fix(evidence): reject non-commit revision objects

archify/renderers/shared/repository-evidence.mjs

@@ -240,7 +240,7 @@ export function verifyRepositoryEvidence(diagramType, diagram, repoRootInput) {
   }
 
   const revision = repository.revision.toLowerCase();
-  const commit = runGit(realRoot, ['cat-file', '-e', `${revision}^{commit}`]);
+  const commit = runGit(realRoot, ['cat-file', '-t', revision]);
   if (commit.status !== 0) {
     evidenceFailure('repository-evidence/revision-unavailable', `Evidence revision ${revision} is not available in the local repository.`, {
       subject: { repoRoot: realRoot },
@@ -249,6 +249,14 @@ export function verifyRepositoryEvidence(diagramType, diagram, repoRootInput) {
     });
   }
 
+  if (commit.stdout.trim() !== 'commit') {
+    evidenceFailure('repository-evidence/revision-not-commit', `Evidence revision ${revision} must identify a commit object.`, {
+      subject: { repoRoot: realRoot },
+      evidence: { revision, objectType: commit.stdout.trim() },
+      supportedFixes: ['pin the full peeled commit SHA instead of a tag, tree or blob object ID'],
+    });
+  }
+
   // The batch is an optimization only: every path, line-range, file and line
   // check still runs in source order in the verification loop below, so a
   // citation the batch cannot answer for never reorders the diagnostics.

docs/assets/archify-live-proof.json

@@ -7,8 +7,8 @@
   "fps": 10,
   "frameCount": 54,
   "durationSeconds": 5.4,
-  "bytes": 843870,
-  "sha256": "b1352f9557026653aeeccac19e11d26f5d24eca8ab013e6c7058529211838c9b",
+  "bytes": 836293,
+  "sha256": "46aaacb2d93c0d781da4f7de8063ea0a8b08c59430cfe678258a20624ea4859b",
   "scenes": [
     {
       "id": "signal-flow",
@@ -31,7 +31,7 @@
     {
       "id": "classic",
       "artifact": "docs/gallery/artifacts/cache-miss.sequence.html",
-      "artifactSha256": "7f68d7303c86988cfbe228202d25fc6da42fb174be47df5f637d57c39fbf5766",
+      "artifactSha256": "ca273484a235600f96a74351ac3976cdb6bffb1cfb5d0b86f9ced8c21bd1aa80",
       "hash": "#route=web~db",
       "eyebrow": "SEQUENCE · CLASSIC",
       "title": "Cache Miss Request",

test/repository-commit-object.test.mjs

@@ -0,0 +1,16 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { verifyRepositoryEvidence } from '../archify/renderers/shared/repository-evidence.mjs';
+import { fixture, git } from './helpers/repository-evidence-fixture.mjs';
+test('repository evidence rejects annotated tag objects without changing commit identities',t=>{
+  const data=fixture();t.after(()=>fs.rmSync(data.root,{recursive:true,force:true}));
+  assert.equal(verifyRepositoryEvidence('architecture',data.diagram,data.root).verified,true);
+  git(data.root,'-c','tag.gpgSign=false','tag','-a','v1','-m','fixture');
+  data.diagram.meta.repository.revision=git(data.root,'rev-parse','refs/tags/v1');
+  assert.throws(()=>verifyRepositoryEvidence('architecture',data.diagram,data.root),(error)=>{
+    assert.match(error.message,/commit/i);
+    assert.equal(error.archifyDiagnostics?.[0]?.code,'repository-evidence/revision-not-commit');
+    return true;
+  });
+});