v0.6 — Cross-source Evidence Compare: baseline ZIP → incident diff

[yaertu]

🎯 User result

Two FixBundle artifacts in, one deterministic, integrity-checked “what changed?” report out.

Product boundary

This is not a generic log diff, Sentry fingerprint clone, or LLM root-cause guesser. The wedge is comparing the normalized evidence FixBundle already captures across local/historical Git, GitHub Actions, and OTLP production incidents.

Acceptance

• fixbundle compare baseline.zip incident.zip
• optional --format json machine output
• validate both SHA256SUMS.txt files before reading evidence
• reject unsafe ZIP paths, duplicate members, malformed checksum lines, missing members, checksum mismatch
• reject malformed/unsupported FixBundle manifests fail-closed
• support current input schemas fixbundle/0.3, fixbundle/0.4, fixbundle/0.5
• normalize bundle/capture identity
• normalize commit/repository/workflow evidence when available
• normalize failed commands/jobs/steps when available
• normalize OTLP exception/service/trace identity when available
• report changed / added / removed / unavailable evidence deterministically
• no LLM/network requirement in compare core
• tests for local↔local, GitHub↔GitHub, GitHub↔OTLP
• tampered ZIP/checksum/path traversal regression tests
• reproducible before/after demo
• existing historical, live GitHub, and OTLP gates remain green
• cross-platform CI remains green before merge
• post-merge main proof remains green

Final proof

• PR feat: add v0.6 cross-source evidence compare #7 final release-tree head: 9082cf792fca5cfdda3d03f3e7394824a641fa1d.
• Final PR CI run 33591771123: completed/success, 9 platform jobs + Live GitHub failure evidence = 10/10 PASS.
• PR feat: add v0.6 cross-source evidence compare #7 merged to main as ede9c616f6d5eb450bfc9e0644753a1402b67231.
• Post-merge main CI run 33591951443: completed/success, 9 platform jobs + Live GitHub failure evidence = 10/10 PASS.
• Every platform job runs tests, CLI smoke, historical demo, OTLP production evidence demo, and cross-source compare demo.

CLI

fixbundle compare baseline.zip incident.zip
fixbundle compare baseline.zip incident.zip --format json

Non-goals preserved

• no root-cause guarantee
• no fuzzy joining of unrelated traces/incidents
• no raw line-by-line log dump as primary output
• no automatic upload
• no mutation/extraction of input bundles

Design/security contract: docs/product/V06_COMPARE.md.