Move the crawler coordinate guards and composer's leading-v rule into utils and delete the copies

[mikolalysenko]

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: discussion #560 register.

Kind: refactor. Source: review Part 6.4; register E37.

Problem

Verified on 045d7ec:

1. Three byte-identical coordinate guards. Each has one production caller:

   • is_safe_cargo_coordinate (caller L235);
   • is_safe_gem_coordinate (caller L182);
   • is_safe_nuget_coordinate (caller L183).

   All three are is_safe_single_segment(name) && is_safe_single_segment(version), each with its own ~20-line test copy. The same predicate is inlined a fourth time in purl::simple_purl, which documents itself as the builder for exactly these three ecosystems.

2. The Maven guard lives in a crawler but is used by utils and vendor. maven_purl calls crawlers::maven_crawler::is_safe_maven_coordinate (def),`` and vendor/maven_repo.rs calls it too. That is a `utils` → `crawlers` edge.

3. Composer's leading-v rule exists twice. composer_crawler::normalize_version (chars) and composer_version::strip_leading_v (bytes) implement the same rule: strip one v/V when a digit follows. They agree today. The crawler copy is what formats::composer and redirect::upstream::composer import, which makes formats → crawlers and redirect → crawlers edges.

Symptoms and impact

I found no open bugs. The copies have not drifted yet, but each new ecosystem adds another guard, and the guard's doc comments already disagree about which "mirror" guards exist. The risk is low, and the change is mechanical.

Proposed change

• Add path_safety::is_safe_name_version(name, version) and move is_safe_maven_coordinate into utils::path_safety.
• Call them from the three crawlers, simple_purl, maven_purl and vendor/maven_repo.rs.
• Make utils::composer_version::strip_leading_v pub(crate) and point every normalize_version caller at it: the composer crawler and its oracle, formats::composer, lock_inventory::composer and upstream::composer.

Delete: is_safe_{cargo,gem,nuget}_coordinate and their three test copies (keep one table test on the shared function), plus composer_crawler::normalize_version.

Size and scope

About 40 production lines deleted and about 10 added, in crawlers/{cargo,ruby,nuget,maven,composer}_crawler.rs, utils/{path_safety,purl,composer_version}.rs, formats/composer/mod.rs, patch/redirect/upstream/composer.rs and vendor/maven_repo.rs. There is no behavior change. Out of scope: the go and deno guards, which use multi-segment and JSR-component rules, and the purl builder families (C20).

Acceptance criteria

• One single-segment name/version guard and one Maven guard, both in utils::path_safety.
• formats/, utils/ and patch/redirect/ no longer import crawlers::composer_crawler::normalize_version or crawlers::maven_crawler::is_safe_maven_coordinate.
• One table test covers the traversal, colon, NUL, backslash and empty cases now spread over the three crawler tests. purl_builders_validate_coordinates and the composer test_normalize_version cases, moved to strip_leading_v, stay green.
• cargo test -p socket-patch-core --lib crawlers and cargo clippy --workspace --all-features -- -D warnings stay green.

Dependencies

cargo_crawler.rs and nuget_crawler.rs are touched by open PR #602 (E06), so land this after it. This issue blocks nothing.

[mikolalysenko]

[agent] Triaged as priority:p3 (cross-cutting crawler/utils refactor with no user-visible behavior change). Not a duplicate, and no open PR covers it.

---

Generated by Claude Code