setup-preflight rejects sha512 in documented svn-zip locks #4

What's broken

A documented method: svn-zip lock containing sha512: makes setup-preflight exit 2 with unknown key: 'sha512'. The checker cannot reach its snapshot, configuration, or reconciliation checks for that lock.

Which layer

Python setup pre-flight parser: plugins/magpie-setup/skills/setup/setup_preflight/lockfile.py, exposed to the Python package through tools/setup-preflight/src/setup_preflight.

The implementation rejects a field required by the existing contract: locks.md, svn-zip example and install.md, committed lock. The documented format should be supported.

How to reproduce

From a checkout of baseline 4556f693455ef2f250d9e07b224bd59a4c04387c, with Python 3.11+:

export PYTHONPATH="$PWD/plugins/magpie-setup/skills/setup"
export PYTHONDONTWRITEBYTECODE=1
python3 -c 'from setup_preflight.lockfile import parse; parse("method: svn-zip\nref: 0.2.0\nsha512: " + "ab" * 64 + "\n")'

Actual result:

setup_preflight.lockfile.MalformedLock: unknown key: 'sha512'

The following also exercises the actual CLI and changes only the sha512: line between the failing case and control:

python3 - <<'PY'
import json, os, subprocess, sys, tempfile
from pathlib import Path

pin = (
    "method: svn-zip\n"
    "url: https://dist.apache.org/repos/dist/release/magpie/0.2.0/apache-magpie-0.2.0-source.zip\n"
    "ref: 0.2.0\nsha512: " + "ab" * 64 + "\n"
)
control = "\n".join(line for line in pin.splitlines() if not line.startswith("sha512:")) + "\n"
with tempfile.TemporaryDirectory() as temporary:
    root = Path(temporary)
    subprocess.run(["git", "init", "-q", str(root)], check=True)
    for name, text in [("documented lock", pin), ("control", control)]:
        (root / ".apache-magpie.lock").write_text(text, encoding="utf-8")
        result = subprocess.run(
            [sys.executable, "-m", "setup_preflight", "--skill", "ci-runner-audit", "--hash", "sha256:0000000000000000"],
            cwd=root, env=os.environ, text=True, capture_output=True,
        )
        print(name, "exit=" + str(result.returncode))
        if result.returncode:
            print(result.stderr.strip())
        else:
            print([finding["code"] for finding in json.loads(result.stdout).get("findings", [])])
PY

The version, URL, and digest are synthetic fixtures matching the documented format. No release artifact is downloaded.

Expected vs actual

The digest is for re-fetch verification. This compatibility fix does not add a digest drift comparison: the documented local lock has no corresponding SHA-512 field. The gap in the upgrade contract requires a separate coordinated fix. Other unknown keys must remain errors.

Surface area (optional)

This affects the shared pre-flight when a svn-zip project pin contains the documented digest. The fix is limited to the parser and two Python regression tests. Valid marketplace, git-tag, git-branch, and local locks should remain unchanged; these methods must reject the svn-zip-specific sha512 field.

Related precedent: apache/magpie#1523 fixed another documented lock-key mismatch. It does not add support for sha512:.

Environment (optional)

• Baseline: 4556f693455ef2f250d9e07b224bd59a4c04387c (fork and upstream main matched at the start).
• Reproduced with the actual CLI on Windows / Python 3.13.5 and in a Linux Docker checkout / CPython 3.12.12.
• The Linux checkout restores real Git symlinks; the Windows checkout materializes them as text files.
• No credentials, downloaded snapshot, or project-specific private data are needed.

Human audit and AI disclosure

This issue is intentionally filed in MakerFlyFly/magpie for human audit before any upstream submission. Codex (GPT-6) assisted reproduction, implementation, and validation. Review feedback has been received; the scoped revision awaits another human audit and does not claim human approval.

Review revision: scope, boundaries, and rollout

The proposed fix accepts and preserves sha512 only when method is svn-zip, independent of key order. Empty values receive a missing-value diagnostic; other methods, unknown keys and scalar assignments to structured blocks remain errors. Existing local locks using either an empty fetched_commit or the svn-zip version are covered by regression tests.

The compatibility fix does not implement SHA-512 security drift detection. upgrade.md asks for a security-flagged finding when a digest changes under the same version, but the existing local lock has no fetched-digest field. A complete fix needs coordinated persistence, parsing, comparison and legacy-lock handling. Digest-format validation, duplicate-key policy and a normalized documentation-contract harness are also outside this issue's two-file fix.

For the normal pinned svn-zip installation path, maintainers must advance the committed project pin to a release containing the fix, install/upgrade to that snapshot, and refresh the personal checker from the updated source. Running config or upgrade against the same affected pin copies the old parser again. No adopter pin is modified automatically by this PR.

Review feedback has been incorporated within that scope. Human review is in progress; the revised Draft PR awaits another human audit. The original reproduction and validation evidence remain preserved.