Module shadow 

PATH shadowing (REQ-SHADOW-001) — does the name actually reach our binary?

varve’s headline claim, in the README, is varve which synth # which binary runs here. It was not checking. With a distro-packaged tool, a cargo installed one, or a stale shim directory earlier in PATH, which printed the store path, verify reported the layer perfect, and the shell ran something else. Each answer was individually correct and the composite was false (varve#66).

The layer really is intact in that situation — so this is not a signature problem and no amount of re-verification finds it. The gap is between what is SIGNED and what will actually EXECUTE, which is the gap varve exists to close.

Resolution here follows the same rules a shell uses: PATH order, left-to-right, first executable regular file wins. Builtins, aliases and shell functions are deliberately out of scope — varve cannot see another process’s shell state, and pretending otherwise would produce a check that is wrong in a new direction.

Enums

Shadowing

What PATH does with a tool name, relative to the path varve dispatches.

Functions

check

Compare what varve dispatches against what PATH would run.

describe

The user-facing report, carrying its fix (clause 4).

resolve_in

Resolve name against a PATH value, as a shell would.