feat: stabilize finding identity for diff

[JeremyDev87]

What

• Add a versioned stable finding identity: kratos:v1:<64-hex-sha256>.
• Base identity only on finding kind, normalized root-relative path, and semantic locator using length-delimited digest input.
• Expose identityVersion and full finding IDs in JSON/Markdown diff evidence.
• Preserve report schema v3, existing ReportDiff callers, and legacy formatter output through additive identity-aware APIs.
• Add RED→GREEN coverage for metadata churn, Unix/Windows path normalization, semantic locator differences, duplicates, ordering, and cross-root determinism.

Why

Presentation metadata such as reason, confidence, safety, and clean-safety evidence must not make one semantic finding appear newly introduced or resolved. A stable identity is required before later introduced-only corpus or gate work can be trusted.

Scope / boundaries

• Issue: [P1-1][kratos] Stable finding identity and introduced-only diff contract #101; parent P0 epic [v1 readiness] Kratos release gate epic (no version bump) #90 is now closed with the completed [v1 readiness][kratos] CLI/report contract freeze and schema evidence #91–[v1 readiness][kratos] Docs parity and v1 scope freeze #95 evidence rollup.
• 10 owned files only: core diff identity, core/CLI tests, five README translations, and the v1 contract plan.
• No scanner semantics outside diff identity/evidence, schema v4, source spans, SARIF/annotations, CI blocking, workspace/cache, version/tag/publish/release, package manifest, or release workflows.

Validation

• Focused core: 13/13 PASS
• Focused CLI: 3/3 PASS
• cargo test --workspace PASS
• cargo clippy --workspace --all-targets PASS
• cargo metadata --locked --no-deps PASS
• npm run verify PASS; 9 passed, 1 environment-gated native smoke skipped
• Changed-file rustfmt: 4/4 PASS
• Real scan --no-write CLI smoke PASS; no report or .kratos/ write
• git diff --check PASS

Known boundary

• cargo fmt --all -- --check reports pre-existing formatting drift in unrelated crates/kratos-core/src/discover.rs, crates/kratos-core/src/ignore.rs, and crates/kratos-core/tests/report_v2.rs. Those files are outside [P1-1][kratos] Stable finding identity and introduced-only diff contract #101 and were not modified; all four changed Rust files pass targeted rustfmt.
• Independent critic timed out without a summary; no independent-consensus claim is made. Direct exact-head review found Critical 0 / High 0.

Live facts

• Base: master@c0fdabd05e7cf1deec65816f551b26ef5777b096
• Candidate head: 58f948cbf11fd296e8ade13f444c281885a6fea5
• [P1-1][kratos] Stable finding identity and introduced-only diff contract #101 has feat label and JeremyDev87 assignee.

Closes #101

[JeremyDev87]

ddalggak review — approve

Verdict: approve
├─ PR: #102 @ 58f948c
├─ Blockers: Critical 0 / High 0 / Evidence gaps 0
├─ 핵심 이유: versioned stable ID로 deletion/orphan metadata churn를 제거하고 ReportDiff 호환·schema v3를 유지함
└─ Next: 주인님 수동 formal review/merge. merge/auto-merge·version/tag/publish 금지

검증 근거 / Checks

• PR: feat: stabilize finding identity for diff #102
• Exact head: 58f948cbf11fd296e8ade13f444c281885a6fea5
• Base: master@c0fdabd05e7cf1deec65816f551b26ef5777b096 (merge-base == origin/master, textual conflict markers none)
• Linked issue: [P1-1][kratos] Stable finding identity and introduced-only diff contract #101 open — Stable finding identity and introduced-only diff contract
• Draft at review start: true → ready after this approve (no formal human approval claimed)
• Current-head checks: 10/10 SUCCESS (Node 18/20/22/24, Rust workspace, native packaging ×5 incl. Windows)
• Local independent verification on exact head:
  • cargo test -p kratos-core --test report_diff 13/13 PASS
  • cargo test -p kratos-cli --test diff_cli 3/3 PASS
  • cargo test --workspace PASS
  • cargo clippy --workspace --all-targets exit 0 (pre-existing warnings only)
  • npm run verify exit 0 (9 passed / 1 env-gated native smoke skipped) + pack dry-run
  • git diff --check origin/master...HEAD exit 0
  • Real CLI: scan→diff JSON identityVersion=1, 9 full kratos:v1: + 64-hex IDs, unique=9, identical-scan totals all persisted; report schemaVersion=3
  • scan --no-write exit 0, no .kratos/ created
• Diff scope: 10 files, exact issue owned set; no package.json/workflows/Cargo.toml/Cargo.lock mutation (sha2 already present)

Findings 상세

Critical / High / Evidence gaps

• none

Substantive non-CI observations (current head)

1. Issue [P1-1][kratos] Stable finding identity and introduced-only diff contract #101 acceptance coverage

   • Identity form kratos:v1:<64-hex-sha256> via finding_id + FINDING_IDENTITY_VERSION=1 (report_diff.rs).
   • Length-delimited digest: domain tag, identity version BE bytes, kind, normalized path, locator count + components (hash_identity_component).
   • Excludes reason/confidence/safe/cleanSafety/timestamps from identity; deletion-candidate and orphan metadata changes stay persisted (GREEN tests + contract doc).
   • Cross-root + Windows-style path normalization via string normalize + root: relative keys (old Path::strip_prefix host coupling removed).
   • Report schema remains v3; ReportDiff struct fields unchanged; additive ReportDiffWithIdentity + *_with_identity formatters; legacy JSON/MD omit identity (legacy_report_diff_struct_literal_remains_source_compatible).
   • CLI diff routes to identity-aware APIs only; README×5 + v1-cli-report-contract.md document the contract.
   • Non-goals respected: no schema v4, SARIF/annotation, CI gate, workspace/cache, version/tag/publish.

2. Changed-code correctness

   • Old deletion key included reason|confidence.to_bits() → metadata churn; new deletion_candidate_id is path-only under kind deletion-candidate.
   • Old orphan key mixed mutable classification metadata; new path-only under kind orphan-file, with Module→Component still persisted (explicit test).
   • Broken-import/unused-import/route-entrypoint/dead-export locators match documented kind-specific semantics.
   • Duplicate multiset handling: shared count persisted, excess introduced/resolved; deterministic group sort via serializer string before materialization.
   • Formatter ID vectors zip 1:1 with findings (assert_eq invariant); JSON inserts additive id without dropping existing fields.

3. Regression / edge risk

   • Consumers parsing CLI JSON get additive identityVersion/id (compatible for open objects). Library legacy formatters unchanged.
   • Orphan kind / dead-export kind intentionally outside identity (documented); classification-only flips no longer churn — desired for P1-1 metadata stability, not a silent regression vs issue contract.
   • Path case-sensitivity and symlink/real-path identity are outside this lane (not claimed).

4. Scope expansion

   • Only the 10 owned paths. No scanner semantic changes outside diff identity. No release surfaces.

5. Test/evidence adequacy

   • Core tests cover metadata persistence, cleanSafety fingerprint ignore, safe migration, cross-root ID equality, Windows root move, duplicates, reorder determinism, dead-export evidence exclusion, formatter identity exposure, legacy compatibility.
   • CLI tests assert MD identity version line + JSON id shape.
   • Issue AC#1 wording asks for preserved RED tests of pre-fix churn; current suite is GREEN contract proof of the fixed algorithm (sufficient for approve; process nit only).

Low / nit (non-blocking)

• Issue title includes “introduced-only” while this PR freezes identity only (later P1 units own introduced-only enforcement). Body/AC are the SSoT and are met.
• No permanent RED-only historical test artifacts; GREEN tests encode the previously failing contracts.

Gate / Wiki / Scope 상세

Quality Lens Router Output

• Applicable:
  • evidence-contract: diff identity is a consumer/API contract needing CLI+test proof
  • simplicity-deletability: additive API over breaking ReportDiff field expansion
  • tdd-systematic-debugging: metadata-churn regression coverage
• Skipped:
  • frontend/react/vercel/a11y/deploy-token: backend/CLI only
  • security-posture workflow lanes: no workflow/package mutation
  • regression-library: one-lane identity fix, no new repeated class beyond intended deletion-metadata churn fix

Evidence Contract

• Required: focused RED→GREEN-style contracts, workspace/npm/clippy, real CLI identity evidence, schema v3 preserved, docs parity — present
• Not applicable: browser/DOM; package publish; CI blocking gate (explicit non-goal)
• Blocking gaps: none

Wiki Context Manifest

• Queries attempted: stable finding identity SSoT No Silent Fallback, finding identity diff contract
• Wiki sources read: [wiki: domains/principles/alex-core-invariants.md] (discovery + SSoT/consistency lens)
• Relevant facts: SSoT for identity algorithm, consistency across roots/formats, no silent fallback to host path quirks
• Constraints: repo contract lives in issue [P1-1][kratos] Stable finding identity and introduced-only diff contract #101 + docs/plans/v1-cli-report-contract.md + code
• Unknowns: no repo-specific kratos P1 identity canonical wiki page
• Non-wiki inference: live diff, master old keys, local/CI execution
• Brain v0 authority: alex-core-invariants domain page
• Raw/imported seen not used as authority: raw/2026-05-26-ai-code-review-sarif-finding-lifecycle-source-map.md, index/log
• Authority conflicts/evidence gaps: none material for approve

Manual merge boundary

• Agent does not merge/auto-merge
• No version bump / tag / npm publish / release dispatch
• Formal GitHub reviewDecision may remain REVIEW_REQUIRED under self-review/branch protection