[DRK-114] Harden DKNet.Svc.Encryption hashing: _disposed visibility + ignoreCase no-op docs

[baoduy]

Summary

Low-priority hardening from the SEC-006 constant-time-compare review follow-ups (DRK-114):

• HmacHashing._disposed and ShaHashing._disposed are now volatile — Dispose() writes are deterministically visible to Compute/Verify reads on another thread, without adding locking to the hot paths.
• Corrected the ignoreCase <param> XML docs on IHmacHashing.VerifySha256/VerifySha512 and IShaHashing.VerifySha256/VerifySha512 to state the flag has no effect on the result (comparisons use CryptographicOperations.FixedTimeEquals on decoded bytes, which are always compared exactly).
• No behavioural change; no public API surface change.

Tests

• HmacHashingDisposeTests / ShaHashingDisposeTests — dispose-then-verify throws ObjectDisposedException deterministically.
• HmacHashingIgnoreCaseTests / ShaHashingIgnoreCaseTests — ignoreCase: true/false return identical results for a mixed-case expected signature/hex string.
• Suite: 99 passed, 0 failed. Coverage on touched classes: HmacHashing 98.1%, ShaHashing 98.1%. dotnet pack clean.

Scope

src/Services/DKNet.Svc.Encryption/{HmacHashing.cs,ShaHashing.cs} + 4 new test files under src/Services/Svc.Encryption.Tests/.

[github-actions]

📊 Code Coverage Report

| Metric | Coverage |
|--------|----------|
| **Line Coverage** | 82% |
| **Branch Coverage** | 80.3% |
| **Method Coverage** | 84.1% |

**Lines:** 3403/undefined covered
**Branches:** 1274/undefined covered

📈 [View Full Coverage Report](https://github.com/baoduy/DKNet/actions/runs/30969463738)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.82%. Comparing base (dc4d57e) to head (42c68f5).
⚠️ Report is 6 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #338      +/-   ##
==========================================
+ Coverage   78.65%   78.82%   +0.17%     
==========================================
  Files         169      169              
  Lines        4155     4147       -8     
  Branches      609      607       -2     
==========================================
+ Hits         3268     3269       +1     
+ Misses        703      697       -6     
+ Partials      184      181       -3     

Flag	Coverage Δ
unittests	78.82% <ø> (+0.17%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[baoduy]

PR Review — #338: DKNet.Svc.Encryption hardening

Score: 10.0 / 10 → APPROVED

Summary

A textbook small, focused hardening change. Two low-risk fixes confined to two files (HmacHashing.cs, ShaHashing.cs) plus four focused test files — exactly what the spec (DRK-114) describes. No surprises, no scope creep.

Score breakdown

Category	Score	Weight	Notes
Correctness & logic	10/10	25%	volatile is the correct low-overhead fix; _disposed reads in Compute/Verify now deterministically observe a completed Dispose(). XML docs accurately describe the ignoreCase no-op.
Security	10/10	20%	No changes to security surface; FixedTimeEquals and CryptographicOperations patterns unchanged.
Testing & coverage	10/10	20%	8 dispose-determinism tests + 4 ignoreCase-no-op tests across both classes. Coverage: 98.1% on HmacHashing, 98.1% on ShaHashing. CI passes.
Maintainability & design	10/10	15%	Minimal diff; follows existing mirror pattern between HmacHashing/ShaHashing; no duplication, no new abstractions.
Spec conformance	10/10	10%	Exact match — _disposed volatile in both classes, all four ignoreCase XML docs corrected, no out-of-scope changes.
Style & conventions	10/10	5%	Matches existing patterns; test naming follows convention; new test files consistent with the test project.
AI-slop gate	10/10	5%	No redundant comments, no dead code, no reinvented helpers.

Weighted average: 10.0/10 · No hard caps triggered.

Findings

Praise

1. [praise] HmacHashing.cs:81, ShaHashing.cs:72 — volatile is the right call: adds zero locking overhead to the hot Compute/Verify paths while making the _disposed guard deterministic. Every entry point (Compute, ComputeHash, Verify, VerifyHash) hits ObjectDisposedException.ThrowIf(_disposed, ...) on line 1 — one modifier, four call-sites protected.
2. [praise] HmacHashingIgnoreCaseTests.cs:21, ShaHashingIgnoreCaseTests.cs:20 — the mixed-case construction (Select((c,i) => i%2==0 ? ToUpper : ToLower)) is a nice touch: it exercises the no-op guarantee against alternating-case hex/signature strings, not just a single case flip, so it catches any edge where ignoreCase might accidentally affect a specific hex digit position.
3. [praise] All four dispose tests use Should.Throw<ObjectDisposedException>(...) with the lambda form — asserts both the exception type AND that it's thrown on the correct call, in one line. Clean.
4. [praise] ShaHashing.cs:47 — the ignoreCase doc specifically names why it has no effect ("hex decoding is case-insensitive") rather than just saying it doesn't. HmacHashing.cs:44 references FixedTimeEquals directly with <see cref>. Both are precise and verifiable.

Preconditions check

• ✅ No blocking/critical findings
• ✅ No secrets, credentials, or connection strings
• ✅ CI: 4/4 checks passing
• ✅ No protected paths touched
• ✅ Not a draft; base is dev
• ✅ Coverage known (98.1%) and ≥ 90% threshold
• ✅ No new external sources or dependency changes

Out-of-scope observation

• HmacHashing.cs and all files in Svc.Encryption.Tests/ lack the copyright header present on ShaHashing.cs (lines 1–6). This is a pre-existing inconsistency across the encryption project — not introduced by this PR. Worth a consistent sweep at some point; not actionable here.