[Mikola Lysenko (mikolalysenko)]

Problem

Cargo VEX and ledger liveness attested wiring the build doesn't use:

• Only the root Cargo.toml was read, so a member reverted to crates.io still attested.
• One manifest's pin attested a crate another declaration builds unpatched (crates.io, another registry, path, git, registry-index).
• A vendored [patch] copy attested when another source, a same-version lock entry or a shadowed [patch] entry bypassed it.
• Ledger liveness matched the uuid as a substring of the lock URL, on any host.

Fix

• Members: read the hosted rewriter's member manifests via ProjectView, only when Socket wiring could need them.
• Mixed pins: one route classifies each declaration. An unpinned one marks the ref vex_cargo_unpinned_declaration, with re-scan advice from the rewriter's own planner run dry. A pin to another patch becomes a wiring_conflict pair.
• Vendored: vex_cargo_patch_bypassed when a declaration or lock entry escapes every honored [patch] table (Shadow models cargo's precedence; URLs compare as CanonicalUrl).
• Liveness: lock URLs are judged by origin via crate::origin: Live / Undecided / Dead. Undecided is never attested; scan retains it.

Owner decisions

• Fail closed: a pre-v5 ledger record wired through a hosted-shaped URL on an unconfigured origin is never attested, even under --no-verify. It's reported as redirect_unwired, with a note naming --patch-server-url.
• Folded into one PR.

Where to look

1. Scope extension, please confirm. Fail closed also covers URLs that appear only in recorded wiring files: yarn berry __archiveUrl, Cargo.lock, pom, Gemfile and go.mod (foreign_hosted_url_in_files, origin::hosted_shape_uuid). Look-alike userinfo hosts (patch.socket.dev@evil.example) count as foreign. The yarn, cargo and maven e2e cells expect redirect_unwired.
2. cargo.rs (route, beside_the_pin, patch_bypassed, Shadow), discover/mod.rs (redirect_record_verdict), and plan_cargo_tomls (extracted from rewrite_cargo_with unchanged).

Testing

• Core: vex:: origin cargo hosted:: patch::redirect:: vendor:: (4962 tests, golden included) and redirect_golden.
• CLI: --lib plus the vex, scan, redirect and cargo-migration suites.
• clippy and fmt are clean. CI green on f1eb764 (46 checks).

Folds #2019, #2024.

Review history

Fixed:

• Lockless pin vs a member's other-version declaration (excluded_reqs).
• Configured-origin records judged dead without the origin (three-way verdict).
• One lockless pin and diagnostic per crate and patch.
• Member walk goes through the view, async, and runs beside a stale lock or a [patch] pin.
• Foreign URL needs a patch-server path; a Socket spelling elsewhere doesn't clear it; userinfo; Go paths.
• [patch]-redirected and registry = "crates-io" declarations aren't unpinned.
• Socket registry beside path/git/registry-index isn't a pin, and the message says so.
• Stale-lock remedy names the redirecting table; vendor offered only for crates.io.
• Re-scan advice follows the rewriter's whole-dependency refusal.
• [patch] precedence: shadowed entries, named vs URL tables, an identical config pin.
• registry-index and git tables, canonical URLs in one helper.
• Misleading "only from other Socket patches" text; conflict gate matches the CLI.
• Diagnostics for an unreflected other-patch pin and for ineffective Socket registries.

Declined:

• Ambiguous unpinned declaration withheld: documented fail closed.
• Socket registry B beside git/path makes no conflict pair: it routes nothing to B.
• Golden workspace-member diagnostic: expected/ holds only changed files.
• Sparse crates.io index not treated as crates.io: missed attestation only.
• Open in Cargo VEX: an ignored [patch] Socket pin still attests a transitive crate; bypass remedies name ambiguous or incomplete commands #2045 (pre-existing on main or remedy text): an ignored [patch] Socket pin as a transitive crate's only wiring; ambiguous cargo update -p beside a tagged copy; no re-lock advice for a stale other-registry entry. Sparse URLs: cargo's CanonicalUrl also drops the trailing /, so no change.
• Single-read liveness, one async member walker, cached lock Socket uuids, URLs from format models: left for lock-model unification.

🤖 Generated with Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: this needs an owner decision. Head 94af3e4f. CI is green apart from one PR-caused failure (coverage (2)) and the main-wide pdm/hishel e2e leg (with its ci-ok aggregate).

The failure. e2e_vex_lockfile yarn::uuid_on_a_foreign_host_is_not_a_hosted_reference (yarn.rs:1048–1085), for Classic with origin https://evil.example + a redirect ledger, not installed:

• the test expects package_not_found
• the PR returns redirect_unwired

Cause. The PR intends this change. Since 43fd5aa ("Match ledger liveness uuids by origin") and 650143e (RecordLiveness::Undecided), a lock entry whose hosted-shaped url is on an origin this run wasn't given is never attested. That contradicts what is documented today:

• CLI_CONTRACT.md § "Patch hosts (manifest-less VEX)": "A pre-v5 redirect ledger still on disk can keep such a record in play under the pre-v5 rule: judged by the ledger's own recorded wiring, attesting only an installed tree that hashes to the record unless --no-verify…"
• The e2e test's "DOCUMENTED FALLBACK" comment says the same. Its later cells expect hash_mismatch for a tampered tree and an attestation for a verified tree.

Question for the owner. Should a pre-v5 redirect-ledger record whose lock url sits on an unconfigured host (a staging server used without --patch-server-url, or a look-alike) still attest an installed tree that hashes to the record?

• No (the PR as written). Next step: rewrite this e2e cell to expect redirect_unwired throughout, and update the CLI_CONTRACT paragraph.
• Yes (the documented contract). Next step: vex must treat Undecided as "judged by the ledger, verify-only" instead of omitting it.

I didn't change either side, because either way the documented user-facing contract changes, and I won't rewrite a test's expectations just to get it green.

Minor, for whoever picks this up: in 94af3e4, hosted_patch_url_uuids's doc comment now sits above normalized_hosted_url (crates/socket-patch-core/src/patch/redirect/mod.rs ~7646). It needs splitting back.

Bugbot reviewed 94af3e4f.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: merged main (568e376). #2002 moved the hosted-origin helpers from patch::redirect into crate::origin, and DiscoverCtx now holds an OriginPolicy. Changes:

• This PR's normalized_hosted_url split now lives in origin.rs.
• The liveness and foreign-origin checks call crate::origin::hosted_patch_uuid.
• Discovery::patch_server_origins is read from ctx.origin.origins().

New head ca08f29; vex::, origin and cargo core tests (1325) pass locally. The agent:needs-human question is still open.

---

Generated by Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared a fix for 1 of the 2 issues found in the latest run.

• ✅ Fixed: Member pin attests unreverted lock
  • Added check in hosted_from_lock to detect when unpinned declarations from different files (root vs member) match the locked version and correctly skip attestation.
• ⚠️ Could not fix: Foreign host skips VEX verification
  • Implemented logic to handle Undecided verdict and proceed to hash verification, but test still fails because redirect_record_verdict returns Dead instead of Undecided for foreign hosts.

Or push these changes by commenting:

@cursor push e8b393275a

Preview (e8b393275a)

diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -82,7 +82,7 @@
 use socket_patch_core::utils::purl_key::{canonical_base_purl, PurlKey};
 use socket_patch_core::vendor::state::{VendorArtifact, VendorEntry, VendorState};
 use socket_patch_core::vex::discover::{
-    vendor_ref, Discovery, LedgerLiveness, PatchedRef, WiringMode,
+    vendor_ref, Discovery, LedgerLiveness, PatchedRef, RecordLiveness, WiringMode,
 };
 use socket_patch_core::vex::{FailedPatch, Unattested, UnattestedKind};
 
@@ -657,15 +657,19 @@
                 continue;
             }
         } else if cand.redirected {
-            let live = assumed.contains(strip_purl_qualifiers(&cand.key))
-                || liveness.redirect_record(&cand.key, &cand.uuid).await;
-            if live {
+            let verdict = if assumed.contains(strip_purl_qualifiers(&cand.key)) {
+                RecordLiveness::Live
+            } else {
+                liveness.redirect_record_verdict(&cand.key, &cand.uuid).await
+            };
+            if verdict == RecordLiveness::Live {
                 Basis::Hosted {
                     lockfile_basis: false,
                 }
-            } else if cand.manifest_owned {
-                // The hosted claim is dead but the manifest still owns the
-                // purl: verify it as the agent-mode patch it now is.
+            } else if verdict == RecordLiveness::Undecided || cand.manifest_owned {
+                // Undecided: foreign host, verify by hash. Manifest-owned:
+                // the hosted claim is dead but the manifest still owns the
+                // purl, verify it as the agent-mode patch it now is.
                 Basis::Installed
             } else {
                 notes.extend(dead_claim_notes(
@@ -784,7 +788,13 @@
             continue;
         }
         match basis {
-            Basis::Installed => {}
+            Basis::Installed => {
+                // Foreign-host candidates from a redirect ledger are verified
+                // by hash but still marked as "(redirected)" for provenance.
+                if cand.redirected && !cand.manifest_owned {
+                    plan.redirected.push(cand.key.clone());
+                }
+            }
             Basis::Vendored(entry) => {
                 plan.vendor_entries.insert(cand.key.clone(), *entry);
             }

diff --git a/crates/socket-patch-core/src/vex/discover/cargo.rs b/crates/socket-patch-core/src/vex/discover/cargo.rs
--- a/crates/socket-patch-core/src/vex/discover/cargo.rs
+++ b/crates/socket-patch-core/src/vex/discover/cargo.rs
@@ -629,10 +629,70 @@
             out.push(lock_ref);
             continue;
         };
-        if regs
+        let pinned: Vec<&Decl> = regs
             .iter()
-            .any(|d| d.registry.as_deref() == Some(reg.as_str()))
-        {
+            .filter(|d| d.registry.as_deref() == Some(reg.as_str()))
+            .collect();
+        if !pinned.is_empty() {
+            // Check if there are unpinned declarations from different files
+            // that would resolve independently. A [patch] entry applies
+            // globally, but a member dependency with a registry does not
+            // affect the root's declaration (or vice versa).
+            let unpinned: Vec<&Decl> = regs
+                .iter()
+                .filter(|d| d.registry.as_deref() != Some(reg.as_str()) && !d.socket_shaped())
+                .collect();
+            // Only check if unpinned declarations are from different files than
+            // the pinned ones (e.g., root vs member), indicating independent
+            // resolution. If all declarations are from the same file (e.g., a
+            // [patch] in Cargo.toml plus a regular dep in Cargo.toml), the
+            // [patch] applies globally.
+            let different_files = !unpinned.is_empty()
+                && unpinned.iter().any(|u| {
+                    pinned.iter().all(|p| {
+                        // Consider declarations from different files, but treat
+                        // Cargo.toml and .cargo/config.toml as the "root" scope
+                        // since [patch] entries from either apply globally.
+                        let p_is_root = p.file == CARGO_TOML
+                            || p.file == ".cargo/config"
+                            || p.file == ".cargo/config.toml";
+                        let u_is_root = u.file == CARGO_TOML
+                            || u.file == ".cargo/config"
+                            || u.file == ".cargo/config.toml";
+                        // Different if one is root-scope and the other isn't,
+                        // or if both are non-root and from different files.
+                        (p_is_root != u_is_root) || (!p_is_root && p.file != u.file)
+                    })
+                });
+            if different_files {
+                use crate::patch::redirect::{cargo_req_selects, CargoReqMatch};
+                let matches_locked = unpinned.iter().any(|d| {
+                    let req = d.version.as_deref();
+                    matches!(
+                        cargo_req_selects(req, &pkg.version, &[]),
+                        CargoReqMatch::Ours | CargoReqMatch::Ambiguous
+                    )
+                });
+                if matches_locked {
+                    let files = decl_files(unpinned.iter().copied());
+                    let verb = if files.contains(", ") {
+                        "declare"
+                    } else {
+                        "declares"
+                    };
+                    out.diag(
+                        DIAG_REF_INVALID,
+                        CARGO_LOCK,
+                        format!(
+                            "{CARGO_LOCK}: {purl} resolves from Socket patch {uuid}, but {files} \
+                             {verb} {} without registry = \"{reg}\" — cargo re-resolves it from the \
+                             declared source; not counted",
+                            pkg.name
+                        ),
+                    );
+                    continue;
+                }
+            }
             out.push(lock_ref);
             continue;
         }

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ca08f29. Configure here.}

[Mikola Lysenko (mikolalysenko)]

The owner settled the agent:needs-human question: fail closed, keep the PR's behavior. A pre-v5 redirect-ledger record whose wiring resolves from a hosted-shaped URL on an unconfigured origin is never attested and is reported as redirect_unwired, even when the installed tree verifies and even under --no-verify.

Changes in cb98b9b:

• The e2e cells for yarn (the CI failure), cargo and maven now expect redirect_unwired.
• The same rule now also applies when the URL lives only in recorded wiring files (berry, Cargo.lock, pom, Gemfile, go.mod). Before, those cases still attested.
• Userinfo look-alikes are treated as foreign.
• vex adds a vex_claim_unwired note that points to --patch-server-url.
• CLI_CONTRACT.md § "Patch hosts (manifest-less VEX)" is updated.

/code-review high findings on the change: 6 fixed, 3 declined (details in the PR body).

Review threads:

• The foreign-host thread is resolved, citing the decision.
• The two "member pin attests unreverted lock" threads are resolved. They're fixed by the stacked Stop attesting a Cargo pin a workspace member resolves from crates.io #2019, which lands right after this PR.

agent:needs-human is removed.

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Review findings (Claude Opus + codex, independent passes):

1. Root-reverted pin is attested (crates/socket-patch-core/src/vex/discover/cargo.rs:634, both reviewers). hosted_from_lock now pools root and member declarations and attests if any one carries registry = "socket-patch-<uuid>". Input: root serde = "=1.0.1" (pin reverted), crates/a still serde = { version = "=1.0.1", registry = "socket-patch-<uuid>" }, stale lock holding only the Socket-sourced serde → ref attested, but the root builds crates.io serde unpatched. On main the root alone decided this (DIAG_REF_INVALID). #2019 fixes it, so this PR should not land on main without #2019. The PR body's "main behaves the same" for mixed states is true only in the root-pinned/member-unpinned direction.
2. Lowercase percent escapes bypass the foreign-origin guard (vex/discover/mod.rs:2710, codex). A Berry __archiveUrl=https%3a%2f%2fevil.example%2fpatch%2f<U>%2fx-1.0.0.tgz is not normalized; since Berry inventory omits the resolved URL, the recorded-file fallback returns Live and a legacy record for U attests under vex --no-verify.

Minor: cargo_workspace.rs:136-147 silently drops a symlinked/unreadable member manifest (not a regression).

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Approving per maintainer decision; see the findings in the review above. Land together with #2019, which fixes finding 1.

[Mikola Lysenko (mikolalysenko)]

Final reviewer: the merge queue removed this PR at 22:11Z because #2018 merged and f1eb764 now conflicts with main. It is still approved, and approvals stay valid, so once main is merged in and ci-ok/clippy are green, it goes back in the queue (by me or the next run). I didn't push because the branch had a push in the last 45 minutes.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

I merged origin/main (#2018) to clear the conflict, in 678f42e. It's a merge only, with no other code changes.

There was one conflict, in CLI_CONTRACT.md, the "Unattested references" bullet:

• From main, kept as is: Never patch a pnpm, yarn or vlt dependency the user patched #2018's patchedDependencies wording ("any tarball", the "patch made on top of the pin" sentence) and its new Packages patched with pnpm, Yarn or patch-package paragraph.
• From this PR, kept as is: the Unpinned Cargo declarations and Vendored Cargo copies a [patch] does not reach paragraphs, appended after Go workspaces.
• The case count is now "Ten cases … one of them" (main's eight plus the two Cargo cases). Never patch a pnpm, yarn or vlt dependency the user patched #2018's paragraph reuses vex_npm_patched_dependency, so it adds no case.

vex_sources.rs, vex/discover/mod.rs and hosted/engine.rs merged automatically.

Ran locally: core vex:: origin cargo hosted:: patch::redirect:: (2303 tests), CLI --lib, e2e_vex_lockfile and e2e_vex_redirect. All pass, and clippy and fmt are clean.