provenance: publish canonical 40/64-hex forms via build_provenance

subc-protocol 0.17.0 validates build_git_sha as exactly 40 lowercase hex and
build_lock_digest as exactly 64. This module published 12 and 16, which is not a
shorter answer to the same question: an abbreviated sha can never compare equal
to a full one, so a fleet census reads permanent drift where there is only a
format difference. Reported against us as iceteaSA #87.

Three changes, and only the first was forced.

1. Built through build_provenance() rather than as a struct literal. The literal
   still compiles, so nothing made this necessary -- it would simply have kept
   publishing non-conforming forms with the validation sitting unused one call
   away. On a form error the block is omitted rather than defaulted or fatal: a
   build that cannot state a conforming fact says nothing, exactly as one that
   could not establish the fact at all does.

2. Full sha instead of the 12-char abbreviation. health.metrics.buildCommit keeps
   its short form -- it answers a skew question against a local rev-parse and is
   documented as carrying a clean sha from a dirty tree, which provenance must
   not.

3. Cargo.lock digest is now SHA-256 rather than DefaultHasher. The width was the
   reported defect; the algorithm was the worse one. DefaultHasher is explicitly
   not guaranteed stable across Rust releases, so the same lockfile could stamp
   differently after a toolchain bump -- and this value exists to say whether two
   builds resolved the same dependencies. A digest that changes without its input
   changing answers that question wrongly while looking correct.

The test now pins 64 lowercase hex explicitly, because the constructor OMITS a
non-conforming value rather than rejecting it: a regression would publish no
digest at all, and absent is indistinguishable from never-stamped.

wire_crate_version is filled by the constructor from the linked crate, so the
local helper is gone. Its assertion stays: the value moved upstream, the claim
this module publishes did not, and a test that stops checking a published field
because a dependency computes it is trusting that dependency to keep meaning what
it meant.

Author: ualtinok

Cargo.lock

@@ -30,5 +30,12 @@ async-trait = { workspace = true }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
 
+# build.rs stamps a lock digest that the manifest publishes as provenance, and
+# subc-protocol validates it as exactly 64 lowercase hex -- a real SHA-256 rather
+# than a hash whose width happens to fit. sha2 is already in the dependency graph
+# for the runtime, so this adds no new third-party surface.
+[build-dependencies]
+sha2 = { workspace = true }
+
 [dev-dependencies]
 subc-core = { workspace = true }

crates/quota-module/Cargo.toml

@@ -88,7 +88,13 @@ fn main() {
         // and yields None on every worktree build.
         match (clean, locate_git_dir().as_deref().and_then(head_commit)) {
             // The ONLY case that may state a commit: we looked, and it was clean.
-            (Some(true), Some(sha)) => short(&sha),
+            //
+            // FULL 40-hex, not the abbreviated form the health stamp uses.
+            // subc-protocol validates provenance shas as exactly 40 lowercase
+            // hex, and an abbreviated one is not a shorter answer to the same
+            // question -- it false-drifts a fleet census against every module
+            // publishing the full form, because the two can never compare equal.
+            (Some(true), Some(sha)) => sha,
             // Dirty, or undeterminable, or no HEAD. Empty string, which the
             // consumer maps to None -- a sentinel must never render as a value.
             _ => String::new(),
@@ -162,12 +168,22 @@ fn tree_clean(worktree_root: &Path) -> Option<bool> {
 /// Deliberately not gated on tree cleanliness. It is a change-detector, not an
 /// identity claim — it answers "are these two builds the same dependencies",
 /// which stays true and useful on a dirty tree where the sha does not.
+/// SHA-256 of `Cargo.lock`, rendered as 64 lowercase hex.
+///
+/// WAS A `DefaultHasher`, which is wrong here for two independent reasons and
+/// only one of them is the width. `DefaultHasher`'s algorithm is explicitly not
+/// guaranteed stable across Rust releases, so the same lockfile could stamp
+/// differently after a toolchain bump -- and this value's entire job is to say
+/// whether two builds resolved the same dependencies. A digest that changes
+/// without its input changing answers that question wrongly while looking fine.
+///
+/// The width matters too: subc-protocol validates this as exactly 64 hex, and a
+/// 16-hex value false-drifts a fleet census against modules publishing full
+/// digests.
 fn lock_digest(worktree_root: &Path) -> Option<String> {
-    use std::hash::{Hash, Hasher};
+    use sha2::{Digest, Sha256};
     let text = std::fs::read(worktree_root.join("Cargo.lock")).ok()?;
-    let mut hasher = std::collections::hash_map::DefaultHasher::new();
-    text.hash(&mut hasher);
-    Some(format!("{:016x}", hasher.finish()))
+    Some(format!("{:x}", Sha256::digest(&text)))
 }
 
 fn is_stamp(raw: &str) -> bool {

crates/quota-module/build.rs

@@ -36,9 +36,8 @@ use serde_json::json;
 use subc_protocol::{
     manifest::{
         Bindings, Concurrency, IdentityBinding, ManagementOperation, ManagementOperationKind,
-        ManifestProvenance, ModuleManifest, ProviderRole, SelfSignalDeclaration, SelfSignalEffect,
-        SelfSignalKind, SignalAnchor, SignalCadence, StorageBinding, StorageKind, StorageScope,
-        TrustTier,
+        ModuleManifest, ProviderRole, SelfSignalDeclaration, SelfSignalEffect, SelfSignalKind,
+        SignalAnchor, SignalCadence, StorageBinding, StorageKind, StorageScope, TrustTier,
     },
     session::{
         HealthStatus, ModuleControlRequest, ModuleControlResponse, MODULE_CONTROL_OP_HEALTH_CHECK,
@@ -1071,28 +1070,6 @@ fn build_lock_digest() -> Option<String> {
     (!raw.is_empty()).then(|| raw.to_string())
 }
 
-/// The subc-protocol version this binary LINKS.
-///
-/// THE REFERENT IS THE FLEET'S WIRE CRATE, NOT OURS. An earlier version declared
-/// `cortexkit-provider-usage` here -- our own envelope crate, read from the
-/// lockfile. That is real information about this module and the wrong answer to
-/// this field, and the two live in different numbering spaces: a census gate of
-/// the form `wire_crate_version >= 0.13.0` would have scored this module
-/// non-conformant while it demonstrably speaks the current protocol. A confident
-/// wrong answer at a gate, which is worse than declaring nothing.
-///
-/// Taken from the linked constant rather than from a lockfile read, which is also
-/// strictly better under the contract's from-the-build rule: `env!` in the crate
-/// we actually link describes THE BINARY, while a lockfile describes the source
-/// tree that happened to sit beside it at build time.
-///
-/// Our provider-usage version is still worth declaring somewhere -- but that is a
-/// case for a second field, not for redefining this one, and minting fleet wire
-/// fields is not ours to do unilaterally.
-fn wire_crate_version() -> Option<String> {
-    Some(subc_protocol::SUBC_PROTOCOL_CRATE_VERSION.to_string())
-}
-
 fn manifest(module_id: &str) -> ModuleManifest {
     // Built through the builder rather than as a literal: `ModuleManifest` is
     // `#[non_exhaustive]` upstream, so a field added there becomes a compile
@@ -1224,28 +1201,34 @@ fn manifest(module_id: &str) -> ModuleManifest {
             ),
         },
     ]))
-    .provenance(Some(ManifestProvenance {
-    // Populated rather than left None, because every field here is one this
-    // module already knows and a consumer otherwise has to ask a human for.
+    // Built through `build_provenance` rather than as a struct literal, and that
+    // is the difference between declaring these facts and declaring them in a
+    // form anyone can join on. The literal still compiles, so nothing forced
+    // this -- it would simply keep publishing a 12-hex sha beside other modules'
+    // 40-hex ones, which can never compare equal and read as permanent drift
+    // rather than as a format difference. Reported against this module as
+    // iceteaSA #87.
     //
-    // `build_git_sha` is NOT the same value as `health.metrics.buildCommit`,
-    // and an earlier version of this code reused it. That stamp is HEAD, so a
-    // dirty build carries a clean sha -- correct for the skew check it serves
-    // and wrong for an identity claim. Reported on insula#12.
+    // ON A FORM ERROR THE WHOLE BLOCK IS OMITTED, not defaulted and not fatal: a
+    // build that cannot state a conforming fact should say nothing, exactly as a
+    // build that could not establish the fact at all does.
     //
-    // `store_schema_version` stays None as an ABSENT FACT rather than an
-    // unfilled blank: this module owns no persistent store, so it has no
-    // schema version to state.
+    // `build_git_sha` is NOT `health.metrics.buildCommit`, and an earlier version
+    // reused it. That stamp is HEAD, so a dirty build carries a clean sha --
+    // correct for the skew check it serves and wrong for an identity claim.
+    // Reported on insula#12.
     //
-    // The other three are conditional by construction. Each is emitted by
-    // build.rs or not at all, and each maps an empty stamp to None -- so a
-    // build that could not establish a fact declares nothing rather than
-    // declaring a plausible one.
-        build_git_sha: build_provenance_sha(),
-        build_lock_digest: build_lock_digest(),
-        wire_crate_version: wire_crate_version(),
-        store_schema_version: None,
-    }))
+    // `store_schema_version` is None as an ABSENT FACT rather than an unfilled
+    // blank: this module owns no persistent store. `wire_crate_version` is filled
+    // by the constructor from the linked crate, so it is no longer ours to pass.
+    .provenance(
+        subc_protocol::manifest::build_provenance(
+            build_provenance_sha().as_deref(),
+            build_lock_digest().as_deref(),
+            None,
+        )
+        .ok(),
+    )
     .capabilities(
         // No versioned capability grammar declared. `None` and an empty block are
         // NOT the same statement: the protocol makes this optional precisely so a
@@ -1401,15 +1384,28 @@ mod tests {
         let digest = p
             .build_lock_digest
             .expect("build_lock_digest is hashed at build time from Cargo.lock");
+        // 64 lowercase hex, the form subc-protocol validates. Asserted here as
+        // well as upstream because the constructor OMITS a non-conforming value
+        // rather than failing: a build that regressed to a shorter digest would
+        // publish no digest at all, and "absent" is a legitimate state that no
+        // consumer can distinguish from "never stamped".
         assert!(
-            digest.len() == 16 && digest.chars().all(|c| c.is_ascii_hexdigit()),
-            "build_lock_digest must be a 16-char hex hash, got {digest:?}"
+            digest.len() == 64
+                && digest
+                    .chars()
+                    .all(|c| c.is_ascii_hexdigit() && !c.is_uppercase()),
+            "build_lock_digest must be 64 lowercase hex, got {digest:?}"
         );
 
         // THE REFERENT IS THE FLEET'S WIRE CRATE. Asserted by identity against the
         // linked constant, not by shape: a semver-shaped check passes just as
         // happily on our own provider-usage version, which is what this field
         // previously carried and what a census gate would have misread.
+        //
+        // Still asserted although `build_provenance` now fills this itself. The
+        // value moved upstream; the CLAIM this module publishes did not, and a
+        // test that stops checking a published field because someone else
+        // computes it is trusting a dependency to keep meaning what it meant.
         let wire = p
             .wire_crate_version
             .expect("wire_crate_version is the linked subc-protocol version");