fix(item-delivery): reject item-set rebinding under reused digest

[cursor]

Superseded

This session-authority/item-set binding slice is fully contained in #185. Do not merge this predecessor.

Fresh exact ancestry evidence immediately before closure:

• fix(item-delivery): reject item-set rebinding under reused digest #99 head: c28768c723b443494e18df92c240868a06821709
• fix(item-delivery): reject deliver after item-set rebinding #185 head: a0752a6a78d3af3823adbb4fbdf402d026d8d474
• fix(item-delivery): reject deliver after item-set rebinding #185 is ahead by 2 commits and behind by 0, with fix(item-delivery): reject item-set rebinding under reused digest #99 as the merge base.

#185 retains the constructor-side exact ordered item-set pin and adds the missing deliver-time item-set comparison, with RED/GREEN coverage for enlarge/reorder/subset rebinding. #185 remains Draft and subject to unchanged exact-head CI/security/review gates. Closing this PR does not promote successor behavior to protected-main truth.

[cursor]

Stale comment

Verdict: domain fix is on this head, not #94

HEAD c28768c closes the #94 authority hole. AssessmentSession now pins the published ordered item-version set. from_session compares release, version, digest, locale, and that ordered set, then copies allowed items from the session. Isolated mismatch tests and same-session_ref / different-release deliver are present. ADR-0005, TRACEABILITY, ERD, UML, and CHANGELOG record the contract.

Keep #94 Draft. Do not merge 5f6142b.

Residuals (do not block this domain slice)

• Durable instrument_version_ref on item_delivery_ledger is still omitted. Name that adapter gap until a follow-up migration lands.
• Session persist PRs (#100 and successors) must store the pinned item_version_refs. Otherwise the pin is lost across restart and the same rebinding hole reopens after reload.
• Detached SessionState in src/response.rs remains a separate ADR-0005 slice (#107).

Next action

Independent last-push review from seonghobae, then mark Ready only after exact-head Runtime CI, coverage, and security checks are green. Do not self-approve. Do not merge #94 in parallel.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Finding

from_session now rejects a reused digest that enlarges, shrinks, or reorders the pinned item set. deliver does not.

InstrumentReleaseManifest::new still accepts any well-formed SHA-256 and does not hash the item list. A second AssessmentSession with the same session_ref, release, version, digest, and locale can therefore present a rebound form. On this head, deliver records item_version_001 as Ok instead of SessionMismatch.

That is the same authority hole #94 and this PR set out to close. Construction-time pinning is not enough if later delivery still treats the item set as honor-system.

What to do next

Do not merge this tip. The complete domain fix is PR #185 (a0752a6) on cursor/bc-fbb857d9-64db-4130-8ff4-546ba5119582-9baf. Keep #94 Draft as well.

Still out of scope here

• PostgreSQL item_delivery_ledger still omits instrument_version_ref.
• Ledger reload remains #110.
• Detached SessionState in src/response.rs remains #107.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

deliver compares session_ref, release, version, digest, and locale, then stops. A reused digest with an enlarged, reordered, or reduced item_version_refs still matches this tuple, so an active rebound session can append delivery evidence.

Add session.item_version_refs() / self.allowed_item_version_refs to this check. The successor that does that is #185.