Harden HCM matcher: artifact verification, tier ladder consistency, dedup

[oratis]

Summary

Hardening pass on andromeda-hardware (HCM matcher + model). All changes are confined to crates/andromeda-hardware/**, schemas/**, and the two hardware dev docs (plus generated Cargo.lock).

1. Fail-closed artifact verification (security review #1)

evaluate_manifest/matcher previously trusted the declared artifacts[].sha256 and never used ArtifactPin.signing_key_id. Added an optional ArtifactVerifier hook:

• New evaluate_manifest_with_verifier / evaluate_manifest_at_with_verifier take Option<&dyn ArtifactVerifier>. The existing evaluate_manifest/evaluate_manifest_at delegate with None, so the CLI and today's behavior are unchanged — but the trust boundary is now explicit in the API.
• When a verifier is supplied, every pinned artifact must resolve and its computed SHA-256 must match the pin, else effective_tier is driven to Blocked; unresolvable-when-verifying is likewise fail-closed.
• DirectoryArtifactVerifier resolves artifacts from a base directory, hashes with sha2, and wires signing_key_id into the contract via an optional trusted-key set (untrusted/unsigned = Blocked). Real signature cryptography is a documented TODO stub (checks key-id membership, not a detached signature).

2. SupportTier single source of truth (documentation review #2/#3)

• Reordered the JSON schema tier enum to blocked, community, reference, supported, certified to match the model.rs declaration order.
• Added a Rust test (schema_tier_enum_matches_model_declaration_order) that reads the schema file and asserts its enum order equals the SupportTier declaration order, so future drift fails CI.
• Docs now state the ladder authoritatively (code is the source of truth) and note that the strategic-doc "OEM Reference Design" is a product-line label, unrelated to the SupportTier::Reference value.

3. Dedup hex-ID helpers (code-quality review #2)

strip_hex_prefix/id_matches were duplicated in matcher.rs and diagnosis.rs, and diagnosis::parse_hex used trim_start_matches("0x") (strips repeated prefixes). Extracted one shared helper in model.rs, made both callers use it with consistent single-strip semantics, and added a test for 0x0x10de / 0X10DE.

4. evaluate_device refactor (code-quality review #4)

Rewrote the "id matched but no bound driver" decision from an inspect-driven side effect (relying on any's lazy short-circuit) to an explicit two-step (collect id-matches, then check driver presence). Behavior identical.

5. deny_unknown_fields on HCM (code-quality review #1)

Added #[serde(deny_unknown_fields)] to HcmManifest, HardwareSelector, CapabilityRequirement (internally tagged — verified compatible), ArtifactPin, and CapabilityEvidence, so a mistyped manifest field is rejected instead of silently dropped. Added a test covering top-level, selector, requirement, and artifact structs (plus a valid-doc control).

6. serde(default) reconciliation (code-quality review #3)

Removed the redundant #[serde(default)] on DeviceInfo Option fields (absent Option already deserializes to None) and documented why DeviceInfo intentionally stays forward-compatible, unlike the untrusted manifest structs.

Validation

• cargo fmt --all --check — clean
• cargo clippy --workspace --all-targets --locked -- -D warnings — clean
• cargo test --workspace --locked — 120 passing (hardware 32 → 43)
• JSON schema parses and the repo example manifest validates against it (jsonschema Draft 2020-12)

Shape changes

• New public API in andromeda-hardware: ArtifactVerifier, ArtifactVerdict, DirectoryArtifactVerifier, evaluate_manifest_with_verifier, evaluate_manifest_at_with_verifier. No existing signature changed; no CLI/JSON output shape change (the CLI still calls evaluate_manifest).
• sha2 added as a dependency of the andromeda-hardware crate only.

🤖 Generated with Claude Code