feat(vendor): vendored-patch verification + Command::Vendor envelope tag

verify_vendored_patch_record: positive file-level evidence against the committed artifact (dirs hashed in place; npm tgz / pypi whl decoded in memory, bomb-capped). Fail-closed: no_files -> vendor_path_unsafe -> vendor_uuid_mismatch (path-level uuid IS the staleness signal) -> vendor_artifact_missing -> unreadable/hash_mismatch. Poisoned state.json paths never stat outside the project tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mikola Lysenko (mikolalysenko) · Jun 10, 2026 · Jun 9, 2026 · Jun 9, 2026 · Jun 9, 2026 · Jun 9, 2026
commit 24055541ba71274a0c0e23a377d3e7ce3fb8b2fa
diff --git a/crates/socket-patch-cli/src/json_envelope.rs b/crates/socket-patch-cli/src/json_envelope.rs
@@ -372,6 +372,7 @@ pub enum Command {
     Repair,
     Setup,
     Unlock,
+    Vendor,
     Vex,
 }
 
@@ -844,6 +845,7 @@ mod tests {
             (Command::Repair, "repair"),
             (Command::Setup, "setup"),
             (Command::Unlock, "unlock"),
+            (Command::Vendor, "vendor"),
             (Command::Vex, "vex"),
         ] {
             let serialized = serde_json::to_string(&command).unwrap();