test(conformance): legis git-rename consumer reaches the bar

The consumer half of the legis->loomweave git-rename seam: drive the REAL
parse_legis_rename_json over a byte-identical vendored copy of the shared golden
git_renames.v1.json (blob 74f69ee..., frozen from legis's real GET /git/renames),
asserting the projected (old_path,new_path) pairs and pinning the blob sha1
(Layer-1 fail-closed byte-pin). Producer (legis) and consumer (loomweave) now
load the SAME bytes and AGREE; a wire drift on either side reds in CI.

The two #[test]s live in sei_git.rs's existing test module (not under tests/)
because parse_legis_rename_json is private to this binary crate and unreachable
from an integration test. No existing test altered. Byte-pin negative-probed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tachyon-beep

crates/loomweave-cli/src/sei_git.rs

@@ -628,6 +628,74 @@ mod tests {
         assert!(parse_legis_rename_json(r#"{"not":"an array"}"#).is_empty());
     }
 
+    // ── Weft shared golden: legis (producer) → Loomweave (consumer) ────────────
+    //
+    // This is the CONSUMER half of a single cross-member golden,
+    // `tests/fixtures/weft/git_renames.v1.json`. The byte-identical file lives in
+    // legis at `tests/contract/weft/vectors/git_renames.v1.json`; legis's
+    // producer oracle drives its REAL `GET /git/renames` and proves the same
+    // projection. Here we drive the REAL `parse_legis_rename_json` over the
+    // frozen bytes and prove it accepts exactly that wire shape.
+    //
+    // Why a `#[cfg(test)]`-module test and not an integration test under
+    // `tests/`: `parse_legis_rename_json` is private to this binary crate (no
+    // `lib.rs`), so it is unreachable from `tests/` — the consumer oracle MUST
+    // live next to the parser it exercises.
+    //
+    // The golden was FROZEN from legis's actual endpoint output (a real
+    // `auth.py → authn.py` rename captured via FastAPI `TestClient`), with one
+    // synthetic empty-`new_path` item appended that git/legis never emit — the
+    // skip case the parser must drop. `include_bytes!` pins the exact vendored
+    // bytes at compile time (a moved/renamed file fails the build, loudly).
+
+    /// The byte-identical vendored copy of the shared Weft golden.
+    const VENDORED_GOLDEN: &[u8] = include_bytes!("../tests/fixtures/weft/git_renames.v1.json");
+
+    /// The git blob sha1 of the frozen golden bytes:
+    /// `sha1(b"blob <len>\0" + bytes)`. legis's producer oracle pins the SAME
+    /// constant against the SAME bytes — the two repos are locked to one wire
+    /// shape. Re-pin only by re-freezing the golden and updating BOTH repos.
+    const VENDORED_BLOB_SHA: &str = "74f69ee81b030a31f9fdd37dc1c49543fbe389c2";
+
+    /// The REAL parser accepts the frozen golden bytes and projects exactly the
+    /// real rename, dropping the synthetic empty-`new_path` skip item — proving
+    /// legis's actual output and Loomweave's actual parser AGREE on these bytes.
+    #[test]
+    fn vendored_golden_parses_to_expected_pairs_via_real_parser() {
+        let body = std::str::from_utf8(VENDORED_GOLDEN).expect("golden is utf-8");
+        let pairs = parse_legis_rename_json(body);
+        assert_eq!(
+            pairs,
+            vec![("auth.py".to_owned(), "authn.py".to_owned())],
+            "the real parser must accept legis's frozen output and skip the \
+             empty-new_path item; got {pairs:?}"
+        );
+    }
+
+    /// Layer-1 byte-pin: recompute the git blob sha1 of the vendored bytes and
+    /// assert it equals `VENDORED_BLOB_SHA`. This is the canonicalization-drift
+    /// detector — re-serialize the golden (key order / whitespace / trailing
+    /// newline) on either side and the sha1 stops reproducing, failing CI before
+    /// the drift reaches production. legis pins the identical sha over the
+    /// identical bytes.
+    #[test]
+    fn vendored_golden_blob_sha_is_byte_pinned() {
+        use sha1::{Digest, Sha1};
+        let mut hasher = Sha1::new();
+        hasher.update(format!("blob {}\0", VENDORED_GOLDEN.len()).as_bytes());
+        hasher.update(VENDORED_GOLDEN);
+        let recomputed: String = hasher
+            .finalize()
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect();
+        assert_eq!(
+            recomputed, VENDORED_BLOB_SHA,
+            "golden bytes changed: {recomputed} != pinned {VENDORED_BLOB_SHA}. \
+             Re-freeze from the real endpoint and update BOTH repos' constant."
+        );
+    }
+
     // --- G16: silent-under-carry is detectable, not swallowed (clarion-73dff1d2d1) ---
     // Defensive half: the parser still never hard-fails, but the cases that
     // silently zero the rename signal are now classified so they can be logged.

crates/loomweave-cli/tests/fixtures/weft/git_renames.v1.json

@@ -0,0 +1,18 @@
+[
+  {
+    "commit_sha": "0000000000000000000000000000000000000000",
+    "new_blob": "",
+    "new_path": "authn.py",
+    "old_blob": "",
+    "old_path": "auth.py",
+    "similarity": 100
+  },
+  {
+    "commit_sha": "0000000000000000000000000000000000000000",
+    "new_blob": "",
+    "new_path": "",
+    "old_blob": "",
+    "old_path": "ghost.py",
+    "similarity": 0
+  }
+]