[Mikola Lysenko (mikolalysenko)]

Stack: PR 1 of the lock-model/* stack, based on #2001 (design: docs/design/lock-model-unification.md).

What

This PR moves the Socket-origin classifier into one new module, crates/socket-patch-core/src/origin.rs. The code comes from two places:

• From vex/discover/mod.rs:
  • hosted_uuid with its cached plain-URL fast path, now on a small OriginPolicy that holds the run's origin allowlist;
  • vendor_ref, vendor_ref_decorated, vendor_uuid_dir, strip_leaf_suffix, vendored_leaf_purl;
  • locate, Located, LocateOpts, Wired;
  • socket_patch_name_uuid;
  • the names_vendor_dir / mentions_vendor_dir / root_anchored_spelling helpers.
• From patch/redirect/mod.rs: hosted_patch_uuid, hosted_patch_url_uuids and SOCKET_PATCH_SERVER_HOST.

The tests move with the code: hosted_patch_uuid_tests verbatim, and the six discovery tests that cover the moved functions.

Why

This is the first step to one classifier for every reader. Today, discovery checks a Socket host allowlist, while the lock inventory accepts any host whose URL leaf matches. Later PRs point the inventory and the writers at this module. It sits outside formats/ on purpose: the formats/mod.rs architecture test keeps format models free of host policy.

No behavior change

• The code moves verbatim. I diffed every removed line against every added line. The only differences are:
  • paths (crate::patch::redirect::X → X);
  • the OriginPolicy struct replacing DiscoverCtx's patch_server_origins / hosted_hosts fields;
  • two one-line delegations on DiscoverCtx (hosted_uuid, locate);
  • module docs;
  • UUID_A → UUID in the moved tests.
• Callers. vex::discover re-exports the moved items its extractors use. patch::redirect's re-export is gone (review finding 7): its four callers import from crate::origin.
• The review's socket_identities change (finding 3) reuses the policy's host matcher instead of building one per call; the answers are the same (the recognition, memo and golden tests pass unchanged).

Size budget

Group	Base (#2001)	This PR	Why
lock-readers (now includes origin.rs)	30,462	30,544	49 lines moved in from patch/redirect, plus OriginPolicy and re-export glue
lock-writers	88,362	88,315	the 49 lines moved out (+2 from rustfmt wrapping a crate::origin:: path)

Counted with #2001's fixed counter. The routine merge 4242ebc resolved the loc-budget.json conflict with the base's path list, which dropped origin.rs from lock-readers (it showed 30,259). The next merge (88df7f9) puts it back. #2009 and #2029 had inherited the same drop, and their restack merges fix it too.

Review findings

Each finding was checked against the code first. Commit fbe644d ("Address the review of the origin move") applies them, after a merge of #2001's review fixes.

1. Fixed (confirmed). The extractor guard (extractors_read_content_only_through_the_recognizing_ctx_helpers) banned only hosted_patch_uuid( / hosted_patch_url_uuids(, so an extractor could build its own OriginPolicy and bypass DiscoverCtx::hosted_uuid. It now also bans OriginPolicy and crate::origin::. The needle is crate::origin::, not bare origin::, because extractors legitimately import crate::vendor::npm_origin::. vex::discover no longer re-exports OriginPolicy; mod.rs imports it from crate::origin directly.

2. Fixed, except one needle. The lock_inventory entry-model guard now also bans OriginPolicy, crate::origin:: and hosted_uuid(. The formats/ guard bans OriginPolicy, hosted_uuid( and SOCKET_PATCH_SERVER_HOST, but not crate::origin::. That guard's rule is "no I/O and no host policy", and origin also holds the pure, root-anchored path grammar (vendor_ref), which applies no host policy. The pnpm planner core in Plan pnpm rewires with one core for both modes (lock-model 2b) #2029 (formats::pnpm::plan::match_key) uses it on purpose: it is the rule N5 asks every reader to use.

3. Fixed (confirmed). socket_identities rebuilt the host list and its Aho-Corasick matcher on every call. It now takes &OriginPolicy, and the policy memoizes:

   • one lowercased host set, shared with hosted_uuid's fast path (which used the un-lowercased host_str(); reqwest already lowercases http(s) hosts, so no answer changes);
   • one case-insensitive matcher (OriginPolicy::host_finder).

   DiscoverCtx passes its own policy, so a discovery run builds the matcher once. hosted_uuids_in_text, the upstream restore's probe, keeps its &[String] signature and builds a policy per call, as before. The vex::discover golden test passes.

4. Fixed. origin.rs's module doc now states the one-classifier rule as the goal and names what still classifies on its own:

   • the inventory's PyPI view (lock_inventory/pypi.rs hosted_pypi_reference, with its own url-tail grammar);
   • discovery's PyPI diagnostics (pypi_other.rs, which compares hosts directly);
   • the upstream restore's known-origin list;
   • the inventory's any-host matching.

5. Fixed. socket_patch_name_uuid is pub(crate) again, as it was in vex::discover.

6. Fixed. Removed the duplicate inner use is_canonical_uuid in hosted_patch_url_uuids.

7. Fixed, with one exception. The patch::redirect re-export of hosted_patch_uuid / hosted_patch_url_uuids / SOCKET_PATCH_SERVER_HOST is gone.

   • Its callers (redirect::vlt_heal, redirect::upstream, lock_inventory::pypi, vex::discover) use crate::origin:: directly.
   • So do the docs: discover rule 4, socket_identities, redirect::generation and vendor::path.
   • The exception: vex::discover keeps re-exporting the vendored-path and locate helpers, and now SOCKET_PATCH_SERVER_HOST for pypi_other.rs:576. Finding 1's guard bans crate::origin:: in extractor files, so the extractors import every identity helper through super::. The public vex::discover::vendor_ref family stays too, because the CLI's vex_sources.rs imports it.

8. Fixed. The new test vex::discover::tests::ctx_hosted_uuid_honours_the_runs_configured_origins goes through DiscoverCtx::with_origins(..).hosted_uuid(..). It checks a configured-origin URL, a registry URL, and the same URL with no origins configured.

9. Fixed (confirmed). The public module's doc linked pub(crate) items (OriginPolicy::hosted_uuid, OriginPolicy::locate, and now socket_patch_name_uuid). They are plain code spans now. cargo doc -p socket-patch-core with rustdoc::private_intra_doc_links reports nothing for origin.rs.

Testing

• cargo test -p socket-patch-core --lib -- origin:: vex:: formats:: vendor::lock_inventory:: vendor::pnpm patch::redirect:: hosted::: 2,518 passed, 0 failed. This includes:
  • vex::discover::testing::golden::tests::committed_fixture_corpus_matches_golden;
  • the extractor, formats and lock_inventory architecture guards;
  • the moved tests under origin::.
• cargo clippy --locked --workspace --all-features -- -D warnings: clean. cargo fmt --all -- --check: clean.
• python3 -B -m unittest discover -s scripts/tests -p 'test_loc_budget.py': 31 tests, OK. scripts/loc-budget.py --check: both groups at their budget.

---

Generated by Claude Code