[kridaydave]

Bugs

• SEC-10: extract_snapshot decodes ls-tree paths with String::from_utf8_lossy, so distinct non-UTF-8 paths can collide into one snapshot key and files get silently merged.

What was wrong

src/adapter/git.rs:extract_snapshot decoded each NUL-framed git ls-tree -r -z entry with String::from_utf8_lossy and split the lossy string on \t. The lossy path became the validate_tree_path input and the Snapshot.files key. Git stores paths as raw bytes; distinct non-UTF-8 paths can decode to the same lossy string, so a later entry overwrote an earlier one and the overwritten file was never diffed, visibility-checked, or exported.

Fix

Parse ls-tree records on raw bytes: split on the tab byte, keep metadata as lossy text (ASCII), and decode the path with std::str::from_utf8. If the path is not valid UTF-8, return an error that names the lossy path and states it was rejected to avoid path collisions. Snapshot.files remains HashMap<String, Vec<u8>>, so rejecting is the smallest change that makes the collision impossible.

Added test_git_adapter_rejects_non_utf8_path in tests/git_adapter_test.rs (unix). It commits a file whose name contains an invalid UTF-8 byte and asserts extract_snapshot returns an error mentioning "non-UTF-8 path".

Verification

CI green (fmt, clippy, tests, release build, adjudication) + the regression test you added