Phase 2: include capabilities in the review hash (provider pinning)

Haofei · claude · Haofei · commit 9877d81ae4c6 · 2026-06-07T02:37:39.000-07:00
The review hash covered identity/risk/reasons/summary but not the individual
capabilities, so a provider swap or re-classification that kept the same summary
counts was invisible to the lock. Hash each capability's binding symbol,
category, provider, service, action, and resource so any capability change
(notably a supply-chain provider swap) changes review_hash and the lock catches
it. Reproducible review now means capability-aware review.

- test: a capability provider swap (same category/code) changes review_hash.
- regenerate committed rsspkg.lock files (this also refreshed pre-existing stale
  interface/native hashes; no test verified the committed locks, so they had
  drifted).

Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/examples/packages/agent-observability-smoke/rsspkg.lock b/examples/packages/agent-observability-smoke/rsspkg.lock
@@ -13,7 +13,7 @@ features = []
 name = "rss-agent"
 version = "0.1.0"
 source = "path+rss/agent"
-checksum = "sha256:403bcdb1b470e20773b1ef9a81759bbfe619b9343c2f1d055ef6f039aee497e6"
+checksum = "sha256:17e60777f0f4340b6cbc170e51cec839b715581662c15e53d3f276957e9935e2"
 interface_hash = "sha256:7cda33905aaa0464b192f6ab1db1bf295a9463877efa88d2370c80e40e559d16"
 review_hash = "sha256:11e8f031906e747a1d003b9d5a0586e0648dda0af8148eae7b1ff6a1a90dcd0a"
 features = []
diff --git a/examples/packages/code-agent/rsspkg.lock b/examples/packages/code-agent/rsspkg.lock
@@ -33,7 +33,7 @@ version = "0.1.0"
 source = "path+rss/async"
 checksum = "sha256:f914a2d48f62d3e5d75a4c38464121a1083ee010d601dfbf73115583e3368c9c"
 interface_hash = "sha256:3b8cb6475d2dc480c4c0372183e1f6810521377170a00b2269e5d7a3d8a6969c"
-review_hash = "sha256:9ea9be9c8adcd29464138b918688bb9352368b2ea3aff00c85dee155c08145f9"
+review_hash = "sha256:8f752099ba99c720c8058d569cc3b660dedaf1c21ec2a585ae0e6a2657edfe16"
 features = []
 
 [[package]]
@@ -51,7 +51,7 @@ version = "0.1.0"
 source = "path+rss/chat-completions"
 checksum = "sha256:81e2795715fab39d6de89715ca6bf03579554742bb7a07b9c70493fc10449ee2"
 interface_hash = "sha256:a9b13f9a056d1dbb90d9ed3b7e45797eb28806843ba5fc5f4467eb59d4748b4c"
-review_hash = "sha256:a8a8d0987f4bc4b2198535b1b3a49c8ab3ff1f8a62aef36162e028fab5223083"
+review_hash = "sha256:7a5df14deccde0abb08388fa79772f47df93e9517d6d290eae0f81e86c17003a"
 features = []
 
 [metadata]
diff --git a/rss/adapters/sqlite/rsspkg.lock b/rss/adapters/sqlite/rsspkg.lock
@@ -4,9 +4,9 @@ version = 1
 name = "rss-sqlite"
 version = "0.1.0"
 source = "path+rss/adapters/sqlite"
-checksum = "sha256:a3d4451fedec7c7a449ac892c8ea5140633ef1c1c00f1c45bd6b8d640beb6712"
-interface_hash = "sha256:283f52be39bfe2702335c89ed601b0ba440d8e80796b878bc843683b73d2842e"
-review_hash = "sha256:56d782e711ae2439301ca473f193abd65b6ae5a2aaa6ebf2718893deb2cdf088"
+checksum = "sha256:af5e8f9c28299180c4ebc738936c7fae1ed261369cefb27a2b3d9415155c0baa"
+interface_hash = "sha256:d564fa176ff3b2dea26f7945831fd49ddaef1ec53c12c20813c9d5afc649cb1f"
+review_hash = "sha256:cab76dc840f2aea95660e3ffc65be182b21ef75549ae5a8cfa8b2017e1647698"
 native_hash = "sha256:afa12d5e46aa0c9e30dac79915b9cac3683b599e481d8378e82c03664bfc3b2f"
 features = []
 
diff --git a/rss/adapters/sqlx-ffi/rsspkg.lock b/rss/adapters/sqlx-ffi/rsspkg.lock
@@ -4,10 +4,10 @@ version = 1
 name = "rss-sqlx-ffi"
 version = "0.1.0"
 source = "path+rss/adapters/sqlx-ffi"
-checksum = "sha256:b6f890ef0dfed98c37d0f5f64d1a1b5ce43aed60d0d77ce61fb74d0de2fb15e5"
+checksum = "sha256:31b05836ca997d6d6a4e4450376378aab2aa5cbf95f6bc0b77c207c9f8306892"
 interface_hash = "sha256:278dfc8763d620a3c4a603928b975ddcb919084e10dd6cf1550fc8dfdea031a8"
-review_hash = "sha256:ca9b92941dfbef01726c9a226aafed6e427f231c78bd961d7bd673d4fb731641"
-native_hash = "sha256:cf27173db6eb3ef1b1f3d567d050c35376c320a3334d267c6c5442d37ae557c7"
+review_hash = "sha256:3e59f928a567d7f308de84cf5b683893564ada9e3c282b989fc2fe9d6f7f9424"
+native_hash = "sha256:1f1a996dc8fe1c4d54f1faf7bd1e2d728221ea102f7a55130a949a7b731e22ba"
 features = []
 
 [metadata]
diff --git a/rss/adapters/sqlx/rsspkg.lock b/rss/adapters/sqlx/rsspkg.lock
@@ -13,10 +13,10 @@ features = []
 name = "rss-sqlx-ffi"
 version = "0.1.0"
 source = "path+rss/adapters/sqlx-ffi"
-checksum = "sha256:b6f890ef0dfed98c37d0f5f64d1a1b5ce43aed60d0d77ce61fb74d0de2fb15e5"
+checksum = "sha256:31b05836ca997d6d6a4e4450376378aab2aa5cbf95f6bc0b77c207c9f8306892"
 interface_hash = "sha256:278dfc8763d620a3c4a603928b975ddcb919084e10dd6cf1550fc8dfdea031a8"
-review_hash = "sha256:ca9b92941dfbef01726c9a226aafed6e427f231c78bd961d7bd673d4fb731641"
-native_hash = "sha256:cf27173db6eb3ef1b1f3d567d050c35376c320a3334d267c6c5442d37ae557c7"
+review_hash = "sha256:3e59f928a567d7f308de84cf5b683893564ada9e3c282b989fc2fe9d6f7f9424"
+native_hash = "sha256:1f1a996dc8fe1c4d54f1faf7bd1e2d728221ea102f7a55130a949a7b731e22ba"
 features = []
 
 [metadata]
diff --git a/rss/async/rsspkg.lock b/rss/async/rsspkg.lock
@@ -6,7 +6,7 @@ version = "0.1.0"
 source = "path+rss/async"
 checksum = "sha256:f914a2d48f62d3e5d75a4c38464121a1083ee010d601dfbf73115583e3368c9c"
 interface_hash = "sha256:3b8cb6475d2dc480c4c0372183e1f6810521377170a00b2269e5d7a3d8a6969c"
-review_hash = "sha256:9ea9be9c8adcd29464138b918688bb9352368b2ea3aff00c85dee155c08145f9"
+review_hash = "sha256:8f752099ba99c720c8058d569cc3b660dedaf1c21ec2a585ae0e6a2657edfe16"
 features = []
 
 [metadata]
diff --git a/rss/chat-completions/rsspkg.lock b/rss/chat-completions/rsspkg.lock
@@ -6,7 +6,7 @@ version = "0.1.0"
 source = "path+rss/chat-completions"
 checksum = "sha256:81e2795715fab39d6de89715ca6bf03579554742bb7a07b9c70493fc10449ee2"
 interface_hash = "sha256:a9b13f9a056d1dbb90d9ed3b7e45797eb28806843ba5fc5f4467eb59d4748b4c"
-review_hash = "sha256:a8a8d0987f4bc4b2198535b1b3a49c8ab3ff1f8a62aef36162e028fab5223083"
+review_hash = "sha256:7a5df14deccde0abb08388fa79772f47df93e9517d6d290eae0f81e86c17003a"
 features = []
 
 [[package]]
diff --git a/rss/core-properties/rsspkg.lock b/rss/core-properties/rsspkg.lock
@@ -12,7 +12,7 @@ features = []
 [[package]]
 name = "rss-quickcheck"
 version = "0.1.0"
-source = "path+rss/core-properties/../quickcheck"
+source = "path+rss/quickcheck"
 checksum = "sha256:f07a06f95d5a31f56daedd27c0c26d34a400659a0e5c935976a62d7e7831822f"
 interface_hash = "sha256:39d4fe5382251d41297e6d0b4393bc4a455f13b5e415366a966ba0944d0f2f1f"
 review_hash = "sha256:befe1b5705d6651c43a4d6995e31dc274f3f32191c64a6a3ad1b377d10085668"
diff --git a/rss/core/cli/rsspkg.lock b/rss/core/cli/rsspkg.lock
@@ -4,10 +4,10 @@ version = 1
 name = "rss-core-cli"
 version = "0.1.0"
 source = "path+rss/core/cli"
-checksum = "sha256:d8e00c918feac67c291e08a1d9278f1c6a350335df5c5feda0934331283aab80"
+checksum = "sha256:a8401e90961c8e6a7f394cba65476ed053c0fe2642b57e83e2b0f22acb301aff"
 interface_hash = "sha256:4f052e08055a890f184a6077af38285c9fa7a70053ec687326f16c53fe8b269b"
-review_hash = "sha256:02d674c35483eba36d71977d6804abf13b0157913849975119f27254c36caea7"
-native_hash = "sha256:47065cff06d26a623783c647d734bf849fc83332f467c11fb9de30976e746f2e"
+review_hash = "sha256:90b04f52ba72bb3256cc26f050799998199c4607f9fa1c7dbcb4ddf35962b8c7"
+native_hash = "sha256:919bed8bf7bb5b02e56b1fb1795ff30a34b6860dbaf8400fe01d6a168bf1796c"
 features = []
 
 [metadata]
diff --git a/rss/core/crypto/rsspkg.lock b/rss/core/crypto/rsspkg.lock
@@ -6,7 +6,7 @@ version = "0.1.0"
 source = "path+rss/core/crypto"
 checksum = "sha256:d017e77e2b5307ec0c29dbd5d5117df6593647930fae092d4828c5cbce3b9f7e"
 interface_hash = "sha256:7807302bebf82d229a2f67a0cc4bc008bfe1d0392e3789089ae2628335042b88"
-review_hash = "sha256:e274fe2f40b14847c65a69cca1a20c1da73e66a913477e987d8b0213bcc1f9b4"
+review_hash = "sha256:cdd9b1541be24c6d3dd9d9d0718014fab42fbbafc2a9733544c1457850d15188"
 native_hash = "sha256:20d532f4da768755f9dda393caabd777f14809df99b07f2b4b7523b0b5128f48"
 features = []
 
diff --git a/rss/core/http-server/rsspkg.lock b/rss/core/http-server/rsspkg.lock
@@ -4,10 +4,10 @@ version = 1
 name = "rss-core-http-server"
 version = "0.1.0"
 source = "path+rss/core/http-server"
-checksum = "sha256:3ebc663f710ccdcdf2bf07c645d1e00facef74c0bd667ef3a520504744ef1585"
+checksum = "sha256:91b5572f38f31029f770ef8ce18aa081fd0df620f34cd235f22ea44f04af0ce5"
 interface_hash = "sha256:2ed018b976ef74c33e0b0c530c969c742d15d6b4f23a38eaa740c2dbbb25623b"
-review_hash = "sha256:d0c235a8aa8e688b9a5bd85b4a0b0060f6eeb879c14f8ea70a92ca19cb0e503f"
-native_hash = "sha256:d9fa348ab6ec37f1aad0217bd8ad369f42be38bf73b38bc995b465c0c619f547"
+review_hash = "sha256:219400d161fb506e7ac056d68b83e27990e9a3551e9474ea0b78061bc45ff223"
+native_hash = "sha256:18b38e4f3191736fa723f688a40e7336ee6fa611163beacdbe845306496586ab"
 features = []
 
 [metadata]
diff --git a/rss/rayon/rsspkg.lock b/rss/rayon/rsspkg.lock
@@ -4,10 +4,10 @@ version = 1
 name = "rss-rayon"
 version = "0.1.0"
 source = "path+rss/rayon"
-checksum = "sha256:dd44d39934957c996740775ad66320b620b0405a4cd077d5da3fa4d578c4bc14"
+checksum = "sha256:af1ab884615c4f4a448d740f9e31ef95535ff7b7bb4c3be774404e2279fd1bb9"
 interface_hash = "sha256:7ebfd975892c2819dbb3736bd08e25ef4f3110cc9ea1050dc90349a568a04fa4"
-review_hash = "sha256:e5c28bb5ffe48f3fd056875ec9af6fe0fbff9de368162b32d2af929af36a932b"
-native_hash = "sha256:79297ed45f2f5c36beab1dd7150aaf908a0770816e9fa6d5f8ae3227348a3dd0"
+review_hash = "sha256:500a3f4359adc46ed515ba5e590e1f54b59f5585947966447869a80994730d5a"
+native_hash = "sha256:e6690fdbfc53c2172d7659282aab6942b8431c6d8522001c457f1443ff9039b8"
 features = []
 
 [metadata]
diff --git a/rss/test-runner/rsspkg.lock b/rss/test-runner/rsspkg.lock
@@ -4,9 +4,9 @@ version = 1
 name = "rss-test-runner"
 version = "0.1.0"
 source = "path+rss/test-runner"
-checksum = "sha256:8b2a21fe01418a4bd67e17d79bdf358263be87b57225792bfdabf712b3c27e3f"
+checksum = "sha256:34c961bb3b0dec7163f9d9110dfefe8761e37f3c807eac81ed72e04d2ceee5c5"
 interface_hash = "sha256:3281e549229a291481c7a385d8d248a6a64d1a8724d151bc06f1f9298daf42ed"
-review_hash = "sha256:455d894623f2a3fb67e9aa63ab7ea33cc1ce047c9387bbdcdfb706b4fac11ec7"
+review_hash = "sha256:336fc125ba103f2288140f8ccc188108ee9ffc96888e62558a4085611e858f60"
 features = []
 
 [metadata]
diff --git a/src/package/lock.rs b/src/package/lock.rs
@@ -615,6 +615,23 @@ fn package_review_hash(review: &PackageReview) -> String {
         input.push_str(&diagnostic.summary);
         input.push('\n');
     }
+    // Capabilities (incl. provider/service/action/resource) are part of the
+    // review identity: a provider swap or re-classification that keeps the same
+    // summary counts must still change the review hash, so the lock catches it.
+    for capability in &review.capabilities {
+        input.push_str(&capability.binding_symbol);
+        input.push('\n');
+        input.push_str(&capability.category);
+        input.push('\n');
+        input.push_str(capability.provider.as_deref().unwrap_or(""));
+        input.push('\n');
+        input.push_str(capability.service.as_deref().unwrap_or(""));
+        input.push('\n');
+        input.push_str(capability.action.as_deref().unwrap_or(""));
+        input.push('\n');
+        input.push_str(capability.resource.as_deref().unwrap_or(""));
+        input.push('\n');
+    }
     sha256_label(input.as_bytes())
 }
 
diff --git a/tests/checker_package.rs b/tests/checker_package.rs
@@ -5131,6 +5131,58 @@ native fn Native.two(message: read String) -> String
     );
 }
 
+#[test]
+fn package_lock_review_hash_tracks_capability_provider_swap() {
+    // Same code, same capability category — only the provider changes. The lock
+    // must still notice (provider pinning), otherwise a supply-chain provider
+    // swap would be invisible to review.
+    let old_dir = common::unique_temp_dir("rsscript-package-lock-provider-old");
+    let new_dir = common::unique_temp_dir("rsscript-package-lock-provider-new");
+    let manifest = |provider: &str| {
+        format!(
+            r#"[native.rust]
+enabled = true
+path = "native/rust"
+crate = "rss_native"
+build_scripts = "forbid"
+proc_macros = "forbid"
+unsafe = "forbid"
+
+[[review.capability_bindings]]
+symbol = "Native.write"
+category = "database.write"
+provider = "{provider}"
+"#
+        )
+    };
+    let source = r#"features: native
+
+native fn Native.write(message: read String) -> String
+    effects(native)
+"#;
+    let bindings = r#"[bindings]
+"Native.write" = "rss_native::write"
+"#;
+    common::write_package_fixture(&old_dir, "0.1.0", &manifest("trusted-db"), source);
+    common::write_package_fixture(&new_dir, "0.1.0", &manifest("rogue-db"), source);
+    for dir in [&old_dir, &new_dir] {
+        fs::create_dir_all(dir.join("native")).expect("native dir should be created");
+        fs::write(dir.join("native/bindings.rssbind.toml"), bindings)
+            .expect("native bindings should be written");
+    }
+
+    let old_lock = lock_package_dir(&old_dir).expect("old package lock should succeed");
+    let new_lock = lock_package_dir(&new_dir).expect("new package lock should succeed");
+    let _ = fs::remove_dir_all(&old_dir);
+    let _ = fs::remove_dir_all(&new_dir);
+
+    assert_ne!(
+        old_lock.packages[0].review_hash,
+        new_lock.packages[0].review_hash,
+        "a capability provider swap must change the review hash"
+    );
+}
+
 #[test]
 fn package_lock_review_hash_tracks_await_live_across_changes() {
     let old_dir = common::unique_temp_dir("rsscript-package-lock-await-live-old");
