From 2a3fb3adabb0aa17113032ad785458556fb6372e Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 02:42:03 +0000
Subject: Filter internal members from collected archive facts

---
 src/manifest.rs  |  6 +++++-
 tests/compare.rs | 24 ++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/src/manifest.rs b/src/manifest.rs
index c25f0a8..afbf5d6 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -185,6 +185,10 @@ fn collect_archive_members(archive_path: &Path) -> Result<Vec<ArchiveMemberRecor
     let mut members = Vec::new();
     for entry in archive.entries().with_context(|| format!("read archive {}", archive_path.display()))? {
         let entry = entry.with_context(|| format!("read archive member from {}", archive_path.display()))?;
+        let path = portable_path(&entry.path()?)?;
+        if is_archive_root_path(&path) || is_internal_metadata_path(&path) {
+            continue;
+        }
         let kind = match entry.header().entry_type() {
             EntryType::Regular => "file",
             EntryType::Directory => "directory",
@@ -192,7 +196,7 @@ fn collect_archive_members(archive_path: &Path) -> Result<Vec<ArchiveMemberRecor
             EntryType::Link => "hardlink",
             other => bail!("unsupported archive member type {other:?} in {}", archive_path.display()),
         };
-        members.push(ArchiveMemberRecord::new(portable_path(&entry.path()?)?, kind));
+        members.push(ArchiveMemberRecord::new(path, kind));
     }
     Ok(members)
 }
diff --git a/tests/compare.rs b/tests/compare.rs
index eb6d388..0bb2fff 100644
--- a/tests/compare.rs
+++ b/tests/compare.rs
@@ -265,3 +265,27 @@ fn excludes_legacy_internal_host_and_fakedata_archive_members() {
     let report = compare(&legacy_manifest, &native_manifest);
     assert!(report.is_equivalent(), "{}", report.render());
 }
+
+#[test]
+fn native_manifest_collection_excludes_internal_members_from_its_archive_facts() {
+    let fixture = tempdir().expect("temporary directory");
+    let rootfs = fixture.path().join("rootfs");
+    fs::create_dir_all(rootfs.join(".host/private")).expect("create host metadata");
+    fs::create_dir_all(rootfs.join(".fakedata")).expect("create fakeroot metadata");
+    fs::create_dir_all(rootfs.join("etc")).expect("create visible directory");
+    fs::write(rootfs.join(".host/private/secret"), "metadata").expect("write host metadata");
+    fs::write(rootfs.join(".fakedata/owner"), "metadata").expect("write fakeroot metadata");
+    fs::write(rootfs.join("etc/controller.conf"), "controller\n").expect("write visible file");
+    let artifact = fixture.path().join("legacy.tar");
+    let mut writer = tar::Builder::new(fs::File::create(&artifact).expect("create legacy archive"));
+    writer.append_dir_all(".", &rootfs).expect("write legacy archive");
+    writer.finish().expect("finish legacy archive");
+
+    let manifest = ArtifactManifest::collect(&rootfs, vec![], None, &artifact)
+        .expect("collect native filesystem and archive facts");
+
+    assert!(manifest
+        .archive_members
+        .iter()
+        .all(|record| !record.path.starts_with(".host/") && !record.path.starts_with(".fakedata/")));
+}
-- 
cgit v1.2.3