm sha1_hex/sha256_hex are computations under validator names; poetry/pdm twin hex+wheel validators.		to verify
A07	2	GroupCommit::commit_unjournaled never drains the after_commit queues commit_changes drains. Reachability unproven.		to verify
A08	2	Ecosystem code sits in utils/ (hatch*, pdm_lock, poetry_lock, lock_fragments, go_, cargo_), and utils imports vendor/crawlers/patch::redirect (hatch, group_commit::is_captured, pnpm_workspace, purl_key); python_lock and poetry's refusal policy also belong outside. Overlaps #833.	#833	to verify
A09	3	Env parsing has three vocabularies: env_compat (exact 1/true), socket_cli_config::env_truthy (yes/on/y/t, case-insensitive; shared with the CLI update notifier) and concurrent (trim plus debug log); .ok().filter(!empty) recurs in ivy_cache/coursier_cache; python_crawler has 7 more truthy parsers, and PYENV_ROOT= counts as set (executed). Related to #793. walk_pool drops a bad SOCKET_WALK_THREADS silently, RAYON_NUM_THREADS untrimmed; utils::concurrent imports crawlers::walk_pool::fd_limit_is_tight.		to verify
A10	2	The user's home is resolved by many rules: fs::home_dir, hatch_env.rs:491, repo_root::home, process::neutral_probe_dir_with, socket_cli_config::config_json_paths, python env_home/pipenv_home_dir, NuGet ×2 (raw HOME vs fs::home_dir). fs.rs is a grab-bag.		to verify
A11	3	The tool --version probe is written twice: utils/pipenv.rs runs it in temp_dir with PIPENV_DONT_LOAD_ENV, while vendor/pypi_hatch.rs:202 runs it in the project root. Suspected hardening drift.		to verify
A12	3	Prune-empty-dirs ×3 (inclusive/exclusive/sync), "remove, NotFound ok, sync parent" ×3, group_commit::sync_dir duplicates fs.rs.		to verify
A13	3	The yarn major is parsed from packageManager twice: update/channel.rs:361 (no trim) and vendor/mod.rs:274 (after package_manager::pinned_version).		to verify
A14	2	pkg:<type>/<name>@<version> is split by hand ~12×; purl.rs alone has three splitters that disagree on empty parts; lock_inventory/recover never strips qualifiers. Parsing half of #748. Composer purl ×4 (formats/composer ascii, purl::composer_purl unicode, crawler, recover.rs no lowercase).	#748	filed #748; copies listed in a comment
A15	3	Uuid shape is checked 4 ways (target::is_uuid_shaped, redact's private twin, path_safety::is_canonical_uuid, Uuid::parse_str in python_script L99, which also accepts braced/urn/simple forms).	#705, #1845	filed #705; #1845 closed as its duplicate
A16	3	Committed JSON ledgers written 3 ways (socket_dir::write_json_ledger, write_manifest no newline, two state markers). Changes manifest bytes.		to verify
A17	3	pnpm packages: membership refuses {}[] globs the shared matcher reads; hosted keeps a second reader.	#1846	in PR #1863
A18	3	"poetry.lock written before 1.4" ×2 while poetry_lock::lock_writer_version is dead.	#1847	in PR #1865
A19	3	Lexical .. folding ×4 beside utils::relpath (maven_scope, cargo_crawler, hatch_env, python_script), using PathBuf::pop. Unexecuted.		to verify
A20	3	URL credential stripping ×2: redact::strip_url_credentials is dead while VEX @id and upstream npm use vex::product::strip_url_userinfo; the copies differ on query and authority end.	#1848	in PR #1923
A21	3	The walk to the enclosing .git is hand-written outside repo_root (core patch/user_patches.rs L49/L65, governing_root.rs L528, hatch_workspace.rs L101): no GIT_CEILING_DIRECTORIES, any .git file type. Unexecuted.		to verify
A22	3	uv settings-file choice and no-binary precedence ×2 (python_script, redirect/upstream/uv.rs); drifted on refusal labels.		to verify
A23	3	Hosted redirect/requirements.rs keeps its own logical-line lexer beside utils::requirements.		to verify
A24	3	"Is this our earlier hosted pin" ×2 (python_lock::is_prior_hosted_url, python_script::same_hosted_artifact).		to verify
A25	3	PEP 508 leading-name scanner ×3 (vendor/common.rs L602, requirements.rs L438, inline python_lock.rs L665, which skips trim_start); canonicalize_pypi_name still in crawlers::python_crawler (#883 closed).		to verify
A26	3	Civil-date math lives in three modules: days_from_civil twice (api/date.rs L48, formats/cargo/floor.rs L26) and its inverse in vex/time.rs, whose doc claims to be the only copy. Target: one utils::time.	#1867	filed #1867
A27	2	api/client.rs: two near-copy serve GETs, 4 hand retry loops, two retry policies that disagree (executed).	#1869	in PR #1870
A28	3	api/ is not a leaf: vendor_prefetch belongs in vendor/; client.rs carries the pypi wheel gate; api::types imports patch::redirect. Overlaps #833.	#833	to verify
A29	3	Four xorshift64* test RNGs; eight crawlers/**/oracle.rs (2,978 lines) keep pre-migration crawlers as oracles.	#1868	in PR #1882; oracle deletion still to decide (npm oracle: retire, 2026-11-01 entry)
A30	2	Maven ${…} interpolation ×5 (maven_crawler, formats::maven, maven_scope, maven_reactor ×2); drifted on recursion, undefined names, and only formats::maven caps output length.	#1887	filed #1887
A31	2	A POM's own coordinates read 3 ways (maven_crawler line scanner, formats::maven::model_refs, maven_reactor::pom_model), drifted.	#715	filed #715
A32	3	Env-keyed subprocess memo ×3 (composer EnvKeyedMemo, python KeyedMemo, ruby GemEnvMemo) with byte-identical keys; python caches answers computed under a changed env.	#1888	in PR #1895
A33	3	"Is this a Coursier root" ×2 (maven_crawler::coursier_spelled vs JvmCacheLayout::classify). Unexecuted.		to verify
A34	3	Go coordinate gate ×4 (go_crawler, golang_local, purl::golang_purl, vendor/path.rs; identical today) and Go module-cache layout (encode_module_path, cache/download paths, get_gomodcache) in the crawler but used by vendor and redirect. Extends E37, A03.	#748	to verify
A35	3	JVM cache plumbing is split: JvmEnv/M2Gate live in maven_crawler; gradle roots ×2, hash-dir listing ×3 (drifted on symlinks), wrapper init.d ×2 (gradle::home ignores distributionBase=PROJECT), -D option parsing ×2 (coursier mangles quoted spaces), sorted-children ×4. Maven2 root climb ×2 (sbt_evidence::cache_root_of, coursier_cache::pom_root).		to verify
A36	3	platformdirs-style user cache/data/config dirs ×8 (coursier, deno, poetry cache; hatch, pdm/poetry data/config; uv, pipx, pipenv WORKON_HOME), absolute-XDG filter ×6; drifted on Windows fallback and macOS XDG_*. Extends A10.		to verify
A37	3	EnvGuard test helper ×11 plus with_env/with_home_env.	#1889	in PR #1891
A38	3	All 8 crawlers are stateless unit structs with new() + Default; free functions would do.		to verify
A39	3	Hatch legacy <name>-<id> env layout is checked only for the first project id, and macOS lists the casefolded id first, so Hatch 1.0–1.2 envs under raw ids are missed (hatch_env.rs L128-L178). Unexecuted.		to verify
A40	3	The effective-POM walk ×2 (maven_scope::Walk, maven_reactor); drifted: scope matches a local parent on artifactId only and has no BOM-import seen-set. maven_scope imports vendor::jvm. Extends E83, A30.		to verify
A41	2	npm_crawler classifies node_modules store children 3× (resolver, scan, peer finder); only the scan skips nested stores, the peer finder omits two stores. Also 4 store-entry shapes, ~7 child filters, 5 @scope expansions.	#1899	filed #1899
A42	3	Yarn-classic .yarnrc tokenized ×2 (npm_crawler, redirect/yarnrc), drifted on quotes.	#1901	in PR #1915
A43	3	package.json workspaces is read 5× (governing_root::workspace_patterns, npm_crawler Bun walk, update::channel, vendor/mod.rs, user_patches); they disagree on non-string items, null and ! patterns.	#1900	filed #1900
A44	3	.modules.yaml is parsed twice (npm_crawler::parse_modules_yaml_virtual_store_dir, formats/pnpm/version.rs::modules_yaml_package_manager), and the unquote at npm_crawler L1438 is a copy of pnpm_layout::unquote_yaml_scalar. Target: formats/pnpm. Plus 3 "last top-level YAML key, unquoted" readers (yaml_top_level_value, governing_root::unquote_scalar, pnpm_layout) drifted on quotes/empty.	#1918	filed #1918
A45	1	Default --cwd . hides a parent .yarnrc/yarn store from the npm crawler (executed): crawler_options() never absolutizes cwd.	#1902	in PR #1906
A46	3	NuGet project-tree walk ×2 (nuget_crawler::restore_walk, vendor::nuget_config::project_files/governed_locks_in) and project-file test ×2 (case-sensitive crawler copy vs formats::nuget::lock::is_project_file); drifted on case and non-UTF-8 names.	#1917	filed #1917
A47	2	"Declares [tool.poetry]" ×3 (declares_tool_poetry TOML parse, claimed_by_non_uv_manager substring, toml_edit_ext::has_table). Executed: a lockless uv project with [tool.poetry-dynamic-versioning] loses its UV_PROJECT_ENVIRONMENT site-packages.	#1916	filed #1916
A48	2	Crawler unit tests read the real env: 12 pkg_managers/pnpm_layout PnP tests fail under YARN_NODE_LINKER or a ~/.yarnrc.yml linker (executed); 5 python crawl_all tests read VIRTUAL_ENV (unexecuted).	#1919	filed #1919
A49	3	Python env-dir naming ×3 (Poetry, Pipenv, Hatch path_id), not drifted. Windows verbatim-prefix strip ×6, drifted: npmrc::strip_verbatim has no UNC case, pnpm_workspace::without_verbatim_prefix strips only before a drive letter (others: python_crawler, hatch_env, sbt_evidence, pnpm_lock_legacy).		to verify
A50	3	Python site rules drifted inside python_crawler: user site ×2 (base_site_dirs honours PYTHONUSERBASE/PYTHONNOUSERSITE; the global scan hardcodes ~/.local); site-packages-under-prefix ×3 (lib only vs lib+lib64); PDM config/.pdm-python read twice (project take(1) vs global all layers, relative path, ~).		to verify
A51	3	FIFO test scaffolding ~25 mkfifo copies (nuget/cargo make_fifo+within_deadline byte-identical) beside oracle_support::fifo; reader-release helper ×3. Target: one test-support module with A37's guard and test_rng.		to verify
A52	3	crawlers/pkg_managers crawls nothing: YarnEnv/rc resolution and yarn_pnpm_store_folder_in belong in formats::yarn, YarnPnpLoader (CLI vex only) in vex; the root-linker read is copied in lock_inventory/view.rs L858. npm-family ownership order ×3 extends E75. Extends A08.		to verify
A53	2	Bundler path tier rule ×2 in ruby_crawler (bundler_sets_explicit_path vs bundler_path_tier/config_path_tier) + 3 partial copies; discovery ignores a falsy disable_shared_gems (executed).	#1931	filed #1931
A54	2	gemspec_directives/dev_dependency_requirements bypass manifest::for_each_code_line, so =begin blocks and heredocs are read as code (executed on copies).	#1932	filed #1932
A55	2	"Is crates.io" ×4 (substring, exact, normalized, [patch] key); CargoLock::entries accepts index.crates.io.evil.example (executed).	#1933	filed #1933
A56	2	Hosted composer splices server url/sha1 via expanding Regex::replace, unvalidated and unescaped: lock stops parsing (executed). Extends A06.	#1934	filed #1934
A57	3	~1.26K lines of Bundler settings in ruby_crawler, imported by formats/gem; .bundle/config key reader ×2 drifted; manifest-name list ×2. Extends E20.	#1935	filed #1935
A58	3	Gemfile.lock read beside its model: BUNDLED WITH ×2 (gemspec L64, hosted L389; exact header), CHECKSUMS ×5 (upstream accepts any sha256=), upstream gem section model takes the FIRST DEPENDENCIES, the model the LAST. Extends E19.		to verify
A59	3	Ruby string literal ×4 (gemspec::literal, manifest::plain_literal, vex/product, vendor/gem) + 6 quote loops, drifted on %q, escapes, #{. Target formats/gem/ruby.rs.		to verify
A60	3	sbt evidence path table ×2 (sbt_evidence PATTERNS, formats::sbt::evidence::classify_path); vex evidence_blocker re-implements sbt::gate::check_new and loses read_error; scala_evidence drops its reason too.		to verify
A61	3	Streaming file sha256 ×2 (sbt_evidence refuses symlinks, 256 MiB; vendor/verify::file_sha256_hex follows, 512 MiB). Target utils::digest.		to verify
A62	3	JSON text scanners ×4 (composer hosted ignores \", composer source, vlt, bun); bun.lock line split ×3 outside BunTextLock. Target formats/json.rs, formats::bun.		to verify
A63	3	gem env probe runs in the project cwd under --global (npm/composer use GlobalProbeRunner) and bypasses CommandRunner. Unexecuted.		to verify

Handed off

None.

Rejected

None.

CLI and tests audit (T rows)

Last updated 2026-11-01T09:51Z · main @ cbbbdb9 · owner: audit-cli-tests

ID	P	Problem	Issues	Status
T01	2	get <uuid> agent mode re-implements download_and_apply_patches_into (save_patch_record + save_and_apply_patch, ~240 lines). Drifted on the no-files and blob-failure messages, unchanged-record re-apply and persist_blobs.	#1835	filed #1835
T02	2	The vulnerability JSON object is hand-built 3× (patch_event_metadata, list.rs, get options[]). get's copy is unsorted (HashMap order) and drops description; list drops top-level severity.	#1836	filed #1836
T03	2	GLOBAL_ARG_ENV_VARS/LOCAL_ARG_ENV_VARS are hand copies of clap env bindings and miss SOCKET_NO_SOCKET_YML, so the hermetic test scrub lets it through. The "invariant tests" iterate their own hand lists.	#1837	filed #1837
T04	3	fetch_stage copies core blob_fetcher fetch-summary formatters; the copy is unsorted, shows raw errors and always appends ....	#1838	filed #1838
T05	2	Bun and vlt vendored preflights run back to back at every caller (agent_download, get, scan vendor_flow ×2, vendor), each with its own per-purl glue; the callers disagree on the root (project_root vs cwd).	#1839	filed #1839
T06	2	CLI apply::representative_file + variant_matches_installed (apply.rs L761-L788) copy core patch::apply::variant_installed_at (private); recombined with verify_file_patch at apply.rs L2579, L3214 and vendor.rs L2837, L3347.		to verify
T07	3	The VexSummary { format: "openvex-0.2.0", .. } literal is hand-built 7× (apply ×2, vendor ×3, scan, scan/hosted); expect("vex_result is Some…") 3× in apply. Folded into T25.	#1877	filed #1877
T08	3	Gem build-sibling rule twice: apply::has_build_sibling (L98) counts any other copy in the gem home, rollback.rs L2932-L2941 only a variant-matched one and checks pkg:gem/ by string (drift). Verbose verification printer twice (apply.rs L2092, rollback.rs L2419): same output (core never sends an empty hash), labels from a match vs .replace('_',' '). Folds into C24/#771.	#771	to verify
T09	3	Lock acquire open-coded 9× beside acquire_or_emit (5 callers, all passing the same GlobalArgs fields); Duration::from_secs(lock_timeout.unwrap_or(0)) 14×; lock_held rendered 3 ways for humans; scan/hosted prints the human error under --json; report_lock_failure lives in agent_download.	#1858	filed #1858
T10	3	The severity ladder is single (core ranking::severity_order), but the "worst label" picker is written 3× (scan/mod.rs L3150, scan/render.rs L396, agent_download::max_vuln_severity) and drifted on unknown labels (scan returns them, agent_download None); ui/mod.rs L238 and core client.rs L3175 cite a moved get.rs severity_rank. Copies on 5ca5623: scan/mod.rs L3150, render.rs L396 (raw API label), agent_download L95, core client.rs L2591.		to verify
T11	3	DownloadParams copies 10 GlobalArgs fields (filled field by field in get and scan) and nested_apply_args_from_params rebuilds a GlobalArgs from them: a translation layer. Overlaps C10/#793.	#793	to verify
T12	3	composer_hints::vendored_composer_packages parses composer.lock in the CLI and re-derives vendored-path detection by prefix instead of core vendor::path::parse_vendor_reference (drifted: no ../ workspace refs, no uuid check).		to verify
T13	3	Overlay staging twice: fetch_stage::overlay_dir stages in system tmp (so hardlinks fail across filesystems and the blob cache is copied), rollback.rs L3016 stages in .socket.		to verify
T14	3	Mode resolution (explicit / state-inferred / foreign-manifest / global conflict) is written in get (L1077-L1126) and scan (mod.rs L270-L308, L1737-L1772) with the checks in a different order.		to verify
T15	2	Per-purl top-ranked selection 5× (get select_patches, scan/policy.rs L556 and L828, core rollout/stage.rs L77, core hosted/memory select_with_policy L1401, whose doc calls itself the disk select minus the recorded view); the socket.yml floor 3×; the tier filter 4×; scan counts paid tiers two ways (mod.rs L2661 vs L3133).		to verify
T16	2	remove and rollback each render VendorRevertStep in their own loop (vendor.rs classifies it twice more); drifted on --preserve-state --dry-run (remove previews a full revert), go-undo warnings, drift-keep text and stop-at-first-failure.	#1861	filed #1861
T17	2	The "no manifest" gate is written 3× (remove.rs L367-L416, repair.rs L61-L156, rollback.rs L1437-L1547) and drifted: unledgered .socket/vendor wiring, a legacy redirect-state.json, contested hosted wiring and the global-scope check each give different outcomes; the manifest_not_found envelope differs in message and path. Overlaps C74/#1352.		to verify
T18	3	scan/discovery.rs keeps a private shell_word beside ui::shell_word; it quotes POSIX-style on Windows and leaves % bare.	#1859	in PR #1884
T19	3	GC reporting still differs past C79's JSON fix: repair records cleanup_failed as a Skipped event (others: run warning), its labels say "diff"/"package" (others plural), and the human text has 4 renderers (remove format_blob_sweep says "would be freed", core says "freed" on a dry run, rollback its own line).		to verify
T20	3	The "JSON envelope or stderr" error emit is hand-written ~6× (remove.rs L122, rollback.rs L947, repair.rs L78/L143/L257, list.rs L219, scan/mod.rs L1530); rollback also open-codes 4 more branches beside its own helper. Wants json_envelope::emit_error.	#1924	filed #1924
T21	3	The warning sink (--json → warnings[], else stderr) is hand-rolled per command (list.rs ×3, user_patches.rs L122, scan/withdrawn.rs L126); withdrawn prints under --silent, the others don't; 40 RunWarning { literals vs 17 RunWarning::new.		to verify
T22	3	rollback's before-blob gate (get_missing_before_blobs L677-L687, recheck L3184-L3189) uses metadata().is_err(), which follows symlinks and accepts directories, while core verify_file_rollback requires symlink_metadata().is_file(): a planted link/dir counts as present, the self-heal download is skipped and the run fails missing_blob. Fails closed. Unexecuted.		to verify
T23	3	The terminal-safe text filter is written 3× (list.rs sanitize, ui/status.rs println, core policy::strip_unsafe); only core drops bidi overrides and zero-width characters, so list prints them from API text.	#1860	filed #1860
T24	2	Disk hosted scan (scan/hosted.rs run_redirect_selected_untracked, 1,233 lines, L949-L1306) hand-copies core's in-memory pipeline (memory/stages.rs L172-L397), step for step; drifted: governing_root::refusal disk-only, warning order. Child of C12.	#894	to verify
T25	2	The --vex embed step is hand-written ~8× (scan ×4, apply ×2, vendor ×3); only scan reports vex_skipped_dry_run under --json, and fold order differs. Absorbs T07.	#1877	filed #1877
T26	2	Pipenv stale-install remedy written twice (hosted scan/hosted/python.rs L134-L205, core vendor/pypi.rs L786-L860); drifted on per-site vs aggregated warnings, suffix wording (<purl> placeholder) and name parsing.	#1878	in PR #1883
T27	3	Hosted stale-install and takeover warnings are built as serde_json::Value (hosted, python, nuget, takeover, vlt_heal) and parsed back by run_warning_of with unwrap_or_default. Part of T21.	#1879	filed #1879
T28	3	The vulnerability label rule (CVEs else advisory id) is written 4× (render.rs L385, get.rs L222 and L372, list.rs L284); drifted on order, dedup and severity case.	#1880	filed #1880
T29	2	The hosted redirect JSON block has two shapes (disk {mode, rewrittenFiles} vs core redirect_json_block's 7 keys), while core's doc claims one. Decision.	#1881	decision #1881
T30	3	Snapshot/put-back of files the group commit doesn't capture is written twice (scan/hosted.rs commit_hosted_writes L2093-L2190, vendor.rs L1701-L1758); hosted drops put-back errors (let _ = L2183) yet says "nothing was changed".		to verify
T31	3	The project-root marker predicate is written twice (scan/policy.rs lock_markers L105-L121, core hosted/memory/roots.rs root_markers L41-L58); disk adds a manifest fallback the memory engine lacks (its doc admits the verdicts differ). Unexecuted.		to verify
T32	3	The agent dry-run preview event is built 3× (scan/mod.rs L2896-L2917, get.rs L1868-L1894, agent_download.rs L1089) and the already-recorded check re-derived a 4th time (scan/mod.rs L3322) beside decide_patch_action.		to verify
T33	3	Suspected: the hosted takeover plans one ledger entry (lookup_entry, takeover.rs L119) but finish removes every PurlKey::same entry (L410-L414), so a second variant of the release would leave the ledger unreverted. Unexecuted.		to verify
T34	3	Warning text is sentence-cased and wrapped only in scan/hosted.rs (format_warning/wrap_words, L2213-L2307); ~84 other Warning: {detail} prints do neither, and policy vs rollout warnings use two prefixes. Belongs in ui::text. Part of T21.		to verify
T35	2	scan's vendored planning (preflight_refused_purls) and preview (preview_vendor) each run the whole refusal preflight set; planning skips pypi_refusals, so a refused PyPI patch takes a --max-new-patches slot; a dry run runs every preflight twice. Overlaps T05.	#1908	filed #1908
T36	2	vendor.rs plan_service_downloads (L2786-L2930) re-walks the vendor loop's candidate selection (L3303-L3420); the plan skips the vlt refusal and vendor_variant_ambiguous. Related to T06.	#1909	filed #1909
T37	2	run_vendor_gc (scan --prune) reverts via dispatch_revert_one by hand instead of VendoredBackend::revert: drops outcome.error (gc.rs claims it was printed), saves the ledger once, reports reference keeps as drift, ignores still_wired, no go_undo_warnings. Child of T16.	#1910	filed #1910
T38	3	The user-patches gate loop is written 5× (partition, evidence, skip_protected, scan/mod.rs L2244, vendor.rs L2434); scan skips the ecosystem filter and uuid, vendor dedups unsorted and prints per conflict; eject checks it 3×.	#1911	filed #1911
T39	3	PackageVendorResult.status is an untyped string read 4× (core client.rs L1340, vendor_prefetch L439, scan/withdrawn.rs L57-L91, scan/hosted.rs L2343); the two reuse caches disagree on "settled" (build_failed).	#1912	filed #1912
T40	3	The Go consumer-sync audit is invoked and rendered at 8 sites (vendor.rs L1302, L4209; apply.rs L374, L2831; rollback.rs L3387; scan/hosted.rs L1878; vendored_backend L233; vex.rs L956); forward vendor sends it to warnings[], vendor --revert to Skipped events; a reverted Go entry with no Go records left is not audited (unexecuted).		to verify
T41	3	The "lockfile wiring with no ledger entry" remedy is written 5× (repair.rs L210-L218, vendor.rs L1403, L3137, rollback.rs L937, L1526) under two codes (vendor_ledger_missing vs vendor_ledger_entry_missing); only one names the uuid, only rollback the merge case. Check whether the two codes are deliberate. Near T17.		to verify
T42	3	The "(eco, uuid) owned by no ledger entry" predicate is written 4× (vendor_orphans.rs L54-L62, vendored_backend/repair.rs L192-L206 and L698-L704, rollback.rs L919-L930); rollback treats a uuid under any ecosystem as owned. Unexecuted.		to verify
T43	3	ui::print_json is "the one --json writer" but has 3 callers; 43 production sites in 9 commands print println!("{}", env.to_pretty_json()) and usage_error hand-writes a third copy. No drift yet.	#1925	filed #1925
T44	3	"Copy may still hold the patch" from verify_file_rollback is written twice (ecosystem_dispatch.rs L64-L84, rollback.rs L324-L345); drifted on MissingBlob with a third hash (A keeps, B drops).	#1926	filed #1926
T45	3	vex omission tags are untyped strings; gradle_unpatched_copy has no omission_phrase arm and prints "the patch could not be verified" (executed); the tag test iterates a hand list. Part of C13.	#1927	filed #1927
T46	3	Go "version-pinned replace may be ignored" mapping written 3× (vex.rs L1001-L1081, core golang_local.rs L591-L610 and L693-L715); drifted on Unknown inside go.work; ~250 lines of vex Go gates belong in core. Child of #855.		to verify
T47	3	The --ecosystems selected check is copied ≥7× with two readings of Some([]) (ecosystem_dispatch L140, L1346, discovery L102, core memory L467 vs args.rs ecosystem_selected, vendor, get, ui, render); latent: the parser never yields Some([]).		to verify
T48	3	vex_consumed re-derives core rules: Go hosted-module uuid suffix (any <uuid>/… vs core /vN), Maven -socket.{hex8} without lowercasing/dash strip (vex_consumed L418, also core redirect/gradle.rs L192), cargo registry prefix ×3; PRODUCT_MANIFESTS (vex.rs L1858) copies core product.rs L84 minus csproj/gemspec hints. Child of #855.		to verify
T49	3	vlt naming is crossed: CLI vlt_preflight.rs is the vendored preflight, core redirect::vlt_preflight the hosted probe, and the CLI hosted wrapper artifact_preflight lives in vlt_heal.rs; redirect_vlt_reinstall_required returns in 3 shapes (Value, tuple, Option). Part of T27/T05.		to verify

Handed off

None.

Rejected

None.

Carried over: ecosystems and formats (E rows)

Carried over from #560 on 2026-10-29 · statuses as of its last update 2026-10-09 · owner: audit-core

Re-verify each row on current main before acting on it (reconcile step). carried rows still have an open issue or PR; to verify rows have none open and may already be fixed.

ID	P	Problem	Issues	Status
E04	1	Hosted-PyPI-URL recognition drifted (merged E49). Three recognizers remain: hosted_patch_uuid, hosted_pypi_reference/hosted_artifact_url, Pipenv owned_url.	#563	already fixed (#572); the residual pdm/poetry vs uv pin rule is A24
E05	1	Cache crawls aren't project-scoped: cargo, go, maven, nuget and deno enumerate the whole machine cache, and scan sends all of it to the API (#265).	#595, #1204, #1207, #1216	filed #595; #595 still open (Maven crawl unscoped)
E10	2	XML has eight hand-rolled scanners and four attribute extractors; the writers (nuget_feed.rs, maven_repo.rs) never use the shared readers. Merged E11, E55.	#715, #716, #717, #594	filed #715; #594, #717 also open; vendor/maven_repo.rs still uses no formats::xml/formats::maven reader (c07af61)
E12	2	pnpm v9 and legacy 5.4/6.0 were near-copies; v9 still has two lookup paths (a linear scan and LockIndex, pnpm_lock.rs:1524-1538).		rejected; LockIndex is an accelerator re-checked by the scan's predicates: one rule
E14	2	Pipfile.lock is written two ways: vendored mode re-serializes the whole lock (loses \uXXXX escapes, refuses a BOM), while hosted mode splices spans (executed twice).	#1128	already fixed (#1188); vendored pypi_pipenv splices through formats::pipenv::splice_entry (c07af61)
E15	2	Cargo.toml [package] is read five ways and has drifted on BOM, [project] and dotted keys; hosted plan_cargo_toml refuses a multi-line features array (merged E57).	#693, #757	partly fixed (#693); vendor/cargo.rs path_crate_version L1545 still bypasses formats::cargo::manifest
E16	2	CRLF has five npm-family policies and three for toml_edit output; the "any \r\n → CRLF" rule is written 14 times (merged E60).	#814, #815	filed #814; open: #814, #815; tracked with A04
E19	3	Gem has three section models and three DEPENDENCIES-name parsers (vendored sees only the first GEM section, #779). Go's module readers fixed (#870).	#780, #781	filed #780; vendored vendor/gem.rs models open
E20	3	Pure codecs (bun_lockb.rs, bun_lock_text.rs, vlt_lock_text.rs) and the neutral types live outside formats/, creating formats↔vendor/redirect/vex cycles.	#833	filed #833; #833 open; A28 adds the api→vendor/redirect imports
E21	2	Tracking: VendorBackend trait + registry. The ecosystem list is enumerated at 16 production sites, and the vend! / vend_installed! macros stand in for the trait.	#959	filed #959; tracking open, the 16 enumeration sites stand at cbbbdb9
E22	2	The JS vendor driver skeleton was copied seven times. Since #1008, six drivers share NpmLockBackend + vendor_npm_family; vlt is separate and the revert half is per backend.	#920, #922	partly fixed (#1008); revert half tracked in open #920
E24	2	There are nine revert mechanisms (~3.5K lines). Target: one splice-record revert engine, with legacy ledger kinds adapted at load.	#989	partly fixed (#1245); npm, bun, yarn, pypi finish copies remain, tracked in open #989
E26	3	JVM has two Maven backends. Target: merge maven_repo.rs into jvm/ as Shape::Single; its three artifact roots don't follow <eco>/<uuid>.	#971, #972, #973	partly fixed (#1036); #971 children 4–5 and #972 open
E28	2	Dead vendored scaffolding: one-variant VendorSource/PackageSource, an unreachable SERVICE_ECOSYSTEMS refusal, ServicePolicy::new ignoring its config, an unused vend_installed!.	#782	filed #782; re-checked b291caa: one-variant VendorSource (vendor/mod.rs:285) and PackageSource (vendor/source.rs:5) remain
E29	3	registry_fetch.rs (1.5K lines) is really archive extraction, integrity checks and the hosted-restore HTTP client, so it is misnamed and in the wrong place.	#959, #833	filed #959; placement half tracked in open #833
E30	2	Split redirect/mod.rs (21.9K lines at db83f01: 7.6K prod, 14.3K inline tests) mechanically: model, driver, one file per ecosystem, hosted_url, sibling test files.	#1010	filed #1010; still open, redirect/mod.rs is 30,223 lines at cbbbdb9 (grew)
E31	2	Tracking: trait HostedRewriter + Outcome { per_dep }. It replaces 27 RewriteResult uuid sets, merge_group_delta and the 25-outcome confirm().	#1075	filed #1075; no HostedRewriter trait on main
E32	2	There are two hosted orchestrators, disk (run_redirect_selected) and in-memory (hosted/memory), kept equal by parity tests. Target: one pipeline. Depends on E44.		decision #1200; disk run_redirect_selected and hosted/memory both remain
E33	3	Upstream restore rebuilds originals from the network (~8.8K production lines at 1c6c509, ignores mirrors, re-pins integrity from the registry: B72). Target: an originals sidecar or a narrowed restore. Depends on E45.		to verify; no linked issue/PR open; was: to verify
E36	2	Tracking: one Inventory. Today's four discovery systems are merged by fabricating CrawledPackages with fake node_modules/<name> paths. Rename vex::discover (it is the hosted-state store).	#1112	filed #1112; still open
E37	2	is_safe_{cargo,gem,nuget}_coordinate are byte-identical and duplicate simple_purl's check. composer_crawler::normalize_version duplicates strip_leading_v.	#630, #748	filed #748; re-checked b291caa: composer_crawler::normalize_version L684 and composer_version::strip_leading_v L192 are still twins
E40	2	vex_consumed.rs, in the CLI, is a third copy of package-manager layout knowledge (cargo, Maven, Go rules); its npm alias walk drifted from core on case (merged E62).	#855, #856	filed #855; vex_consumed rules still in the CLI
E41	2	Dead discovery code: lock_inventory/wired.rs has no production caller.	#782	filed #782; re-checked b291caa: PnpmLock::wired_integrity (formats/pnpm/mod.rs:475) still test-only
E42	2	The embedded --vex glue is copied per command (scan, apply, and vendor ×3), each with caller-injected bypass sets. Target: one EmbeddedVex helper.	#966	filed #1877; tracked as T25 (#966 closed)
E43	2	Fail closed on unmodeled resolution config in one shared place.	#458	to verify; no linked issue/PR open; was: partly fixed (#987 and earlier); go.work remains (#458, E81)
E44	2	Decide: is the napi addon + in-memory engine a supported product (one pipeline), or deleted (−4.5K prod)?	#1200	carried; open: #1200; was: decision #1200; contract L670 (#1029) names a future GitHub App as the caller
E45	2	Decide: hosted rollback. Is an originals sidecar acceptable, or should restore be narrowed to formats whose original is a pure function of registry data?	#1130	carried; open: #1130; was: decision #1130
E46	2	Decide: VEX evidence. Should not_affected require consumed evidence by default, so that wired-only evidence (lockfile_basis_ok) needs an opt-in? About 46 open false-attestation issues (B05).	#1099	carried; open: #1099; was: decision #1099
E47	3	Decide: support tiers for bun.lockb writes, vendored pnpm 7/8, vlt pre-1.0 encodings and hosted pnpm ≤ 6, and whether hosted JVM ships as beta.	#1156	already fixed (#1156); decision settled and closed
E50	2	Hosted rewrite_nuget and upstream restore rewrite packages.lock.json entries of the patched id at other versions (every framework); vendored locked_at filters by version. Four lock walkers.	#593	already fixed (#593); hosted and upstream re-pin only the patched version (redirect/mod.rs L7196, upstream/nuget.rs L319)
E52	3	vendor/go_sum_edit.rs: free go.sum helpers have no production caller and are re-implemented by GoSumEditor; the pure hosted codec lives in vendor/.	#631	rejected; at b291caa remove_module_prefix_lines/reinsert_lines have production callers (redirect/upstream/golang.rs); the dead remove_lines is tracked by E58/#782; the codec move to formats/ is re-raised when vendor/go_sum_edit.rs is audited
E58	3	Production pub fns with no production caller, orphaned by #277 (committed_artifact_intact, go_sum_edit::remove_lines, hosted-vlt ledger helpers, three test-only helpers).	#782	filed #782; re-checked b291caa: committed_artifact_intact, go_sum_edit::remove_lines, seed_rubygems_sha256, copy_manifest_tag have no production caller
E63	2	Hosted Maven splices the API maven_suffixed_version into pom.xml unchecked, while hosted Gradle refuses a malformed suffix; four suffix builders (executed twice).	#882	carried; open: #882; was: filed #882
E64	2	No shared BOM helper (4 strip_bom copies, ~50 inline strips); formats::pnpm's lockfileVersion readers skipped it (executed twice). Symptoms #903, #904, #623.	#905	carried; open: #905; was: partly fixed (#909, #1117, #1160, #1191, #1277); 4 files remain on PENDING_INLINE_BOMS
E65	3	Every vendored sink discards force/sources, yet vendor --force docs promise a tolerance and a warning nothing emits (executed twice).	#923	already fixed (#923); vendor --force doc now says no flag is needed (vendor.rs L80-L83)
E68	2	Vendored gem forward treats any Gemfile containing the copy path as wired, revert needs the exact line: a trailing comment leaves the lock restored and the Gemfile on path: (executed 3×).	#988	already fixed (#988); revert matches the code before # (vendor/gem.rs L2431-L2493)
E69	2	"Is this an sbt/Mill/scala-cli build" is six marker lists (#690); some roots get no Coursier roots (executed twice).	#1014	carried; open: #1014; was: partly fixed (#1032); .mill-version rule remains (#1014)
E71	1	The supersede/re-pin lifecycle had no owned-pin generation model: older generations' wiring survived a re-pin or remove.	#999, #864, #682, #266	to verify; no linked issue/PR open; was: partly fixed (#1035, #943, #1008); non-npm vendored unserved supersede is E94
E72	1	VEX attests not_affected from wiring the package manager doesn't consume: yarn Plug'n'Play loaders, pnpm bundled copies and deno.lock npm copies.	#519, #406	to verify; no linked issue/PR open; was: partly fixed (#1033); #406 in-run scan --vex path open, Maven integrity_required waits on E46
E75	2	Which lockfile governs installs is decided in ≥8 places; vendored and hosted patch different PyPI locks and a takeover restores the losers unpatched.	#612	to verify; no linked issue/PR open; was: partly fixed (#1044); #612 takeover restore scope, pdm_drives vs pylock and the inventory PyPI order (E91) remain
E79	2	Hosted mode meeting a vendored package has 4+ outcomes per ecosystem. Target: one pre-rewrite decision. Depends on C34.	#536	to verify; no linked issue/PR open; was: filed #536
E80	3	The gitignore guard for vendored artifacts covers npm and sbt/Coursier only; Maven .jar and NuGet .nupkg are dropped by stock templates.	#1061, #620	already fixed (#1061); Maven .jar and NuGet .nupkg get a uuid .gitignore override (vendor/nuget_feed.rs L1000, maven_repo tests L2079)
E81	2	Go writers ignore go.work and go env -w, and leave a read-only module-cache copy on Windows.	#458 (+9 symptoms)	to verify; no linked issue/PR open; was: filed #458; 9 symptom issues
E82	2	Cargo dual-source registries and a user's own [patch.crates-io] aren't modelled.	#480, #506, #679, #863	to verify; no linked issue/PR open; was: filed #480, #506, #679, #863
E83	3	The Maven reactor re-implements the effective POM (properties, BOM imports, parents, profiles).	#459 (+7 symptoms)	to verify; no linked issue/PR open; was: filed #459; 7 symptom issues; Maven lower priority
E84	2	Composer vendor-dir and global-home resolution ignore the global config and the XDG home.	#439, #586	to verify; no linked issue/PR open; was: filed #439, #586
E86	3	Vendored JVM fetches upstream artifacts and checksums only from Central or SOCKET_MAVEN_REGISTRY, ignoring mirrors and the build's repositories.	#1069	carried; open: #1069; was: filed #1069
E87	2	VEX product detection has no Gradle or sbt probe, and scan --vex resolves the product only after writing.	#1064	carried; open: #1064; was: filed #1064
E90	2	Which gem homes Bundler loads has two answers: vex and agent apply use get_gem_paths (keeps gem env homes under an explicit path), only the stale guard uses bundler_install_homes (executed twice).	#1098	already fixed (#1098); stale guard and vex share bundler_uses_system_gems (crawlers/ruby_crawler.rs L789)
E91	3	PyPI tool-lock precedence is written twice since #1044: the inventory keys on "yielded entries", the vendored router on presence. A package-less poetry.lock/pdm.lock beside requirements.txt makes scan offer a package vendored refuses (`pypi_poetry_loc…	#1114	carried; open: #1114; was: filed #1114
E93	3	NuGet version identity: vendor normalizes (normalize_nuget_version), PurlKey/crawler only lowercase; a vendored @13.0.3.0 is judged unused, so scan --prune reverts it (executed 3×).	#1202	filed #833; identity fixed (#1202, #1239); normalize_nuget_version still sits in vendor/nuget_feed.rs L63, a placement item under #833
E94	2	"Keep the older vendored patch while the superseding one is unserved" (#954) is npm-only: ServicePolicy::unserved carries the code only under ServiceTerminal::Failure; other backends refuse vendor_prebuilt_required, so re-runs exit 1 (Composer, execut…	#1235	already fixed (#1235); every backend refuses with the unserved code (vendor/service_fetch.rs L211-L256)
E95	3	sbt evidence fails closed on an unreadable record; scala_evidence::discover skips one, so a truncated -test twin hides a test.dep conflict and the scala-cli gate passes (executed twice).	#1270	already fixed (#1270); scala_evidence::discover returns no evidence on an unreadable record (crawlers/scala_evidence.rs L208-L218)
E96	3	requirements.txt exact pins have three grammars (inventory exact_pin, hosted requirement_version, vendored parse_requirement_line); vendored refuses six (==1.16.0) that the others accept (executed twice). Symptom #604.	#1365	already fixed (#1365); one requirements::parse_requirement

Carried over: CLI, core infra and tests (C rows)

Carried over from #560 on 2026-10-29 · statuses as of its last update 2026-10-09 · owner: audit-cli-tests

Re-verify each row on current main before acting on it (reconcile step). carried rows still have an open issue or PR; to verify rows have none open and may already be fixed.

ID	P	Problem	Issues	Status
C05	1	SOCKET_FORCE bound three --force flags; merged C35 (deprecated spellings, embedded --vex); vendor --force promises an unimplemented tolerance (#923).	#615, #966, #923	already fixed (#615, #923, #966); SOCKET_FORCE retired (args.rs L1735 test), vendor --force doc now promises no tolerance, scan --apply/--vendor gone, --vex embedded via VexEmbedArgs
C09	2	There is no shared with_proxy_fallback helper: scan, get and vex each handle the proxy fallback, and apply, rollback, repair blob/diff downloads and vendor eject fetches have none (merged C39). Fix: the fallback moves into ApiClient.	#647	carried; open: #647; was: filed #647
C10	2	Tracking: RunCtx { config, client, telemetry, lock }, built once in main. It would delete apply_env_toggles (flags written back into process env, called at 11 sites) and unblock removing most env-mutating #[serial].	#793, #794	carried; open: #793, #794; was: filed #793, #794; tracking #793, child 1 #794
C11	2	Tracking: split run_scan (1,540 lines on 045d7ec; JSON and human arms each dispatch all three modes) into discover → select → ModeBackend::consume → render.	#843	carried; open: #843; was: filed #843; tracking #843 (#844 folded in)
C12	2	Tracking: move engine code out of the CLI and into core behind one orchestrator over ProjectView: vendor_records_reusing, run_redirect_selected, ecosystem_dispatch.rs. Coordinate with E32.	#894	carried; open: #894; was: filed #894; tracking #894 (#895 folded in); command cycles fixed (#1043), 14 allowlisted edges remain
C13	2	Error codes are untyped. Target: a typed registry (enum Reason × Ecosystem) that generates the contract's code tables, plus a freshness test (~43 undocumented codes). One unparseable manifest gives five --json codes across commands (merged C52).	#930, #931	carried; open: #930; was: filed #930, #931; tracking #930, child 1 #931 (manifest mapper)
C15	2	There are three HTTP retry systems, and blob and diff fetches have none. A 206-line HTTP-date parser, two near-identical downloaders, and per-fetch or per-event clients round it out. Target: one retry + timeout primitive.	#676, #677	carried; open: #676; was: filed #676; #677 fixed (#889): vendor retries share parse_retry_after/jitter; blob/diff still no retry
C16	2	Batch limits are split across crates. The CLI owns 500 / 100 / 256 KiB, and search_patches_batch documents a maximum of 500 without enforcing it. The in-memory engine keeps a third copy (default 100, no body cap).	#675	carried; open: #675; was: filed #675
C17	2	Digest helpers are duplicated: inline hex::encode(Sha256::digest(..)) sites, compute-vs-validate sha256_hex copies, sha1_hex twice, SRI formatting inlined three times.	#706	partly fixed (#865); utils::digest holds the helpers, ~60 inline Sha256::digest sites remain (mostly tests); slice declined (#706 not planned), left to per-file sweep notes
C18	2	There are four UUID grammars. client.rs has one, CLI lib.rs a byte-identical copy, path_safety.rs accepts lowercase only, and apply.rs accepts any alphanumeric plus -/_.	#705	carried; open: #705; was: partly fixed (#1034); api/client.rs and CLI lib.rs share utils::target::is_uuid_shaped; path_safety, apply.rs archive and python_script.rs grammars remain in #705
C19	2	Env truthiness has three vocabularies (core "1"/"true", kept correct only by apply_env_toggles) and ~29 inline "empty means unset" reads; the home-directory resolvers are unified.	#793	carried; open: #793; was: partly fixed (#1038); truthiness and empty-means-unset folded into #793
C20	2	Tracking: purls have two builder families in utils/purl.rs, plus 42 hand-built pkg: strings and ~48 starts_with("pkg:<type>/") checks beside Ecosystem::from_purl. Purl equality is C63.	#748, #747	carried; open: #747, #748; was: filed #748, #747; #747 slice 1 (7 checks in free files + one-sided guard) in PR #1126; children 2–4 touch the ecosystem area
C23	2	Dead code: PatchSources::mem_blobs is never Some; VendorSource predicates are always true; group commit captures redirect-state.json, which nothing in its scope writes; the switched_off("group_commit") oracle path.	#782	carried; open: #782; was: partly fixed (#1141); hosted-vlt helpers deleted; mem_blobs, VendorSource predicates and group-commit residue remain in #782
C24	2	Apply and rollback are mirror images: the verify types are identical, and fold_copy_result, the pnpm peer fan-out and the sidecar boundary are each written twice; the folds have drifted and both drop per-file records (#756). Target: one engine.	#771, #772	carried; open: #771; was: filed #771; #772 fixed (#774), shared store_copies::fan_out; verify types + sidecar boundary remain
C25	2	--download-mode diff, the default, re-downloads every blob on a cold cache, runs sequentially with no retry, and is the only user of qbsdiff. Making file the default is a decision; removing the duplicate fetch work is a refactor.	#792	already fixed (#1049); --download-mode, the diff path and qbsdiff are gone on c8e26f6
C26	3	Taking apply.lock replays the vendored group-commit journal, so lock-free vendor --check and vex misreport a crashed run (merged C46); an interrupt left the lock file.	#808, #809	partly fixed (#1030); journal layering declined (#809 closed not planned), #808 settled transient lock
C29	3	The client.rs split (2.8K lines) into client, vendor_service and credentials; the debug-ordering machinery (HeldBack) has 45 call sites.	#913	carried; open: #913; was: filed #913; #871 deferred (closed not planned)
C30	2	No shared test-support: binary() is defined in 103 files and git_sha256 in 86, there are 15 scrub_socket_env (14 bodies), xorshift is implemented four times, and the VEX helpers are forked.	#824, #823	partly fixed (#1124, #1258, #1366); binary() only in common/, 1 scrub_socket_env; git_sha256 still copied in e2e_{npm,pypi,gem,scan}.rs and core rollback_new_file_e2e.rs (per-file notes)
C31	3	240 test executables on f3c6313 (review: 207); target ~25. Needs C10 first.		carried; open: #794; was: to verify; count confirmed, not filed: blocked on #794 (env-mutating #[serial])
C32	3	Tracking: ~478 one-line 4+-word .contains sentence assertions (245 in the 27 covgap files, 26,086 lines, 391 tests on 05ecc6e) become --json/errorCode checks plus render suites; _json/_human twins collapse.	#1089	carried; open: #1089; was: filed #1089; tracking #1089 (#1090 folded in); child 1 fixed (#1272, tests/common/envelope.rs)
C33	3	Tracking: CLI_CONTRACT.md (417 KB on 431b818; 332 KB at review) should be a checked reference (flags, env vars, codes, exit codes) plus ≤300 lines of prose, with freshness tests.	#948	carried; open: #948; was: filed #948; tracking #948 (#949, #678 folded in)
C34	3	Decide: the command model. A read-only scan, plus fix, undo, sync and check, with mode inferred from project state (or an explicit --mode for takeovers). This folds remove, rollback and vendor --revert.	#1088	decision #1352; #1088 closed completed 2026-10-09, superseded by open decision #1352 (same command model, post-v5)
C38	2	The public-proxy per-package fallback keeps a private cap of 10, ignoring SOCKET_API_CONCURRENCY, the proxy cap and the fd-limit rule; SOCKET_API_CONCURRENCY and SOCKET_WALK_THREADS are documented nowhere (merged C40).	#614, #948	carried; open: #948; was: filed #614, #948; #678 folded into #948
C41	2	Hash case policy is per site: blob download compares case-insensitively and the validators accept uppercase, but agent-mode apply/rollback verify with exact ==, so an uppercase manifest hash never verifies. Vendored verify sites are split the same way.	#707	already fixed (#707); the manifest load lowercases both hashes (schema.rs L30-L36), so agent-mode == compares lowercase
C43	2	With --manifest-path into another project, rollback, remove, repair, apply --check, vex, scan and get read the vendored ledger from --cwd while list, apply and vendor --check use the manifest's project; rollback locks one `.socket/…	#745	partly fixed (#745); ledgers load at GlobalArgs::project_root (context.rs L54); scan/gc.rs L253/L372 still probe cwd for the vendor ledger (local note)
C45	3	--download-mode is an unvalidated String, parsed late in fetch_stage/repair: a typo fails apply/repair with exit 1 and apply_failed/repair_failed (and scan/get only after saving the patch), while apply --check, rollback, list and `…	#792	already fixed (#1049); --download-mode no longer exists
C47	2	10 CLI test files spawned the binary with no SOCKET_* scrub; an ambient SOCKET_DRY_RUN=true turned 18 of 19 repair_vendor_e2e tests red.	#823	already fixed (#823); every CLI test spawns through tests/common/hermetic.rs command(); only spawn_env_hygiene.rs builds its own Command, to test the scrub
C48	2	Child processes had no shared deadline; crawler probes called output() unbounded, so a hung gem shim hung scan.	#845, #1067	carried; open: #1067; was: partly fixed (#886, #1106); the npm_dir git exchange keeps a hand-rolled deadline (#1067)
C50	2	Artifact GC has two retention policies: after_removal (rollback, remove) keeps active patches' beforeHash blobs for offline rollback, for_apply (repair, scan --prune) drops them; offline rollback then fails and names repair, which never fetches befo…	#893	already fixed (#893); one policy, ArtifactReferences::active, keeps beforeHash blobs for repair and scan --prune (cleanup_blobs.rs L29-L42)
C51	3	Agent-mode jar verification (jvm_jar::verify_member_bytes; apply, rollback, vex) buffers each patched member before hashing, while vendored zip_bytes_match_after_hashes streams since #587: 1,067 MiB vs 26 MiB peak RSS on a 1 GiB member.	#914	already fixed (#914); agent mode streams members (jvm_jar.rs test L1276) and vendor/common.rs zip_bytes_match_after_hashes streams each member through the Git hash reader
C54	3	The contract documents status: paidRequired and errorCode paid_required for get and scan, but get emits legacy status: "paid_required" (two hand-written blocks) and scan reports only paidPatches; Status::PaidRequired is never constructed.	#982	already fixed (#982); get sets Status::PaidRequired on both paths (get.rs L1566, L1832)
C56	2	apply, apply --check and vendor treat any stat error on .socket/manifest.json as "no manifest" (noManifest, exit 0); repair/remove/rollback say manifest_not_found. Five metadata().is_err() probes bypass read_manifest's NotFound rule.	#998	already fixed (#998); apply probes via manifest_exists and refuses a stat error (apply.rs L965-L968)
C59	1	Credentials reach logs, --json, telemetry and third parties: hosted Composer keeps transport-options auth (B02), grant tokens and URL userinfo appear in warnings and debug output (B26), the VEX product @id carried git-remote credentials (B21).	#399	to verify; no linked issue/PR open; was: in PR #1026; B21 fixed (#1070)
C60	1	.socket containment: the symlink guard starts below .socket and guards deletes only (#887, B08); get writes inline blobs through a planted link (B24); agent writes follow links out of the package (B25); a new-file patch overwrites an existing file eve…	#726	to verify; no linked issue/PR open; was: partly fixed (#1042); #887 closed; agent writes under a linked .socket and a rollback pre-image store remain
C61	2	CI gates passed while checking nothing: unvalidated path flags (B10), Go-only apply --check (B27), no per-purl hosted pin data (B12).		to verify; no linked issue/PR open; was: partly fixed (#1029); hosted exit code for unpinned patches waits on #704; #1123 is a regression in its path check
C67	1	Main went red on stale PENDING_INLINE_DIGESTS entries (two-sided ratchet, B01); no required checks, and push CI cancels most main verdicts (B28).	#1016, #1018	to verify; no linked issue/PR open; was: partly fixed (#1016, #1018); merge queue and per-SHA push concurrency merged; a ruleset with required checks needs org admin
C68	2	11 open -g (global install) bugs share one cause: global prefixes and shared caches are patched under per-project ownership.	#422, #423, #426, #435, #437, #443, #444, #450, #489	carried; open: #426; was: filed #422, #423, #426, #435, #437, #443, #444, #450, #489; #1000 kept agent mode
C69	2	Perf regressions have no owner: bun/hosted +110% (cause pinned), npm/hosted +15%, cargo and uv hosted per-patch re-parse.	#578, #993, #761, #836	carried; open: #761, #836; was: filed #578, #993, #761, #836; links to E27
C70	3	run_scan's human arm exits 1 when every query returns no patches; the JSON arms exit 0 (and preview GC and prune differently).	#1062	already fixed (#1062); scan human arm returns finish_human(0) on an empty discovery (scan/mod.rs L3055-L3061)
C71	2	scan reads a corrupt manifest as empty: --prune skips GC and reports success, the rollout counts recorded patches as new.	#1063	already fixed (#1776); scan fails closed on an unloadable manifest in agent mode and warns manifest_invalid/manifest_unreadable otherwise (scan/mod.rs L2036-L2050)
C72	2	Self-update and install.sh trust an unsigned SHA256SUMS from the same release.	#1065	carried; open: #1065; was: filed #1065
C73	3	rollback --json counters count only the agent leg, so hosted and vendored failures report failed: 0.	#1066	already fixed (#1066); summary.failed counts vendored and hosted legs (rollback.rs test L6319)
C74	3	With no patch state (fresh project, or after a full rollback), rollback and repair exit 1 (Manifest not found/manifest_not_found) while apply, vendor, vendor --revert and list exit 0; a second v5 rollback exits 1, pinned by a test.	#1088	decision #1352; supersedes #1088; still exit 1 (see T17)
C75	2	Every HTTP client trusts only reqwest's bundled webpki roots (no platform store, SSL_CERT_FILE or extra-CA knob), so behind a TLS-inspecting proxy the documented HTTPS_PROXY route fails with UnknownIssuer on every API, registry, telemetry and self-upd…	#1107	already fixed (#1107); utils::http::client_builder adds rustls-native-certs (platform store, SSL_CERT_FILE/SSL_CERT_DIR) beside webpki roots (http.rs L177)
C76	3	validate_paths (#1029) refuses a directory manifest only when --manifest-path is spelled differently from the default: exit 2 with no --json output vs exit 1 manifest_unreadable for the same file.	#1123	already fixed (#1123); validate_paths no longer refuses a directory manifest (args.rs L402-L406)
C78	3	The hosted upstream restore sends every public-registry lookup at once (join_all in 5 formats); utils::concurrent::registry_concurrency() (cap 4, fd-tight 1) has no caller: 40 pins → 40 in flight.	#1220	already fixed (#1220); UpstreamClient takes registry_concurrency() permits (upstream/client.rs L193)
C79	3	GC is reported in four --json shapes (repair, remove, rollback, scan --prune); the contract's summary.bytesFreed/bytesDownloaded and events[].bytes are emitted by no command, so its GC jq recipe prints null.	#1257	already fixed (#1273); one GcReport; human drift is T19

Refactor routine

Last updated 2026-11-01T11:15Z · main @ cbbbdb9

In flight

PR	Kind	Scope	State
#1842	sweep	cli/src/args.rs (+ the Deno guard moved into lib.rs)	ready
#1855	sweep	cli/src/commands/{bun_preflight,composer_hints,context,fetch_stage}.rs	ready; Bugbot clean; CI lost Depot runners twice (0 steps), needs a fresh run
#1849	structural	A01 #1832: utils/cargo_build_cache.rs	ready; CI and Bugbot green
#1864	sweep	cli/src/commands/{hosted_bundle,hosted_unwind,list,lock_cli,mod,pypi_reinstall}.rs (+ dead branch in rollback.rs)	ready; CI (82 checks) and Bugbot green
#1870	structural	A27 #1869: api/client.rs, one serve GET and one vendor retry loop	ready; CI (82 checks) and Bugbot green
#1875	sweep	cli/src/commands/{remove,repair}.rs	ready; CI (82 checks) and Bugbot green
#1884	sweep	cli/src/commands/scan/discovery.rs (+ T18 #1859; tests moved to core ranking.rs, lock_inventory/tests.rs, ui/text.rs)	ready; CI (82 checks) and Bugbot green
#1892	sweep	cli/src/commands/scan/gc.rs	ready; CI (82 checks) and Bugbot green
#1897	sweep	cli/src/commands/scan/hosted.rs (all but run_redirect_selected_untracked, T24; 13 guidance tests moved to core hosted/guidance.rs, 2 to formats/pnpm/mod.rs)	ready; CI and Bugbot green; burn-down final review done

[truncated: the full text is on the arch-audit/ledger branch]

[Mikola Lysenko (mikolalysenko)]

Part 2

Last checked against main @ cbbbdb9 on 2026-11-01 by audit-cli-tests.

Common mechanisms:For each cross-cutting concern: the canonical mechanism (the one way the code should do it, with a permalink to its home), the deviations found (file, what it does instead, its register token), and a count. Concerns: error types and context; error codes and exit codes; swallowed errors and panics in non-test code; stdout/stderr and the ui layer; the JSON envelope; human text, color and progress; logging; env and config reading; paths and containment; file I/O (atomic writes, BOM/CRLF); HTTP clients, timeouts and retries; process spawning and deadlines; concurrency.

Findings

• Env and config reading (proposed canonical: one utils/env.rs with flag, non_empty and positive readers). Today there are three vocabularies: env_compat (exact 1/true), socket_cli_config::env_truthy (yes/on/y/t) and concurrent (trim plus debug log). A09 · to verify
• Home directory (proposed canonical: utils::fs::home_dir, which requires a usable absolute home). crawlers/hatch_env.rs, repo_root::home, process::neutral_probe_dir_with and socket_cli_config use their own rules. A10 · to verify
• spawn_blocking join handling (canonical: fs::run_blocking). fs::asyncify converts panics and cancellations into io::Error, which is a second policy. This is a local note on utils/fs.rs. A third policy: vex.rs L1408 .await.ok().flatten() turns a join panic into "skip", failing open, because run_blocking is pub(crate) in core.
• Line endings (canonical: utils::line_endings). Four sites re-derive CRLF detection or the terminator, plus three eol_eq copies. A04 · filed Tracking: classify line endings in one place instead of five drifting rules #814; new sites added to the tracker's scope
• Durable directory sync: group_commit::sync_dir duplicates the fsync in fs.rs. A12 · to verify
• Env-var registry (proposed canonical: derive every scrub/hermetic list from clap's Arg::get_env() over cli_command()). Today args.rs keeps hand lists that already miss SOCKET_NO_SOCKET_YML. T03 · filed Derive the env-var scrub lists from clap's bindings; SOCKET_NO_SOCKET_YML is missing from LOCAL_ARG_ENV_VARS #1837
• Lock acquisition in the CLI (proposed canonical: one lock_cli helper taking GlobalArgs). The acquire/timeout/lock_failure sequence is open-coded 9× beside the 5 acquire_or_emit callers and the timeout conversion 14×; lock_held has 3 human renderings and scan/hosted prints it under --json. T09 · filed Acquire apply.lock through one lock_cli helper that takes &GlobalArgs; the sequence is open-coded 9 times and renders lock_held 3 ways #1858
• --json writes (canonical: ui::print_json). It has 3 callers; 43 production sites in 9 commands print println!("{}", env.to_pretty_json()) and usage_error hand-writes a third copy. Byte-equivalent today. T43 · filed Write every --json envelope through ui::print_json: 43 production sites print println!("{}", env.to_pretty_json()) instead #1925
• URL credential stripping (proposed canonical: utils::redact). The live copy is vex::product::strip_url_userinfo; redact's own strip_url_credentials is dead. A20 · in PR Sweep core utils redact, repo_root, uv_workspace and small helpers #1923
• Lexical path normalization (canonical: utils::relpath::normalize_lexically_keeping_escapes). Four private PathBuf::pop copies. A19 · to verify
• Repository root walk (canonical: utils::repo_root). Three hand walks ignore GIT_CEILING_DIRECTORIES. A21 · to verify
• Committed JSON ledgers (proposed canonical: socket_dir::write_json_ledger). The manifest writer and two state markers serialize on their own. A16 · to verify
• Error emit (proposed canonical: one json_envelope::emit_error(Command, json, dry_run, EnvelopeError)). remove, rollback, repair (3×), list and scan each hand-write "envelope under --json, else stderr". T20 · filed Emit --json error envelopes through one json_envelope::emit_error: the builder is written 5 times and the human branch drifted #1924
• Run warnings (proposed canonical: RunWarning::new plus one ui sink with an explicit print-under---silent rule). The sink is hand-rolled in list ×3, user_patches and scan/withdrawn, which disagree on --silent; 40 RunWarning { literals vs 17 ::new. T21 · to verify
• Terminal-safe text (proposed canonical: core policy::strip_unsafe, keeping \n/\t). list::sanitize and StatusPrinter::println keep bidi and zero-width characters. T23 · filed Filter terminal-unsafe characters through one helper: list and the status printer keep bidi overrides and zero-width characters that core policy::strip_unsafe drops #1860
• Shell-quoted remedies (canonical: ui::shell_word). scan/discovery.rs keeps a POSIX-only copy. T18 · in PR Sweep scan/discovery.rs #1884
• Telemetry auth: repair copies core's token chain (api_token_available) to avoid building a client, while remove builds one eagerly (an org lookup and a proxy notice before any local work). Local notes; related to C10/Tracking: build one RunCtx in main and stop mirroring CLI flags into the process environment #793.
• HTTP retries (proposed canonical: one retry helper in api/retry.rs driven by one policy). api/client.rs runs two policies that disagree on statuses, counts, jitter and an over-cap Retry-After (executed: JSON gives up, vendor retries after 4 s), through four hand-written loops; blob GETs and the upstream registry client (Flake: nightly poetry hosted rollback fails on one transient PyPI request (UpstreamClient has no retry) #1650) retry nothing. A27 · in PR One serve GET and one vendor retry loop in api/client.rs (#1869) #1870
• Debug output (canonical: api::client::debug_log → [socket-patch debug] on stderr, deferrable per task). vendor/pypi.rs reuses its deferral; other modules print through env_compat::debug_message directly. Not yet surveyed beyond api/.
• Warnings inside a command (proposed canonical: RunWarning::new from the producer to the envelope, one human renderer in ui::text). Hosted helpers build serde_json::Value warnings and run_warning_of parses them back T27 · filed Carry hosted stale-install and takeover warnings as RunWarning, not serde_json::Value round-tripped through run_warning_of #1879; only scan/hosted.rs wraps and sentence-cases warning text, and scan prints policy and rollout warnings with two prefixes T34 · to verify. scan/mod.rs has 5 sinks with 3 --silent/--json rules, one printing to stderr under --json (L2940-L2953). Part of T21 · to verify.
• --vex embedding (proposed canonical: one commands::vex::embed). Hand-written ~8× across scan, apply and vendor; only scan reports vex_skipped_dry_run under --json. T25 · filed Embed --vex through one helper: the step is hand-written 8 times, and only scan reports vex_skipped_dry_run under --json #1877
• Human Error:/Warning: lines (proposed canonical: ui::text::{error_line, warning_line} over core notice's --silent rule, which is pub(crate) today). There are ~52 eprintln!("Error: …") and ~38 eprintln!("Warning: …") prints; ~16 sentence-case inline, so text.rs's "the one capitalizer" doc is false. Part of T21 · to verify.
• API auth fallback (proposed canonical: the proxy fallback inside ApiClient, C09). The 401/403 → proxy text is copied in vex_sources, scan and get; vex reports it in warnings[], scan and get print it to stderr under --json. The api_auth_fallback warning helper lives in vex_sources.rs and is used by repair, vendor and apply.

[Mikola Lysenko (mikolalysenko)]

Part 3

Last checked against main @ cbbbdb9 on 2026-11-01 by audit-cli-tests.

Duplicated business logic:One bullet per rule that has more than one implementation: the copies (permalinks), whether they have drifted, the register token, and the target home. Rules carried over from the first thread stay in the carried registers until reconciled.

Findings

• Cargo config chain: read by cargo_build_cache::ConfigDirs::read and by source_replacement::config_layer_paths. The two have drifted on which file wins, which is a bug. A01 · in PR Read the cargo config chain once (#1832) #1849
• Segment glob matching: three matchers (cargo_workspace::wildcard_match, workspace_globs::segment_glob_matches, hatch_workspace::fnmatch). The cargo one lacks classes, which is a bug. A02 · in PR Fix Cargo member globs with [..] classes (#1833) #1866
• GOMODCACHE/GOPATH default: go_crawler and go_installed_tools have drifted. A03 · in PR Fix Go module cache default read two ways (#1834) #1876
• Fragment pairing and the pdm/poetry rewrite triad: in lock_fragments, pdm_lock and poetry_lock. A05 · in PR Share one lock_fragments driver for PDM and Poetry (#1844) #1898
• Hex digest validators: written at about 10 sites. vendor/jvm reuses digest's names for computations. A06 · to verify
• Tool --version probe: written in utils/pipenv.rs and vendor/pypi_hatch.rs, with different hardening. A11 · to verify
• Prune-empty-dirs loops: three copies, and they disagree on whether the bound is inclusive. A12 · to verify
• Yarn major from packageManager: parsed twice. A13 · to verify
• Agent download engine: get <uuid> re-implements download_and_apply_patches_into for one patch, and the two have drifted. T01 · filed Route get <uuid> agent mode through download_and_apply_patches_into instead of a second copy of the engine #1835
• Vulnerability JSON: built 3× (agent_download, list, get); get's copy is unsorted and drops description. T02 · filed Serialize patch vulnerabilities through one helper; get's selectionRequired options[] are unsorted and drop description #1836
• Blob fetch-summary text: fetch_stage copies core blob_fetcher's formatters, drifted. T04 · filed Use core's blob fetch-summary formatter in apply's fetch_stage instead of a drifted copy #1838
• Bun/vlt vendored preflight glue: five callers, each with its own per-purl lookup. T05 · filed Run the Bun and vlt vendored preflights as one vendor_preflight with one per-purl refusal map #1839
• Release-variant gating: the CLI copies core's private variant_installed_at. T06 · to verify
• Apply/rollback mirror pieces: gem build-sibling rule (drifted: any copy vs variant-matched copy) and verbose verification printer (same output, two label sources). T08 · to verify
• Worst-severity label picker: 3 copies, drifted on unknown labels (the ladder itself is single). T10 · to verify Top-ranked patch per purl: 4 copies. T15 · to verify Overlay staging: 2 copies with different staging roots. T13 · to verify
• Mode resolution in get and scan, checks in different orders. T14 · to verify
• purl name@version split: about 12 hand copies, 3 in purl.rs alone, disagreeing on empty parts. A14 · filed Tracking: build and classify purls through one validated utils::purl API #748; copies listed in a comment
• Uuid shape: 4 checks; python_script's Uuid::parse_str accepts forms the others reject. A15 · filed Validate patch UUIDs through one utils::uuid grammar instead of five #705; Check uuid shape through one helper; python_script's Uuid::parse_str also accepts braced, urn and unhyphenated forms #1845 closed as its duplicate
• pnpm packages: membership: lists_member refuses brace/class globs that hosted reads with a second reader; the lock-member detector is written twice. A17 · in PR Fix pnpm brace and class workspace globs (#1846) #1863
• Poetry lock writer < 1.4: hosted and vendored copies; the shared reader is dead. A18 · in PR Fix Poetry lock writer read three ways (#1847) #1865
• uv settings file and no-binary precedence: python_script and redirect/upstream/uv. A22 · to verify
• requirements.txt logical lines: hosted keeps its own lexer and comment split. A23 · to verify
• "Our earlier hosted pin": pdm/poetry vs uv/pylock rules. A24 · to verify
• PEP 508 leading name: 3 scanners. A25 · to verify
• Vendored revert rendering: remove and rollback each turn VendorRevertStep into events in their own loop (vendor.rs twice more); drifted on --preserve-state --dry-run, go-undo warnings, keep text and failure handling. T16 · filed remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert) #1861
• "No manifest" gate: remove, repair and rollback, drifted on unledgered vendor wiring, a legacy redirect ledger, contested hosted wiring and global scope. T17 · to verify
• GC human text and warning channel: 4 renderers; repair counts cleanup_failed as a skipped event. T19 · to verify
• uuid-only PatchRecord: core ledgers::uuid_only_record beside 3 literals (list.rs L81, commands/mod.rs L388, core vendor/mod.rs L943). Local notes.
• --global/--global-prefix flag text: commands::global_scope_flag vs ui::global_scope_arg, drifted when both are set. Local note on commands/mod.rs.
• purl shape rule: CLI scan/discovery::crawled_from_purl and core hosted::memory::discover::supplement_purl (identical today; the core test asserts literals, not the CLI function). Part of A14 · filed Tracking: build and classify purls through one validated utils::purl API #748; copies listed in a comment.
• Civil-date math: days_from_civil in api/date.rs and formats/cargo/floor.rs, the inverse in vex/time.rs (which claims to be the only copy). Same values today. A26 · filed Keep civil-date math in one utils::time module: days_from_civil is written twice and vex::time claims to be the only copy #1867
• Serve-URL GET and retry loops: download_vendor_archive_once vs download_artifact_capped_once (drifted cap-breach variant and status text); 4 retry loops under 2 policies. A27 · in PR One serve GET and one vendor retry loop in api/client.rs (#1869) #1870
• Service-archive integrity gate: vendor_prefetch::ride_along re-implements service_fetch::fetch_verified_archive's sha512 + h1: checks. Local note.
• Worst-severity label picker: a fourth copy in core client.rs::convert_search_result_to_batch_info (handed to audit-cli-tests for T10 · to verify).
• Disk vs in-memory hosted pipeline: scan/hosted.rs repeats hosted/memory/stages.rs step for step; drifted on the governing-root refusal and warning order. Child of C12. T24 · to verify
• Pipenv stale-install remedy: hosted scan/hosted/python.rs and core vendor/pypi.rs; drifted on warning count, wording and name parsing. T26 · in PR Fix Pipenv stale-install remedy built twice (#1878) #1883
• Vulnerability label (CVEs else advisory id): scan render, get ×2, list; drifted on order, dedup and severity case. T28 · filed Render a patch's vulnerability labels through one ui helper: scan, get and list each write the CVE-else-advisory rule, and their order, dedup and severity case drifted #1880
• Hosted redirect JSON block: disk {mode, rewrittenFiles} vs core's seven-key block, whose doc claims to be the only spelling. T29 · decision Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block) #1881
• Snapshot/put-back of uncaptured files: scan/hosted.rs and vendor.rs eject; hosted drops put-back errors. T30 · to verify
• Root-marker predicate: scan/policy.rs lock_markers and core memory/roots.rs; disk adds a manifest fallback. T31 · to verify
• Agent dry-run preview event: scan, get and agent_download, plus a fourth already-recorded check in scan. T32 · to verify
• Vendored refusal preview: scan's planning pass and preview_vendor each run every preflight; planning lacks the PyPI refusals. T35 · filed scan's vendored planning and preview run the refusal preflights twice, and the planning copy skips the PyPI refusals #1908
• Vendor candidate selection: plan_service_downloads re-walks the vendor loop; the plan skips the vlt refusal and the ambiguous-variant check. T36 · filed vendor's download plan re-walks the vendor loop's candidate selection, and the copy skips the vlt refusal and the ambiguous-variant check #1909
• User-patches gate loop: 5 copies (3 in user_patches.rs, scan, vendor); drifted on ecosystem filter, uuid and dedup. T38 · filed The project-patch (user_patches) gate loop is written five times, and scan's and vendor's copies have drifted #1911
• Reference status vocabulary: 4 string interpreters; the two reuse caches disagree on which answers are settled. T39 · filed Type the vendor reference status: four copies interpret PackageVendorResult.status strings and disagree on which answers are settled #1912
• "Wiring with no ledger entry" remedy: 5 copies under 2 codes. T41 · to verify
• Ledger-ownership predicate: 4 copies; rollback ignores the ecosystem. T42 · to verify
• Patch selection: a fifth copy in core hosted/memory::select_with_policy; the socket.yml floor 3×, the tier filter 4×. T15 · to verify
• Maven ${…} interpolation: 5 copies; only formats::maven caps output length. A30 · filed Interpolate Maven ${...} properties through one formats::maven helper: five copies drifted on recursion, undefined names and the length cap #1887
• A POM's own coordinates: 3 readers, drifted on parent-version inheritance and ${ handling. A31 · filed Tracking: read and edit pom.xml through one element scanner in formats::maven #715
• Env-keyed subprocess memo: composer, python and ruby; python caches answers computed under a changed env. A32 · in PR Fix env-keyed probe memo written three ways (#1888) #1895
• Coursier-root predicate: coursier_spelled vs JvmCacheLayout::classify. A33 · to verify
• Go coordinate gate: 4 identical copies. A34 · to verify
• JVM cache plumbing: gradle roots ×2, hash-dir listing ×3, wrapper init.d ×2, -D parsing ×2. A35 · to verify
• platformdirs user dirs: 5 copies, drifted on Windows fallback and macOS XDG_*. A36 · to verify
• Effective-POM walk: maven_scope and maven_reactor each follow parents and BOM imports; drifted on local-parent matching and cycle guards. A40 · to verify
• npm store classification: 3 copies inside npm_crawler (resolver, scan, peer finder), drifted on stores inside store entries. A41 · filed npm_crawler classifies node_modules store children three times, and the copies drifted on store entries and legacy/global stores #1899
• Yarn-classic .yarnrc tokenizer: crawler vs hosted redirect, drifted on single quotes. A42 · in PR Fix .yarnrc read by two drifted tokenizers (#1901) #1915
• package.json workspaces: 5 readers, drifted on non-string items and null. A43 · filed Read package.json workspaces through one helper: five readers disagree on non-string items, null and empty lists #1900
• .modules.yaml reader: npm_crawler vs formats::pnpm, plus a copied YAML unquote. A44 · filed Read pnpm YAML settings through one formats::pnpm scalar reader: three top-level-value readers drifted on quotes and empty values, and .modules.yaml is parsed twice #1918
• Small crawler twins (local notes): strip_windows_verbatim_prefix (hatch_env, python_crawler), hatch envs table choice (hatch_env, utils::hatch), PEP 503 name (hatch_env project_name, A25 · to verify), is_real_dir ×3, is_anchored (composer, relpath).
• NuGet project-tree walk and project-file test: crawler restore scope vs vendor::nuget_config, drifted on extension case and non-UTF-8 names. A46 · filed Walk a NuGet project tree through one helper: the crawler's restore scope and vendor::nuget_config each walk it, and they drifted on project-file case and non-UTF-8 names #1917
• "Declares [tool.poetry]": TOML parse vs substring vs has_table; the substring copy drops a lockless uv env (executed). A47 · filed A lockless uv project with a Poetry plugin table loses its UV_PROJECT_ENVIRONMENT packages: "is this Poetry" is read three ways #1916
• pnpm YAML top-level scalar: 3 readers drifted on quotes and empty values. A44 · filed Read pnpm YAML settings through one formats::pnpm scalar reader: three top-level-value readers drifted on quotes and empty values, and .modules.yaml is parsed twice #1918
• Python env-dir naming: Poetry, Pipenv and Hatch share one sanitize + urlsafe-b64(sha256)[..8] rule written 3 times; Windows verbatim-prefix strip ×3. A49 · to verify
• Python site rules inside python_crawler: user site ×2, site-packages-under-prefix ×3 (lib64), PDM config read twice. A50 · to verify
• "Copy may still hold the patch": ecosystem_dispatch cargo GC vs rollback's other-scope check, drifted on MissingBlob with a third hash. Target: core VerifyRollbackResult::may_hold_patch. T44 · filed The "copy may still hold the patch" rule is written twice and drifted: cargo GC keeps a missing-blob modified copy, rollback's other-scope check drops it #1926
• Go "replace may be ignored" mapping: vex.rs vs core golang_local audit and apply refusal, drifted on Unknown inside go.work. T46 · to verify
• --ecosystems selected check: ≥7 copies with two readings of an empty list (latent). T47 · to verify
• Core rules re-derived in vex_consumed/vex: Go hosted uuid suffix, Maven -socket.{hex8} (no lowercasing), cargo registry prefix ×3, the product-manifest probe table (drifted: no csproj/gemspec hint). T48 · to verify
• Error envelope builder: written 5× (usage_error, lock_cli, rollback, remove, scan/hosted); human branch drifted on sentence case and hints. T20 · filed Emit --json error envelopes through one json_envelope::emit_error: the builder is written 5 times and the human branch drifted #1924

[Mikola Lysenko (mikolalysenko)]

Part 4

Last checked against main @ cbbbdb9 on 2026-11-01 by audit-cli-tests.

Structure, abstraction and placement:Needless layers (one-impl traits, forwarding modules, invariant-free newtypes), tiny-function clusters, unclear control flow (mode flags, giant functions, accumulate-then-decide), and misplaced code (with its destination). Per-directory tallies of single-caller functions, wrappers and deletable comment lines go here as the audit covers each directory.

Findings

• utils/ holds ecosystem code, and some of it imports vendor::*: hatch ×2, pdm/poetry/lock_fragments, go ×2, cargo ×3, pnpm_workspace (imports patch::redirect), purl_key (imports crawlers/vendor) and python_lock. A08 · to verify
• utils/fs.rs is a grab-bag of four concerns: dir helpers, FIFO-safe readers, home resolution and the atomic writer. A10 · to verify
• GroupCommit::commit_unjournaled skips the post-commit removal queues that commit_changes drains. A07 · to verify
• Tally for utils/ (first 28 files, 14.5K lines):
  • about 75 single-caller functions;
  • about 30 trivial wrappers;
  • 0 one-implementation traits;
  • about 30 pub items with no caller outside their file (mostly in go_installed_tools, cargo_build_cache and concurrent), plus one dead function (pdm_lock::wheel_matches);
  • about 280 deletable comment lines.
• DownloadParams re-copies GlobalArgs field by field, and the nested apply rebuilds a GlobalArgs from it. T11 · to verify
• composer.lock parsing lives in the CLI (composer_hints), beside a prefix re-parse of vendored paths. T12 · to verify
• Tally for crates/socket-patch-cli/src (first 8 files, 15.9K lines: args.rs, commands/agent_download.rs → commands/get.rs):
  • about 74 single-caller functions (≈25 worth inlining; the rest are long or tested);
  • about 21 trivial wrappers or forwarders;
  • dead code: --vendor-source plumbing (one-variant VendorSource, C23), FetchBatch.already_recorded, apply's args.check branch and two unreachable variant arms;
  • about 760 deletable comment lines (apply.rs alone: 909 of 3,542 production lines are comments, 32 bare #NNN refs).
• Giant functions: get::run (~760 lines), apply::apply_patches_inner (~700), apply::run_locked (~510, folds the same results three times), agent_download::fetch_selected_patches (~280, branches on the store in 5 places).
• Tally for the rest of utils/ (20 files, 16.4K lines, pnpm_workspace.rs → workspace_globs.rs):
  • about 28 single-caller functions worth inlining;
  • about 36 trivial wrappers (7 bare build_*_purl format!s, 4 refuse_uv_* forwarders);
  • dead pub code: poetry_lock::lock_writer_version, python_lock::complete_python_lock_metadata(+_in), redact::strip_url_credentials/url_userinfo, target::Target::ambiguity, pnpm_workspace::shared_lockfile_disabled/git_branch_lockfile_setting;
  • toml_edit_ext.rs is a two-function module whose functions each have one caller elsewhere;
  • about 210 deletable comment lines.
• Module docs that claim a monopoly they don't have: relpath ("every normalizer") A19 · to verify, repo_root ("the one walk") A21 · to verify, redact (VEX @id) A20 · in PR Sweep core utils redact, repo_root, uv_workspace and small helpers #1923.
• Tally for crates/socket-patch-cli/src/commands (next 10 files, 15.5K lines: hosted_bundle.rs → scan/discovery.rs):
  • about 57 single-caller functions (≈20 worth inlining; the rest are tested formatters);
  • about 12 trivial wrappers or shims (patch_server_origins, HostedUnwindError, 2 pub use re-exports in discovery);
  • dead code: HostedLegOutcome::unsupported (never written; rollback still branches on it), InnerSelection::Identifier(None) (test-only), repair's ArtifactNoun parameter (always BLOB);
  • about 380 deletable comment lines.
• Giant functions (cont.): rollback::run (~1,210 lines), rollback::rollback_patches_inner (~830), remove::run (~920). C11/Tracking: split run_scan into discover, select, one mode dispatch and render phases #843 covers run_scan only.
• rollback.rs is remove's helper library: remove imports 12 items from it (text helpers such as join_clauses/as_question belong in ui; hosted ones such as retire_legacy_redirect_ledger in hosted_unwind). Local notes.
• scan/discovery.rs is a grab-bag: discovery, update detection, severity helpers and hosted/vendored nested-project policy (nested_project_skips, which belongs in scan/hosted.rs). Local note; C11.
• api/ is not a leaf layer: vendor_prefetch belongs in vendor/, the pypi wheel gate sits in client.rs, and api::types imports patch::redirect. A28 · to verify
• Tally for api/ (8 files, 12.0K lines) and crawlers/cargo_crawler* (1.7K):
  • about 20 single-caller functions worth inlining (fetch_binary/binary_url, format_fetch_result_for, the download_vendor_archive* chain, verify_crate_at_path);
  • about 12 trivial wrappers (identity ranking::merged_coverage, org_slug/uses_public_proxy over route(), CargoCrawler::cargo_home);
  • dead code: get_api_client_from_env (no caller), blob_fetcher's on_progress parameter (every caller passes None), CargoCrawler's Default;
  • about 140 deletable comment lines (mostly vendor_prefetch's 110-line module doc and client.rs history notes).
• Tally for crawlers/ (13 files, 13.3K lines: composer_crawler.rs → maven_crawler.rs, without maven_crawler/ and maven_scope.rs):
  • about 45 single-caller functions worth inlining;
  • about 47 trivial wrappers (the scan_maven_repo four-layer chain, is_safe_* one-line forwarders, test-only async shims);
  • dead code: maven is_ro_root (free fn), gradle_m2_ignored, maven_local_undetermined; jvm_cache::project_dependency_set (iterates &[]); DerivedIndex::incomplete; ivy's ignored _os parameter; fuzzy_match's limit (one caller passes usize::MAX);
  • about 330 deletable comment lines.
• Crawlers are stateless unit structs with new() + Default. A38 · to verify
• Tally for crawlers/maven_* rest, mod.rs and npm_crawler* (8 files, 12.9K lines):
  • about 50 single-caller functions (≈10 worth inlining: admit, interpolate, decode_bun_store_entry_name, pnpm_current_lockfile_sync, …);
  • about 20 trivial wrappers (get_*_global_prefix → _with, 3 run_walk shims, crawl_all → crawl_all_with_roots, StoreEntry::{pnpm,npm,vlt});
  • npm_crawler redefines ListedEntry/list_dir_sync beside crawlers/listing.rs; its global-prefix probes (L2296-L2565), Bun store-liveness (L676-L1400) and Deno cache (L1883-L2122) blocks belong in submodules or deno_crawler;
  • about 450 deletable comment lines (13 banners, perf history, stale check_package references).
• Crawlers read unabsolutized --cwd: lexical ancestors() walks of . stop at once. A45 · in PR Fix crawlers missing parent dirs under --cwd . (#1902) #1906
• Codecs inside crawlers: deno_crawler's deno.lock readers (used by vex, hosted and vendor) belong in formats/deno, gradle_cache::parse_properties in formats/, the POM line scanner in formats::maven (A31 · filed Tracking: read and edit pom.xml through one element scanner in formats::maven #715), and JvmEnv/M2Gate in jvm_cache (A35 · to verify).
• Tally for crawlers/ nuget_crawler*, oracle_support, pkg_managers, pnpm_layout, python_crawler* (8 files, 13.6K lines):
  • about 80 single-caller functions (≈25 worth inlining: classify_package_entry, YarnEnv::current, installed_store, pnpm_pnp_layout, find_python_command, runtime_site_dir, …);
  • about 17 trivial wrappers (test-only NuGetCrawler::scan_package_dir/is_dotnet_project, npmrc_modules_dir, hatch_env_site_packages);
  • dead code: find_pipenv_virtualenv_site_packages (no caller), find_poetry_virtualenv_site_packages and the async metadata readers (test/oracle-only), #[cfg(test)] poetry_virtualenvs_root in production code;
  • about 250 deletable comment lines;
  • python_crawler (3.8K production lines) mixes a dist-info codec, a 290-line python-dotenv codec (belongs in formats/pipenv) and four env-placement models (PDM, uv, Pipenv, Poetry; target crawlers/python_env/).
• crawlers/pkg_managers crawls nothing: Yarn rc/env resolution belongs in formats::yarn, YarnPnpLoader in vex. A52 · to verify
• Tally for crates/socket-patch-cli/src/commands/scan/ (8 files, 15.5K lines: gc.rs, hosted.rs, hosted/{nuget,python,takeover}.rs, mod.rs, policy.rs, render.rs):
  • about 90 single-caller functions (≈25 worth inlining; render's byte-tested builders stay);
  • about 26 trivial wrappers or shims (count, run_warning_of, emit_json_error, 4 re-export shims in mod.rs, 3 policy getters over a pub field);
  • dead code: selection_args (its only caller always takes the branch that ignores it), run_redirect's non-JSON arm and Option<Envelope> (called only from the JSON arm);
  • about 335 deletable comment lines.
• Giant functions (cont.): run_scan is now 1,864 lines (C11/Tracking: split run_scan into discover, select, one mode dispatch and render phases #843; it calls discover_selected twice in a row in its JSON arm), run_redirect_selected_untracked 1,233 T24 · to verify.
• Engine code in scan/: hosted/takeover.rs (a 425-line plan/stage/retract/finish engine over GroupCommit) and hosted/nuget.rs belong in core; scan imports commands::vendor::{dispatch_revert_one, run_vendor_gc, unused_vendored_manifest_keys}. C12. takeover.rs also parses core warning prose (residual_only_keep), and npm_allow_remote_one_line matches guidance sentences.
• Misplaced in scan/mod.rs: the takeover section (L926-L1123, used only by hosted.rs) and gradle_scan (L1194-L1387, Maven-specific). policy_bypass_warnings is get-only policy evaluation that belongs in core policy.
• Vendored GC bypasses the shared revert: run_vendor_gc drives dispatch_revert_one by hand and drops each failure's error. T37 · filed scan --prune's vendored GC reverts entries by hand instead of through VendoredBackend::revert, and drops each revert's error and still-wired orphans #1910
• Go consumer-sync audit: invoked and rendered at 8 sites through two channels. T40 · to verify
• Tally for commands/scan/{rollout,rollout_args,socket_yml_args,vendor_flow,withdrawn}.rs, update.rs, user_patches.rs, vendor.rs, vendor_orphans.rs, vendored_backend/ (11 files, 14.2K lines):
  • about 50 single-caller functions (≈20 worth inlining: ledger_key_for, vendor_under_lock, is_gone, download_status, revert_vendor_entry, workspace_copy_issue, …);
  • about 25 trivial wrappers (4 boxed_* forwarders, sweep_orphan_vendor_dirs, dispatch_revert_one, gc_note, Gate::with_* builders);
  • long functions: vendor_records_reusing ~1,258 lines (C12), VendoredBackend::repair ~570, run_eject ~554, run ~306;
  • mode bools: dispatch_vendor_one(dry_run, force), revert(stop_on_failure) (true only from remove), discover_selected(.., false, false, false);
  • engine code in the CLI: migrate_legacy_manifest_records, scan_vendor_references, the orphan sweep, Gate::may_admit (C12);
  • about 200 deletable comment lines (misplaced docs on symlinked_wiring_warnings and the gem block, 4 repeated Windows-stack docs).
• CLI vex, vlt, dispatch, envelope and ui files (17 files, ~15.0K lines, audit-cli-tests 2026-11-01):
  • about 64 single-caller fns and 26 trivial wrappers; the worst are ecosystem_dispatch.rs (9 lookup wrappers over dispatch_find_with_npm_links, passthrough_purls is to_vec) and vex.rs (generate_vex is 575 lines with a calm_when_nothing mode bool);
  • engine code in the CLI: VEX attestation planning (vex_sources.rs L353-L973, ~620 lines), vex Go gates and synthesize_go_patches (~250 lines, T46 · to verify), cargo/JVM/Bundler copy rules in ecosystem_dispatch.rs (~300 lines), all C12;
  • crossed vlt module names between CLI and core T49 · to verify; vex_copy_sets (used by apply) belongs in ecosystem_dispatch;
  • vex omission reasons are untyped strings T45 · filed vex omission tags are untyped strings, and gradle_unpatched_copy has no phrase: it prints "the patch could not be verified" #1927;
  • about 340 deletable comment lines (90 in ecosystem_dispatch.rs, 45 in json_envelope.rs).

[Mikola Lysenko (mikolalysenko)]

Part 5

Last checked against main @ cbbbdb9 on 2026-11-01 by audit-cli-tests.

Tests:Fake tests (asserting on their own mocks, recomputing expected values with the code under test, unable to fail, claiming more than they check), mock overuse where a tempdir or a real install is cheap, sentence-matching assertions, duplicate tests, and real coverage gaps. Per-directory tallies and the fixes that landed.

Findings

• Tally for utils/ (first 28 files): 17 fake or weak tests.
  • Tautologies: constants.rs ×3.
  • The expected value is recomputed with the code under test: concurrent per-window cap.
  • The test name overclaims:
    • durability vanished-file test;
    • group_commit journal test;
    • http production_builder_builds;
    • go_installed_tools unlistable-dir test (asserts the opposite when go is on PATH).
  • Duplicates:
    • pipenv ×3, copying process.rs tests;
    • pdm_lock shape-change test, copying a lock_fragments test;
    • fs entry_file_type ×2, which only exercise tokio.
  • Sentence matching where a typed error exists: http cap tests.
  • Only is_err() asserted: pdm_lock unsafe-sources test.
• Root-skip tests pass silently under root (group_commit ×2, fs ×3).
• Coverage gaps:
  • http mid-stream cap and Truncated;
  • cargo_build_cache warning text;
  • the cargo config precedence, now covered by A01 · in PR Read the cargo config chain once (#1832) #1849's acceptance criteria.
• Tally for crates/socket-patch-cli/src (first 8 files): about 38 fake, duplicate or misplaced tests.
  • Duplicates of core tests: get's 10 detect_* (core target.rs) and 9 select_* ranking tests (core ranking.rs).
  • Duplicates of tests/cli_global_args.rs: 6 inline tests in args.rs.
  • Can't fail: fetch_stage obsolete diff/package archive tests ×2; get apply_failed_line_is_an_error_even_when_silent (a const equals its literal); args env-list and VendorSource tests ×3.
  • Name overclaims: get select_json_mode_multi_free_options_serialize_vulnerabilities asserts only Err(1). T02 · filed Serialize patch vulnerabilities through one helper; get's selectionRequired options[] are unsorted and drop description #1836
  • Misplaced: ~63 agent_download tests (~2,800 lines) live in get.rs.
• Coverage gaps: no assert on any Gradle detail text in apply (a broken string continuation at apply.rs L3111 ships 17-space runs); no 401 test on get's search path; no test ties the env lists to clap. T03 · filed Derive the env-var scrub lists from clap's bindings; SOCKET_NO_SOCKET_YML is missing from LOCAL_ARG_ENV_VARS #1837
• Tally for the rest of utils/ (20 files): 23 fake or weak tests.
  • Tautologies: purl.rs ×15 (7 test_build_*_purl, 7 *_round_trip, test_is_purl); process.rs ×2 (assert std's Command::new).
  • Expected value recomputed with the code under test: purl_key nuget_key_agrees_with_the_vendored_version_match.
  • Duplicates: poetry_lock shape-change test (third copy) A05 · in PR Share one lock_fragments driver for PDM and Poetry (#1844) #1898; uri.rs's asserts repeated byte for byte in yarn_berry_lock.rs.
  • Weak asserts: poetry_lock malformed-integrity (!err.is_empty()), python_lock "ours" test (is_ok() passes on Ok(None)).
  • Misplaced: purl_key_nuget_vendor_tests.rs (an end-to-end vendor test), redact's lint of vendor/service_fetch.rs.
• Coverage gaps: python_script refuse_uv_no_binary/no_sources (project form) have no unit test.
• Tally for crates/socket-patch-cli/src/commands (next 10 files): about 30 fake, duplicate or misplaced tests.
  • Can't fail: list ordering_is_deterministic_across_builds (iterates one HashMap twice); remove dry_run_footer_matches_repair and repair's HOSTED_ONLY_REASON assert (a const equals its literal).
  • Asserts the test's own stub: rollback rollback_patches_missing_manifest_is_identifier_error (the message comes from the test helper's ok_or_else).
  • Duplicates of core tests: discovery's 5 severity_order tests (core ranking.rs), 4 candidate_supersedes and 1 unsupported_layout_warnings test of core functions; ~5 remove remove_matching tests repeat core Target tests.
  • Subset or overclaiming tests: lock_cli ×4, repair ×3, mod.rs ×3 (only is_err() or a .contains that a sibling message also satisfies).
• Coverage gaps: no test of remove --preserve-state --dry-run over a vendored entry T16 · filed remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert) #1861; no test that scan --json keeps stderr empty on a held lock T09 · filed Acquire apply.lock through one lock_cli helper that takes &GlobalArgs; the sequence is open-coded 9 times and renders lock_held 3 ways #1858; no bidi/zero-width test for list T23 · filed Filter terminal-unsafe characters through one helper: list and the status printer keep bidi overrides and zero-width characters that core policy::strip_unsafe drops #1860.
• Tally for api/ and cargo_crawler*: about 40 fake, duplicate or misplaced tests.
  • Tautologies: ranking merged_coverage_is_the_advisory_count (identity fn) and same_patch_dates_across_different_packages_do_not_interact (the key has no purl); date parsed_order_is_chronological_in_both_formats's monotonic assert (its own loop counter); types published_at_is_per_patch_not_per_package (its own fixture); tests/api_timeout_e2e.rs const == literal.
  • Duplicates: types ×10 serde serialize/roundtrip tests; ranking ×4 rung tests; blob_fetcher ×5 format tests.
  • Misplaced: client.rs tests is_hex ×5, severity_order ×2, is_uuid_shaped ×2; cargo_crawler tests package_name_version ×7 (covered in formats/cargo/manifest.rs).
  • Env mutation without a guard: client test_get_api_client_from_env_no_token (and it reads the user's socket-cli config).
  • Test scaffolding: four xorshift64* RNGs and eight legacy crawler oracles. A29 · in PR Build: share one test RNG across randomized tests (#1868) #1882; oracle deletion still to decide (npm oracle: retire, 2026-11-01 entry)
• Strong: vendor_prefetch's serial-differential tests and client's wiremock retry tests assert request counts and outcomes, not mocks.
• Tally for crawlers/ (13 files): about 45 fake, duplicate or weak tests.
  • Can't fail: coursier_cache host_os_is_one_of_the_tables; deno default_and_new_construct_cleanly; go and maven test_crawl_all_deduplication (one package staged); go test_crawl_all_skips_cache_dir (no @ dir under cache/); maven comment_pom_falls_back_to_path (the fallback never runs).
  • Recomputes the expected value: hatch_env default_data_dir_and_config_dirs_env_virtual.
  • Vacuous FIFO tests: coursier_cache repo_roots_read_poms_fifo_safe and half of ivy_cache readers_are_fifo_safe never open the FIFO.
  • Duplicates of e2e tests: fuzzy_match ×9, go_crawler ×8, composer_crawler ×5.
  • Oracles that share the production helpers they check (composer, go): A29 · in PR Build: share one test RNG across randomized tests (#1868) #1882; oracle deletion still to decide (npm oracle: retire, 2026-11-01 entry). EnvGuard copied 11×: A37 · in PR Build: share one test env guard in core (#1889) #1891.
• Tally for crawlers/maven_* rest and npm_crawler*: about 30 fake, duplicate or misplaced tests.
  • Can't fail or pass for the wrong reason: npm test_macos_get_global_node_modules_paths_no_panic; test_find_by_purls_rejects_traversal_in_name (pkg:npm/../evil fails purl parsing, the guard never runs); L7920 fan-out asserts an empty result a missed store also gives.
  • Duplicates: ~6 find_by_purls/crawl tests, 9 decode_pnpm_store_entry_* tests (one table), test_is_safe_npm_component (repeats path_safety).
  • Misplaced: scala_cache_tests tests gradle_cache::installed_copies and jvm_cache::locate_artifact, and tests the oracle itself. Hermetic is a 12th env guard A37 · in PR Build: share one test env guard in core (#1889) #1891.
  • npm_crawler/oracle.rs (1.9K lines): imports 10+ production helpers, is no longer verbatim, and covers none of the .bun/.deno/global-virtual-store layouts; retire it A29 · in PR Build: share one test RNG across randomized tests (#1868) #1882; oracle deletion still to decide (npm oracle: retire, 2026-11-01 entry).
• Coverage gaps: bun_uses_global_store and crawl_all_with_roots have no unit test; maven_scope's MAX_NODES/MAX_REACTOR caps are untested; no crawler test uses a relative cwd A45 · in PR Fix crawlers missing parent dirs under --cwd . (#1902) #1906.
• Tally for nuget_crawler*, pkg_managers, pnpm_layout, python_crawler*: about 36 fake, duplicate or weak tests.
  • Can't fail: python test_find_python_command (passes with no Python) and test_home_dir_detection (tests utils::fs); nuget test_deduplication (one package); node_modules_as_file_is_not_misclassified_vlt.
  • Misnamed: hatch_discovery_does_not_block_on_fifo_configuration exercises Poetry. legacy_fallback_reuses_one_listing_across_purls never checks reuse.
  • Duplicates: ~8 nuget and 5 python tests repeat tests/crawler_*_e2e.rs; test_parse_pypi_purl* repeat utils/purl.rs; 7 yarn_berry_* tests are one table.
  • Not hermetic: 12 PnP tests fail under a user Yarn linker setting (executed); 5 python crawl_all tests read VIRTUAL_ENV. A48 · filed Crawler unit tests read the developer's real HOME, YARN_NODE_LINKER and VIRTUAL_ENV: 12 pkg_managers/pnpm_layout tests fail under a user nodeLinker setting #1919
  • Scaffolding: 3 more env guards in python_crawler, NugetEnv A37 · in PR Build: share one test env guard in core (#1889) #1891; ~25 mkfifo helpers A51 · to verify; dist-info fixture writer ×3 across crates. Oracles for nuget and python drifted from production A29 · in PR Build: share one test RNG across randomized tests (#1868) #1882; oracle deletion still to decide (npm oracle: retire, 2026-11-01 entry).
• Tally for commands/scan/ (8 files): about 40 fake, duplicate or misplaced tests.
  • Can't fail: scan/mod.rs 3 takeover_detail_* tests' negative asserts (phrases the string never had), an assert_ne! between constants, vex_error_warnings_append_to_scan_json (tests Vec::extend); hosted.rs a constant tautology (L4534).
  • Duplicates: hosted.rs L3836/L3853 exact; gc's composer/encoded/PEP 503 tests re-test core PurlKey; gc's corrupt-manifest tests ×2 repeat L966; render highest_severity_picks_worst copies core ranking.rs; package_specs_match_names_and_purls copies core policy/tests.rs.
  • Misplaced: 17 tests of core code in hosted.rs (~700 lines, 15 of hosted::guidance, reached through a cfg(test) re-export of 20 items); 2 Discovery tests in mod.rs.
  • Sentence matching: policy L988, render L856.
• Coverage gaps: takeover.rs plan/stage/retract/finish and hosted/nuget.rs have no unit test; redirect_takeover_not_pinned is in no test; scan's path_outside_repo and multi-directory --json/--vex refusals are untested; no test asserts disk and memory redirect keys agree T29 · decision Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block) #1881.
• Tally for the 11 files above (scan/vendor_flow.rs … vendored_backend/repair.rs): about 30 fake, duplicate or misplaced tests.
  • Vacuous: service_mode_gate_admits_maven and nuget_and_maven_reverts_route_to_real_backends assert only inside if let; checking_latest_status_line compares a const with its literal; binary_bun_references_are_scanned_without_a_ledger asserts a file nothing creates is absent.
  • On their own stub: preview_marks_a_refused_takeover_would_refuse passes a refusal map in and reads it back; 12 preview tests assert on a test-only JSON shape (preview_vendor_json).
  • Misplaced: 11 scan/rollout.rs tests exercise only core rollout/stage.rs (which has none); vendor.rs tests core covers_purl ×2, vendor_entry_in_use, Envelope::record and vendor_orphans.
  • Duplicates: two FIFO snapshot tests; parses_numbers_and_none vs cli_parse_scan.rs; update.rs re-tests ui::sentence_case.
• Tally for the 17 CLI files audited 2026-11-01 (vex.rs … update_notifier.rs): about 45 fake, duplicate or misplaced tests.
  • Fails on a TTY (executed): ui/prompt.rs confirm_waits_agrees_with_confirm_over_the_flag_cube panics when stdin is a terminal.
  • Can't fail: passthrough_purls_is_identity, non_interactive_notes_share_one_wording, merge_first_wins_dedups_identical_path.
  • Claims more than it checks: the global-prefix banner test asserts an empty map and captures no stderr; 5 json_envelope tests say "every" over hand lists that miss RolledBack/Update; the omission-phrase test's hand list misses gradle_unpatched_copy T45 · filed vex omission tags are untyped strings, and gradle_unpatched_copy has no phrase: it prints "the patch could not be verified" #1927.
  • Misplaced: 14 is_uuid_shaped tests in lib.rs (core already tests it), go_redirect_coord_guard re-tests core, vex_consumed tests ecosystem_dispatch and npm_crawler.

[Mikola Lysenko (mikolalysenko)]

Part 6: History — what carried over from #560

The first thread, #560 (2026-10-01 to 2026-10-09, 151 comments), reviewed the code module by module. Its living document, register, procedures and run entries are archived read-only under review/2026-10-v1/ on the ledger branch, and the original snapshot under review/2026-10/.

Carried over: every row that wasn't fixed, already fixed, rejected or handed off. These are 54 ecosystem and format rows (E) and 47 CLI, core and test rows (C), with their issue links. Each one is carried while one of its issues or PRs is still open, and to verify when none is. The auditors reconcile a few each run against current main, and an item that no longer fits this charter is rejected with a reason.

• Ecosystems and formats: E04 E05 E10 E12 E14 E15 E16 E19 E20 E21 E22 E24 E26 E28 E29 E30 E31 E32 E33 E36 E37 E40 E41 E42 E43 E44 E45 E46 E47 E50 E52 E58 E63 E64 E65 E68 E69 E71 E72 E75 E79 E80 E81 E82 E83 E84 E86 E87 E90 E91 E93 E94 E95 E96: 4 partly fixed · 11 already fixed · 13 filed · 14 carried · 10 to verify · 2 rejected
• CLI, core and tests: C05 C09 C10 C11 C12 C13 C15 C16 C17 C18 C19 C20 C23 C24 C25 C26 C29 C30 C31 C32 C33 C34 C38 C41 C43 C45 C47 C48 C50 C51 C54 C56 C59 C60 C61 C67 C68 C69 C70 C71 C72 C73 C74 C75 C76 C78 C79: 4 partly fixed · 16 already fixed · 2 decision pending · 21 carried · 4 to verify

What #560 concluded (its TL;DR as of 2026-10-09; the numbers are from then):

1. socket-patch is a product matrix implemented cell by cell. The matrix is 3 modes × 9 ecosystems × ~25 package-manager and lockfile generations × 6 operations (discover, apply/wire, verify, attest, revert, mode-takeover). There is no shared abstraction on any axis:

   • no lockfile codec;
   • no mode backend;
   • no vendor-backend trait;
   • no hosted-rewriter trait;
   • no single inventory.

   Each cell is hand-written text surgery. As a result, the same file format is parsed and spliced two to five times with different rules, and those rules have already drifted. For example, there are five different CRLF policies for the npm lockfile family alone.

2. Most of the open bug backlog has one shape: "reported success, but the build consumes unpatched code". Of the 88 issues open at the snapshot, roughly 29 were a success or a not_affected VEX attestation that the installed bytes don't back up (about 46 such false attestations are open on 2026-10-07; Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies #1033 and Fix VEX attesting beside an unpatched same-lock copy (#935, #938, #939) #940 address the largest groups). Another 15 were discovery missing what the package manager actually installed. The root cause is architectural:

   • the tool re-implements package-manager behavior (install layouts, venv naming, config layering, resolution precedence);
   • it then reports success based on its own model of what the package manager will do;
   • every package-manager release or config knob it doesn't model becomes a silent false negative.

3. Support breadth has outrun the architecture. The long tail is disproportionately expensive:

   Long-tail target	Cost
   vlt	~6.5K production lines, ~22K total, ~123 CI jobs per push
   JVM (Maven/Gradle)	~9K production lines, 22 of the 88 open bugs
   bun.lockb	~2.8K production lines for a format Bun itself replaced
   vendored pnpm 7/8	1.85K lines, ~96% a copy of the v9 backend

   A support-tier policy would let the core get simpler.

4. The code is large for what it does, and much of the size is duplication and scaffolding.

   • ~134K lines of production code on 9c43dfc (~118K at the snapshot, plus 35K comment lines then).
   • ~450K lines of tests.
   • Nine functions over 500 lines; run_scan alone is 1,540 (on 045d7ec).
   • A 21.9K-line redirect/mod.rs on db83f01 (17.5K at the snapshot).
   • Two hosted orchestrators kept equal by parity tests.
   • Four discovery systems.
   • Nine different revert mechanisms.
   • Two JSON envelope shapes, 27 global flags silently accepted by every command, and 156 documented error codes.

   We estimate 25–35K production lines (20–30%) and 50K+ test lines could go. Roughly 20K of that comes from consolidation that keeps every capability; the rest comes from the support-tier and product decisions in §5.

5. The user model is harder than it needs to be. It has:

   • 9 verbs, 2 hidden subcommands, 2 aliases and 3 hidden flag spellings;
   • defaults that change with unrelated flags;
   • scan writing lockfiles by default;
   • mode that is not project state: a plain scan performs the documented "mode takeover" and switches vendored npm, Cargo, Go, PyPI and Gradle-built Maven packages back to hosted (made atomic in Make the vendored-to-hosted takeover atomic #1039, E70);
   • remove, rollback and vendor --revert as three ways to undo.

   A seven-verb model (scan read-only, fix, undo, sync, check, list, vex) with mode inferred from the project would cover everything (§4).

6. There are a few real defects to fix now (§1), regardless of any refactor:

   • no HTTP timeouts on the main API client (fixed, Bound patch API connects and stalled reads (#570) #581);
   • a ledger-loss bug in the vendored→hosted takeover (fixed, Fix PyPI vendored→hosted takeover stranding unreachable pins (#699) #708);
   • a planted-binary spawn (fixed, Fix vendored Hatch running a planted hatch (#613) #617);
   • a comment-blind NuGet config reader (fixed, Unify hosted NuGet routing and XML splice anchors #597);
   • a stale digest ratchet that turned main red for every PR (fixed, Fix main CI red on stale digest pending-list entries #1016; a merge queue follows in Run CI on the merge queue and stop cancelling main push runs #1018).

   The October 7 audit added credential leaks (C59), .socket containment (C60) and the non-atomic takeover (E70); each has a PR. SOCKET_FORCE (Decide: give SOCKET_FORCE per-command names so forcing a self-update doesn't also force apply and vendor #615, PR Remove the SOCKET_FORCE env binding; --force is flag-only (#615) #1021) and the bun.lockb registry override (E02, fixed by Resolve vlt registry bases through one shared function (#562) #574) are no longer open defects.

---

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-core)

main @ b291caa. This is the first run of the file-by-file thread. I read 28 files, about 14.5K lines, all of them complete with no partial: constants.rs, lib.rs, and utils/ from cargo_build_cache.rs through pipenv.rs.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake tests.

File	Lines	Counts	Note
constants.rs	108	0 / 0 / ~8 / 3	The 3 fake tests are tautologies.
lib.rs	22	clean
utils/cargo_build_cache.rs	483	6 / 1 / ~4 / 0	7 needless pub items.
utils/cargo_home.rs	191	1 / 0 / ~6 / 0
utils/cargo_workspace.rs	690	4 / 2 / ~12 / 0
utils/composer_version.rs	415	5 / 0 / ~8 / 0	Dead composer_version_identity_key.
utils/concurrent.rs	429	3 / 2 / ~8 / 1
utils/containment.rs	216	3 / 2 / ~3 / 0
utils/digest.rs	224	0 / 2 / ~5 / 0
utils/durability.rs	365	3 / 4 / ~25 / 1
utils/env_compat.rs	193	2 / 1 / ~3 / 0
utils/failpoint.rs	87	0 / 0 / 0 / 0	Small hit() cleanups.
utils/fs.rs	1991	7 / 5 / ~65 / 5	The 5 fake tests are redundant.
utils/go_env.rs	287	3 / 1 / ~3 / 0
utils/go_installed_tools.rs	644	7 / 2 / ~2 / 1	12 needless pub items.
utils/group_commit.rs	2163	4 / 2 / ~20 / 2
utils/hatch.rs	1738	7 / 3 / ~12 / 1
utils/hatch_workspace.rs	604	6 / 1 / ~8 / 0
utils/http.rs	546	1 / 2 / ~6 / 1
utils/line_endings.rs	238	clean	Callers re-derive it: A04.
utils/lock_fragments.rs	654	2 / 1 / ~4 / 0
utils/mod.rs	45	visibility only
utils/notice.rs	99	1 / 0 / 0 / 0
utils/npm_range.rs	117	2 / 0 / 0 / 0
utils/package_manager.rs	31	0 / 0 / 0 / 0	One-function module: A13.
utils/pdm_lock.rs	1315	4 / 3 / ~10 / 2	Dead wheel_matches.
utils/pep440.rs	347	0 / 1 / ~1 / 0
utils/pipenv.rs	224	2 / 1 / ~8 / 3	The 3 fake tests duplicate process.rs tests.

The detailed cleanup lists are in each file's notes in coverage/files.tsv.

Structural findings

Both bugs were shown by scratch tests in a throwaway worktree. No product code was changed.

• A01, bug, filed #1832. The build-cache cleaner reads .cargo/config.toml where cargo reads .cargo/config. Run with both files present, it resolved ws/modern where cargo uses ws/legacy.
• A02, bug, filed #1833. members = ["crates/[ab]*"] resolves to [].
• A03, refactor, filed #1834. GOMODCACHE/GOPATH resolution is written twice, and the copies have drifted.
• A04 → Tracking: classify line endings in one place instead of five drifting rules #814. Line-ending re-derivations.
• To verify:
  • A05: fragment pairing ×3 and the pdm/poetry triad. Confirm when poetry_lock.rs is read.
  • A06: hex validators about 10×.
  • A07: commit_unjournaled skips the post-commit queues. The code is confirmed; reachability is not.
  • A08: ecosystem code in utils/.
  • A09: three env vocabularies.
  • A10: three home rules.
  • A11: version probe ×2.
  • A12: prune loops ×3.
  • A13: yarn major ×2.

Carried rows reconciled (5)

• E28: filed #782. Still real.
• E37: filed #748. The normalize_version and strip_leading_v twins remain.
• E41: filed #782. wired_integrity is still test-only.
• E52: rejected. The free go.sum helpers now have production callers, and the dead remove_lines is tracked by E58.
• E58: filed #782. All four functions still have no production caller.

Ruled out

• fs.rs's let _ = swallows (L785, L846, L856) are documented best-effort.
• go_env::user_config_dir reading only HOME is correct: it matches Go's os.UserConfigDir on Unix.
• cargo_home trims CARGO_HOME and only empty-checks HOME. The comments say this is deliberate.
• The hardcoded .socket/manifest.json literals in the CLI are all inside test modules.
• group_commit's catch_unwind is justified, because the profile is panic=unwind.
• The hatch batch-vs-sequential helper is backed by an exact-bytes test.

Next files

utils/pnpm_workspace.rs (1682), poetry_lock.rs, process.rs, purl.rs, purl_key.rs, purl_key_nuget_vendor_tests.rs, python_lock.rs, python_script.rs, redact.rs, relpath.rs, repo_root.rs, requirements.rs, and the rest of utils/ through workspace_globs.rs. That is about 16.4K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-cli-tests)

main @ c07af61. This is the first run of audit-cli-tests. I read 8 files, 15,949 lines, all complete with no partial: args.rs, then commands/agent_download.rs through commands/get.rs. The manifest needed no sync: since b291caa, main only modified 3 existing files, and none was added or deleted.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake tests.

File	Lines	Counts	Note
args.rs	1810	5 / 5 / ~75 / 9	Dead --vendor-source plumbing. 6 inline tests duplicate tests/cli_global_args.rs.
commands/agent_download.rs	1909	9 / 4 / ~110 / 1	Its tests live in get.rs. Dead FetchBatch.already_recorded.
commands/apply.rs	4324	27 / 4 / ~250 / 2	Broken string continuation at L3111. Three dead branches.
commands/bun_preflight.rs	425	3 / 3 / ~25 / 0	Three forwarders and a lazy-load mode.
commands/composer_hints.rs	314	4 / 0 / ~6 / 0
commands/context.rs	109	0 / 1 / ~6 / 0	Stale module doc, otherwise clean.
commands/fetch_stage.rs	649	5 / 1 / ~20 / 3	Orphan doc comment. 2 tests can't fail.
commands/get.rs	6409	21 / 4 / ~160 / 23	19 tests copy core tests. ~2,800 lines of agent_download tests.

Each file's detailed cleanup list is in its notes column in coverage/files.tsv.

apply.rs L3111 bug, shown by cat -A. The gradle_m2_may_be_unconsumed detail lost its \ line continuations, so the message carries three runs of 17 spaces. I put it in the local notes because it is a one-line fix inside the file.

Structural findings

• T01 → #1835. get <uuid> in agent mode re-implements download_and_apply_patches_into.
• T02 → #1836. The vulnerability JSON is built three times. Get's options[] copy is unsorted and drops description. This is from reading the code: it iterates a HashMap. I did not execute it.
• T03 → #1837. The env scrub lists are hand copies, and SOCKET_NO_SOCKET_YML is missing from them.
• T04 → #1838. fetch_stage keeps a drifted copy of core's fetch-summary formatter.
• T05 → #1839. The Bun and vlt preflight glue is repeated at 5 callers.
• To verify:
  • T06: variant gating copies core.
  • T07: the VexSummary literal is written 7 times.
  • T08: apply/rollback mirror pieces, under Tracking: one agent-mode patch engine for apply and rollback #771.
  • T09: the lock-acquire sequence.
  • T10: the severity ladder.
  • T11: DownloadParams copies GlobalArgs, under Tracking: build one RunCtx in main and stop mirroring CLI flags into the process environment #793.
  • T12: composer.lock parsing in the CLI.
  • T13: overlay staging root.
  • T14: mode resolution in get and scan.
  • T15: top-ranked selection is written 4 times.

Carried rows reconciled (5)

Each was checked against the code on c07af61:

• C54: already fixed (#982). Get sets Status::PaidRequired on both paths.
• C56: already fixed (#998). apply probes with manifest_exists and refuses a stat error.
• C70: already fixed (#1062). Scan's human arm exits 0 on an empty discovery.
• C73: already fixed (#1066). rollback's summary.failed counts the hosted and vendored legs.
• C76: already fixed (#1123). validate_paths no longer refuses a directory manifest.

Already covered, not re-filed

• Get's search path has no 401/403 proxy fallback. That is C09, #647.
• apply_env_toggles is called at 10 command entry points. That is C10, #794.
• The three boolean env vocabularies are A09 and C19, #793.
• The one-variant VendorSource is C23, #782.
• rollback.rs's metadata().is_err() probes (L682, L1455, L3186) will be checked when rollback.rs is audited.

Ruled out

• apply.rs manifest probing is correct (C56 is fixed).
• synthesize_vendor_owned_results has a documented stack-frame reason to stay a separate function.
• composer_hints .contains asserts on hint prose are acceptable, because the output is prose with no code.

Next files

commands/hosted_bundle.rs, hosted_unwind.rs, list.rs, lock_cli.rs, mod.rs, pypi_reinstall.rs, remove.rs, repair.rs and rollback.rs (6,525). That is about 13K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture refactor (sweep)

main @ c07af61. This is the first run of the refactor routine on this thread. No earlier entry existed and no maintainer steering was posted, so I swept the first audited, unswept row in coverage/files.tsv: crates/socket-patch-cli/src/args.rs (1810 lines). Open PRs don't touch it. #1698 touches agent_download.rs, apply.rs and get.rs, so those wait.

PR: #1842, ready for review, with CI and Bugbot pending.

args.rs

• Inlined: 3 functions. unsupported_ecosystem_message, telemetry_credentials, and refuse_unloaded_deno_prefix (into its one caller, Commands::validate_paths).
• Flattened: 1. validate_paths uses one require_dir instead of two copies of the same block.
• Comments: about 110 lines removed. These were history notes, bare #444 / #745 / #1123 references and text that restated the code. --help doc comments are untouched.
• Tests: 12 deleted, 4 fixed.
  • 9 deleted as duplicates of tests/cli_global_args.rs or of another inline test.
  • 3 deleted because they can't fail: two assert constant VendorSource predicates, and one checks a hand-written list against itself.
  • The 4 fixed tests (ecosystem messages, telemetry_auth, use_public_proxy threading, and the vendor-source test name and comments) each fail when the code is broken; I checked that for the non-trivial ones.
• Net lines: production −94 (args.rs −117, lib.rs +23), tests −232.

Merges recorded

None.

Lessons

• The coverage note "drop api_client_overrides empty filter" was wrong. build_proxy_fallback_client uses proxy_url without filtering empties, so the filter is load-bearing. I kept it and documented why.
• Clap field doc comments are --help text, so a sweep must not trim them.

Next

Structural work, per the alternation rule. The top candidates are A01 (#1832) and A02 (#1833), both scoring 7.

[github-actions[bot]]

[agent] 2026-10-29: handover from audit-core to audit-cli-tests

Found while auditing crates/socket-patch-core/src/utils/ at c07af61. Both are in your files.

• crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs L185 re-implements encode_uri_component instead of importing core's utils::uri helper (uri.rs).
• crates/socket-patch-cli/src/lib.rs L475-L562: 14 looks_like_uuid_* tests re-test core's uuid rule. That rule is being consolidated by A15 (#1845), so one smoke test is enough.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-core)

main @ c07af61. I read 20 files, about 16.4K lines, all complete with no partial: the rest of utils/, from pnpm_workspace.rs through workspace_globs.rs. utils/ is now fully audited. No product code was changed and nothing was executed: every finding below comes from reading the code, with permalinks. Where a finding would need a run to prove a behavior claim, it stays to verify.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests.

File	Lines	Counts	Note
pnpm_workspace.rs	1682	3 / 4 / ~12 / 0	Two dead pub wrappers. A17, A08
poetry_lock.rs	1859	3 / 3 (+2 aliases) / ~8 / 2	Dead lock_writer_version. A05, A18
process.rs	783	1 / 2 / ~25 / 2	Stale stderr docs
purl.rs	1428	2 / 9 / ~25 / 15	15 tautology tests. A14
purl_key.rs	633	4 / 1 / ~8 / 1
purl_key_nuget_vendor_tests.rs	151	0 / 0 / ~6 / 0	Misplaced end-to-end test
python_lock.rs	2283	4 / 4 / ~15 / 2	Dead complete_python_lock_metadata. A24, A25
python_script.rs	1768	1 / 5 / ~30 / 0	Always-None parameter. A15, A22
redact.rs	552	0 / 0 / ~6 / 1	Dead strip_url_credentials. A20
relpath.rs	232	0 / 0 / ~4 / 0	Clean code, false doc. A19
repo_root.rs	363	3 / 1 / ~3 / 0	A21
requirements.rs	1125	1 / 2 / ~14 / 0	Stale module doc. A23
serde.rs	21	0 / 0 / ~6 / 0
socket_cli_config.rs	527	1 / 1 / ~8 / 0	A09, A10
socket_dir.rs	492	0 / 0 / ~8 / 0	A12, A16
target.rs	762	3 / 1 / ~6 / 0	Dead Target::ambiguity
toml_edit_ext.rs	42	2 / 0 / ~2 / 0	Delete the module
uri.rs	49	clean
uv_workspace.rs	214	1 / 0 / ~11 / 0
workspace_globs.rs	1445	2 / 2 / ~15 / 0	Duplicate segment_glob_matches. A02

The detailed cleanup lists are in each file's notes in coverage/files.tsv.

Structural findings

Filed (5):

• A05: confirmed. #1844 asks for one lock_fragments driver for pdm and poetry.
• A15: #1845, uuid shape is checked 4 ways.
• A17: #1846, pnpm packages: refuses brace and class globs the shared matcher reads.
• A18: #1847, the poetry pre-1.4 writer rule is written twice and the shared reader is dead.
• A20: #1848, the redact credential stripper is dead while vex::product's copy serves production.

Added to an open tracker: A14, purl name@version split ×12. I commented on #748 instead of filing a new issue.

New rows left to verify:

• A16: JSON ledgers are written 2–3 ways. Fixing it changes manifest bytes.
• A19: four .. folders.
• A21: three .git walks.
• A22: uv settings ×2.
• A23: hosted requirements lexer.
• A24: two hosted-pin rules.
• A25: PEP 508 name ×3.

Existing rows extended:

• A02: npm_crawler::expand_workspace_pattern_sync has no brace expansion. I did not execute this.
• A06: poetry and pdm artifact validators.
• A08: pnpm_workspace → redirect, purl_key → crawlers/vendor, and python_lock.
• A09, A10: process and socket_cli_config each add another home or env reader.
• A12: socket_dir::prune_empty_dirs callers.

Handover: two CLI test duplicates went to audit-cli-tests.

Carried rows reconciled (5)

• E04: already fixed (#572). One recognizer stack remains; the residual pdm/poetry vs uv rule is now A24.
• E05: filed #595. The issue is open, and the Maven crawl is still unscoped.
• E10: filed #715. maven_repo.rs still uses no shared XML reader.
• E12: rejected. The LockIndex path is an accelerator that is re-checked by the scan's own predicates, so it is one rule, not two copies.
• E14: already fixed (#1188). Vendored Pipenv splices through formats::pipenv.
• Next carried row: E96 looks fixed. Every reader goes through requirements::parse_requirement, and the vendored parse_requirement_line is gone. I will reconcile it next run.

Ruled out

• CommandRunner has two production impls, so it is a real seam.
• pnpm env_setting and pnpm_env_setting encode different coercions on purpose.
• same_hosted_artifact is not a fourth E04 recognizer: it delegates to replaceable_hosted_pin first.
• PEP 503 canonicalization has one implementation.
• SourcesLayout changes bytes and is pinned by tests.
• Picomatch { negated } carries meaning as an Option.
• The ExtglobMatcher memo key is sound.
• The write_json_ledger failure tests use real filesystem errors, not mocks.

Next files

All of api/:

File	Lines
blob_fetcher.rs	1191
client.rs	6356
date.rs	528
mod.rs	7
ranking.rs	986
retry.rs	561
types.rs	663
vendor_prefetch.rs	1705

That is about 12K lines. After that come crawlers/cargo_crawler.rs and onward, to about 15K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture refactor (structural)

main @ c07af61. The previous run was a sweep, so this run was structural. A01 #1832 and A02 #1833 both score 7. A02 is blocked: the open #1829 touches workspace_globs.rs and npm_crawler.rs. So I took A01. There was no maintainer steering.

PR: #1849, ready for review, with CI and Bugbot pending.

What changed

• cargo_build_cache::ConfigDirs::read now takes its files from source_replacement::config_layer_paths, and I deleted its own walk and file pick. When both files exist, the cleaner now reads .cargo/config over config.toml, as cargo 1.93 does (checked with real cargo).
• /code-review high found that build_dirs_with walked the ancestors of the cwd as given. With the default --cwd ., from a workspace member, it found no build dir. It now walks std::path::absolute(cwd).
• The file probe consults group_commit::exists, so it agrees with the capture-aware read.
• Tests: 2 added, each shown red→green. My first version of the relative-cwd test could not fail, because a relative path with components still walks upward. I replaced it with a chdir under #[serial].
• Net lines: production about −7, tests +56.

Merges recorded

None. #1842 is still open.

Lessons

• See the Notes in the register: absolutize --cwd before any upward walk, and test that with "." after a chdir.
• vendor/cargo_config.rs keeps a third .cargo/config pick. I left it for that file's sweep.

Next

A sweep: commands/bun_preflight.rs onward.

[github-actions[bot]]

[agent] 2026-10-29: architecture refactor (sweep)

main @ c8e26f6. The previous run was structural, so this run was a sweep. There was no maintainer steering, and no PR of mine merged or closed. The next audited, unswept rows were four files in cli/src/commands/: bun_preflight.rs, composer_hints.rs, context.rs and fetch_stage.rs. No open PR touches them.

PR: #1855, ready for review, with CI and Bugbot pending.

Per file

• bun_preflight.rs: 1 function inlined (refusal_with_exemptions), plus one is_npm helper in place of 3 copies of the npm purl check. The no-op probe loop now runs only for the workspace-gate code. About 45 comment lines removed. Production −41, tests 0.
• composer_hints.rs: 3 bare #658 references removed. 4 tests now assert exact strings instead of .contains, including the relocated vendor dir on both hosted_reinstall_hint branches. Tests +11.
• context.rs: the wrong users in the module doc and a wrong doc link fixed, #745 dropped. −2.
• fetch_stage.rs: 1 function inlined (report_offline_missing) and 2 single-use constants inlined. The orphaned vendor-stager doc deleted. 2 tests deleted because they can't fail (they cover archive stores nothing reads). 1 test fixed: the fully-cached test now also runs online, and it fails red when the missing_blobs.is_empty() fast path is broken. Production −39, tests −51.
• Net: production about −82, tests about −40.

Not done

The audit notes' collapse of the three bun_vendor_preflight* entry points and the StageOutcome::Unavailable payload both need edits in get.rs / agent_download.rs / vendor.rs / apply.rs, which #1698 touches.

Merges recorded

None.

Lessons

• Check every caller file a signature change reaches against open PRs, not only the file being swept: vendor.rs turned out to be in Fix Go patch delivery, audits, and reinstalls #1698.

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-cli-tests)

main @ c8e26f6. I read 10 files, 15,560 lines, all complete with no partial: commands/hosted_bundle.rs through commands/rollback.rs, then commands/scan/discovery.rs. The manifest needed no sync: since c07af61, main changed only CI files, and no .rs file was added or deleted. There was no maintainer steering on the discussion.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests. Each file's cleanup list is in its notes column in coverage/files.tsv.

File	Lines	Counts	Note
hosted_bundle.rs	182	1 / 0 / ~2 / 0	Stale stdin schema. Ad-hoc json! error. Hand-built ApiClient skips api_client_overrides.
hosted_unwind.rs	170	0 / 1 / ~3 / 0	Dead HostedLegOutcome::unsupported, which rollback still branches on (C23).
list.rs	1102	1 / 1 / ~20 / 1	ordering_is_deterministic_across_builds can't fail. Hand-built uuid-only record.
lock_cli.rs	596	4 / 0 / ~30 / 4	Most sites bypass the wrapper (T09).
mod.rs	675	3 / 1 / ~8 / 3	global_scope_flag duplicates ui::global_scope_arg and has drifted.
pypi_reinstall.rs	206	clean
remove.rs	2184	10 / 3 / ~90 / 1 + 5 dup	run is 924 lines.
repair.rs	1349	8 / 1 / ~45 / 1 + 3 dup	The ArtifactNoun parameter only ever takes one value.
rollback.rs	6525	25 / 2 / ~120 / 1 + 3 weak	run is 1,214 lines. The file doubles as remove's helper library.
scan/discovery.rs	2571	4 / 4 / ~35 / 11	Copies of core tests. Its shell_word copy has drifted (T18).

Structural findings

• T09 → #1858, lock acquisition.
  • Re-verified with counts. The sequence is open-coded at 9 sites, and the timeout conversion appears 14 times.
  • lock_held has 3 different human renderings.
  • scan/hosted prints the human error to stderr even under --json.
• T16 → #1861, vendored revert rendering. remove and rollback each render VendorRevertStep in their own loop.
  • remove has no WouldRevert if preserve arm. So remove --preserve-state --dry-run previews vendor_would_revert where the wet run reports vendor_state_preserved.
  • I confirmed this by reading the code: remove.rs L1421-L1438 vs rollback.rs L1039. I did not run it; a cold build was stopped to save time.
• T18 → #1859, shell_word. discovery's private copy quotes POSIX-style on Windows and leaves % bare.
• T23 → #1860, terminal-safe text filter. Only core drops bidi and zero-width characters, so list passes them through from API text.
• To verify:
  • T17: the "no manifest" gate is written 3 times and has drifted. It overlaps the open decision Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo #1352.
  • T19: GC human text and warning channel.
  • T20: the error-emit helper.
  • T21: the warning sink and its --silent rule.
  • T22: rollback's before-blob gate uses metadata(), where the engine uses symlink_metadata().is_file(). It fails closed. Not executed.
• Rewritten rows:
  • T08: the printer-drift claim was wrong. Core never sends an empty hash, so the output is the same. The build-sibling rule has drifted in meaning: apply counts any copy in the gem home, rollback only a variant-matched copy.
  • T10: the severity ladder exists once. The "worst label" picker has 3 copies, and they have drifted on unknown labels.

Carried rows reconciled (5)

• C25: already fixed (#1049). --download-mode, the diff path and qbsdiff are gone.
• C45: already fixed (#1049).
• C74: decision #1352. That issue supersedes Decide: make the command model read-only scan plus fix/undo/sync, with mode taken from project state, and make "nothing to undo" exit 0 #1088. remove, repair and rollback still exit 1.
• C78: already fixed (#1220). UpstreamClient now takes registry_concurrency() permits.
• C79: already fixed (#1273). GC now reports through one GcReport. The remaining human and warning drift is T19.

Next to reconcile, from the reading:

• C50 looks fixed. ArtifactReferences::active keeps beforeHash blobs.
• C43 looks fixed for remove and repair. Both use project_root().

Handover

To audit-core:

• the uuid-only record in vendor/mod.rs;
• supplement_purl, which duplicates the CLI's shape rule (A14);
• a stale client.rs comment;
• policy::strip_unsafe for T23.

Ruled out

• T10's ladder: every copy already delegates to core severity_order.
• rollback.rs L1440 manifest probe: it uses manifest_exists, so it is fixed. The ledger probe at L1454 (metadata(state.json).is_ok()) is a residual of C56. It is a local note.
• discovery's debug_assert!(false) refetch: it can't be reached.
• C09, C16 and C38: discovery has no proxy fallback, no batch constants and no private cap.
• C73: it stays fixed.

Next files

• commands/scan/gc.rs, scan/hosted.rs, scan/hosted/{nuget,python,takeover}.rs, then scan/mod.rs (5,264). That is about 13.4K lines.
• If time allows, scan/policy.rs.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: handover from audit-cli-tests to audit-core

Found while auditing crates/socket-patch-cli/src/commands/ at c8e26f6. All four sites are in your files.

• vendor/mod.rs L943-L951 hand-builds a uuid-only PatchRecord in a closure. It should call ledgers::uuid_only_record. The CLI copies are in the notes for list.rs and commands/mod.rs.
• hosted/memory/discover.rs L162-L171: supplement_purl copies the CLI's scan/discovery::crawled_from_purl shape rule. The two are identical today. Its test asserts hand-written literals instead of the shared rule, so nothing stops them drifting. This belongs with A14 / Tracking: build and classify purls through one validated utils::purl API #748.
• api/client.rs L3175-L3179 cites "get.rs severity_rank", which has moved to agent_download.rs (T10).
• policy::strip_unsafe is the target helper of T23 (#1860). Generalizing it to keep \n/\t touches policy/mod.rs.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-30: architecture refactor (sweep)

main @ 5ca5623. The previous run was a sweep, so this run looked for structural work first. Every candidate scoring 6 or more has files held by an open PR:

• A30 #1887 (~8.7) is blocked by Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886 (maven_scope.rs, maven_reactor.rs).
• A05 #1844 (~8) is blocked by Fix Poetry lock writer read three ways (#1847) #1865 (poetry_lock.rs).
• T09 (~7), T01 (~6.4) and T25 (~6) are still blocked by Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864 and Fix Go patch delivery, audits, and reinstalls #1698.
• A32 #1888 (~6) is blocked by Build: share one test RNG across randomized tests (#1868) #1882, which touches all three crawlers.

So I ran a sweep, per the rule. The next audited, unswept row with free files is scan/gc.rs. scan/policy.rs was skipped because its getters are called from scan/mod.rs, which #1856 and #1884 hold. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1892, ready for review. /code-review high ran first; CI and Bugbot are pending.

Per file

• scan/gc.rs:
  • 1 wrapper deleted (count → ui::plural).
  • The duplicated pre-lock ledger gate and lock acquire are now written once each (has_ledger, lock).
  • 4 fields and total_bytes made private.
  • About 40 comment lines removed, including 6 test banners and the bare #998, #1063, #1278 and B20 references. One stale contract doc was fixed.
  • Tests: 12 deleted or merged, leaving 17.
    • The 5 PurlKey spelling tests became 1, which now also covers the empty-scan and short-composer cases. Shown red→green.
    • The vendored pair became 1, shown red→green.
    • The vendored-lines, preview/parity and corrupt-manifest duplicates were folded into their siblings with exact assertions.
  • Net: production −37, tests −232 (+173 / −442 total).
• Callers: none changed. print_gc_vendored_line (vendor_flow) and gc_into's dry_run parameter wait on Fix vendored dry-run counting in-sync patches (#1850) #1856.

Behavior

None.

Merges recorded

None.

Lessons

• /code-review found the ledger gate's cwd-vs-project_root() mismatch (C43, pre-existing). It is left for an issue because the fix changes behavior.
• When merging tests, keep each test's negative half: the review caught that merging dropped the "gone variant still prunes" cases.
• The sandbox proxy refuses branch deletions. The stale arch-refactor/sweep-scan-gc-policy needs a maintainer to delete it.

[github-actions[bot]]

[agent] 2026-10-30: architecture refactor (sweep)

main @ 5ca5623. The previous run was a sweep, so this run looked for structural work first. Every candidate scoring 6 or more still has files held by an open PR:

• A30 (Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886), A05 (Fix Poetry lock writer read three ways (#1847) #1865) and A32 (Build: share one test RNG across randomized tests (#1868) #1882, and now the fixer's Fix env-keyed probe memo written three ways (#1888) #1895);
• T09, T01 and T25 (Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864, Fix Go patch delivery, audits, and reinstalls #1698).

The free candidates, A20 and A26, score about 4. So I ran a sweep, per the rule. The next audited, unswept row with free files is scan/hosted.rs. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1897, ready for review. /code-review high ran first and found no bugs in the diff. CI and Bugbot were pending at handoff.

Per file

• scan/hosted.rs (all but the 1,233-line run_redirect_selected_untracked, which is T24):
  • 1 fn inlined (emit_json_error), and run_redirect's dead human arm deleted (it runs only under --json).
  • 1 test-only wrapper deleted (installed_stale_positive_evidence), and 1 #[cfg(test)] re-export shim of 17 core items deleted.
  • The gem probe's vendor/cache fold is flattened. Shown red→green.
  • About 120 comment lines removed, including 3 banners and bare issue references.
  • Tests: 13 guidance tests moved to core hosted/guidance.rs, and 2 pnpm lock-sniff tests moved to formats/pnpm/mod.rs.
    • 1 duplicate test deleted.
    • 1 test's missing \/-escaped assertion added, shown red→green.
  • Net: production −147, tests −595 in the file. Repository-wide: +696 / −847, most of it the move.
• Callers: scan/mod.rs passes the envelope by value (±1).

Behavior

None.

Merges recorded

None.

Lessons

• /code-review found two pre-existing gaps in the gem stale probe's pass 3:

  • it dedups vendor/cache warnings by purl string;
  • it builds the archive name without the platform suffix.

  Both change output, so they were noted for an issue rather than fixed in the sweep.

• When a doc comment claims a case, check that an assert covers it. The moved heal-probe test documented three URL spellings but asserted only two.

[github-actions[bot]]

[agent] 2026-11-01: architecture audit (audit-core)

main is at cbbbdb9. Since 5ca5623 it has gained one commit (#1796). This run read 8 files, about 12.9K lines, all to the end: the rest of crawlers/maven_crawler/, maven_pom_equivalence_tests.rs, maven_scope.rs, crawlers/mod.rs, npm_crawler.rs and npm_crawler/oracle.rs. npm_crawler.rs was read in three parallel slices (L1-L2612, L2600-L4818, and tests L4819-L8796). No product code was changed. One behavior claim was executed with a throwaway integration test, which was then deleted (A45). The coverage manifest matches main, with no files added or removed.

Per file

Counts are single-caller fns / wrappers / deletable comment lines / fake or duplicate tests.

File	Lines	Counts	Note
crawlers/maven_crawler/local_repo_tests.rs	309	clean	Real tests; its write helper duplicates one in scala_cache_tests
crawlers/maven_crawler/oracle.rs	181	test-only	Imports the production POM/path parsers it checks (A29)
crawlers/maven_crawler/scala_cache_tests.rs	535	– / – / ~2 / 3	Hermetic is a 12th env guard (A37); 2 misplaced tests; 1 test of the oracle itself
crawlers/maven_pom_equivalence_tests.rs	154	– / – / ~3 / 0	Belongs under maven_crawler/
crawlers/maven_scope.rs	900	4 / 2 / ~10 / 0	A40; prefetch is serial; caps untested
crawlers/mod.rs	99	clean
crawlers/npm_crawler.rs	8796	45 / 20 / ~440 / 25	A41-A45; duplicates crawlers/listing.rs types
crawlers/npm_crawler/oracle.rs	1938	test-only	Retire: circular, not verbatim, misses the newer layouts (A29)

The detailed cleanup lists are in each row's notes. Further detail for npm_crawler.rs:

• Identical functions: parse_npm_root_output is the same as parse_pnpm_root_output.
• Mixed return types in the global probes: Result<String,String>, Option<String> and Result<Option<String>,String>.
• Mode parameters: live_bun_store_entries_sync and reach_bun_store_entries_sync switch modes on Option parameters, and BunStoreDirs::entry_of returns Option<Option<Reached>>.
• Two glob walkers in this file, beyond A02: skipped_members_of silently truncates at WORKSPACE_GLOB_DIR_BUDGET, while expand_workspace_pattern_sync returns None there.
• Never-erroring Results: get_node_modules_paths and find_by_purls return Result but never return Err.
• Stale comments: they refer to a check_package that no longer exists (L2265, L3726, L3931).
• Test hook in production code: VARIANT_STORE_SCANS (L4609).

Structural findings

Filed (4):

• A41: #1899. Store children of node_modules are classified three times (resolver, scan, peer finder). Only the scan skips stores found inside a store entry. There are also 4 store-entry shapes, about 7 package-child filters and 5 @scope expansions.
• A42: #1901. The yarn-classic .yarnrc tokenizer is written twice, and the copies drifted on single quotes.
• A43: #1900. package.json workspaces has 5 readers.
• A45: #1902, a bug, executed. Under the default --cwd ., yarnrc_modules_folder and relocated_yarn_pnpm_store_sync walk the lexical ancestors of .. In the run, an absolute cwd found pkg:npm/foo@1.0.0 under a parent .yarnrc modules folder, and . found [].

New rows left to verify:

• A40: the effective-POM walk is written in both maven_scope and maven_reactor. Extends E83.
• A44: the .modules.yaml reader is written twice, and a YAML unquote is copied.

Register statuses refreshed:

• A05 is in PR #1898, A32 is in PR #1895, and A37 is in PR #1891.
• A29 now notes that the npm oracle should be retired.
• No merged PR resolved an open arch-audit issue.
• There is no maintainer steering on socket-patch implementation review (living document, file by file): abstraction, duplication, mechanisms, tests #1830.

Carried rows reconciled (5)

• E80: already fixed (#1061). Maven .jar and NuGet .nupkg files get a uuid .gitignore override.
• E90: already fixed (#1098). The stale guard and vex share bundler_uses_system_gems.
• E93: filed #833. The identity half is fixed. normalize_nuget_version still lives in vendor/nuget_feed.rs, which is a placement item.
• E94: already fixed (#1235). Every backend reports the unserved code.
• E95: already fixed (#1270). scala_evidence::discover fails closed on an unreadable record.

Ruled out

• maven_scope::interpolate as a new finding: it is already one of A30's five copies.
• npm_crawler::parse_purl_components as a new row: it copies utils/purl.rs split_name_version, so it was added to A14/Tracking: build and classify purls through one validated utils::purl API #748's list of copies.
• The get_*_global_prefix_with pub items as dead code: they are reached by tests/crawler_npm_e2e.rs. They are injection seams rather than dead code, though the wrapper chain is still noted.
• Resolver alias search vs peer finder on a relocated Yarn store (is_npm_linked_store_entry): low confidence and unexecuted, so it is left as a note under A41.

Next files

• crawlers/nuget_crawler.rs (2784), nuget_crawler/oracle.rs (208), oracle_support.rs (171)
• pkg_managers.rs (1486), pnpm_layout.rs (340)
• python_crawler.rs (8143) and its two subfiles
• ruby_crawler.rs (6457, possibly partial)

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-11-01: architecture refactor (sweep)

main @ cbbbdb9. The previous run was a sweep, so this run looked for structural work first. Every candidate scoring 6 or more still has files held by an open PR:

• A30 (Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886);
• T09, T01 and T25 (Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864, Fix Go patch delivery, audits, and reinstalls #1698);
• the new A41 #1899 (npm_crawler.rs, held by Build: share one test env guard in core (#1889) #1891 and Fix hidden npm workspace members left unpatched (#1827) #1829);
• A43 #1900 (governing_root.rs in Fix pnpm brace and class workspace globs (#1846) #1863, vendor/mod.rs in Fix Go patch delivery, audits, and reinstalls #1698).

So I ran a sweep, per the rule. The next audited, unswept rows with free files are scan/hosted/nuget.rs and scan/hosted/takeover.rs; python.rs is in #1883. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1903, ready for review. /code-review high ran first; CI and Bugbot were pending at entry time.

Per file

• scan/hosted/takeover.rs:
  • 3 single-caller fns inlined (revert_keeps_wiring, residual_takeover_warning, drifted_takeover_warning). unwires_alias_copy was kept, because inlining it nested 5 closures.
  • 1 dead conjunct deleted.
  • The residual-reference literal is replaced by the core const, and the refusal code ×4 is now REVERT_FAILED.
  • KEPT_VENDORED is private.
  • About 12 comment lines changed, including 9 bare issue references.
  • Tests: none changed. The alias path is shown guarded by a mutation (classic_takeover_keeps_vendored_alias_copy_patched).
  • Net: production −28.
• scan/hosted/nuget.rs: the bare #352 was dropped (net −1). Its other notes (T27 json!, C12 placement, the sha512-strip twin) are structural.
• Total: +65 / −94, all production.

Behavior

None.

Merges recorded

None.

Lessons

• /code-review found two pre-existing gaps in the takeover's residual refusal. It builds the pin from an undecoded purl, so %2B would reach the advice. It also disagrees with core kept_for_residual_reference on kept_artifact, which matters for dry-run pypi reverts. Both change output, so they were left out of the sweep.
• No test asserts that refusal's detail text.

[github-actions[bot]]

[agent] 2026-11-01: architecture refactor (sweep)

main @ cbbbdb9. The previous run was a sweep, so this run looked for structural work first. Every candidate scoring 6 or more still has files held by an open PR:

• A30 (Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886);
• T09, T01 and T25 (Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864, Fix Go patch delivery, audits, and reinstalls #1698);
• A41 (npm_crawler.rs, now also held by the fixer's Fix crawlers missing parent dirs under --cwd . (#1902) #1906);
• A43 (Fix pnpm brace and class workspace globs (#1846) #1863, Fix Go patch delivery, audits, and reinstalls #1698).

So I ran a sweep, per the rule. scan/policy.rs and scan/render.rs still wait on #1856 and #1884, so the next audited, unswept rows with free files were core constants.rs and utils/{cargo_home,composer_version,concurrent,containment,digest,durability,env_compat,failpoint}.rs. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1907, ready for review. /code-review high ran first, and its 3 confirmed findings are fixed. Bugbot was triggered; CI was still running at hand-off.

Per file

• constants.rs: 2 tautological tests deleted, and the URL test trimmed to the https/no-slash/distinct asserts. About 4 history comment lines removed. Net −33.
• cargo_home.rs: about 9 comment lines of module-doc story and bare #1135 refs removed. Net −7.
• composer_version.rs:
  • 1 dead pub fn deleted (composer_version_identity_key). composer_versions_equivalent now uses the PurlKey key.
  • 2 pairwise tests merged into 1 that is checked against an independent spec, shown red→green.
  • About 8 comment lines removed.
  • Net −37, plus −5 in purl_key.rs tests.
• concurrent.rs:
  • 1 duplicate const deleted (MAX_API_CONCURRENCY), and 1 fn inlined (adaptive_concurrency).
  • 5 consts made private or pub(crate), and the env override is now read once.
  • The per-window test asserts literals, shown red→green.
  • Net −20.
• containment.rs:
  • 1 fn inlined (socket_project_root), 1 fn moved to socket_dir.rs (nearest_socket_dir), and 1 fn made private.
  • The moved test gains a nested-.socket case, shown red→green.
  • Net −29 here, +19 in socket_dir.rs.
• digest.rs: a banner and a stale note removed. Net −4.
• durability.rs:
  • The take/sync/restore sequence is shared (sync_or_restore), sync_all_blocking is private, and a dead if let is removed.
  • About 6 history comment lines removed, and 1 overclaiming test renamed.
  • Net −11.
• env_compat.rs: 1 private env_flag replaces 2 copies. Net −2.
• failpoint.rs: the match is flattened. Net +1.
• Total: +163 / −291, about −52 production and −76 test lines.

Behavior

None.

Merges recorded

None.

Lessons

• git checkout <file> after a mutation test reverted my uncommitted concurrent.rs edits. I redid them; commit before mutating.
• Watch what /code-review flags:
  • narrowing pub items leaves private intra-doc links;
  • an inlined clamp loses a min guard, now a const assert;
  • a check placed ahead of the take split an atomic step.

[github-actions[bot]]

[agent] 2026-11-01: architecture audit (audit-cli-tests)

main @ cbbbdb9. I read 11 files, 14,247 lines, all complete with no partial: commands/scan/{rollout,rollout_args,socket_yml_args,vendor_flow,withdrawn}.rs, update.rs, user_patches.rs, vendor.rs, vendor_orphans.rs, and vendored_backend/{mod,repair}.rs.

• The manifest needed no sync: no .rs file was added or deleted. vendored_backend/repair.rs grew from 1,308 to 1,369 lines.
• There was no maintainer steering on the discussion.
• Four parallel readers did the reading. I re-checked each filed claim against main before filing it.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests. Each file's cleanup list is in its notes column in coverage/files.tsv.

File	Lines	Counts	Note
scan/rollout.rs	860	3 / 3 / ~2 / 0 + 11 misplaced	Its tests exercise only core rollout/stage.rs, which has none of its own.
scan/rollout_args.rs	126	0 / 3 / 0 / 2 dup
scan/socket_yml_args.rs	58	1 / 0 / 0 / 0	--min-severity is parsed twice. The second parse's error prefix is unreachable.
scan/vendor_flow.rs	2099	9 / 6 / ~25 / 3	Two preflight sets (T35). A test-only JSON shape.
scan/withdrawn.rs	350	2 / 2 / ~3 / 1	Untyped status (T39). --silent drift inside the file.
update.rs	613	5 / 1 / ~20 / 3	An unreachable Err arm. A version-tag parser copied from core that accepts vv3.4.0.
user_patches.rs	188	2 / 1 / ~2 / 0	The gate loop is written 5× (T38).
vendor.rs	7937	~21 / 7 / ~70 / ~12	run_eject is 554 lines. Candidate selection is written twice (T36). The GC bypasses the backend (T37).
vendor_orphans.rs	242	1 / 1 / ~8 / 1	A stale test doc contradicts the const.
vendored_backend/mod.rs	405	1 / 1 / ~5 / 0	stop_on_failure is true only from remove.
vendored_backend/repair.rs	1369	7 / 1 / ~15 / 4	repair() is 570 lines.

Structural findings

• T35 → #1908. scan computes the vendored refusal preview twice.
  • preflight_refused_purls lacks pypi_refusals, so a refused PyPI patch holds a rollout slot.
  • A dry run runs every preflight twice.
  • I confirmed the drift by reading both functions side by side.
• T36 → #1909. plan_service_downloads copies the vendor loop's candidate selection.
  • The plan has no vlt refusal: the function takes no vlt input. It also has no vendor_variant_ambiguous check.
• T37 → #1910. run_vendor_gc bypasses VendoredBackend::revert.
  • It never reads outcome.error (confirmed with grep), though scan/gc.rs L529 says the error was printed.
  • It drops sweep.still_wired, saves the ledger once at the end and has no go_undo_warnings.
  • It is a child of T16/remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert) #1861.
• T38 → #1911. The user-patches gate loop is written 5×. I read all five copies.
• T39 → #1912. PackageVendorResult.status is untyped and interpreted 4×. Prefetch and withdrawn disagree on whether build_failed is settled.
• To verify:
  • T40: the Go consumer-sync audit, at 8 sites.
  • T41: the no-ledger-entry remedy, written 5× under 2 codes.
  • T42: the ledger-ownership predicate, written 4×.
• More evidence for existing rows:
  • T05: vendor_flow's two sets.
  • T09: vendor_flow L531, withdrawn L208, vendor.rs L1005/L2067. The eject journal-replay lock is dropped at once, so the hosted inventory and record fetches run unlocked.
  • T21: vendor.rs has 10 RunWarning {} literals and 0 ::new. print_refusals writes [warning] to stdout.
  • T25: vendor's 3 --vex copies drifted. Eject generates VEX after dropping the lock, and eject's dry-run branch is dead.
  • T30: vendor ignores a create_dir_all failure on put-back, while hosted maps it to an error.
  • C12: migrate_legacy_manifest_records, scan_vendor_references, the orphan sweep and Gate::may_admit are engine code in the CLI.

Carried rows reconciled (4)

• C05: already fixed (#615, #923, #966).
• C17: partly fixed (#865). About 60 inline digests remain, mostly tests. Compute sha256, sha1 and sha512-SRI digests through utils::digest instead of inline copies #706 was closed as not planned.
• C26: partly fixed (#1030). The journal layering was declined (vendor --check and vex misreport a crashed vendored run whose commit journal is pending, because only lock-taking commands replay it #809 closed as not planned).
• C30: partly fixed (#1124, #1258, #1366). git_sha256 is still copied in 4 e2e files and in core rollback_new_file_e2e.rs.

Handover

To audit-core, in entries/audit-core/ with the same timestamp.

Ruled out

• merge_vendor_envelope's hand-written summary sum: no Summary merge exists, and the sum is correct.
• The double sort/dedup in rollout upgrades: it is needed after extend.
• GC pass (b) skipping the pypi and gem advisories: this is intended, because the dependency has left the lock.
• load_state(..).ok() in eject (L2210): it fails closed.
• The println! calls in update.rs, repair.rs and vendor.rs L1-L4000: all are gated on --json/--silent.
• version-tag parser as a register row: it is a one-line local note on update.rs, not structural.

Next files

• vex.rs (2,789), vex_consumed.rs (1,028), vex_sources.rs (1,897), vlt_heal.rs (762), vlt_preflight.rs (288).
• Then ecosystem_dispatch.rs (2,856), interrupt.rs, json_envelope.rs (1,506), lib.rs (1,041), main.rs, path_scope.rs, and ui/*.
• That is about 14.9K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-11-01: handover from audit-cli-tests to audit-core

Found while auditing commands/scan/*, vendor.rs and vendored_backend/ at cbbbdb9.

• Core rollout/stage.rs (530 lines) has no tests of its own. Its 11 tests sit in CLI scan/rollout.rs L370-L859, and the refactor routine can move them when it sweeps stage.rs. Gate::may_admit (L113-L120) reads Stage internals and belongs on Stage.
• A21 cites "user_patches.rs L44" for a .git walk. The walk is in core patch/user_patches.rs L49/L65, not the CLI file of that name, so fix the citation.
• T39/#1912 touches core api/client.rs L1340-L1356 and api/vendor_prefetch.rs L439-L443. The ReferenceStatus enum belongs in api::types.
• update/release.rs parse_release_tag has a CLI near-copy (update.rs parse_version_pin, which accepts vv3.4.0). The CLI side is a local note; nothing is needed in core beyond keeping parse_release_tag pub.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-11-01: architecture refactor (sweep)

main @ cbbbdb9. The previous run was a sweep, so this run looked for structural work first. Nothing has merged since 2026-10-29, so every candidate scoring 6 or more is still held by an open PR:

• A30 (Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886);
• T09, T01 and T25 (Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864, Fix Go patch delivery, audits, and reinstalls #1698);
• A41 (npm_crawler.rs: Build: share one test env guard in core (#1889) #1891, Fix hidden npm workspace members left unpatched (#1827) #1829, Fix crawlers missing parent dirs under --cwd . (#1902) #1906);
• A43 (Fix pnpm brace and class workspace globs (#1846) #1863, Fix Go patch delivery, audits, and reinstalls #1698).

So I ran a sweep, per the rule. The next audited, unswept rows with free files are core utils/http.rs, line_endings.rs, mod.rs, hatch_workspace.rs and hatch.rs. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1914, ready for review. /code-review high ran first: I fixed 3 of its 8 findings and gave reasons for the other 5 in the PR. CI and Bugbot were pending at hand-off.

Per file

• http.rs:
  • 3 cap tests now assert the typed ReadCappedError instead of .contains("too large").
  • 2 tests added for the untested branches (the mid-stream cap and Truncated), each shown red→green by mutation.
  • 1 overclaiming test renamed, and about 5 comment lines removed.
  • Net: production −4, tests +42.
  • The String read_capped wrapper stays, because its callers are held by open PRs.
• line_endings.rs: clean.
• mod.rs: the hatch modules are sorted, and hatch_workspace is pub(crate). Net −1.
• hatch_workspace.rs: 1 fn inlined (expand), 1 constant take_while flattened, and 6 history comment refs removed. Net −1.
• hatch.rs:
  • 1 forwarder deleted (environments), and 3 hand copies of the hatch.toml merge rule and the tool.hatch lookup folded into merged_key and tool_hatch.
  • 2 duplicated Round builds folded into Round::new, 3 {root:uri} literals into Target::root_relative, and require_pip_installer now reuses parse_documents.
  • 13 bare issue refs removed.
  • Net −13, plus ±3 in vendor/pypi_hatch.rs.
• Total: +231 / −208, about −19 production and +42 test lines.

Behavior

None.

Merges recorded

None.

Lessons

• Check an audit note that merges two types against what each field holds. HatchPermission and HatchEdit share field names, but one holds whole files and the other a single line, so /code-review rightly rejected the merge.
• /code-review found a pre-existing gap. require_pip_installer_documents ignores the hatch.toml envs override (see Notes in the register).

[github-actions[bot]]

[agent] 2026-11-01: architecture audit (audit-core)

main is at cbbbdb9, unchanged since the last run. This run read 8 files, 13,604 lines, all to the end: crawlers/nuget_crawler.rs and its oracle, oracle_support.rs, pkg_managers.rs, pnpm_layout.rs, python_crawler.rs (in three slices: production L1-L1917, L1917-L3802, tests L3803-L8143) and its oracle.rs and pdm_site.rs. No product code was changed. Two behavior claims were executed with a throwaway probe binary and scratch builds outside the repo (A47, A48). The coverage manifest matches main.

Per file

Counts are single-caller fns / wrappers / deletable comment lines / fake or duplicate tests.

File	Lines	Counts	Note
crawlers/nuget_crawler.rs	2784	11 / 4 / ~75 / ~11	A46; ~8 tests copy crawler_nuget_e2e; NugetEnv guard (A37)
crawlers/nuget_crawler/oracle.rs	208	test-only	Drifted (no #1202 normalization), calls production paths; delete (A29)
crawlers/oracle_support.rs	171	0 / 1 / 0 / 0	General test scaffolding, not oracle-only (A51)
crawlers/pkg_managers.rs	1486	5 / 2 / ~45 / 9	A48 (12 non-hermetic tests, executed), A52
crawlers/pnpm_layout.rs	340	3 / 1 / ~4 / 0	A44 (YAML scalar ×3), depends on patch::redirect
crawlers/python_crawler.rs	8143	59 / 10 / ~120 / 15	A47 (executed), A49, A50; 2 dead/test-only pub fns
crawlers/python_crawler/oracle.rs	101	test-only	Copies purl_lookup/match_listing verbatim (A29)
crawlers/python_crawler/pdm_site.rs	371	3 / 0 / ~2 / 0	Third probe-cwd policy; tests real

Further detail for python_crawler.rs:

• Truthy parsers: 7 in the file (PDM ensure_boolean ×2, Pipenv env_to_bool ×3, Poetry ×2), none through env_truthy (added to A09). PYENV_ROOT= counts as set: executed, the global crawl lists <cwd>/versions/…/site-packages.
• Home/user dirs: env_home, pipenv_home_dir, uv/pipx/pipenv-workon candidates, 6 absolute-XDG filters (added to A10/A36).
• Mechanism deviation: add_system_site_packages does blocking std::fs inside async fns instead of fs::run_blocking.
• Copies inside the file: find_by_purls_listed re-implements visible; find_each_by_purl re-implements purl_lookup; the pipx loop repeats find_child_env_site_packages. get_global_python_site_packages is ~258 lines with nested fns.
• Tests: 106. Delete test_find_python_command, test_home_dir_detection, test_parse_pypi_purl* (dup purl.rs); 5 duplicate crawler_python_e2e; 2 in-file duplicates (test_find_python_dirs_literal, _pyenv_layout); #[serial] unneeded on 3 poetry tests; install_dist fixture ×3 across crates.
• Gaps: inherited_same_release, hatch_env_site_packages and non_hatch_local_venv_site_packages have no direct test.

Structural findings

Filed (4):

• A47: #1916, bug, executed. claimed_by_non_uv_manager tests contains("[tool.poetry") while declares_tool_poetry excludes plugin tables. A lockless uv project with only [tool.poetry-dynamic-versioning] and UV_PROJECT_ENVIRONMENT=env returned no env site-packages; with [tool.other-plugin] it returned env/lib/python3.12/site-packages.
• A46: #1917. The NuGet project walk is in both the crawler and vendor::nuget_config; the project-file test drifted on case, the walks on non-UTF-8 names.
• A44: #1918. Widened: three "last top-level YAML key, unquoted" readers drifted on quotes and empty values, besides the .modules.yaml twin.
• A48: #1919, test bug, executed. With YARN_NODE_LINKER=node-modules, 12 pkg_managers/pnpm_layout tests fail; with a ~/.yarnrc.yml linker, 11.

New rows left to verify: A49 (python env-dir naming ×3, verbatim strip ×3), A50 (user site ×2, site-packages-under-prefix ×3, PDM config ×2; drifted), A51 (~25 mkfifo test helpers), A52 (pkg_managers placement; root-linker read copied in lock_inventory/view.rs; npm-family ownership order ×3 extends E75).

Register statuses refreshed: A42 in PR #1915, A45 in PR #1906. A21's citation fixed to core patch/user_patches.rs L49/L65 (handover). Rows A02, A07, A08, A10, A14, A33, A40, A41 shortened to keep the register under 15,000 characters. No merged PR resolved an open arch-audit issue (main unchanged). No maintainer steering on #1830.

Handover from audit-cli-tests: the rollout/stage.rs row now carries the note to take its 11 tests from CLI scan/rollout.rs and host Gate::may_admit; it will be audited in order.

Carried rows reconciled (5)

• E21: filed #959 (open tracking).
• E22: partly fixed (#1008); revert half in open Tracking: drive the seven npm-family vendor backends through one generic driver #920.
• E24: partly fixed (#1245); four finish copies remain in open Tracking: revert every vendored backend through one record-revert engine instead of nine hand-written mechanisms #989.
• E26: partly fixed (#1036); Tracking: vendor every Maven shape through the jvm planner and retire the legacy single-pom backend #971 children and Move the v5 JVM vendor orchestration and Maven acquisition out of maven_repo.rs into vendor/jvm #972 open.
• E29: filed #959; placement half in open Tracking: move the pure lock codecs and neutral lock types into formats/ so formats imports nothing from vendor or redirect #833.

Ruled out

• Yarn vs python dotenv parsers: different upstream grammars; only the placement note stands.
• A second METADATA/PKG-INFO or project.assets.json reader: none in src, only fixtures.
• yarn_pnpm_store_folder_in vs yarn_node_linker_in rc walks: they resolve against different folders on purpose.
• NuGet package_roots vs project_restore_folders disagreeing on the legacy folder: deliberate (Since #446, scan -g --mode agent then rollback -g from a vendored NuGet project reverts the project's patched package in the shared global packages folder; the locked restore stays "up-to-date" and VEX keeps attesting #489).
• pipenv_workon_home accepting a relative XDG_DATA_HOME: matches Pipenv.
• Relative cwd in the NuGet walk (A45): restore_walk absolutizes locally.

Next files

• crawlers/ruby_crawler.rs (6457, possibly partial), sbt_evidence.rs (636) + sbt_evidence/tests.rs (527), scala_evidence.rs (901), types.rs (652), walk_pool.rs (541)
• then formats/bun, formats/cargo/*, formats/composer/*

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-11-01: architecture refactor (sweep)

main @ cbbbdb9. The previous run was a sweep, so this run looked for structural work first. Every candidate scoring 6 or more is still held by an open PR (A30, T09, T01, T25, A41, A43; nothing has merged since 2026-10-29). The audit's new rows score lower: A46 #1917 about 4 and A44 #1918 about 4. A47 #1916 and A48 #1919 are bugs for the fixer. So I ran a sweep. The next audited, unswept core rows with free files were utils/{notice,npm_range,package_manager,pep440,pipenv,purl}.rs. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1920, ready for review. /code-review high ran first: I fixed 2 of its 7 findings and gave reasons for the other 5 in the PR. CI (82 checks) and Bugbot are green.

Per file

• notice.rs: 1 fn inlined (is_muted). Net −4.
• npm_range.rs: the operator set written twice is now one is_operator. Net +1.
• package_manager.rs: nothing local. The yarn_major note is A13, and vendor/mod.rs is held by Fix Go patch delivery, audits, and reinstalls #1698.
• pep440.rs: the trailing-zero trim ×2 is now one trim_trailing_zeros, and 1 bare ref was dropped. Net 0.
• pipenv.rs:
  • 1 forwarder inlined (resolve_on_path).
  • 3 tests deleted that duplicate process.rs's resolver tests.
  • let _ = root replaced by _root.
  • Net: production −15, tests −90.
• purl.rs:
  • 1 alias deleted (JsrPurlParts), 1 wrapper deleted (is_purl, now inlined at 2 sites in target.rs), and parse_name_version made private.
  • About 30 comment lines removed (essay, REGRESSION/B73/remove and rollback don't PEP 503-normalise PyPI purl identifiers, so remove pkg:pypi/typing_extensions@4.7.1 exits 1 "No patch found" while get accepts the same identifier #1024 tags, banners), and 3 test modules folded into 1.
  • Tests: 16 tautological or duplicate tests deleted and 2 duplicates merged into the parse tests. 1 builder round-trip test added, shown red→green by mutating build_jsr_purl.
  • Net: production −37, tests −152.
• Total: +135 / −432, about −55 production and −242 test lines.

Behavior

None.

Merges recorded

None.

Lessons

• git checkout HEAD -- <file> after a mutation test bit again. It dropped the uncommitted review-fix test, which I re-applied. Commit every edit before mutating.
• /code-review found a pre-existing bug. npm_range_admits(">=", v) admits every version, where npm admits none. It changes output, so it is noted in the register for an issue.

[github-actions[bot]]

[agent] 2026-11-01: architecture refactor (sweep)

main @ cbbbdb9. The previous run was a sweep, so this run looked for structural work first. Nothing has merged since 2026-10-29, and every candidate scoring 6 or more is still held by an open PR (A30, T09, T01, T25, A41, A43). So I ran a sweep. The scan rows (policy, rollout, rollout_args, socket_yml_args, withdrawn) have free files, but their audit notes change callers in scan/mod.rs, which #1856, #1884 and #1897 hold. The next audited, unswept rows with free files were core utils/{redact,repo_root,serde,toml_edit_ext,uri,uv_workspace}.rs. A20 #1848 is local to redact.rs plus two free callers, so the sweep claims and fixes it. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1923, ready for review. /code-review high ran first: I fixed 3 of its 7 findings and gave reasons for the other 4 in the PR. CI (82 checks) and Bugbot are green.

Per file

• redact.rs:
  • 2 dead pub fns deleted (strip_url_credentials, url_userinfo), and vex::product::strip_url_userinfo moved in (A20), now built on userinfo_span.
  • 2 single-caller fns folded into secret_query_spans (query_span, query_pairs).
  • Tests: the deleted helper's test replaced by a table over the survivor; an empty-value case added, shown red→green by mutation; the advisory lint moved to vendor/service_fetch.rs.
  • Net −87 (production about −50).
• repo_root.rs: 1 fn inlined (GitRepo::dot_git), the module-doc monopoly claim and a bare B22 tag removed. Net −8.
• serde.rs: 7 doc lines removed. Net −7.
• toml_edit_ext.rs: stale module doc fixed. Net −1. Deleting the module waits on utils/mod.rs (Sweep core utils http, mod and hatch #1914) and vendor/pypi.rs.
• uri.rs: clean; 10 copied test lines dropped from vendor/yarn_berry_lock.rs.
• uv_workspace.rs: module-doc history cut. Net −8. Folding its two-call pattern waits on governing_root.rs (Fix pnpm brace and class workspace globs (#1846) #1863) and vendor/pypi.rs.
• Total: +114 / −219, about −100 production and −5 test lines.

Behavior

None, except that the npm upstream_registry_fallback warning no longer mangles a registry URL with an @ in its query or fragment (a pre-existing bug the move fixed). VEX @id bytes are unchanged.

Merges recorded

None.

Lessons

• A moved helper inherits its old bugs. /code-review found 3 pre-existing gaps in strip_url_userinfo and its npm caller; 2 change output and are noted in the register for issues.
• The core lib suite has 4 root-sandbox failures besides tests/repair's 2; they are now listed in the register.

[github-actions[bot]]

[agent] 2026-11-01: architecture audit (audit-cli-tests)

main @ cbbbdb9 (unchanged since the last run). I read 17 files, 14,967 lines, all complete with no partial:

• commands/{vex,vex_consumed,vex_sources,vlt_heal,vlt_preflight}.rs;
• ecosystem_dispatch.rs, interrupt.rs, json_envelope.rs, lib.rs, main.rs, path_scope.rs;
• ui/{mod,prompt,status,test_support,text}.rs;
• update_notifier.rs.

The manifest needed no sync, and there was no maintainer steering. Four parallel readers did the reading. I re-checked every filed claim against main. One claim was proven by a throwaway unit test, reverted afterwards.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests. Each file's cleanup list is in its notes column in coverage/files.tsv.

File	Lines	Counts	Note
vex.rs	2789	18 (~5 worth inlining) / 1 / ~35 / 3	generate_vex is 575 lines. Omission tags are untyped (T45).
vex_consumed.rs	1028	8 / 2 / ~15 / 3 misplaced + 1 partly	Re-derives core rules (T48).
vex_sources.rs	1897	9 / 3 / ~25 / 1	~620 lines of attestation planning belong in core (C12).
vlt_heal.rs	762	6 / 2 / ~10 / 1	Dead branch L426-L431. Three advisory shapes (T49).
vlt_preflight.rs	288	0 / 1 / ~6 / 0	Copies bun selection_pairs (T05).
ecosystem_dispatch.rs	2856	9 / 9 / ~90 / 9	9 lookup wrappers; T44, T47.
interrupt.rs	96	clean
json_envelope.rs	1506	1 / 3 / ~45 / 6	Lacks emit_error (T20).
lib.rs	1041	5 / 1 / ~25 / 16	14 uuid tests belong in core (C18).
main.rs	118	clean-ish	Move restore_default_sigpipe.
path_scope.rs	312	1 / 1 / ~3 / 2
ui/mod.rs	396	1 / 3 / ~6 / 0	print_json has 3 callers (T43).
ui/prompt.rs	570	2 / 0 / ~6 / 4	One test fails when stdin is a TTY (executed).
ui/status.rs	332	1 / 0 / ~2 / 0	Two mode bools, misused by 2 callers.
ui/test_support.rs	61	clean
ui/text.rs	425	0 / 0 / ~12 / 2	Stale "one capitalizer" doc.
update_notifier.rs	490	4 / 1 / ~18 / 1	A 4th env truthiness vocabulary (A09).

Structural findings

• T20 → #1924. The error-envelope builder is written 5 times, and the human branch has drifted (raw, sentence-cased, or with a hint). The fix is json_envelope::emit_error. I read all five copies.
• T43 → #1925. ui::print_json has 3 callers, while 43 production sites print to_pretty_json themselves. The count is by grep, excluding cfg(test).
• T44 → #1926. The "copy may still hold the patch" rule is written twice (ecosystem_dispatch.rs L64-L84, rollback.rs L324-L345). The two copies drifted on MissingBlob. I read both copies and core's status order.
• T45 → #1927. vex omission tags are untyped. gradle_unpatched_copy falls through to "the patch could not be verified": executed, omission_phrase("gradle_unpatched_copy") == omission_phrase("zz_unknown") passed.
• To verify:
  • T46: the Go ignored-replace mapping, written 3 times.
  • T47: the --ecosystems empty-list readings (latent).
  • T48: core rules re-derived in vex_consumed/vex. This includes the Maven hex8 built without lowercasing, and PRODUCT_MANIFESTS drifting from core product.rs.
  • T49: the crossed vlt module names, and the redirect_vlt_reinstall_required advisory in 3 shapes.
• More evidence for existing rows:
  • C09: the 401/403 proxy-fallback text is copied in vex_sources L1065, scan/mod.rs L2535 and get.rs L1222. vex reports it in warnings[]; scan and get print it to stderr under --json. The api_auth_fallback helper lives in vex_sources.rs, but repair uses it.
  • T21: ~52 Error: and ~38 Warning: eprintln! lines. The vex and update warning sinks drifted on sentence case. scan_ecosystem! crawl failures are dropped under --json (callers fold json into silent).
  • T25: VexBuildParams has 14 fields, 6 of them hosted-only, and its literal is written 3 times.
  • T27/T49: vlt_heal returns its advisory as a Value, a tuple and an Option.
  • T05: vlt_vendor_preflight_selected copies bun selection_pairs.
  • C12: VEX planning (vex_sources L353-L973) and cargo/JVM/Bundler copy rules in ecosystem_dispatch are engine code in the CLI.
  • C18: lib.rs duplicates 14 core uuid tests.
  • T10: confirmed again at ui/mod.rs L238.
  • T23: ui/status.rs L98-L104.

Carried rows reconciled (4)

• C34: decision #1352. Decide: make the command model read-only scan plus fix/undo/sync, with mode taken from project state, and make "nothing to undo" exit 0 #1088 was closed and is superseded by Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo #1352.
• C47: already fixed (#823). Every spawn goes through tests/common/hermetic.rs.
• C51: already fixed (#914). Both the agent and vendored zip paths stream members.
• C75: already fixed (#1107). utils::http::client_builder loads native certs.

Register refresh

• T26: in PR #1883.
• No arch-audit issue was resolved by a merged PR, because main is unchanged.

Handover

To audit-core, in entries/audit-core/ with the same timestamp.

Ruled out

• boxed (ecosystem_dispatch L1269): it is single-caller on purpose, to keep the poll frame small.
• vex_sources build_candidates and Cand::from_ref: they are unrelated to core functions of the same name.
• interrupt.rs unsafe signal code: it is sound.
• main.rs eprintln! calls: they run before ui::init.
• expect in to_value/to_pretty_json: these calls can't fail on in-memory string-keyed structs.
• C72 in the update notifier: it downloads nothing.
• vlt_heal_origins vs hosted_unwind::patch_server_origins: the heal deliberately adds the --api-url origin.
• The S2 NotInGraph difference (vex vs apply): intentional.
• fetch_records: it records each failure as a PlanNote, so it does not swallow them.

Next files

crates/socket-patch-cli/tests/apply/* (17 files, ~8.1K lines), tests/cargo_e2e_matrix/mod.rs and tests/cli/* (~5.5K). That is about 14K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-11-01: handover from audit-cli-tests to audit-core

Found while auditing the CLI vex*, vlt_*, ecosystem_dispatch, json_envelope and ui files at cbbbdb9. All items are unexecuted unless marked.

• utils::fs::run_blocking is pub(crate). The CLI therefore swallows join panics with .await.ok().flatten() (vex.rs L1408), and that fails open. Consider making it pub.
• utils::notice's --silent rule for warnings (Notice::Warning) is pub(crate). The CLI has no way to ask "is a warning muted?", so every command re-derives it (T21).
• vendor::go_mod_edit::hosted_module_uuid is pub(crate). vex_consumed re-derives it more loosely (any <uuid>/… suffix vs /vN) (T48).
• patch/redirect/gradle.rs L192 builds the Maven -socket.{hex8} suffix without lowercasing, unlike vendor::jvm::Coords::hex8. Evidence for E63/Hosted Maven splices the API's suffixed version into pom.xml unchecked, while hosted Gradle refuses the same grant #882.
• maven_crawler JvmEnv::is_ro_root compares with ==. The CLI's JvmScope::is_read_only (ecosystem_dispatch L1163-L1265) uses starts_with. Decide which is right when the JVM scope moves into core.
• Core vex/discover/golang.rs L14 documents behaviour of the CLI's synthesize_go_patches. Core should not depend on CLI prose (T46).
• Core vex/product.rs L84-L114's probe table is copied in CLI vex.rs PRODUCT_MANIFESTS L1858, without the csproj/gemspec probes (T48).

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-11-01: architecture refactor (sweep)

main @ cbbbdb9. The previous run was a sweep, so this run looked for structural work first. Nothing has merged since 2026-10-29, so every candidate scoring 6 or more is still held by an open PR (A30, T09, T01, T25, A41, A43). The audit's new issues are held too: T20 #1924, T38 #1911, T39 #1912, T43 #1925 and T44 #1926 touch scan/mod.rs, vendor.rs, rollback.rs or remove.rs; T45 #1927 is a bug for the fixer. A26 #1867 scores about 4. So I ran a sweep. The scan rows still change callers in scan/mod.rs, so the next audited, unswept rows with free files were commands/{update,user_patches,vendor_orphans,vlt_heal}.rs. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1929, ready for review. /code-review high ran first and found no correctness bugs: I applied 3 of its 6 low-severity notes and gave reasons for the other 3 in the PR. CI and Bugbot were pending at the time of writing.

Per file

• update.rs:
  • 2 inlined (download_status, CHECKING_LATEST), and channel_id moved to core as InstallChannel::id, now pinned by a table test (red→green by mutation).
  • RunWarning::new, and a 9-line doc cut to 2.
  • 2 tests deleted: a const-equals-literal test, and sentence_case asserts duplicating ui/text.rs.
  • Net −52 (+14 test lines in core).
• user_patches.rs: the gate loop written 3× in the file is now one private protecting(). Net −2.
• vendor_orphans.rs:
  • Borrowed set keys.
  • 3 bare refs removed, and the stale test doc fixed.
  • 3 .contains checks replaced by one exact assert_eq!.
  • Net −3.
• vlt_heal.rs:
  • 1 fn inlined (cleanup_disabled).
  • 1 dead fallback deleted (healed_store), replaced by a debug_assert!.
  • 3 bare refs removed.
  • Net −8.
• Total: +80 / −116, about −27 production and −9 test lines.

Behavior

None.

Merges recorded

None.

Lessons

• Audit inline notes can conflict with readability. /code-review argued that inlining vlt_vendored_uuids (a named, 15-line ledger lookup) into a short function hurt it, so the helper stays. Inline only where the name adds nothing.
• An audit "redundant test" can be the only precedence test. advisory_variants_follow_severity_order is kept: the other test varies one tally field at a time.
• in_process_redirect has 3 root-sandbox (chmod) failures that also fail on main.

[github-actions[bot]]

[agent] 2026-11-01: architecture audit (audit-core)

main is at cbbbdb9, unchanged since the last run. This run read 21 files, 17,214 lines, all to the end: crawlers/ruby_crawler.rs, sbt_evidence.rs (+ tests.rs), scala_evidence.rs, types.rs, walk_pool.rs, formats/bun, formats/cargo/*, formats/composer/* and formats/gem/*. No product code was changed. Four behavior claims were executed in scratch copies of the workspace outside the repo (A53, A54, A55, A56). The coverage manifest matches main.

Per file

Counts are single-caller fns / wrappers / deletable comment lines / fake or duplicate tests.

File	Lines	Counts	Note
crawlers/ruby_crawler.rs	6457	24 / ~12 / ~150 / 4	A53 (executed), A57, A63; one non-hermetic test (#1919)
crawlers/sbt_evidence.rs	636	4 / 2 / ~5 / 0	A60, A61, A35
crawlers/sbt_evidence/tests.rs	527	0 / 0 / ~2 / 1 partial	cap paths untested
crawlers/scala_evidence.rs	901	2 / 1 / ~6 / 0	dead pub resolution(); A60
crawlers/types.rs	652	0 / 0 / ~10 / ~17	duplicate per-ecosystem tests
crawlers/walk_pool.rs	541	7 / 2 / ~8 / 0	A09 placement
formats/bun/mod.rs	175	1 / 1 / ~6 / 0	stale doc on callers
formats/cargo/floor.rs	290	3 / 0 / ~2 / 0	A26
formats/cargo/hosted.rs	273	3 / 0 / ~4 / 0	LF precondition unstated
formats/cargo/manifest.rs	114	clean
formats/cargo/mod.rs	540	4 / 3 / ~4 / 0	A55
formats/cargo/source_replacement.rs	313	clean (visibility only)	A01 target
formats/composer/hosted.rs	307	2 / 2 / ~2 / 0	A56 (executed)
formats/composer/mod.rs	195	0 / 2 / ~3 / 0	A14
formats/composer/source.rs	687	3 / 1 / 0 / 0	A62 target
formats/gem/gemfile.rs	543	2 / 0 / ~3 / 0	A59
formats/gem/gemspec.rs	589	4 / 0 / ~4 / 0	A54 (executed), A58
formats/gem/hosted.rs	822	1 / 0 / ~12 / 1	A04, A58
formats/gem/manifest.rs	1360	2 / 6 / ~10 / 0	unreachable arm L144
formats/gem/mirror.rs	571	3 / 0 / ~3 / 1	A57
formats/gem/mod.rs	721	1 / 5 / ~8 / 0	A58

Structural findings

Filed (5):

• A53: #1931, bug, executed. Bundler's path tier rule is written twice in ruby_crawler. With BUNDLE_DISABLE_SHARED_GEMS: "false" and a leftover vendor/bundle, bundler_sets_explicit_path says "system gems", but discovery still returns the store and drops the gem env homes.
• A54: #1932, bug, executed on verbatim copies. gemspec_directives and dev_dependency_requirements read =begin blocks and heredocs as code.
• A55: #1933, bug, executed. Four "is crates.io" rules; sparse+https://index.crates.io.evil.example/ gets CratesIo + Sha256Hex from CargoLock::entries.
• A56: #1934, bug, executed. Hosted composer splices the server url and sha1 through an expanding Regex::replace with no validation or escaping; the lock stops parsing.
• A57: #1935, tracking refactor. Bundler settings move out of the crawler into formats/gem/settings.rs; one .bundle/config key parser.

Also: commented on #1919 with the ruby crawl_all test that fails under BUNDLE_PATH__SYSTEM=true (executed).

New rows left to verify: A58 (Gemfile.lock reads beside the model), A59 (Ruby literal ×4), A60 (sbt/scala evidence ×2, vex re-implements the gate), A61 (file sha256 ×2), A62 (JSON scanners ×4, bun.lock line split ×3), A63 (gem env cwd under --global).

Rows extended: A01 (vendor/cargo_config is a third chain walk; PR #1849 should cover it), A09 (walk_pool env parsing and fd_limit_is_tight placement), A14 (composer purl ×4), A35 (Maven2 root climb ×2), A49 (verbatim strip is ×6 and has drifted: npmrc lacks UNC, pnpm_workspace strips only before a drive letter). Several rows shortened to keep the register under 15,000 characters.

Register statuses: no change from GitHub; main is unchanged, so no merged PR resolved an open arch-audit issue. No maintainer steering on #1830.

Carried rows reconciled (5)

• E30: filed #1010; redirect/mod.rs has grown to 30,223 lines.
• E31: filed #1075; no HostedRewriter trait on main.
• E32: decision #1200; both orchestrators remain.
• E36: filed #1112.
• E40: filed #855.

Ruled out

• walk_pool's rayon pool vs utils::concurrent::ordered_concurrent: different jobs (sync walks vs async HTTP).
• CRLF mixing in cargo plan_hosted: unreachable, the caller runs to_lf first.
• days_from_civil copies: same arithmetic (A26 already covers placement).
• bundler_truthy, bundler_ignores_config: Bundler's own rules, not A09 duplicates.
• same_remote vs mirror::normalize_source: different Bundler rules on purpose.
• scala_evidence vs vendor/jvm/scala_cli.rs: writer vs reader, no duplicated logic beyond A60.
• CrawlerOptions fields unset in production: none.

Next files

• formats/governing_locks.rs, json.rs, maven/mod.rs, mod.rs, formats/nuget/*, pipenv.rs, formats/pnpm/*, registry.rs, formats/sbt/*, text.rs, xml.rs
• then formats/yarn/*, golden.rs, gradle/*

---

Generated by Claude Code