Fix proof-flow evidence logical_id collision on degenerate corpora (CVE-2026-4600)

[jorge-garcia-le]

Problem

Running the proof flow against CVE-2026-4600 (jsrsasign) aborts with:

ERROR: Evidence evidencel-2c2c1cb37effa428 already exists; append a successor revision instead

Root cause

Every VersionedRecord derives its logical_id by hashing an identity payload. For Evidence (models.py) that payload was only:

{ "kind", "artifact_digest", "observations", "provenance" }

The mechanical obligation resolver (resolvers.py::_resolution) builds evidence from the matching facts, with a constant provenance (producer="mechanical-obligation-resolver", no command / context packet) and observations keyed on fact.id. So when two different obligations (from two different candidates) resolve off the same fact via the same deterministic rule, all four identity fields are byte-identical → identical logical_id.

The append-only ProofGraph._add treats a repeat logical_id as "you must be revising" and raises. That raise is swallowed on the falsifier path (engine.py:580) but not on the resolver path — apply_resolution at engine.py:856 is unguarded, so the ValueError propagates out of arun() and kills the whole run.

Why it only surfaced now

Prior proof-flow targets were C (jq, etc.): multi-file trees where facts live at distinct ids/locations, so distinct obligations produce distinct evidence. jsrsasign's entire source is effectively one minified line (jsrsasign-all-min.js), so ~200 candidates converge on the same handful of sentinel_use facts — the first corpus degenerate enough for two mechanical resolutions to be literally identical evidence.

Confirmed from the run dir (results/cve-2026-4600/sh-cbad7381/): the colliding evidence's observations all cite fact-d09dfc9df70fa9ae at jsrsasign-all-min.js:225, kind static_sentinel_definition, constant mechanical provenance. Two obligations (obligationl-f69a6adac865f0c2 and a sibling) claim it.

Fix

1. Widen Evidence.identity_payload to include supports / contradicts. Evidence supporting different claims/obligations is genuinely different logical evidence, so it earns a distinct logical_id. (Claim identity already carries the candidate subject + obligation scope, so the supported claim ids differ per obligation.)
2. Make apply_resolution idempotent as a defensive net: if an evidence/claim logical_id is already in the graph, reuse it instead of re-adding — a genuine duplicate can never again abort a whole run.

Tests

Two synchronous regression tests in test_sourcehunt_proof_investigation.py reproducing the jsrsasign scenario (two candidates, same shared fact):

• test_evidence_identity_distinguishes_supported_claims — same kind/observations, distinct supported claims ⇒ distinct evidence logical_id.
• test_apply_resolution_tolerates_duplicate_evidence — re-applying an identical resolution no longer raises.

Verification

• New tests pass; ruff clean on all changed files.
• The 4 affected proof test files show an identical failure set with and without this change (13 pre-existing failures + my 2 new passes). The pre-existing failures are @pytest.mark.asyncio tests skipped because pytest-asyncio isn't active in this venv — environmental, unrelated to this change.

Branch naming

Named fix/proof-hunt-eval-patches (not CVE-specific) intentionally — a landing spot for further proof-flow eval fixes surfaced by other CVEs.