Projects · Security engineering · Research prototype · MEASURED

semdiff

What this establishes

That a focused command-line tool can produce semantic, severity-ranked diffs of high-risk engineering artifacts, Cargo.lock, package-lock.json, OpenAPI, and Kubernetes YAML, deterministically.

What this does not establish

It is not a summariser and makes no language-model calls; not a universal file-type tool, covering only the four formats; not a full OpenAPI linter; not a network tool. Correctness here is the test suite plus determinism, not a proof.

Trusted base

The Rust toolchain and the crate dependencies; and the human-authored classification rule table, which is an authored coding scheme and part of the trusted base.

Method

Each artifact is parsed, its load-bearing content extracted, and changes ranked by severity; the output is deterministic and sorted, with a stable JSON schema and defined exit codes.

Result

134 fixture pairs and 137 tests; the demo output is byte-identical to the documented example.

Reproduce

cargo test && cargo run --release -p semdiff-cli -- file --old fixtures/cargo/basic_old/Cargo.lock --new fixtures/cargo/basic_new/Cargo.lock

Toolchain: Rust, edition 2021, a Cargo workspace
Verified at: repowazdogz-droid/semdiff@c454417 (2026-07-20)

This pass. Re-verified this pass: the demo and cargo test were re-run at c454417 (byte-identical output, 137 tests passing).

Independent reproduction

None known.

Prior art and positioning

Structured and semantic diffing and supply-chain change review. The contribution is the deliberately narrow, deterministic, no-language-model diff for four high-risk formats.