Context
collect() currently archives every artifact declaration and stores results in a dict[source, archive]. Duplicate resolved sources therefore consume the byte budget multiple times while later entries silently overwrite earlier archives; differing exclude lists make the result order-dependent.
This was found in post-merge review of #2144 and appeared on #2152 only during its automatic retarget to main; artifacts.py is not part of #2152's current diff. The broader transport security boundary is tracked in #2194 and the durable archival contract in #2189.
Done when
- Duplicate resolved sources are rejected with a clear error, or normalized with explicitly documented merge semantics before any archive is created.
- The byte budget corresponds exactly to the returned collection.
- Differing exclusion rules cannot silently overwrite one another.
Context
collect()currently archives every artifact declaration and stores results in adict[source, archive]. Duplicate resolved sources therefore consume the byte budget multiple times while later entries silently overwrite earlier archives; differingexcludelists make the result order-dependent.This was found in post-merge review of #2144 and appeared on #2152 only during its automatic retarget to
main;artifacts.pyis not part of #2152's current diff. The broader transport security boundary is tracked in #2194 and the durable archival contract in #2189.Done when