Hybrid diff artifacts (source, symbols, normalized bytes)

Verified against commit 942a18727c (2026-09-26). Re-verify with: git grep -n "public sealed record\|public .* { get; init; }" -- src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.BinaryArtifacts/DeltaSig/HybridDiffContracts.cs

Objective

A hybrid diff links three views of one patch so that a reviewer or a policy can check them against each other:

Implementation

The contracts and the composer are in the closed BinaryArtifacts SDK, src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.BinaryArtifacts/DeltaSig/:

FileContent
HybridDiffContracts.csSemanticEditScript, SymbolMap, SymbolPatchPlan, PatchManifest and the HybridDiffEvidence bundle
HybridDiffComposer.csIHybridDiffComposer: builds the edit script from source diffs, builds a fallback symbol map from signatures, joins edits and symbols into a patch plan, builds the patch manifest, and computes the linking digests
DeltaSigService.csAttaches HybridDiffEvidence to the v1 DeltaSigPredicate (hybridDiff) when DeltaSigRequest.IncludeHybridDiffEvidence is true (the default)

DeltaSigRequest accepts optional SourceDiffs, OldSymbolMap and NewSymbolMap. When no symbol map is supplied, the composer synthesizes one from the generated signatures (AddressSource records the origin; the default is manifest).

Current constraints:

Artifact contracts

All four artifacts carry SchemaVersion, default 1.0.0.

Semantic edit script

SourceTreeDigest and Edits[]. Each SemanticEdit has StableId, EditType, NodeKind, NodePath, Anchor, and optional PreSpan, PostSpan (StartLine, EndLine), PreDigest, PostDigest.

Symbol map

BuildId, optional BinaryDigest, AddressSource, and Symbols[]. Each SymbolMapEntry has Name, Kind (default function), AddressStart, AddressEnd, Section (default .text) and optional SourceRanges[] (File, LineStart, LineEnd).

Symbol patch plan

BuildIdBefore, BuildIdAfter, EditsDigest, SymbolMapDigestBefore, SymbolMapDigestAfter, and Changes[]. Each SymbolPatchChange has Symbol, ChangeType, AstAnchors[], optional PreHash and PostHash, and DeltaRef.

Patch manifest

BuildId, NormalizationRecipeId and Patches[]. Each SymbolPatchArtifact has Symbol, AddressRange, DeltaDigest, and Pre and Post values of Size and Hash. The manifest does not carry an attestation reference.

Evidence bundle

HybridDiffEvidence carries the edit script, both symbol maps, the patch plan and the patch manifest, plus the digest of each: SemanticEditScriptDigest, OldSymbolMapDigest, NewSymbolMapDigest, SymbolPatchPlanDigest, PatchManifestDigest.

Verification

DeltaSigService.VerifyAsync recomputes each artifact digest and fails with DeltaSigVerificationStatus.HybridEvidenceMismatch when a digest or linkage does not match. A predicate without hybridDiff is verified without this step.

Policy

DeltaSigPolicyOptions (in IDeltaSigService.cs) adds hybrid controls to the function-count and byte budgets: RequireHybridEvidence, RequireAstAnchors, DeniedSymbolPrefixes, ProtectedSymbolPrefixes and MaxPatchManifestDeltaBytes. The hub-owned DeltaSigPolicyEvaluator.EvaluatePolicy (src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.DeltaSig/Policy/) evaluates them. At the verified commit its only caller is DeltaSigServiceHybridPolicyTests. The stella binary delta-sig gate command applies its own function-count, byte and similarity checks.

Not implemented

The following parts of the original design have no implementation at the verified commit: