[Mikola Lysenko (mikolalysenko)]

Stacked on #2019 (fix/cargo-mixed-member-pins). It closes the two Cargo false-attestation gaps the #2019 author found.

Vendored twin from another source

vendor wires a crate through the root's [patch.crates-io], and cargo applies that only to crates.io declarations. A workspace member (or the root) can declare the crate from another registry or from a repository URL, at a requirement the patched version satisfies. That declaration resolves its own unpatched copy. The vendored ref still attested beside it, because the lock copy claim (vendored_copy_claim) only reads sourceless entries.

• The ref now stays (rollback, remove and the ledgers still see the wiring), but it's marked unattested with a new UnattestedKind::CargoPatchBypassed. The detail names the declaration.
• A Cargo.lock entry at exactly the patched version from any registry or repository source, beside the copy, is marked the same way. The detail names that lock entry.
• A declaration counts as covered when a [patch.<source>] table for its source points at the same copy (for example [patch.my-corp], or a repository URL table, ignoring a trailing / or .git).
• A path declaration (the user's own fork) is still ignored, as a_same_version_fork_beside_the_tagged_copy_is_ignored already specifies.
• The CLI omits the ref as vex_cargo_patch_bypassed. That tag is documented in CLI_CONTRACT.md (Unattested references paragraph and the notes table).

I added a new variant rather than reusing CargoUnpinnedDeclaration. That variant's note tells the user to re-run scan to pin the declaration, which is the wrong fix for vendored wiring.

Split patches

The root pins a crate to Socket patch A and a member pins it to patch B. When the lock holds only A, discovery stopped as soon as it found a declaration pinning A, so it never emitted B and the CLI's wiring_conflict gate never ran. Discovery now also emits a Cargo.toml ref for B, attributed to the member, when two things hold:

• B's requirement accepts the locked version.
• The lock resolves the crate from no B entry.

So the package is gated as wiring_conflict. A same-version B lock entry was already its own ref, so the conflict pair came from the lock and nothing changes there. B locked at another version is a separate, patched package, so it doesn't conflict.

Refactor

DepEntry / Decl now carry a DepSource (crates.io / registry / repository URL / path) in place of the message-only origin string.

Tests

• New tests that failed before this change: split_patches_across_root_and_member_emit_both, a_member_from_another_source_bypasses_the_vendored_copy, a_same_version_lock_entry_from_any_source_bypasses_the_vendored_copy, a_member_from_git_bypasses_the_config_wired_copy.
• Guards that stay attested:
  • declarations_the_patch_redirects_keep_the_vendored_copy_attested: crates.io members in every spelling, including registry = "crates-io" and a rename; an excluding requirement; [patch.my-corp] and repository-URL coverage; a path fork.
  • another_patch_pin_at_another_version_does_not_conflict.
• CLI: a_vendored_cargo_copy_beside_a_bypassing_source_is_gated.
• Results:
  • cargo test -p socket-patch-core --lib -- vex::discover:: vendor::cargo patch::redirect:: utils::cargo_workspace (includes the golden corpus test): 1552 passed.
  • -p socket-patch-cli --lib vex_sources: 16 passed.
  • --test in_process_redirect cargo: 6 passed.
  • --test mode_migration_cargo: 30 passed.
  • --test in_process_cargo_apply cargo: 3 passed.
• cargo clippy --locked --workspace --all-features -- -D warnings and cargo fmt --all -- --check are clean.

Not done

• No vendored planner warning. vendor::cargo already refuses the lock-twin state: locked_multi_source_conflict covers a same-version entry from two sources, and vendor_source_unsupported covers a non-crates.io entry. A member declaration whose other-source copy isn't locked yet is invisible to the planner without re-resolving.
• No CLI-level test for the split case. The core test shows both refs reach Discovery.refs, and wiring_conflicts already groups refs by purl and uuid.

🤖 Generated with Claude Code