chore(deps): repin dpp-core to 0.11.0

[LKSNDRTMLKV]

Summary

Pins dpp-core 0.10.0 → 0.11.0. Plan and measurements: dpp-docs/work/CORE-REPIN-0-11-PLAN.md.

The 27 compile errors were the easy half. The work was the part with no compile signal: dpp-render compiled clean and was wrong, because every section reads its fields by string key with a "-" fallback and each section's test fixture was a hand-written JSON literal using the same stale key. Production code and fixture were consistently wrong, so the suite stayed green while the public page silently lost data.

Changes

Mechanical (compiler-caught). countryOfManufacture/countryOfProduction/countryOfManufacturing → countryOfOrigin across seven sectors; MaterialEntry::originCountry → countryOfOrigin; the validated Gtin newtype; six new optional BatteryData fields; AccessTier → Audience + Disclosure in the vault's public view and the resolver.

The passport-level manufacturerCountry is a different field and is untouched.

validate_gtin_checksum became parse_gtin, returning the parsed value instead of validating and discarding it — the sector structs now hold Gtin, and parsing once means no call site re-parses a string it has already proven valid.

Structural (the actual fix). dpp-render now takes dpp-domain as a dev-dependency and every section fixture round-trips through the typed SectorData before rendering. A renamed required field now fails the deserialise; a renamed optional one comes back absent. Either way the assertion fails instead of the value quietly disappearing.

That guard immediately found four defects the old fixtures were hiding:

Sector	What the fixture claimed	Reality
steel	productionRoute: "EAF"	kebab-case enum with #[serde(other)] — "EAF" silently became Other
aluminium	productionRoute: "Primary"	same; correct value is "primary"
detergent	surfactants: ["anionic", ...]	Vec<SurfactantEntry> — the fixture shape was structurally impossible
electronics	repairabilityScore: 7.5	a RepairabilityScore struct — see below

A live defect, pre-dating this repin. The electronics section read repairabilityScore as a scalar, but ElectronicsData has carried a RepairabilityScore struct ({ overall, criteria }) since before 0.10.0. The lookup always missed, so the public electronics page has never shown a repairability score — it rendered a dash. Furniture's field genuinely is an f64 and was always correct. Fixed here because the guard surfaced it.

Operator-facing. CSV templates edited in place (countryOfOrigin, material_N_countryOfOrigin); 13 demo datasets and 2 sample JSON files swept to match.

Breaking — all in CHANGELOG with migration notes

• Sector country fields renamed; a CSV built from an older template fails validation naming the new column.
• Passports stored under 0.10.0 or earlier are unreadable. No serde alias exists for the old names, so a row either fails to deserialise (six sectors, required) or silently loses the value (textile top-level and MaterialEntry, optional). No migration ships — there are no deployed nodes and no operator data, so it would be code that never runs. Drop and re-seed dev/staging.
• The public view changed, so signatures over it changed. stateOfHealthPct and lintResult are now correctly excluded. Because publicJwsSignature signs that view, a passport published before this release will not verify against a view recomputed after it. Snapshots diverge the same way, and BOM pins by publicJwsHash change.
• QR URLs changed. short_serial was cut from a UUIDv7's leading bytes — a millisecond timestamp — so serials sorted by creation order and decoded to the creation instant. Now from the random tail. Resolution is GTIN-keyed and unaffected; printed labels no longer match.

Verification

• cargo check --workspace --all-targets clean; just check exits 0
• 543/543 unit tests
• 371/371 Docker integration tests (dal, vault, node, plugin-host)
• cargo audit clean, register still 1 entry

Two fixtures only reachable behind --features integration-tests broke and were invisible to the default build — same class as the superuser-guard break in #51. Worth noting that the feature-gated tier is a recurring blind spot.

Follow-on, not in this PR

0.11.0 adds SealFormat::Cades, which dpp-seal's tests are waiting on (#57, ADR-009 §7). It also gives core a correct Audience/Disclosure model that the engine only exercises for Audience::Public — there is no endpoint serving the authority or legitimate-interest views. That is new capability the engine does not yet expose.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}