From fc4e46c41bfb769193159143f6567341cd3e3a51 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 04:10:14 +0000
Subject: Validate semantic file record invariants

---
 tests/compare.rs | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

(limited to 'tests')

diff --git a/tests/compare.rs b/tests/compare.rs
index 43c91e0..45522d1 100644
--- a/tests/compare.rs
+++ b/tests/compare.rs
@@ -172,6 +172,39 @@ fn rejects_duplicate_semantic_keys() {
     assert!(error.to_string().contains("duplicate package record"));
 }
 
+#[test]
+fn rejects_malformed_file_records_before_comparison() {
+    let error = ArtifactManifest::new(
+        vec![],
+        vec![FileRecord {
+            path: "etc/controller.conf".into(),
+            kind: "file".into(),
+            digest: None,
+            target: None,
+        }],
+        None,
+        vec![],
+        vec![],
+    )
+    .expect_err("regular files require a digest");
+    assert!(error.to_string().contains("regular file record requires a digest"));
+
+    let error = ArtifactManifest::new(
+        vec![],
+        vec![FileRecord {
+            path: "etc/controller-link".into(),
+            kind: "symlink".into(),
+            digest: Some("not-applicable".into()),
+            target: Some("controller.conf".into()),
+        }],
+        None,
+        vec![],
+        vec![],
+    )
+    .expect_err("symlinks cannot carry a digest");
+    assert!(error.to_string().contains("symlink record cannot carry a digest"));
+}
+
 #[test]
 fn collects_semantic_facts_from_native_rootfs_and_tar_artifact() {
     let fixture = tempdir().expect("temporary directory");
-- 
cgit v1.2.3