deploy(hf): sync szl-holdings/a11oy@648cf7c672d1b1e31260f3fe4b359dc9b364c54f derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 648cf7c672d1b1e31260f3fe4b359dc9b364c54f.
Files: 1174 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

packages/receipt-substrate/src/index.ts

@@ -499,7 +499,9 @@ const SENSITIVE_SOURCE_QUERY_KEYS = new Set([
   "sig",
   "token",
 ]);
-const DIGESTED_SOURCE_QUERY_KEYS = new Set(["code"]);
+const DIGESTED_SOURCE_QUERY_KEYS = new Set(["code", "q", "snippet"]);
+const ZONED_RFC3339_PATTERN =
+  /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(Z|[+-]\d{2}:\d{2})$/;
 const SENSITIVE_SOURCE_QUERY_PREFIXES = ["x-amz-", "x-goog-", "x-oss-"];
 const TRACKING_SOURCE_QUERY_PREFIXES = ["utm_"];
 const TRACKING_SOURCE_QUERY_KEYS = new Set(["fbclid", "gclid", "mc_cid", "mc_eid"]);
@@ -569,8 +571,39 @@ function cleanHttpStatus(value: unknown): number | undefined {
 }
 
 function cleanDate(value: unknown): string | undefined {
-  if (typeof value !== "string" || !value.trim()) return undefined;
-  const date = new Date(value);
+  if (typeof value !== "string") return undefined;
+  const cleaned = value.trim();
+  const match = ZONED_RFC3339_PATTERN.exec(cleaned);
+  if (!match) return undefined;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction = "", zone] =
+    match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const millisecond = Number((fraction + "000").slice(0, 3));
+  if (zone === "-00:00") return undefined;
+  if (zone !== "Z") {
+    const offsetHour = Number(zone.slice(1, 3));
+    const offsetMinute = Number(zone.slice(4, 6));
+    if (offsetHour > 23 || offsetMinute > 59) return undefined;
+  }
+  const calendar = new Date(0);
+  calendar.setUTCFullYear(year, month - 1, day);
+  calendar.setUTCHours(hour, minute, second, millisecond);
+  if (
+    calendar.getUTCFullYear() !== year ||
+    calendar.getUTCMonth() !== month - 1 ||
+    calendar.getUTCDate() !== day ||
+    calendar.getUTCHours() !== hour ||
+    calendar.getUTCMinutes() !== minute ||
+    calendar.getUTCSeconds() !== second
+  ) {
+    return undefined;
+  }
+  const date = new Date(cleaned);
   return Number.isNaN(date.getTime()) ? undefined : date.toISOString();
 }
 

packages/receipt-substrate/src/research_evidence.test.ts

@@ -117,6 +117,113 @@ test("content-selecting code parameters retain distinct redacted identities", ()
   assert.match(new URL(openai.sources[0]?.url ?? "").searchParams.get("code") ?? "", /^sha256:/);
 });
 
+test("query and snippet selectors retain distinct digested identities without leaking content", () => {
+  const base = fixtures.cases.find((candidate) => candidate.name === "matching");
+  assert.ok(base);
+  const openai = normalizeOpenAIWebSearchResult({
+    ...base.openai,
+    sources: [{
+      url: "https://research.example/paper?q=private-query-alpha&snippet=private-snippet-alpha",
+    }],
+  });
+  const perplexity = normalizePerplexitySearchResult({
+    ...base.perplexity,
+    results: [{
+      url: "https://research.example/paper?q=private-query-beta&snippet=private-snippet-beta",
+    }],
+  });
+  const comparison = compareResearchEvidence({
+    query_sha256: fixtures.query_sha256,
+    policy_sha256: fixtures.policy_sha256,
+    providers: [openai, perplexity],
+  });
+  const receipt = emitTwoWitnessResearchReceipt(comparison, {
+    actor_id: "did:example:selector-redaction",
+    timestamp: new Date("2026-07-28T12:00:00.000Z"),
+  });
+  const serialized = JSON.stringify(receipt.envelope);
+  const openaiUrl = new URL(openai.sources[0]?.url ?? "");
+  const perplexityUrl = new URL(perplexity.sources[0]?.url ?? "");
+
+  for (const forbidden of [
+    "private-query-alpha",
+    "private-query-beta",
+    "private-snippet-alpha",
+    "private-snippet-beta",
+  ]) {
+    assert.equal(serialized.includes(forbidden), false);
+  }
+  for (const key of ["q", "snippet"]) {
+    assert.match(openaiUrl.searchParams.get(key) ?? "", /^sha256:[a-f0-9]{64}$/);
+    assert.match(perplexityUrl.searchParams.get(key) ?? "", /^sha256:[a-f0-9]{64}$/);
+    assert.notEqual(openaiUrl.searchParams.get(key), perplexityUrl.searchParams.get(key));
+  }
+  assert.equal(comparison.source_url_overlap_count, 0);
+  assert.equal(comparison.label, "DIVERGENT");
+});
+
+test("source dates require an explicit timezone and normalize deterministically", () => {
+  const base = fixtures.cases.find((candidate) => candidate.name === "matching");
+  assert.ok(base);
+  const zoned = normalizeOpenAIWebSearchResult({
+    ...base.openai,
+    sources: [{
+      url: "https://research.example/zoned",
+      published_at: "2026-07-28T08:00:00-04:00",
+      last_updated_at: "2026-07-28T12:00:00Z",
+    }],
+  });
+  const zoneLess = normalizeOpenAIWebSearchResult({
+    ...base.openai,
+    sources: [{
+      url: "https://research.example/zone-less",
+      published_at: "2026-07-28T12:00:00",
+      last_updated_at: "2026-07-28",
+    }],
+  });
+
+  assert.equal(zoned.sources[0]?.published_at, "2026-07-28T12:00:00.000Z");
+  assert.equal(zoned.sources[0]?.last_updated_at, "2026-07-28T12:00:00.000Z");
+  assert.equal(zoneLess.sources[0]?.published_at, undefined);
+  assert.equal(zoneLess.sources[0]?.last_updated_at, undefined);
+
+  const leapDay = normalizeOpenAIWebSearchResult({
+    ...base.openai,
+    sources: [{
+      url: "https://research.example/leap-day",
+      published_at: "2024-02-29T23:59:59+00:00",
+    }],
+  });
+  assert.equal(leapDay.sources[0]?.published_at, "2024-02-29T23:59:59.000Z");
+});
+
+test("source dates reject impossible calendar values and offsets", () => {
+  const base = fixtures.cases.find((candidate) => candidate.name === "matching");
+  assert.ok(base);
+  const invalidValues = [
+    "2026-02-29T12:00:00Z",
+    "2026-02-30T00:00:00Z",
+    "2026-04-31T12:00:00Z",
+    "2026-13-01T00:00:00Z",
+    "2026-07-28T24:00:00Z",
+    "2026-07-28T24:01:00Z",
+    "2026-07-28T12:00:00-00:00",
+    "2026-07-28T12:00:00+24:00",
+    "2026-07-28T12:00:00+04:60",
+  ];
+
+  for (const published_at of invalidValues) {
+    const normalized = normalizeOpenAIWebSearchResult({
+      ...base.openai,
+      sources: [{
+        url: "https://research.example/invalid-time",
+        published_at,
+      }],
+    });
+    assert.equal(normalized.sources[0]?.published_at, undefined, published_at);
+  }
+});
+
 test("vendor-prefixed presigned credentials never enter normalized evidence", () => {
   const base = fixtures.cases.find((candidate) => candidate.name === "matching");
   assert.ok(base);