Keep complete paths in missing version evidence

This commit is contained in:
2026-10-15 22:20:20 +00:00
parent 0a2246bdbe
commit e69ad0f32d
5 changed files with 105 additions and 7 deletions

View File

@@ -351,7 +351,9 @@ occur. Otherwise it records a source-local `Path`, the observed `Version` state
(`Present`, `Null`, and, when disclosed, exact `Text`), an actual or nearest
available `Location`, and whether text was redacted. A non-nil record with
`Present == false` records observed absence; it does not say the checker ran or
accepted a declaration. During callbacks and in failed-load source records,
accepted a declaration. Absent evidence still identifies the full requested
header path, while its location identifies the nearest available source node.
During callbacks and in failed-load source records,
text is conservatively withheld because final classification may not be
available. Successful final source records reflect completed sensitivity
classification at the declaration's mounted path and ancestors, including

View File

@@ -265,7 +265,15 @@ Required remediation:
### 5. Retain the complete requested path for absent declaration evidence (P2)
Status: open.
Status: complete. Lookup now clones the full requested path and refines only
segments whose container shape was actually observed. Unresolved suffixes remain
intact, and nearest source locations remain independent of the header path.
Engine regressions protect segment intent and caller ownership; public
regressions cover missing early members, scalar obstruction, and unavailable
intermediate indices through optional final/callback evidence and required-load
failure evidence. Both regressions failed before the fix and pass afterward.
Focused source-version/path/source-record tests and the everyday check passed
on `go1.26.9 linux/amd64`. The configuration contract clarifies absence evidence.
Affected: `resolveSourceVersionPath` and `sourceVersionCheckForEvidence` in
[source_version.go](../../internal/engine/source_version.go), especially lines