Project consumed version evidence through sequence appends

internal/engine/source_version.go

@@ -30,16 +30,17 @@ type sourceVersionAncestor struct {
 }
 
 type sourceVersionEvidence struct {
-	sourceID     string
-	path         Path
-	resolvedPath Path
-	destination  Path
-	version      Version
-	location     *Location
-	ancestors    []sourceVersionAncestor
-	absence      sourceVersionPathAbsence
-	checked      bool
-	redacted     bool
+	sourceID       string
+	path           Path
+	resolvedPath   Path
+	destination    Path
+	projectedPaths []Path
+	version        Version
+	location       *Location
+	ancestors      []sourceVersionAncestor
+	absence        sourceVersionPathAbsence
+	checked        bool
+	redacted       bool
 }
 
 type sourceVersionState struct {
@@ -80,7 +81,7 @@ func sourceVersionCheckForEvidence(evidence *sourceVersionEvidence, sensitivity
 	redacted := evidence.redacted
 	if conservative {
 		redacted = redacted || version.Text != ""
-	} else if sensitivity.isSensitiveAtOrAbove(appendDestination(evidence.destination, path).String()) {
+	} else if sensitivity.isSensitiveAtOrAbove(evidence.sensitivityPaths()[0].String()) {
 		redacted = true
 	}
 	if redacted {
@@ -91,6 +92,24 @@ func sourceVersionCheckForEvidence(evidence *sourceVersionEvidence, sensitivity
 	}
 }
 
+// sensitivityPaths preserves source-local evidence while describing its assigned
+// application coordinates. Before assembly, the original mount is the fallback.
+func (evidence *sourceVersionEvidence) sensitivityPaths() []Path {
+	if evidence.projectedPaths != nil {
+		return evidence.projectedPaths
+	}
+	local := evidence.resolvedPath
+	if !local.valid() {
+		local = evidence.path
+	}
+	paths := make([]Path, 0, len(evidence.ancestors)+1)
+	paths = append(paths, appendDestination(evidence.destination, local))
+	for _, ancestor := range evidence.ancestors {
+		paths = append(paths, appendDestination(evidence.destination, ancestor.path))
+	}
+	return paths
+}
+
 func (state *sourceVersionState) process(root *document.Node, role sourceVersionRole, destination Path, sourceID string, placement placementMode) (sourceVersionProcessingResult, []Diagnostic) {
 	if state == nil || state.mode == sourceVersionModeDefault {
 		return sourceVersionProcessingResult{}, nil