Harden Axiom adapter references and kernel hash coverage (NZ v0, G1b)

changelog.d/axiom-adapter-hardening.fixed.md

@@ -0,0 +1,23 @@
+Harden the Axiom adapter's engine references (follow-ups to microcosm#1118).
+`axiom_engine_ref` now refuses a git checkout root that contains a submodule,
+and it examines the root's own repository: git runs without the caller's
+`GIT_DIR`, `GIT_WORK_TREE` and the other `git rev-parse --local-env-vars`
+variables and without replace refs, and the root must be its repository's top
+level. The files outside the root's `.git` must also be exactly the declared
+commit's, each byte for byte the blob the commit records and with its
+executable bit, so a change that
+`git status` does not report is refused: an edit hidden from a stat cache
+trusted under `core.trustctime=false`, by a clean filter or by a file system
+monitor, a nested `.git` entry, or a symbolic link held as a plain file under
+`core.symlinks=false`, or an executable-bit change hidden by
+`core.filemode=false`. Committed paths pair with files one to one: a name git
+records precomposed (usually Unicode NFC) matches the file listed under an
+equivalent NFD name only when that one file opens under both, as on macOS, and
+one directory entry never answers for two committed names. The commit's paths and blob names are read
+from the repository's object database, whose commit and tree objects are not
+rehashed, so this check assumes the database is intact: deliberate
+object-store tampering, such as a nested tree rewritten under its old object
+name, is out of its scope, though the directory digest still pins the bytes
+present. A referenced adapter also records the file its module
+path resolves to, and refuses to compile or take a second reference once the
+path resolves to another file.

changelog.d/axiom-graph-adapter.added.md

@@ -13,7 +13,9 @@ and date outputs. The default output stays as before.
 digest, the RuleSpec commit, the module and whole-root content digests, and the
 adapter configuration, so a RuleSpec edit re-keys every node that names it. It
 also pins the adapter, which then refuses to compile from a root whose bytes
-have moved. A git-checkout root must hold exactly the declared commit.
+have moved. A git checkout root must be clean, at the declared commit,
+contain no submodules, and have no tracked file flagged skip-worktree or
+assume-unchanged.
 `assert_no_relations` refuses relation-bearing modules.
 
 The new `simulate.rules_by_ref@1` kernel (`microcosm.frame.rules_kernels`) runs