test(hub): rebuild openalex fixture with summary and ontology module objects

[DecisionNerd]

Closes #1745. Part of #1732. Builds on #1747 (discovery contract) and #1754 (summary derivation and module resolution).

What

• generate_hub_fixture --rebuild-source rebuilds tests/fixtures/hub/openalex-source through the public facade in a temporary durable project. It uses fixed UUIDs and the confirmed synthetic values: title "OpenAlex", license "CC0-1.0", declared corpus size of 1000 nodes and 2500 relationships, public/open access, one module https://openalex.org/ontology/works@2026.01 adopted through the multi-module API, and an advisory activation profile. It swaps the tree atomically, and two runs produce identical bytes.
• The generator now emits the canonical Project summary (summarize_verified_portable_v2) and a per-module package from the exact-composition selection, which is component-selective. Both are digest-addressed objects. The manifest gains summary and ontology, and fixture.json records their digests.
• Validation now requires bind_summary to succeed, the summary bytes to hash to summary.object_digest, and the module object to resolve through resolve_discovered_ontology_module to exactly the advertised identity.
• Facade verification receipts are regenerated from the same build. They now carry the ontology composition.
• Docs: tests/fixtures/hub/README.md covers the new objects and the rebuild steps. tests/fixtures/portable-v2/README.md notes that receipts are compared by value. The discovery README now says what research_present means.

Acceptance evidence (#1745)

Criterion	Test
Title, license, ontology modules and counts for openalex/openalex come from the checked-in generated/v1 artifacts alone, with no hand-entered metadata	crates/graphforge-cli/tests/hub_fixture.rs::project_page_facts_come_from_the_checked_in_artifacts_alone
A different object location base leaves summary bytes and summary/ontology descriptors unchanged	hub_fixture.rs::summary_and_descriptors_survive_a_different_object_location_base; lib test summary_and_descriptors_do_not_depend_on_the_object_location_base
gf clone still succeeds against the regenerated manifest and refs	hub_clone::tests::clone_succeeds_against_the_checked_in_hub_fixture: exactly three requests (refs, manifest, Project package), then reopens and reads the title and license
Fixture drift check runs in CI	hub_fixture.rs::checked_in_fixture_has_no_drift, plus the existing lib test checked_in_hub_fixture_is_exact_rust_output
Rebuild is deterministic	rebuilt_source_is_deterministic_and_matches_the_checked_in_tree

Verification

cargo run -p graphforge-cli --example generate_hub_fixture -- --rebuild-source && ... -- --update && ...   # drift check exit 0
cargo test -p graphforge-cli --test hub_fixture --test portable           # 3 + 10 pass
cargo test -p graphforge-cli --lib hub_                                   # 33 pass, 1 ignored (existing perf test)
cargo test -p graphforge-api --test discovery_project_summary --test discovery_ontology_module --test discovery_portable_v2   # 8 + 6 + 4 pass
uv run --no-sync python crates/graphforge-bindings-py/tests/portable_v2_parity.py   # pass, on rebuilt wheel
node --test tests/portable_v2.test.mjs   (Node bindings)                  # pass, on rebuilt addon
python3 scripts/ci/non-cypher-surface-gate.py                              # pass (455 methods, unchanged)
scripts/ci/repo-checks.sh                                                  # pass

Review notes

• An independent reviewer found no critical or major issues.
• Determinism of the module package. A fresh-root import starts from a randomly identified bootstrap generation, and a component-selective export records the exporting generation's manifest hash. To make the fixture's module package reproducible, the generator re-commits the identical research metadata under a fixed operation UUID before exporting. This is generator mechanics and is commented in the code. It does not affect feat(protocol): expose Project summaries and ontology modules through Hub discovery #1732's "descriptors don't depend on storage provider or locations" guarantee, because module package_digest depends on the source by design (ADR 0051). Making fresh-root import deterministic belongs in a separate storage follow-up.
• PortableV2ExactIdentity is re-exported from graphforge-api so the CLI can build the exact-composition selection without reaching into graphforge-core. It is a type, so the method-surface gate doesn't change.
• generator_source_digest hashes all of hub_fixture_artifacts.rs, so any edit to that file requires --update.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: CurateLabs/graphforge/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8088b8be-8fb0-4d38-824c-f912806959da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.