feat(trace-topology): IdentityUnknown reconciliation check (v0.11.0)

[avrabe]

Summary

First of the five v1 deterministic checks — the start of the v0.11.0
reconciliation engine (design docs/designs/v0.10.0-trace-topology.md
§4.1; contract docs/contracts/spar-trace-topology-v1.md).

• New engine module:
  • DeclaredModel — the declared-identity index, built once by walking
    an instantiated AADL SystemInstance and reading every component's
    Spar_Identity::MAC_Address / LLDP_Chassis_Id.
  • check_identity_unknown — flags any unicast MAC observed in a PCAPNG
    capture, or any LLDP neighbor chassis-id, that no AADL component
    declares. Emits ReconcileFinding::IdentityUnknown.
  • parse_mac / ReconcileError — the MAC-normalisation primitive and
    the engine's input-failure error type (CLI exit code 2).
• Group-addressed (multicast / broadcast) MACs are exempt — they are
  reconciled against Multicast_Group, a connection-borne surface, not
  MAC_Address. Without this filter every capture would flood findings
  for LLDP / gPTP / broadcast protocol traffic.
• Findings are deterministic: PCAPNG findings then LLDP findings,
  each ascending, each distinct identity reported once — finding order
  is a pure function of input content.

Deliberately deferred (documented in the module + commit)

• Connection-borne identities (Stream_Handle, Multicast_Group,
  VLAN_ID) — declared on AADL connections, not components, so not
  reachable through the component property-map surface this module uses.
• The other four checks (TopologyMissingWiring, ConfigDrift,
  GptpOutOfBudget, BinaryMismatch), the orchestrating reconcile(),
  and SARIF / in-toto emission — sibling v0.11.0 / v1.0 commits.

Artifacts: REQ-TRACE-TOPOLOGY-008 + TEST-TRACE-TOPOLOGY-IDENTITY-UNKNOWN.

Test plan

• cargo test -p spar-trace-topology --lib -- engine::tests — 11 unit tests
• cargo test -p spar-trace-topology --test identity_reconcile — 3 integration tests (instantiated AADL)
• cargo clippy -p spar-trace-topology --all-targets — clean
• cargo fmt --check — clean
• rivet validate — 0 broken cross-refs; error/warning totals byte-identical to baseline

🤖 Generated with Claude Code

[github-actions]

Rivet verification gate

✅ 20/20 passed

	count
Passed	20
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}

[codecov]

Codecov Report

❌ Patch coverage is 96.23431% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/spar-trace-topology/src/engine.rs	96.23%	9 Missing ⚠️

📢 Thoughts on this report? Let us know!