GeezerVison

…get artifact is rebuilt

When the hot path found the committed artifact missing or stale, it rebuilt
it but returned no entry, so the ledger kept the previous fingerprint: the
gem file inventory, the maven/nuget sha256, and the nuget lock pin. A
rebuild from the other source (service vs local) then produced bytes the
ledger did not describe. VEX and verify reported tamper, repair of a
service-vendored maven/nuget entry could fail, --revert left
packages.lock.json pinned to the patched contentHash, and a service-sourced
rebuild was labelled already_vendored.

The rebuild branches now return a refreshed entry built from the new bytes
or tree, with no wiring of their own. For nuget the entry carries only the
re-pinned lock record, with original: None. carry_forward_wiring (same
uuid) re-attaches the first run's records and fills in the true
pre-vendor hash.

The CLI does not record such an entry when the ledger has no previous one,
because it would carry no wiring and --revert would delete the artifact
while the project still points at it. repair carries the repaired entry's
wiring forward before persisting, and emits vendor_inventory_refreshed when
the backend's refreshed inventory differs from the recorded one.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…fore accepting it

service_archive_copy (the Tier-A maven .jar / nuget .nupkg path) accepted any
archive that matched its SRI. The bytes were written verbatim and every
patched file was reported AlreadyPatched, so a served archive without the
patch was committed as patched. The hot path then saw a stale artifact on
every later run and rebuilt it.

The helper now takes the PatchRecord and requires every patched member to
hash to its afterHash (zip_bytes_match_after_hashes, the check the hot path
already uses) before returning Used. A mismatch is a service miss: auto
falls back to the local build with vendor_prebuilt_layout_mismatch, and
service refuses with vendor_prebuilt_required. The vendor_prebuilt_downloaded
advisory is only pushed for accepted bytes.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…to too

ServiceArtifact documents IntegrityMismatch as always a hard error, but
golang, composer, pypi, npm and gem (the .gem and the stub gemspec) mapped
it through their miss policy. Under auto they warned and built the package
locally, so a sign of tampering became a quiet fallback. Under service
they refused with the generic vendor_prebuilt_required code.

These arms now refuse in every mode, as cargo already did: golang,
composer, pypi and gem return vendor_prebuilt_integrity_mismatch, and npm
fails the package with the integrity detail. The npm test that pinned the
old fallback is replaced by one that expects the refusal. The service-mode
tests for these ecosystems now expect the specific code.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…figured

Every backend's service helper treats !service_enabled() as "build
locally", and service_enabled() is false without a client. The
service-only policy was enforced by common::service_offline_conflict, which
checked only --offline. So a VendorServiceConfig with source: Service and
client: None built the artifact locally in every backend, contradicting
service's fail-closed promise. The CLI always passes a client, so only
library callers could reach this.

The gate every backend already calls at its entry point now also refuses
that combination (vendor_prebuilt_required), before any service
consultation or write. Regression tests cover all eight backends.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

The in-sync hot path rebuilt a missing/stale crate copy with
copy_and_patch directly, so `--vendor-source=service` with --offline or
no API client rebuilt locally and reported success, and online service
mode never consulted the patch service. Refuse via
service_offline_conflict first and prefer cargo_service_copy, falling
back to the local build only where the policy allows, as composer and
gem already do.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

The service SRI proves only that the download is intact. A wheel or
tarball whose patched members still held the original bytes was written
as-is, reported as already patched, and pinned in the lockfile. Check
each patched member against its afterHash before using the artifact:
auto builds locally with vendor_prebuilt_layout_mismatch, service
refuses (pypi: vendor_prebuilt_required; npm fails the package). Adds
read_archive_bytes_to_map for the in-memory tarball check.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

A wiring-less refreshed entry relies on carry_forward_wiring, which
re-attaches wiring only from a same-uuid ledger entry. Over an entry
from another patch uuid (the run that wired this uuid never saved), the
guard let it through, saving an entry --revert could not unwire and
sweeping the other uuid's dir. Leave the ledger as it is instead.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>