[Mikola Lysenko (mikolalysenko)]

Stack: PR 1 of the lock-model/* stack, based on #2001 (design: docs/design/lock-model-unification.md).

What

This PR moves the Socket-origin classifier into one new module, crates/socket-patch-core/src/origin.rs. The code comes from two places:

• From vex/discover/mod.rs:
  • hosted_uuid with its cached plain-URL fast path, now on a small OriginPolicy that holds the run's origin allowlist;
  • vendor_ref, vendor_ref_decorated, vendor_uuid_dir, strip_leaf_suffix, vendored_leaf_purl;
  • locate, Located, LocateOpts, Wired;
  • socket_patch_name_uuid;
  • the names_vendor_dir / mentions_vendor_dir / root_anchored_spelling helpers.
• From patch/redirect/mod.rs: hosted_patch_uuid, hosted_patch_url_uuids and SOCKET_PATCH_SERVER_HOST.

The tests move with the code: hosted_patch_uuid_tests verbatim, and the six discovery tests that cover the moved functions.

Why

This is the first step to one classifier for every reader. Today, discovery checks a Socket host allowlist, while the lock inventory accepts any host whose URL leaf matches. Later PRs point the inventory and the writers at this module. It sits outside formats/ on purpose: the formats/mod.rs architecture test keeps format models free of host policy.

No behavior change

• The code moves verbatim. I diffed every removed line against every added line. The only differences are:
  • paths (crate::patch::redirect::X → X);
  • the OriginPolicy struct replacing DiscoverCtx's patch_server_origins / hosted_hosts fields;
  • two one-line delegations on DiscoverCtx (hosted_uuid, locate);
  • module docs;
  • UUID_A → UUID in the moved tests.
• Callers. vex::discover re-exports the moved items its extractors use. patch::redirect's re-export is gone (review finding 7): its four callers import from crate::origin.
• The review's socket_identities change (finding 3) reuses the policy's host matcher instead of building one per call; the answers are the same (the recognition, memo and golden tests pass unchanged).

Size budget

Group	Base (#2001)	This PR	Why
lock-readers (now includes origin.rs)	30,462	30,544	49 lines moved in from patch/redirect, plus OriginPolicy and re-export glue
lock-writers	88,362	88,315	the 49 lines moved out (+2 from rustfmt wrapping a crate::origin:: path)

Counted with #2001's fixed counter. The routine merge 4242ebc resolved the loc-budget.json conflict with the base's path list, which dropped origin.rs from lock-readers (it showed 30,259). The next merge (88df7f9) puts it back. #2009 and #2029 had inherited the same drop, and their restack merges fix it too.

Review findings

Each finding was checked against the code first. Commit fbe644d ("Address the review of the origin move") applies them, after a merge of #2001's review fixes.

1. Fixed (confirmed). The extractor guard (extractors_read_content_only_through_the_recognizing_ctx_helpers) banned only hosted_patch_uuid( / hosted_patch_url_uuids(, so an extractor could build its own OriginPolicy and bypass DiscoverCtx::hosted_uuid. It now also bans OriginPolicy and crate::origin::. The needle is crate::origin::, not bare origin::, because extractors legitimately import crate::vendor::npm_origin::. vex::discover no longer re-exports OriginPolicy; mod.rs imports it from crate::origin directly.

2. Fixed, except one needle. The lock_inventory entry-model guard now also bans OriginPolicy, crate::origin:: and hosted_uuid(. The formats/ guard bans OriginPolicy, hosted_uuid( and SOCKET_PATCH_SERVER_HOST, but not crate::origin::. That guard's rule is "no I/O and no host policy", and origin also holds the pure, root-anchored path grammar (vendor_ref), which applies no host policy. The pnpm planner core in Plan pnpm rewires with one core for both modes (lock-model 2b) #2029 (formats::pnpm::plan::match_key) uses it on purpose: it is the rule N5 asks every reader to use.

3. Fixed (confirmed). socket_identities rebuilt the host list and its Aho-Corasick matcher on every call. It now takes &OriginPolicy, and the policy memoizes:

   • one lowercased host set, shared with hosted_uuid's fast path (which used the un-lowercased host_str(); reqwest already lowercases http(s) hosts, so no answer changes);
   • one case-insensitive matcher (OriginPolicy::host_finder).

   DiscoverCtx passes its own policy, so a discovery run builds the matcher once. hosted_uuids_in_text, the upstream restore's probe, keeps its &[String] signature and builds a policy per call, as before. The vex::discover golden test passes.

4. Fixed. origin.rs's module doc now states the one-classifier rule as the goal and names what still classifies on its own:

   • the inventory's PyPI view (lock_inventory/pypi.rs hosted_pypi_reference, with its own url-tail grammar);
   • discovery's PyPI diagnostics (pypi_other.rs, which compares hosts directly);
   • the upstream restore's known-origin list;
   • the inventory's any-host matching.

5. Fixed. socket_patch_name_uuid is pub(crate) again, as it was in vex::discover.

6. Fixed. Removed the duplicate inner use is_canonical_uuid in hosted_patch_url_uuids.

7. Fixed, with one exception. The patch::redirect re-export of hosted_patch_uuid / hosted_patch_url_uuids / SOCKET_PATCH_SERVER_HOST is gone.

   • Its callers (redirect::vlt_heal, redirect::upstream, lock_inventory::pypi, vex::discover) use crate::origin:: directly.
   • So do the docs: discover rule 4, socket_identities, redirect::generation and vendor::path.
   • The exception: vex::discover keeps re-exporting the vendored-path and locate helpers, and now SOCKET_PATCH_SERVER_HOST for pypi_other.rs:576. Finding 1's guard bans crate::origin:: in extractor files, so the extractors import every identity helper through super::. The public vex::discover::vendor_ref family stays too, because the CLI's vex_sources.rs imports it.

8. Fixed. The new test vex::discover::tests::ctx_hosted_uuid_honours_the_runs_configured_origins goes through DiscoverCtx::with_origins(..).hosted_uuid(..). It checks a configured-origin URL, a registry URL, and the same URL with no origins configured.

9. Fixed (confirmed). The public module's doc linked pub(crate) items (OriginPolicy::hosted_uuid, OriginPolicy::locate, and now socket_patch_name_uuid). They are plain code spans now. cargo doc -p socket-patch-core with rustdoc::private_intra_doc_links reports nothing for origin.rs.

Testing

• cargo test -p socket-patch-core --lib -- origin:: vex:: formats:: vendor::lock_inventory:: vendor::pnpm patch::redirect:: hosted::: 2,518 passed, 0 failed. This includes:
  • vex::discover::testing::golden::tests::committed_fixture_corpus_matches_golden;
  • the extractor, formats and lock_inventory architecture guards;
  • the moved tests under origin::.
• cargo clippy --locked --workspace --all-features -- -D warnings: clean. cargo fmt --all -- --check: clean.
• python3 -B -m unittest discover -s scripts/tests -p 'test_loc_budget.py': 31 tests, OK. scripts/loc-budget.py --check: both groups at their budget.

---

Note

Medium Risk
Centralizes attestation-critical hosted URL and vendored path recognition; mistakes could misclassify lockfile wiring, though the PR positions this as a verbatim move with existing tests and architecture guards.

Overview
Introduces crates/socket-patch-core/src/origin.rs as the single place for classifying lockfile/config strings as Socket hosted URLs, vendored .socket/vendor/… paths, or socket-patch-<uuid> names. Logic moves here from patch::redirect (hosted_patch_uuid, hosted_patch_url_uuids, SOCKET_PATCH_SERVER_HOST) and vex::discover (vendor ref helpers, locate/Located, identity sweep support).

OriginPolicy holds the run’s patch-server allowlist and memoizes host sets and an Aho–Corasick matcher. DiscoverCtx delegates hosted_uuid and locate to it; socket_identities takes &OriginPolicy instead of rebuilding matchers per call. Callers (redirect::upstream, vlt_heal, lock inventory PyPI view, discover extractors) import from crate::origin; discover re-exports what extractors need and tightens architecture guards so extractors cannot bypass the ctx.

Tests move with the code; patch::redirect re-exports are removed. scripts/loc-budget.json adds origin.rs to the lock-readers group. Documented intent: no behavior change—refactor toward one classifier for all readers (follow-up PRs in the lock-model stack).

^{Reviewed by Cursor Bugbot for commit a322027. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a322027. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: Bugbot reviewed a322027d and found nothing, there are no unresolved review threads, and the draft CI subset is green (7 pass, 31 skipped). The description is complete, so I've marked this ready for review to run the full CI. The Ready for review label goes on once that's green. #2009 and #2029 are stacked on this PR.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at head a322027.

• CI: 32/32 ran checks green on a322027 (the rest skipped by path filters).
• Bugbot: reviewed a322027, no findings. No open review threads.
• Reviewer note: this is a pure move of the Socket-origin classifier into crates/socket-patch-core/src/origin.rs, with no behavior change. The stacked lock-model PRs (Read pnpm locks through one walk (lock-model 2a) #2009, then Plan pnpm rewires with one core for both modes (lock-model 2b) #2029) build on it.
• Slack: the announcement could not be sent in this run. The Slack send tool wasn't available to it.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief (head a322027)

What it does: Moves the Socket-origin classifier (hosted-URL uuid recognition, the vendored-path grammar, locate, and SOCKET_PATCH_SERVER_HOST) out of vex::discover and patch::redirect into one new module, origin.rs. A small OriginPolicy takes over DiscoverCtx's origin fields and memoizes the host set and matcher. This is step 1 of the lock-model stack, and behavior should not change.

Risk: low. I diffed every removed line against every added line. The only differences are import paths, the OriginPolicy glue, the two DiscoverCtx delegations, UUID_A → UUID in the moved tests, and docs. The one semantic touch is the shared host set, which now lowercases host_str(). That gives the same answers: url already lowercases http(s) hosts, and the identity sweep's matcher was already case-insensitive.

Look here

• origin.rs:181-245: OriginPolicy: hosts(), host_finder(), hosted_uuid fast path
• origin.rs:45-90: SOCKET_PATCH_SERVER_HOST, hosted_patch_uuid, hosted_patch_url_uuids (moved from patch::redirect)
• vex/discover/mod.rs:1954: socket_identities now takes &OriginPolicy (one matcher per discovery run instead of one per call)
• vex/discover/mod.rs:205-215: the re-exports extractors and the CLI still use
• vex/discover/mod.rs:4471 and formats/mod.rs / lock_inventory/mod.rs IMPURE lists: the architecture guards now ban OriginPolicy / hosted_uuid( (and crate::origin:: outside formats/)

Verified

• Moved-line diff as above. Base Plan one lock model for every lockfile reader #2001 is merged, and the diff against main is these 13 files only. CHANGELOG.md is untouched, and there is no debug code.
• cargo clippy --locked -p socket-patch-core --all-features -- -D warnings (CI's flags): clean.
• cargo test -p socket-patch-core --lib -- origin:: vex::discover:: patch::redirect:: formats:: vendor::lock_inventory::: 1805 passed, 1 failed. The failure is vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, a permission test that can't hold when run as root in my container. This PR doesn't touch it, and it passes in CI.
• CI is green on the head (ci-ok and clippy included). Bugbot reviewed a322027 with no findings. No review threads are unresolved.

Changes I made: none.

Open questions (non-blocking)

• scripts/loc-budget.py --check reports both lock groups over budget here, but main is over too (lock-readers 31,346 / lock-writers 88,837 on main against a 30,462 / 88,362 budget). So the size table in the description is stale against today's main. It isn't caused by this PR, and CI treats it as a warning.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code