test(chain): tamper -> CHAIN BROKEN (exit 5); BAM input -> external

Adds the failure-mode integration gates and applies fmt + the sort_by_key
clippy fix. Full suite green; clippy -D warnings + fmt --check clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: logannye

crates/receipt/src/chain.rs

@@ -118,7 +118,9 @@ pub fn walk_chain(receipts: &[RunManifest]) -> ChainReport {
     let mut producer: HashMap<String, String> = HashMap::new();
     for (m, id) in receipts.iter().zip(&ids) {
         for o in &m.outputs {
-            producer.entry(o.blake3.clone()).or_insert_with(|| id.clone());
+            producer
+                .entry(o.blake3.clone())
+                .or_insert_with(|| id.clone());
         }
     }
 
@@ -229,7 +231,10 @@ mod tests {
             .filter(|e| matches!(e.status, EdgeStatus::External))
             .count();
         assert_eq!(resolved, 1, "exactly the --index edge resolves");
-        assert_eq!(external, 2, "--alignments and --reference are external sources");
+        assert_eq!(
+            external, 2,
+            "--alignments and --reference are external sources"
+        );
         assert_eq!(
             report.to_json(),
             "{\"intact\":true,\"nodes\":2,\"edges_resolved\":1,\"edges_external\":2,\"edges_broken\":0}"

src/main.rs

@@ -754,9 +754,10 @@ fn run_index(reference: PathBuf, output: PathBuf, memory_budget_mb: Option<u64>)
         cmd.record_into(&mut manifest);
         // `reference_blake3` is the in-memory NORMALIZED sequence hash (a "what genome"
         // id, stable across FASTA reformatting) — informational, NOT the chain edge.
-        manifest
-            .params
-            .insert("reference_blake3".to_string(), blake3_hex(&reference_blake3));
+        manifest.params.insert(
+            "reference_blake3".to_string(),
+            blake3_hex(&reference_blake3),
+        );
         manifest
             .params
             .insert("total_bp".to_string(), total_bp.to_string());
@@ -1064,7 +1065,7 @@ fn run_chain_verify(dir: PathBuf, json: bool) -> Result<()> {
         bail!("no receipts (*.manifest.json) found in {}", dir.display());
     }
     // Stable order (independent of read_dir) so the report is deterministic.
-    receipts.sort_by(|a, b| a.content_hash().cmp(&b.content_hash()));
+    receipts.sort_by_key(|m| m.content_hash());
 
     let report = walk_chain(&receipts);
 
@@ -1093,7 +1094,10 @@ fn run_chain_verify(dir: PathBuf, json: bool) -> Result<()> {
             match &e.status {
                 EdgeStatus::Resolved { parent_id } => {
                     let p = sub.get(parent_id.as_str()).copied().unwrap_or("?");
-                    println!("edge: {}  {}-->  {p}  [resolved]", e.child_subcommand, e.flag);
+                    println!(
+                        "edge: {}  {}-->  {p}  [resolved]",
+                        e.child_subcommand, e.flag
+                    );
                 }
                 EdgeStatus::External => {
                     println!(

tests/chain.rs

@@ -214,3 +214,81 @@ fn chain_verify_is_intact_on_a_real_index_variants_chain() {
 
     std::fs::remove_dir_all(&d).ok();
 }
+
+#[test]
+fn chain_verify_breaks_when_the_index_receipt_is_tampered() {
+    let d = tmpdir();
+    let seq = "ACGTACGTACGTACGTACGTACGTACGTACGT";
+    let fa = write_fasta(&d, "chr1", seq);
+    let fq = write_fastq(&d, seq, &[0, 0, 8], 16);
+    let (idx, bam) = build_index_and_sorted_bam(&d, &fa, &fq);
+    let vcf = d.join("calls.vcf");
+    assert!(run(&[
+        "variants",
+        "--index",
+        idx.to_str().unwrap(),
+        "--alignments",
+        bam.to_str().unwrap(),
+        "-o",
+        vcf.to_str().unwrap(),
+    ])
+    .status
+    .success());
+
+    // Tamper with the index receipt's claim: flip a digit of total_bp without
+    // recomputing manifest_blake3 → the node self-hash must fail.
+    let mpath = d.join("ref.idx.manifest.json");
+    let text = std::fs::read_to_string(&mpath).unwrap();
+    let tampered = text.replacen("\"total_bp\":\"", "\"total_bp\":\"9", 1);
+    assert_ne!(
+        text, tampered,
+        "the receipt must contain a total_bp field to tamper"
+    );
+    std::fs::write(&mpath, tampered).unwrap();
+
+    let out = run(&["chain", "verify", d.to_str().unwrap()]);
+    assert_eq!(out.status.code(), Some(5), "a tampered node must exit 5");
+    assert!(
+        String::from_utf8_lossy(&out.stdout).contains("CHAIN BROKEN"),
+        "stdout: {}",
+        String::from_utf8_lossy(&out.stdout)
+    );
+
+    std::fs::remove_dir_all(&d).ok();
+}
+
+#[test]
+fn chain_verify_reports_the_bam_input_as_external_not_a_failure() {
+    let d = tmpdir();
+    let seq = "ACGTACGTACGTACGTACGTACGTACGTACGT";
+    let fa = write_fasta(&d, "chr1", seq);
+    let fq = write_fastq(&d, seq, &[0, 0, 8], 16);
+    let (idx, bam) = build_index_and_sorted_bam(&d, &fa, &fq);
+    let vcf = d.join("calls.vcf");
+    assert!(run(&[
+        "variants",
+        "--index",
+        idx.to_str().unwrap(),
+        "--alignments",
+        bam.to_str().unwrap(),
+        "-o",
+        vcf.to_str().unwrap(),
+    ])
+    .status
+    .success());
+
+    let out = run(&["chain", "verify", d.to_str().unwrap()]);
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    // The BAM alignments input has no producing receipt → external/integrity-only,
+    // and it must NOT fail the chain.
+    assert!(
+        out.status.success(),
+        "external inputs must not break the chain: {stdout}"
+    );
+    assert!(
+        stdout.contains("--alignments-->  (external)  [integrity-only]"),
+        "the BAM edge must be reported external: {stdout}"
+    );
+
+    std::fs::remove_dir_all(&d).ok();
+}