feat(hashing): add deterministic GeoJSON feature digests

[bartytime4life]

Final disposition

• Merged: 2026-08-07 at merge commit 924921864fe2aace5f72a45f66f2b57cb1edd1a5
• Base: a6bbaa2a7986858bd72629cf3a77181b9e72a761
• Merged head: de8eb2cb1f8e63d2044670e5bb0d10da4f2b05b4
• Follow-up: draft PR fix(ci): decouple current GeoJSON receipt validation #2107 repairs a post-merge generated-receipt gate without changing the GeoJSON digest semantics.
• No release, deployment, promotion, publication, source activation, or repository-setting change occurred in this PR.

Goal

Implement a bounded, deterministic GeoJSON integrity slice derived from the attached New Ideas.pdf pattern for separate geometry and record digests.

Implemented change

• Adds packages/hashing/src/hashing/geojson.py with the versioned kfm-geojson-feature-digest-v1 profile.
• Emits separate geometry_sha256 and record_sha256 identifiers using the repository's RFC 8785 JCS + SHA-256 implementation and current sha256:<hex> grammar.
• Binds the declared CRS and coordinate precision into both digest domains.
• Quantizes finite coordinates with decimal round-half-even semantics and normalizes negative zero.
• Supports GeoJSON Point, MultiPoint, LineString, MultiLineString, Polygon, MultiPolygon, GeometryCollection, and Feature-level null geometry.
• Excludes geometry foreign members from the geometry hash domain.
• Requires volatile property exclusions to be explicit; no field is silently dropped.
• Keeps Feature id out of record_sha256 by default and admits it only through an explicit option.
• Adds a bounded geojson-feature CLI command with deterministic JSON output and finite failure states.
• Adds focused no-network tests, implementation documentation, workflow wiring, and an authoring receipt.

Trust boundary

Digest equality proves only equality under the declared structural profile. This change does not reproject coordinates, repair or validate topology, rotate rings, canonicalize line direction, sort collections, or establish topological or real-world spatial equivalence.

The command emits authority: NONE and creates no source admission, EvidenceBundle, PolicyDecision, review, PromotionDecision, release, publication, or public-use authority.

Directory Rules basis

The change uses existing responsibility roots only:

• reusable implementation: packages/hashing/src/hashing/
• operator/CI command: tools/spec_hash/
• enforceability: tests/validators/
• CI orchestration: .github/workflows/
• authoring provenance: data/receipts/generated/

No parallel schema, contract, policy, registry, receipt, proof, release, or publication home is introduced. Placement follows adopted Directory Rules v2 through ADR-0029.

Files

• .github/workflows/spec-hash.yml
• packages/hashing/src/hashing/__init__.py
• packages/hashing/src/hashing/cli.py
• packages/hashing/src/hashing/geojson.py
• tests/validators/test_validate_spec_hash_geojson.py
• tools/spec_hash/GEOJSON_FEATURE_DIGESTS.md
• data/receipts/generated/genrec-geojson-feature-digests-20260806.json

Validation record

PASS

• Python compilation for changed Python surfaces.
• Local focused deterministic tests.
• Hosted dependency installation.
• Hosted deterministic no-network spec-hash and GeoJSON digest tests, including:
  • stable golden geometry and record digests;
  • key-order and sub-precision invariance;
  • separate geometry and record hash domains;
  • explicit property exclusions;
  • CRS, precision, and optional Feature-ID binding;
  • input immutability and fail-closed invalid Feature handling;
  • deterministic, bounded, non-authoritative CLI behavior.
• Workflow YAML parse.

Post-merge gate finding

The hosted run failed only after the deterministic tests passed, in generated-receipt validation. The workflow revalidated the historical genrec-spec-hash-validator-20260806.json against newly changed current workflow bytes. That historical receipt is immutable process memory, not a perpetual current-state assertion. Draft PR #2107 preserves the historical receipt, adds a current-state receipt, and changes the workflow to validate the current receipt only.

Commits

• 7056706987ba595514aa1b135fa3577cdaabbdc8 — implementation
• de8eb2cb1f8e63d2044670e5bb0d10da4f2b05b4 — normalized test layout and final PR receipt binding
• 924921864fe2aace5f72a45f66f2b57cb1edd1a5 — merge commit

Rollback

Revert merge commit 924921864fe2aace5f72a45f66f2b57cb1edd1a5. If follow-up PR #2107 is later merged, revert its merge commit first. No source deactivation, data migration, release withdrawal, cache invalidation, public correction, or published-artifact rollback is required because this slice performs no lifecycle or publication transition.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.