Summary
The checksum comparison in DbPathResolver.cs:323 uses StringComparison.OrdinalIgnoreCase for hex digest equality. While case-folded equality is harmless for hex, it masks a real defect: two writers in the codebase may emit the same logical hash in different cases (one uses BitConverter.ToString upper-case, another uses ToString("x2") lower-case). The comparison silently accepts the mismatch. If a future bug introduces a tampered hash that happens to differ only in case, the OrdinalIgnoreCase comparison would also accept it. More importantly, the inconsistent emit format itself is a latent contract bug.
Where
src/CodeIndex/Cli/DbPathResolver.cs:323 (checksum comparison)- All hash-emit sites elsewhere in the codebase that should be standardized
Suggested approach
(1) Audit all hash-emit sites and standardize on lowercase hex (ToString("x2")). (2) Switch the comparison to StringComparison.Ordinal. (3) Add a unit test that asserts every hash-producing helper returns lowercase. (4) Add a CI check (or schema invariant) that no persisted hash row contains uppercase letters. (5) Document the lowercase-hex convention in DEVELOPER_GUIDE.
Summary
The checksum comparison in
DbPathResolver.cs:323usesStringComparison.OrdinalIgnoreCasefor hex digest equality. While case-folded equality is harmless for hex, it masks a real defect: two writers in the codebase may emit the same logical hash in different cases (one usesBitConverter.ToStringupper-case, another usesToString("x2")lower-case). The comparison silently accepts the mismatch. If a future bug introduces a tampered hash that happens to differ only in case, the OrdinalIgnoreCase comparison would also accept it. More importantly, the inconsistent emit format itself is a latent contract bug.Where
src/CodeIndex/Cli/DbPathResolver.cs:323(checksum comparison)Suggested approach
(1) Audit all hash-emit sites and standardize on lowercase hex (
ToString("x2")). (2) Switch the comparison toStringComparison.Ordinal. (3) Add a unit test that asserts every hash-producing helper returns lowercase. (4) Add a CI check (or schema invariant) that no persisted hash row contains uppercase letters. (5) Document the lowercase-hex convention in DEVELOPER_GUIDE.