devrites 7.2.7 → 7.3.0

package/engine/internal/lib/context_io.go

@@ -0,0 +1,171 @@
+package lib
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/devrites/devrites/internal/fsutil"
+)
+
+type contextSource struct {
+	data []byte
+	err  error
+}
+
+// contextSources retains one invocation's bytes, including optional absence.
+type contextSources struct {
+	dir   string
+	files map[string]contextSource
+}
+
+func (s *contextSources) read(name string) ([]byte, error) {
+	if s.dir == "" {
+		return nil, os.ErrNotExist
+	}
+	name = filepath.Clean(filepath.FromSlash(name))
+	if !filepath.IsLocal(name) {
+		return nil, fmt.Errorf("workspace artifact %q escapes workspace", name)
+	}
+	if source, ok := s.files[name]; ok {
+		return source.data, source.err
+	}
+	var source contextSource
+	if source.err = contextParents(s.dir, name); source.err == nil {
+		source.data, source.err = readBoundedRegularFile(filepath.Join(s.dir, name), workspaceArtifactLimit)
+	}
+	if source.err != nil {
+		source.err = fmt.Errorf("workspace artifact %s: %w", name, source.err)
+	}
+	if s.files == nil {
+		s.files = make(map[string]contextSource)
+	}
+	s.files[name] = source
+	return source.data, source.err
+}
+
+// Reject even in-workspace parent links: managed paths name actual directories.
+func contextParents(dir, rel string) error {
+	parent := filepath.Dir(rel)
+	if parent == "." {
+		return nil
+	}
+	for _, part := range strings.Split(parent, string(filepath.Separator)) {
+		dir = filepath.Join(dir, part)
+		info, err := os.Lstat(dir)
+		if os.IsNotExist(err) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() {
+			return fmt.Errorf("context parent %s is not a directory (symlinks are not allowed)", dir)
+		}
+	}
+	return nil
+}
+
+func publishContext(featureDir string, opts contextOpts, body []byte) (out string, unchanged bool, err error) {
+	out = opts.out
+	managed := featureDir != "" && (out == "" || !filepath.IsAbs(out))
+	if out == "" {
+		out = filepath.Join("ctx", bundleName(opts))
+	}
+	base, rel := featureDir, out
+	if !managed && featureDir != "" {
+		absoluteFeature, absErr := filepath.Abs(featureDir)
+		if absErr != nil {
+			return out, false, absErr
+		}
+		if within, relErr := filepath.Rel(absoluteFeature, out); relErr == nil && filepath.IsLocal(within) {
+			managed, rel = true, within
+		}
+	}
+	if managed {
+		if !filepath.IsLocal(rel) {
+			return out, false, fmt.Errorf("context output %q escapes workspace", out)
+		}
+		if err := contextParents(base, rel); err != nil {
+			return out, false, err
+		}
+		out = filepath.Join(base, rel)
+	} else {
+		base, rel = filepath.Dir(out), filepath.Base(out)
+		if err := os.MkdirAll(base, 0o755); err != nil {
+			return out, false, err
+		}
+	}
+	ws, err := os.OpenRoot(base)
+	if err != nil {
+		return out, false, err
+	}
+	defer func() { _ = ws.Close() }()
+	if err := ws.MkdirAll(filepath.Dir(rel), 0o755); err != nil {
+		return out, false, err
+	}
+	digest := []byte(fmt.Sprintf("%x\n", sha256.Sum256(body)))
+	// Check both destinations before publishing either; never follow a leaf link.
+	matches := true
+	for _, entry := range []struct {
+		name string
+		data []byte
+	}{{rel, body}, {rel + ".sha256", digest}} {
+		info, err := ws.Lstat(entry.name)
+		if os.IsNotExist(err) {
+			matches = false
+			continue
+		}
+		if err != nil {
+			return out, false, err
+		}
+		if !info.Mode().IsRegular() {
+			return out, false, fmt.Errorf("context output %s is not a regular file", entry.name)
+		}
+		// shortcut: Windows FileMode cannot prove POSIX 0600; rebuild until ACL-aware reuse is needed.
+		if info.Mode() != 0o600 || info.Size() != int64(len(entry.data)) {
+			matches = false
+			continue
+		}
+		// Open through the confined root; replacement still uses an atomic rename.
+		file, err := ws.Open(entry.name)
+		if err != nil {
+			return out, false, err
+		}
+		opened, err := file.Stat()
+		if err == nil && (opened.Mode() != 0o600 || !os.SameFile(info, opened)) {
+			err = fmt.Errorf("context output %s changed while opening", entry.name)
+		}
+		var data []byte
+		if err == nil {
+			data, err = io.ReadAll(io.LimitReader(file, int64(len(entry.data))+1))
+		}
+		if err == nil {
+			current, statErr := ws.Lstat(entry.name)
+			if statErr != nil {
+				err = statErr
+			} else if current.Mode() != 0o600 || !os.SameFile(opened, current) {
+				err = fmt.Errorf("context output %s changed while reading", entry.name)
+			}
+		}
+		_ = file.Close()
+		if err != nil {
+			return out, false, err
+		}
+		matches = matches && bytes.Equal(data, entry.data)
+	}
+	if matches {
+		return out, true, nil
+	}
+	if err := fsutil.WriteFileAtomicIn(ws, rel, body, 0o600); err != nil {
+		return out, false, err
+	}
+	if err := fsutil.WriteFileAtomicIn(ws, rel+".sha256", digest, 0o600); err != nil {
+		return out, false, err
+	}
+	return out, false, nil
+}

package/engine/internal/lib/detect.go

@@ -251,27 +251,27 @@ func manifestFallback(root string, slot string) (detectedCommand, bool) {
 	}
 	manifests := []manifest{
 		{"go.mod", "go.mod", map[string]string{
-			"unit": "go test ./...", "integration": "go test -tags=integration ./...",
+			"unit": "go test ./...",
 			"lint": "golangci-lint run", "vet": "go vet ./...", "build": "go build ./...",
 		}},
 		{"Cargo.toml", "Cargo.toml", map[string]string{
-			"unit": "cargo test", "integration": "cargo test -- --ignored",
+			"unit": "cargo test",
 			"lint": "cargo clippy --all-targets", "vet": "cargo check", "build": "cargo build",
 		}},
 		{"pyproject.toml", "pyproject.toml", map[string]string{
-			"unit": "python -m pytest", "integration": "python -m pytest -m integration",
+			"unit": "python -m pytest",
 			"lint": "ruff check", "vet": "mypy .", "build": "python -m build",
 		}},
 		{"setup.py", "setup.py", map[string]string{
-			"unit": "python -m pytest", "integration": "python -m pytest -m integration",
+			"unit": "python -m pytest",
 			"lint": "flake8", "vet": "mypy .",
 		}},
 		{"pom.xml", "pom.xml", map[string]string{
-			"unit": "mvn test", "integration": "mvn verify",
-			"vet": "mvn -q compile", "build": "mvn package",
+			"unit": "mvn test",
+			"vet":  "mvn -q compile", "build": "mvn package",
 		}},
 		{"build.gradle", "build.gradle", map[string]string{
-			"unit": "gradle test", "integration": "gradle integrationTest",
+			"unit": "gradle test",
 			"lint": "gradle check", "build": "gradle build",
 		}},
 		{"composer.json", "composer.json", map[string]string{
@@ -279,7 +279,7 @@ func manifestFallback(root string, slot string) (detectedCommand, bool) {
 			"vet": "vendor/bin/phpstan analyse",
 		}},
 		{"Gemfile", "Gemfile", map[string]string{
-			"unit": "bundle exec rspec", "integration": "bundle exec rspec --tag integration",
+			"unit": "bundle exec rspec",
 			"lint": "bundle exec rubocop",
 		}},
 		{"mix.exs", "mix.exs", map[string]string{

package/engine/internal/lib/dispatch.go

@@ -50,6 +50,7 @@ For a reviewer role, return --result <file> stores the return verbatim as
 packets/<wave>-<role>.return.md (never overwritten), derives the outcome
 from its Outcome/Counts head (malformed records gap), refuses an --outcome
 that disagrees, and records its Finding: keys for metrics summary.
+Reviewer returns require --result or --outcome; omitting both leaves the role pending.
 
 A build wave with a wright role must name its slice(s) with --slice; a vet
 wave may (slice-bound recheck), and so may a reviewer-only wave (uncapped),
@@ -324,6 +325,8 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 					if err := lintReviewCandidate(root, slug, packet); err != nil {
 						return fail("BLOCKED: %v", err)
 					}
+				} else if err := lintPacketDiffs(root, slug, packet, false); err != nil {
+					return fail("BLOCKED: %v", err)
 				}
 				break
 			}
@@ -455,6 +458,9 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if r.Returned {
 			return fail("role %q already returned", role)
 		}
+		if isReviewerRole(role) && result == "" && outcome == "" {
+			return fail("reviewer %q needs --result <file> or --outcome <findings|no-findings|gap>", role)
+		}
 		if outcome != "" && !slices.Contains([]string{"findings", "no-findings", "gap"}, outcome) {
 			return fail("--outcome %q is not findings, no-findings, or gap", outcome)
 		}

package/engine/internal/lib/packet.go

@@ -91,6 +91,21 @@ func RunPacket(root string, args []string, stdout, stderr io.Writer) int {
 	if err != nil {
 		return fail(err)
 	}
+	code := 0
+	if err := state.WithFeatureLock(root, slug, func() error {
+		code = renderPacketLocked(root, slug, workspace, wave, phase, role, slice, checks, focus, recheck, wright, doubt, stdout, stderr)
+		return nil
+	}); err != nil {
+		return fail(err)
+	}
+	return code
+}
+
+func renderPacketLocked(root, slug, workspace, wave, phase, role, slice, checks, focus, recheck string, wright, doubt bool, stdout, stderr io.Writer) int {
+	fail := func(err error) int {
+		fmt.Fprintf(stderr, "packet: %v\n", err)
+		return 3
+	}
 	rel := workspaceRel(root, workspace)
 	bundle := "ctx/" + bundleName(contextOpts{phase: phase, role: role, slice: slice, recheck: recheck})
 	if info, err := os.Stat(filepath.Join(workspace, filepath.FromSlash(bundle))); err != nil || !info.Mode().IsRegular() {
@@ -188,16 +203,24 @@ func RunPacket(root string, args []string, stdout, stderr io.Writer) int {
 		return fail(err)
 	}
 	// Lint a sibling draft so a refused re-render keeps the packet already on disk.
-	draft := filepath.Join(workspace, "packets", "."+name+".draft")
-	if err := state.AtomicWrite(draft, []byte(b.String()), 0o600); err != nil {
+	draftFile, err := os.CreateTemp(filepath.Dir(out), "."+name+".draft-*")
+	if err != nil {
+		return fail(err)
+	}
+	draft := draftFile.Name()
+	defer func() { _ = os.Remove(draft) }()
+	_, writeErr := io.WriteString(draftFile, b.String())
+	if writeErr == nil {
+		writeErr = draftFile.Sync()
+	}
+	closeErr := draftFile.Close()
+	if err := errors.Join(writeErr, closeErr); err != nil {
 		return fail(err)
 	}
 	if err := lintRenderedPacket(root, slug, draft, role, wright, finalPhase); err != nil {
-		_ = os.Remove(draft)
 		return fail(fmt.Errorf("BLOCKED: %w", err))
 	}
 	if err := os.Rename(draft, out); err != nil {
-		_ = os.Remove(draft)
 		return fail(err)
 	}
 	fmt.Fprintf(stdout, "packet: %s/packets/%s (%s, %d bytes)\n", rel, name, role, b.Len())
@@ -216,7 +239,7 @@ func lintRenderedPacket(root, slug, path, role string, wright, finalPhase bool)
 	if finalPhase {
 		return lintReviewCandidate(root, slug, path)
 	}
-	return nil
+	return lintPacketDiffs(root, slug, path, false)
 }
 
 // frozenCandidate returns packets/<wave>.sha256 when candidate freeze wrote
@@ -231,8 +254,15 @@ func frozenCandidate(workspace, wave string) (sums string, partial bool, err err
 	if err != nil {
 		return "", false, fmt.Errorf("packets/%s.sha256: %w", wave, err)
 	}
-	if info, err := os.Stat(filepath.Join(workspace, "packets", wave+".diff")); err != nil || !info.Mode().IsRegular() || info.Size() == 0 {
-		return "", false, fmt.Errorf("packets/%s.sha256 has no non-empty packets/%s.diff beside it; rerun candidate freeze under a new wave", wave, wave)
+	bindings, err := frozenDiffBindings(raw)
+	if err != nil || len(bindings) != 1 || bindings[0].name != "packets/"+wave+".diff" {
+		return "", false, fmt.Errorf("packets/%s.sha256 must bind exactly packets/%s.diff with a diff SHA256 checksum", wave, wave)
+	}
+	if _, _, err := candidatePathInfo(workspace, "packets/"+wave+".diff"); err != nil {
+		return "", false, err
+	}
+	if err := verifyFrozenDiff(filepath.Join(workspace, "packets", wave+".diff"), bindings[0].digest); err != nil {
+		return "", false, fmt.Errorf("packets/%s.diff: %w", wave, err)
 	}
 	if len(raw) <= maxContractBytes/2 {
 		return string(raw), false, nil

package/engine/internal/lib/packet_freeze.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"bytes"
 	"crypto/sha256"
 	"errors"
 	"fmt"
@@ -80,6 +81,22 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	if err != nil {
 		return fail(err)
 	}
+	code := 0
+	if err := state.WithFeatureLock(root, slug, func() error {
+		code = freezeCandidateLocked(root, slug, workspace, wave, slice, base, worktree, paths, stdout, stderr)
+		return nil
+	}); err != nil {
+		return fail(err)
+	}
+	return code
+}
+
+func freezeCandidateLocked(root, slug, workspace, wave, slice, base, worktree string, paths []string, stdout, stderr io.Writer) int {
+	fail := func(err error) int {
+		fmt.Fprintf(stderr, "candidate freeze: %v\n", err)
+		return 3
+	}
+	var err error
 	if slice != "" {
 		if paths, err = slicePaths(root, slug, slice); err != nil {
 			return fail(err)
@@ -98,13 +115,10 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	if err := validateCandidateRows(project, rows); err != nil {
 		return fail(err)
 	}
-	diff, baseCommit, err := freezeDiff(project, base, rows)
+	digest, err := hashCandidate(project, rows, true)
 	if err != nil {
 		return fail(err)
 	}
-	if len(diff) == 0 {
-		return fail(errors.New("the path set has no change against the base; there is no candidate to freeze"))
-	}
 	head := ""
 	if worktree != "" {
 		// Review binds to the transfer commit, so the frozen tree must be exactly it.
@@ -115,24 +129,27 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 		if len(dirty) != 0 {
 			return fail(errors.New("the worktree has uncommitted changes on the path set; the frozen candidate must be its HEAD transfer commit"))
 		}
-		head = "head " + commit + "\n"
+		head = commit
 	}
-	digest, err := hashCandidate(project, rows)
+	diff, baseCommit, err := freezeDiff(project, base, rows)
 	if err != nil {
 		return fail(err)
 	}
+	if len(diff) == 0 {
+		return fail(errors.New("the path set has no change against the base; there is no candidate to freeze"))
+	}
 	var sums strings.Builder
-	fmt.Fprintf(&sums, "%s %s\nbase %s\n%sdiff %x packets/%s.diff\n", candidateDigestDomain, candidateDigestVersion, baseCommit, head, sha256.Sum256(diff), wave)
+	fmt.Fprintf(&sums, "%s %s\nbase %s\n", candidateDigestDomain, candidateDigestVersion, baseCommit)
+	if head != "" {
+		fmt.Fprintf(&sums, "head %s\n", head)
+	}
+	fmt.Fprintf(&sums, "diff %x packets/%s.diff\n", sha256.Sum256(diff), wave)
 	for _, row := range rows {
 		if row.state != "present" {
 			fmt.Fprintf(&sums, "file absent %s\n", row.path)
 			continue
 		}
-		file := sha256.New()
-		if err := hashCandidateFile(file, project, row); err != nil {
-			return fail(fmt.Errorf("candidate %q: %w", row.path, err))
-		}
-		fmt.Fprintf(&sums, "file %x %s\n", file.Sum(nil), row.path)
+		fmt.Fprintf(&sums, "file %s %s\n", row.fileDigest, row.path)
 	}
 	fmt.Fprintf(&sums, "aggregate %s\n", digest)
 
@@ -143,6 +160,9 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	} else if err != nil && !errors.Is(err, os.ErrNotExist) {
 		return fail(err)
 	}
+	if err := revalidateFrozenCandidate(project, baseCommit, rows, digest, diff, head); err != nil {
+		return fail(err)
+	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return fail(err)
 	}
@@ -157,6 +177,34 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	return 0
 }
 
+// Bracket Git's mutable worktree reads; refuse observed drift, not a filesystem snapshot guarantee.
+func revalidateFrozenCandidate(project, base string, rows []candidateRow, digest string, diff []byte, head string) error {
+	currentDiff, commit, err := freezeDiff(project, base, rows)
+	if err != nil {
+		return err
+	}
+	if commit != base || !bytes.Equal(currentDiff, diff) {
+		return errors.New("candidate diff changed during freeze; retry under a new wave")
+	}
+	current, err := hashCandidate(project, rows, false)
+	if err != nil {
+		return fmt.Errorf("candidate changed during freeze: %w", err)
+	}
+	if current != digest {
+		return errors.New("candidate bytes changed during freeze; retry under a new wave")
+	}
+	if head != "" {
+		dirty, currentHead, err := freezeDiff(project, "HEAD", rows)
+		if err != nil {
+			return err
+		}
+		if currentHead != head || len(dirty) != 0 {
+			return errors.New("worktree HEAD or path set changed during freeze; candidate must remain its clean transfer commit")
+		}
+	}
+	return nil
+}
+
 // slicePaths is the slice's tasks.md write set: Writer allowlist, else Files
 // likely touched.
 func slicePaths(root, slug, slice string) ([]string, error) {

package/engine/internal/lib/packet_integrity.go

@@ -0,0 +1,179 @@
+package lib
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Binary patches can exceed the candidate's raw-byte bound; stream verification.
+const maxFrozenDiffBytes = 4 * maxCandidateTotalBytes
+
+type frozenDiffBinding struct {
+	name   string
+	digest string
+}
+
+func frozenDiffBindings(raw []byte) ([]frozenDiffBinding, error) {
+	var bindings []frozenDiffBinding
+	for _, line := range strings.Split(string(raw), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 0 || fields[0] != "diff" {
+			continue
+		}
+		if len(fields) != 3 || len(fields[1]) != sha256.Size*2 || diffPathRE.FindString(fields[2]) != fields[2] {
+			return nil, errors.New("malformed diff checksum; use diff <SHA256> <path.diff|path.patch>")
+		}
+		if _, err := hex.DecodeString(fields[1]); err != nil {
+			return nil, errors.New("malformed diff SHA256 checksum")
+		}
+		bindings = append(bindings, frozenDiffBinding{name: fields[2], digest: strings.ToLower(fields[1])})
+	}
+	return bindings, nil
+}
+
+func verifyFrozenDiff(name, expected string) error {
+	before, err := os.Lstat(name)
+	if err != nil {
+		return err
+	}
+	if !before.Mode().IsRegular() || before.Size() <= 0 {
+		return errors.New("frozen candidate diff must be a non-empty regular file")
+	}
+	if before.Size() > maxFrozenDiffBytes {
+		return errors.New("frozen candidate diff exceeds 1 GiB limit")
+	}
+	// #nosec G304 -- validated regular artifact, bounded streaming read below
+	file, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = file.Close() }()
+	opened, err := file.Stat()
+	if err != nil {
+		return err
+	}
+	if !opened.Mode().IsRegular() || !os.SameFile(before, opened) || before.Size() != opened.Size() || !before.ModTime().Equal(opened.ModTime()) {
+		return errors.New("frozen candidate diff changed while opening")
+	}
+	digest := sha256.New()
+	count, err := io.Copy(digest, io.LimitReader(file, maxFrozenDiffBytes+1))
+	if err != nil {
+		return err
+	}
+	after, err := file.Stat()
+	if err != nil {
+		return err
+	}
+	current, err := os.Lstat(name)
+	if err != nil {
+		return err
+	}
+	if count != before.Size() || !os.SameFile(opened, current) || after.Size() != count || current.Size() != count || !opened.ModTime().Equal(after.ModTime()) || !opened.ModTime().Equal(current.ModTime()) {
+		return errors.New("frozen candidate diff changed while reading")
+	}
+	if hex.EncodeToString(digest.Sum(nil)) != expected {
+		return errors.New("frozen candidate diff SHA256 mismatch; freeze the intended bytes under a new wave")
+	}
+	return nil
+}
+
+func resolvePacketDiff(root, slug, name string) (string, error) {
+	clean := filepath.Clean(filepath.FromSlash(name))
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) || clean != filepath.FromSlash(name) {
+		return "", fmt.Errorf("unsafe frozen candidate diff path %q", name)
+	}
+	dirs := []string{projectDir(root), featureDir(root, slug)}
+	// Freeze's checksum rows use this workspace-relative namespace, never a product packets/ directory.
+	if strings.HasPrefix(name, "packets/") {
+		dirs = []string{featureDir(root, slug)}
+	}
+	if filepath.IsAbs(name) {
+		parent, err := filepath.EvalSymlinks(filepath.Dir(name))
+		if err != nil {
+			return "", err
+		}
+		dirs = []string{parent}
+		name = filepath.Base(name)
+	}
+	for _, dir := range dirs {
+		info, exists, err := candidatePathInfo(dir, filepath.ToSlash(name))
+		if err != nil {
+			return "", err
+		}
+		if exists {
+			if !info.Mode().IsRegular() {
+				return "", errors.New("frozen candidate diff is not a regular file")
+			}
+			parent, err := filepath.EvalSymlinks(dir)
+			if err != nil {
+				return "", err
+			}
+			return filepath.Join(parent, filepath.FromSlash(name)), nil
+		}
+	}
+	return "", fmt.Errorf("frozen candidate diff %q does not exist", name)
+}
+
+// Caller may already hold the feature lock (dispatch); never acquire it here.
+func lintPacketDiffs(root, slug, packet string, required bool) error {
+	raw, err := readBoundedRegularFile(packet, maxContractBytes)
+	if err != nil {
+		return fmt.Errorf("reviewer packet %s: %w", packet, err)
+	}
+	bindings, err := frozenDiffBindings(raw)
+	if err != nil {
+		return err
+	}
+	bound := make(map[string]string, len(bindings))
+	for _, binding := range bindings {
+		path, err := resolvePacketDiff(root, slug, binding.name)
+		if err != nil {
+			return err
+		}
+		if prior, ok := bound[path]; ok {
+			if prior != binding.digest {
+				return fmt.Errorf("conflicting diff checksums for %s", binding.name)
+			}
+			continue
+		}
+		if err := verifyFrozenDiff(path, binding.digest); err != nil {
+			return fmt.Errorf("%s: %w", binding.name, err)
+		}
+		bound[path] = binding.digest
+	}
+	var names []string
+	for _, line := range strings.Split(string(raw), "\n") {
+		if entry, candidate := strings.CutPrefix(line, "file "); candidate {
+			identity, path, complete := strings.Cut(entry, " ")
+			// Candidate file identities describe product paths, not reviewer inputs.
+			if complete && path != "" {
+				if identity == "absent" {
+					continue
+				}
+				if digest, err := hex.DecodeString(identity); err == nil && len(digest) == sha256.Size {
+					continue
+				}
+			}
+		}
+		names = append(names, diffPathRE.FindAllString(line, -1)...)
+	}
+	if required && len(names) == 0 {
+		return errors.New("a Review or Seal reviewer packet must name the frozen candidate diff and bind its bytes with diff <SHA256> <path.diff|path.patch>")
+	}
+	for _, name := range names {
+		path, err := resolvePacketDiff(root, slug, name)
+		if err != nil {
+			return err
+		}
+		if _, ok := bound[path]; !ok {
+			return fmt.Errorf("unbound frozen candidate diff %s; add diff <SHA256> %s to the packet", name, name)
+		}
+	}
+	return nil
+}

package/engine/internal/lib/perturb.go

@@ -180,7 +180,7 @@ func pathSetIdentity(project string, paths []string) (candidateIdentity, error)
 	if err != nil {
 		return candidateIdentity{}, err
 	}
-	digest, err := hashCandidate(project, rows)
+	digest, err := hashCandidate(project, rows, false)
 	return candidateIdentity{digest: digest, rows: rows}, err
 }
 
@@ -244,7 +244,7 @@ func runPerturbProbe(project string, identity candidateIdentity, gate *acceptanc
 		probe.reason = "candidate copy failed: " + oneLine(err.Error())
 		return probe
 	}
-	if probe.copyStart, err = hashCandidate(base, rows); err != nil || probe.copyStart != identity.digest {
+	if probe.copyStart, err = hashCandidate(base, rows, false); err != nil || probe.copyStart != identity.digest {
 		probe.reason = "the isolated copy does not hash to the candidate digest"
 		return probe
 	}
@@ -267,7 +267,7 @@ func runPerturbProbe(project string, identity candidateIdentity, gate *acceptanc
 		return probe
 	}
 	if err := validateCandidateRows(base, rows); err == nil {
-		probe.copyRestored, _ = hashCandidate(base, rows)
+		probe.copyRestored, _ = hashCandidate(base, rows, false)
 	}
 	if probe.copyRestored != identity.digest {
 		probe.reason = "the reverted copy does not hash to the candidate digest"