[klboke]

Swift GitHub proxies rejected apple/swift-protobuf 1.20.1 with HTTP 422 because Package@swift-5.7.swift declares tools version 5.6. The filename selects a version-specific manifest, while its declaration specifies the minimum tools requirement; SwiftPM permits these values to differ.

Remove the filename/declaration matching restriction while retaining tools-version syntax validation and all archive safety limits. Keep filename-derived lookup versions and content-declared tools versions separate through persistence and manifest responses. This removes validation work without adding I/O, queries, or archive passes.

Add regressions for archive inspection and GitHub downloads, plus Nexus-backed HTTP coverage for hosted/group reads, cross-replica manifest selection, Link attributes, and the real upstream swift-protobuf release. Correct the existing rejection test to cover malformed declarations.

Validation:

• Both new unit regressions fail on the original implementation with the reported mismatch error.
• 135 focused Swift protocol/server tests pass with zero skips.
• Executable server build passes.
• Three live compatibility tests pass with zero skips against Nexus 3.94.0 and two packaged JVM replicas sharing PostgreSQL 16: existing hosted HTTP contracts, differing filename/tools versions, and real GitHub proxy materialization. Manifest bytes, archive checksums, lookup versions, and advertised tools versions are verified.

Protocol reference: Swift Registry manifest selection and Link attributes.

Closes #510.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T03:44:43.208053Z	1ed2084	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[klboke]

@codex review

Please review the filename-based manifest selection versus declared minimum tools-version semantics, preserved archive safety checks, and the hosted/proxy regression coverage on commit 1ed2084.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 1ed2084627

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.86%. Comparing base (b37cbd2) to head (1ed2084).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #511   +/-   ##
=========================================
  Coverage     88.86%   88.86%           
  Complexity     1850     1850           
=========================================
  Files           923      923           
  Lines         91586    91574   -12     
  Branches      16582    16578    -4     
=========================================
- Hits          81388    81379    -9     
+ Misses        10198    10195    -3     

Flag	Coverage Δ
server-smoke-mysql	20.53% <0.00%> (+<0.01%)	⬆️
server-smoke-postgresql	20.54% <0.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[klboke]

Reviewed commit 1ed2084. No code-level blockers found.

The change preserves the registry's two identities: filename-derived versions remain lookup keys, and content-declared versions remain the advertised minimum tools requirements. Multiple manifests declaring 5.6 retain separate 5.6/5.7 lookup entries. The source archive is preserved byte-for-byte, and the existing ZIP bounds, path checks, root selection, and declaration syntax validation remain active.

Verified both new unit regressions fail on the original code and pass with the fix. The 135 focused Swift tests pass without skips. Three packaged-server HTTP compatibility tests also pass without skips against Nexus 3.94.0 and two JVM replicas sharing PostgreSQL 16, including the real apple/swift-protobuf 1.20.1 proxy path and hosted/group manifest selection and Link attributes. The new live tests are selected by the existing Swift compatibility suite in Full E2E.

The automated review of this same commit reports no findings. CI and Full E2E are still running; merge readiness remains dependent on their terminal results.