fix(apk): reuse canonical subject identity in retained views

src/domain/analysisView/apkSignatureView.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import {
   apkSignatureResultSchema,
   apkSignatureUninterpretedBytes,
+  apkSignatureMatchesSubject,
   type ApkSignatureResult,
 } from "../apkSignature/apkSignatureReport.js";
 import {
@@ -106,8 +107,11 @@ const read = (parent: AnalysisViewParent): Result<Checked, AnalysisError> => {
   // Parent identity is checked on every read, independently of reusable facts.
   if (
     parent.subject != null &&
-    (parent.subject.local_path !== report.artifact.path ||
-      parent.subject.digest.sha256 !== report.artifact.sha256)
+    !apkSignatureMatchesSubject(report.artifact, {
+      path: parent.subject.local_path,
+      sha256: parent.subject.digest.sha256,
+      format: parent.subject.format,
+    })
   )
     return err(
       analysisViewInputError([

tests/boundary/filesystem/apkSignatureViewIdentity.test.ts

@@ -20,7 +20,7 @@ it("checks parent subject identity again when signing facts are already cached",
     const result = await service.inspect({ path, detail: "complete" });
     if (!result.ok) throw result.error;
     const evidence = result.value;
-    if (evidence.subject === null)
+    if (evidence.subject === null || evidence.subject.format !== "apk")
       throw new Error("selected file subject missing");
     const parent = {
       evidenceId: evidence.evidence_id,
@@ -32,7 +32,15 @@ it("checks parent subject identity again when signing facts are already cached",
     };
     const initial = projectApkSignatureView(parent, { kind: "summary" });
     if (!initial.ok) throw initial.error;
+    for (const format of ["file", "apk", "zip"] as const)
+      expect(
+        projectApkSignatureView(
+          { ...parent, subject: { ...evidence.subject, format } },
+          { kind: "summary" },
+        ).ok,
+      ).toBe(true);
     for (const subject of [
+      { ...evidence.subject, format: "directory" as const },
       { ...evidence.subject, local_path: join(root, "other.apk") },
       {
         ...evidence.subject,