source maps: --out-dir far from source produces root-climbing relative sources (sourceRoot design)

[dean0x]

When the output directory is far from the source tree, relative paths in source maps accumulate deep ../../../... chains. This exposes directory structure in shipped artifacts and can be verbose.

Current behavior: sources[] contains verbatim relative paths from output to source files, regardless of depth.

Open question: Should MDS support sourceRoot to factor out the common prefix? What's the right UX for specifying it? Privacy consideration: how much directory structure should shipped maps reveal?

Deferred from the v0.4.0 dogfooding remediation (PR #196) — flagged during the 2026-07-17 dogfooding campaign; deliberately not implemented there pending design discussion.

[dean0x]

Closing as not planned

SourceMap (crates/mds-core/src/sourcemap.rs:142-160) has no sourceRoot field, and no consumer has asked for one.

Adding one would not be a self-contained addition. It would interact directly with the relativize_source choke point (crates/mds-core/src/source_path.rs:25-76) and with ADR-005 path containment — machinery that exists specifically to prevent path leakage (PF-005). Every sources[] entry is funnelled through that guard algorithm precisely so no absolute, drive-qualified, or root-escaping path can reach a shipped artifact. A sourceRoot field is by definition a mechanism for reintroducing a path prefix into the map, so it would have to be threaded through those same invariants and re-verified against them.

That is real design and review cost on a security-sensitive path, spent on speculative surface area: there is no consumer requesting it and no reported problem beyond verbosity.

Reopen if a real consumer appears. If someone hits an actual problem with root-climbing relative sources in a shipped map, that concrete use case is precisely what the design discussion needs, and this should be reopened with it.