audit-ecosystems: file E23 (#937), new finding E66 (#936)

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

doc/05-vendored.md

@@ -2,7 +2,7 @@
 
 ## Part 5: Vendored mode and the non-JS backends
 
-_Last checked against main @ 9c43dfc on 2026-10-06 by audit-ecosystems (5.2 dead `force`/`sources` parameters re-checked at `9c43dfc`; per-backend service-copy and cleanup copies re-checked at `9c43dfc`; 5.4 NuGet, Poetry/PDM and Gem re-checked at `4646693`; as of `045d7ec`: 5.4 Python, Cargo, Maven XML, Gem, Go and CRLF helpers; 5.6 scaffolding; the vendored-reference scan behind repair and the orphan sweeps). Owner: audit-ecosystems._
+_Last checked against main @ 9c43dfc on 2026-10-06 by audit-ecosystems (5.4 Poetry/PDM/Pipenv backend skeleton and Poetry forward splicers re-checked at `9c43dfc`; 5.2 dead `force`/`sources` parameters re-checked at `9c43dfc`; per-backend service-copy and cleanup copies re-checked at `9c43dfc`; 5.4 NuGet, Poetry/PDM and Gem re-checked at `4646693`; as of `045d7ec`: 5.4 Python, Cargo, Maven XML, Gem, Go and CRLF helpers; 5.6 scaffolding; the vendored-reference scan behind repair and the orphan sweeps). Owner: audit-ecosystems._
 
 > Scope: `vendor/` framework (`mod`, `common`, `state`, `verify`, `registry_fetch`, `service_fetch`, `prestage`, `reuse`, `redownload`, `ledger_snapshots`, `parse_memo`, `path`, `source`, `toml_surgery`, `lock_inventory`); backends for cargo, gem, pypi (×10 files), golang, composer, nuget, maven and `jvm/`; related `utils/` parsers; and the CLI `vendor.rs` + `vendored_backend/`.
 
@@ -130,6 +130,9 @@ Revert/restore/unwind code in the non-npm backends totals **about 3,540 lines**:
   - `check_target_guards` (missing / forked / ours-in-sync / ours-stale / user-authored)
   - `wire_*`
   - `revert_*`
+
+  The wire and revert envelope around each format edit is identical in all three, verified on `9c43dfc`: symlink refusal → guards → a defensive `InSync` refusal → edit → `ensure_unchanged` → memo invalidate → mode-preserving write. Each also has its own `{Fresh, InSync}` enum. Target: one shared envelope with flavor-derived error codes. {{E23}}
+- Vendored Poetry has **two forward splicers**. Legacy and CRLF locks go through the shared `utils::poetry_lock` engine; LF 2.x locks go through a private `toml_surgery` line scanner (`rewrite_target_package_unit`). The scanner writes a different `files` shape and skips the engine's wheel-name and lowercase-digest gates (executed twice). {{E66}}
 - Pipfile.lock is read through one shared parser but **written two ways**: vendored reserializes canonically, hosted splices spans.
 - Hosted-URL recognition for Pipenv is shared: hosted `owned_url` and the vendored Pipenv guard both ask `lock_inventory::pypi::hosted_pypi_reference`, which applies `hosted_patch_uuid`'s origin allowlist to `hosted_artifact_url`'s tail grammar; the vendored guard gets the run's `--patch-server-url` origin (#572). {{E04}}
 
@@ -247,6 +250,7 @@ Old `kind`s are translated into `SpliceRecord`s when the ledger loads, so legacy
 
 ### New findings since the review
 
+- {{E66}}: vendored Poetry wires a 2.x lock through the `toml_edit` engine when it is CRLF and through a `toml_surgery` line scanner when it is LF. For the same lock the two give different `files` shapes, and only the engine checks the wheel name and lowercases the digest (executed twice); see 5.4.
 - {{E65}}: `vendor --force` documents a missing-file tolerance and a `vendor_content_mismatch_overwritten` warning that no backend implements; every acquisition sink takes `_force`/`_sources`, and `vendor` with and without `--force` behave the same (executed twice). Bears on #615; see 5.2.
 - {{E61}}: the vendored-reference scan behind `repair`, the `vendor` stranded-reference gate and the orphan sweeps never sees NuGet or Maven wiring. `nuget.config` and `pom.xml` lack the `VENDORED` registry role, and both backends reference the bare uuid directory, which `parse_vendor_path` rejects (it needs a leaf). So with a missing ledger entry, `vendor --revert` and the vendored gc delete a feed or repository that `nuget.config` / `pom.xml` still name (proven by execution). The `eco == "maven2"` arm of the stranded-reference gate is dead.
 - {{E59}}: vendored gem `edit_lock` searched only the first `GEM` section of `Gemfile.lock`, so a gem from a later source was refused; fixed by #805; see 5.4.

entries/audit-ecosystems/20261006T125110Z.md

@@ -0,0 +1,49 @@
+[agent] 2026-10-06: architecture audit (ecosystems and formats)
+
+**main @ `9c43dfc`**, unchanged since the last run. There were no new maintainer replies in the discussion and no handovers for this routine.
+
+**Reconciled.**
+- No status changed: E09/E51 are still in #657 and E64 is still in #909. No open PR references my other issues, except #927, which only cites #883.
+- With `main` unchanged, re-checking open issues would only repeat last run's permalinks, so I skipped it.
+
+**Verified and filed: E23 → [#937](https://github.com/SocketDev/socket-patch/issues/937)** (refactor).
+- `pypi_poetry.rs`, `pypi_pdm.rs` and `pypi_pipenv.rs` each wrap their format edit in the same envelope:
+  - symlink refusal;
+  - guards;
+  - a defensive `InSync` refusal (the message is spelled three times);
+  - `ensure_unchanged`;
+  - memo invalidation;
+  - a mode-preserving write mapped to `pypi_<flavor>_write_failed`.
+- Each revert opens with the same `kept_artifact: true` symlink prelude, and each backend has its own `{Fresh, InSync}` enum.
+- No drift is proven in the envelope. The issue proposes one shared module with flavor-derived codes (byte-identical strings), about −150 / +80 production lines.
+
+**New finding: E66, [#936](https://github.com/SocketDev/socket-patch/issues/936)** (refactor, `pm:poetry`). `wire_poetry` picks its forward splicer by line ending:
+- legacy and CRLF locks go through the shared `utils::poetry_lock` engine, which hosted mode uses too;
+- LF 2.x locks go through the private `toml_surgery` line scanner, `rewrite_target_package_unit`.
+
+**Proof:** a throwaway test, run twice on `9c43dfc`, wired each of the three 2.x fixtures as LF and as CRLF.
+- The outputs differ every time. LF writes Poetry's multi-line `files = [\n    {file = …},\n]`; CRLF writes the inline `files = [{ file = … }]`.
+- Wheel `evil-9.9-py3-none-any.whl` wires on LF but is refused on CRLF.
+- An uppercase digest is written uppercase on LF and lowercase on CRLF. The engine's comment says an uppercase digest would fail every install.
+- The last two gates are latent with today's orchestrator inputs.
+
+The target is for the engine to emit Poetry's multi-line shape, which also aligns hosted output. The LF branch, `replace_files_array`, `package_unit_lines` and `unit_has_canon_name` would be deleted.
+
+**Searched without filing:**
+- PDM reverts non-atomically, while Poetry uses `revert_lock_fragment_splice_atomic`. This is documented, because PDM records a single fragment per unit, so it is not drift.
+- Only PDM has the partial-relock patched-hash guard (`target_carries_patched_wheel_hash`). I couldn't show that Poetry can reach the same state, so I didn't claim it.
+- requirements, pylock and Hatch don't call `ensure_unchanged`. requirements re-reads its files at wire time, and pylock and Hatch have their own compare-before-write (`pypi_lock_changed`, "Hatch configuration changed"). So none of them lacks the race guard.
+- Duplicate check for #936: #694 and #703 covered the utils engines only. Open PR #877 touches `utils/poetry_lock.rs` for parse reuse and not the vendored line scanner.
+
+**False positives ruled out:**
+- The wheel-name and uppercase-digest gate gap is not a live bug today. The orchestrator always passes a wheel it built for that package and a lowercase sha. It is recorded as drift, not filed as a bug.
+
+**Living document:**
+- Part 5 §5.4 Python: the skeleton bullet now describes the shared envelope with {{E23}}, and a new two-splicers bullet has {{E66}}.
+- Part 5: a new-findings bullet for {{E66}}; the check line is updated.
+- The register files E23 and adds E66.
+
+**Next backlog rows:** E08 (yarn grammars; after #657), E21 (`VendorBackend` tracking; count `Ecosystem` match sites), E14 (Pipfile.lock, still unproven), E24 (the nine revert mechanisms), E42 (embedded `--vex` glue; consider handing it to `audit-core`).
+
+---
+_Generated by [Claude Code](https://claude.ai/code)_

register/10-audit-ecosystems.md

@@ -1,5 +1,5 @@
 ### Ecosystems and formats (`audit-ecosystems`)
-_Last updated 2026-10-06T07:30Z · main @ 9c43dfc_
+_Last updated 2026-10-06T12:51Z · main @ 9c43dfc_
 
 | ID | P | Problem | Source | Issues | Status |
 |---|:-:|---|---|---|---|
@@ -25,7 +25,7 @@ _Last updated 2026-10-06T07:30Z · main @ 9c43dfc_
 | E20 | 3 | Pure codecs (`bun_lockb.rs`, `bun_lock_text.rs`, `vlt_lock_text.rs`) and the neutral types (`Edit`, `Warning`, `LockfileEntry`) live outside `formats/`, which creates `formats`↔`vendor`/`redirect`/`vex` cycles. | 2.1; 4.5 #2; 4.7 J | #833, #834 | filed #833, #834; tracking #833, child 1 #834 (entry types) |
 | E21 | 2 | Tracking: `VendorBackend` trait + registry. The ecosystem list is enumerated at 16 production sites, and the `vend!` / `vend_installed!` macros stand in for the trait. | 2.1; 5.2; 5.8 | | to verify |
 | E22 | 2 | The JS vendor driver skeleton is copied seven times (`guard_coordinates` → … → a literal `VendorEntry`; pnpm legacy shares v9's since #583). Target: one generic driver + `NpmLockBackend`. | 4.4; 4.7 C | #920, #922 | filed #920, #922; tracking #920, child 1 #922 (entry constructor) |
-| E23 | 2 | The `pypi_{poetry,pdm,pipenv}.rs` backends repeat one skeleton: `load_*_project`, `classify_dependency`, `check_target_guards`, `wire_*`, `revert_*`. | 5.4 | | to verify |
+| E23 | 2 | The `pypi_{poetry,pdm,pipenv}.rs` backends repeat one skeleton: `load_*_project`, `classify_dependency`, `check_target_guards`, `wire_*`, `revert_*`. | 5.4 | #937 | filed #937; shared wire/revert envelope + one `LockTarget` (no drift proven) |
 | E24 | 2 | There are nine revert mechanisms (~3.5K lines). Target: one splice-record revert engine, with legacy ledger kinds adapted at load. | 2.1; 5.3; 5.8 | | to verify |
 | E25 | 3 | Per-backend copies: `cleanup_failed_stage`, `<eco>_service_copy` (cargo, composer, gem, golang), and the `service_preflight_names_exactly_*` test copied seven times. | 5.4; 5.8 | #906 | filed #906; service-copy pipeline + cleanup (preflight test copies now share `plan_matches_grants`, out of scope) |
 | E26 | 3 | JVM has two Maven backends. Target: merge `maven_repo.rs` into `jvm/` as `Shape::Single`. Its three artifact roots don't follow `<eco>/<uuid>`. | 5.7 | | to verify |
@@ -68,6 +68,7 @@ _Last updated 2026-10-06T07:30Z · main @ 9c43dfc_
 | E63 | 2 | Hosted Maven splices the API `maven_suffixed_version` into `pom.xml` unchecked (any string, even markup), while hosted Gradle refuses the same grant unless it is `<base>-socket.<uuid[..8]>` (`redirect_gradle_override_invalid`); the suffix grammar has four builders and no shared validator, and the Maven/Gradle coordinate derivation is written twice (executed twice). | new finding | #882 | filed #882 |
 | E64 | 2 | BOM handling has no shared helper: 4 named `strip_bom` copies and ~50 inline strips (one-vs-many drift). `formats::pnpm`'s three `lockfileVersion` readers and `workspace::top_level_key` never strip it, so one BOM pnpm lock is readable (entries), not a pnpm lock (VEX), unversioned (hosted trust gate) and unsupported (vendored router), executed twice. Symptoms #903, #904, #623. | new finding; 4.4 | #905 | in PR #909 |
 | E65 | 3 | Every vendored backend sink discards `force` and `sources` (`_force`/`_sources` at 10 sinks) since acquisition went service-only, yet `vendor --force` help and `CLI_CONTRACT.md` promise missing-file tolerance and a `vendor_content_mismatch_overwritten` warning that nothing emits; `--force` only bypasses the variant probe (executed twice). Bears on #615. | new finding; 5.2 | #923 | filed #923 |
+| E66 | 2 | Vendored Poetry has two forward splicers chosen by line ending: CRLF/legacy locks use the shared `utils::poetry_lock` engine (as hosted does), LF 2.x locks use the `toml_surgery` line scanner `rewrite_target_package_unit`. They write different `files` shapes for one lock, and only the engine checks the wheel name and lowercases the digest (executed twice). | new finding; 5.4 | #936 | filed #936 |
 
 **Handed off:** none yet.