Load manifest hashes as lowercase so every verify site agrees (#707)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #707

Summary

PatchFileInfo's beforeHash/afterHash are now lowercased when a manifest is deserialized. Every consumer then sees one spelling: agent-mode apply and rollback verification, blob names and vendored pins. Before this change, a manifest that spelled its hashes in uppercase passed blob download, which compares case-insensitively, and then failed apply and rollback verification. Those compare the computed lowercase git-sha256 with ==, so they reported HashMismatch for bytes that matched.

Why

• Issue #707, register row C41 (register), living document doc/07-infra-agent.md C41: the hash case rule is decided separately at each comparison site. This PR takes the issue's recommended fix, "normalize at the boundary", which sets the rule once at load instead of adding a case-insensitive helper at every site.
• Leverage: B 1 (Agent-mode apply and rollback reject a manifest hash in uppercase hex that blob download accepts as valid #707), U 0, D ≈ 1 (one case rule instead of one per site), R L. Every higher-ranked item touches files that open arch-refactor/* or agent/fix-* PRs also change (see the refactor register's Queue).

What changed

• crates/socket-patch-core/src/manifest/schema.rs: #[serde(deserialize_with = "deserialize_hash")] on both hash fields, plus a doc comment that states the rule.
• Not changed, because open PRs also change these files: api::blob_fetcher::blob_hash_matches (Remove --download-mode and the diff download path (#792) #1049, Resolve the org once per run and route every API call through it (#648) #1041) and the vendored eq_ignore_ascii_case sites. They stay correct, and they become plain == in a follow-up.

Also included

b920a55 ports #1162's fix for the oracle selftest temp-path collision, which failed this PR's coverage job (e2e_vendored_production). It is test-only and becomes a no-op once #1162 merges.

Deleted

Nothing in production. The diff is +18 production lines (including the doc comment) and +112 test lines for #707. The comparison helpers this rule makes redundant are in files that open PRs change (see above).

Behavior

• An uppercase-hash manifest now verifies, applies and rolls back, the same as the lowercase one.
• A manifest that is written back after load stores the lowercase spelling.
• On a case-sensitive filesystem, a blob that was previously saved under an uppercase name is no longer found by that name. It is fetched again under the lowercase name, and GC treats the old file as unreferenced. Lowercase manifests, which is everything the API emits, are unchanged.

Test evidence

• New manifest::schema::tests::test_patch_file_info_loads_hashes_lowercase and test_uppercase_manifest_hashes_apply_and_roll_back, which reads a manifest from disk, then runs verify, apply, rollback-verify and rollback for the lowercase and uppercase spellings.
  • Red on main's rule, with the attribute removed: upper=true: VerifyResult { status: HashMismatch, current_hash: "e5c1…", expected_hash: "E5C1…" }. 2 failed.
  • Green on this branch: 17/17 manifest::schema.
• cargo test -p socket-patch-core --lib: 5788 passed. The 4 failures are the known root-only sandbox tests that also fail on main (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_…, pypi_requirements::wire_failure_rolls_back_…).
• cargo test -p socket-patch-cli --all-features --test e2e_vendored_production: 49 passed, 13 ignored (production).
• cargo clippy --workspace --all-features -- -D warnings: clean.

Risk

Low. One serde attribute on the load path. API-emitted manifests are already lowercase, so they are unaffected.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FkC1KYiCBhfqT5US5QMvSD

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

[agent] coverage failed on 2388907 with error: 1 target failed: -p socket-patch-cli --test e2e_vendored_production. This failure doesn't come from this PR. That binary's production tests are all #[ignore]d, and the binary passes locally (49 passed). This is the oracle-selftest temp-path collision that #1162 diagnoses: tests/common is compiled twice into the binary, and both copies use the same PID-named /tmp paths. It also evicted merge-group runs on main.

I ported #1162's change (a per-test tempfile::tempdir() in tests/common/mod.rs) into this PR as b920a55. The suite passes locally with it, and it becomes a no-op once #1162 merges.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b920a55. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at b920a55.

• CI: all check suites on the head are success (381 check runs, ci-ok success); no main-wide failures.
• Bugbot: reviewed this head (Cursor check success); no unresolved review threads.
• Mergeable, no CHANGELOG.md change.
• Slack announcement not sent this run (Slack send tool unavailable); the next run will retry.

---

Generated by Claude Code