GIT-024: sha1dc is vendored but its collision detection is switched off

Now: OPEN
Sev: MED

Every SHA-1 wrapper in dog/git/SHA1.h calls SHA1DCSetSafeHash(ctx, 0) (disabling the safe-hash countermeasure) AND discards SHA1DCFinal's return value (1 = collision block detected). So the vendored sha1dc costs the detection cycles on every hash and protects nothing — a SHAttered-style colliding object ingests silently. Found in the 2026-07-24 dog/git review. Method: work.

Input

Context

dog/git/SHA1.h:38-57 — SHA1Sum, SHA1Open (SetSafeHash 0), SHA1Close, plus SHA1Sum's own Final: all four drop the result.
git's own policy with sha1dc: safe-hash OFF (a mutated hash breaks interop) but Final's return CHECKED — it dies on detected collision.
All object hashing routes here (PIDXObjSha, keeper's KEEPObjSha twin), so a check covers ingest and index alike.
SHA1Sum/SHA1Close are fun void — surfacing a code changes the signatures; callers ripple (dog, keeper, js binding).

Goals

A detected collision surfaces as a loud error (new RON60 code, e.g. SHA1COLL), never a silently-accepted object.
Keep hashes byte-identical for honest input (safe-hash stays off).

Constraints

Needs gritzko's verdict on the policy first: check-and-fail (git parity, recommended), re-enable safe-hash, or drop sha1dc for a plain SHA-1 and stop paying detection cost. Error text in plain words.
ABC style; ok64 codes via abc/ok64; PRO.h stays out of headers.

WIP

Design decisions

Policy ASSUMED by the orchestrator (worker order came before a verdict): git parity — safe-hash stays off, SHA1DCFinal's return surfaces as SHA1COLL; the hash is still written unmutated so callers can report the offending bytes. Veto reverts cheaply.
Repro embeds the real 320-byte shattered-1 prefix + a 62-byte patch list yielding prefix 2 — genuine same-SHA1 pair, probed as the shortest prefix that trips sha1dc.

TODOs

Get the policy verdict (check-and-fail vs drop sha1dc) — assumed, see Design decisions; standing veto.
Repro-first: hash the public shattered-1.pdf collision block pair (or sha1dc's own test vectors) — expect detection to fire.
Flip SHA1Sum/SHA1Close to ok64, thread the code through callers in the dog tree; ctest green (dog).
Follow-up ripple OUTSIDE the dog clone: jab/codec.cpp:77 discards the new ok64; keeper's KEEPObjSha twin; the JS twin be/shared/util/sha.js has no sha1dc at all; test/PIDX.c 4 discard sites (left per no-test-edits rule).

Blockers and bummers

SHA1COLL is a bare code; plain-words rendering belongs at the CLI layer, not this header.

Outcome

Worker run 07Aug26: staged in //GIT-024 on base 06a2a21d (orchestrator-verified, not landed). git/SHA1.h SHA1COLL + SHA1Sum/SHA1Close → fun ok64; git/PIDX.{h,c} PIDXObjSha → ok64; git/REPACK.c 2 call sites; new test/SHA1.c (honest hashes byte-identical vs sha1sum, both vectors → SHA1COLL, digest unmutated) + CMake row; INDEX.md contract note. ctest 77/77; negative control (bug reintroduced) fails the test.
Suggested commit: GIT-024: surface sha1dc collision detection as SHA1COLL