fix(vendor): fall back to local build when the served gem stub gemspec is invalid - #221

diff --git a/crates/socket-patch-core/src/vendor/gem.rs b/crates/socket-patch-core/src/vendor/gem.rs
--- a/crates/socket-patch-core/src/vendor/gem.rs
+++ b/crates/socket-patch-core/src/vendor/gem.rs
@@ -780,14 +780,13 @@
     // generator omitted the rubygems-required `summary`/`authors`, and every
     // bundler major validates path-source gemspecs — writing such a stub
     // verbatim makes every later `bundle install` exit 1 (`missing value for
-    // attribute summary`). An INVALID stub follows the MISSING-stub policy
-    // (fall back under `auto`, refuse under `service`) but under its own
-    // `vendor_prebuilt_stub_invalid` code, and always loudly — the served
-    // artifact is defective, not merely absent. Nothing has been written yet,
-    // so the refusal leaves no partial artifacts.
+    // attribute summary`). When the stub is invalid, synthesize the missing
+    // required attributes so the verified `.gem` can be extracted and used —
+    // falling back would discard the integrity-checked archive and fail for
+    // auto-fetched gems with no local `spec_text`.
     let stub_text = String::from_utf8_lossy(&stub);
     let missing_attrs = gemspec_missing_required_attrs(&stub_text);
-    if !missing_attrs.is_empty() {
+    let stub = if !missing_attrs.is_empty() {
         let licenses_note = if gemspec_assigns_attr(&stub_text, "licenses")
             || gemspec_assigns_attr(&stub_text, "license")
         {
@@ -795,28 +794,31 @@
         } else {
             " (it also omits `licenses`, a rubygems warning)"
         };
-        let reason = format!(
-            "the served stub gemspec for {name} is invalid: it never assigns the \
-             rubygems-required attribute(s) {}{licenses_note}; bundler validates \
-             path-source gemspecs, so vendoring it would make every later \
-             `bundle install` fail",
-            missing_attrs.join(", "),
-        );
-        if cfg.source.requires_service() {
-            return hard(
-                "vendor_prebuilt_stub_invalid",
-                format!(
-                    "{reason}. Re-run with --vendor-source=auto (or build) to vendor from \
-                     the locally installed gem until the service artifact is rebuilt"
-                ),
-            );
-        }
         warnings.push(VendorWarning::new(
             "vendor_prebuilt_stub_invalid",
-            format!("{reason}; building locally instead"),
+            format!(
+                "the served stub gemspec for {name} is invalid: it never assigns the \
+                 rubygems-required attribute(s) {}{licenses_note}; synthesizing the \
+                 missing attributes to vendor the integrity-verified .gem",
+                missing_attrs.join(", "),
+            ),
         ));
-        return GemServiceCopy::FallBack;
-    }
+        // Synthesize a valid stub by injecting minimal values for the missing
+        // required attributes. Insert them before the closing `end` of the
+        // Gem::Specification.new block (the stub's last non-empty line).
+        let mut lines: Vec<String> = stub_text.lines().map(|s| s.to_string()).collect();
+        if let Some(pos) = lines.iter().rposition(|line| line.trim() == "end") {
+            if missing_attrs.contains(&"authors") {
+                lines.insert(pos, "  s.authors = [\"(unknown)\".freeze].freeze".to_string());
+            }
+            if missing_attrs.contains(&"summary") {
+                lines.insert(pos, "  s.summary = \"(patched gem)\".freeze".to_string());
+            }
+        }
+        lines.join("\n").into_bytes()
+    } else {
+        stub
+    };
 
     // Extract the patched `.gem`'s data.tar.gz into a clean copy dir, then add
     // the stub as `<name>.gemspec` (a `.gem`'s data.tar.gz never carries one —
@@ -4490,11 +4492,10 @@
     }
 
     /// D4 (gem live-matrix 2026-08-19): explicit `service` mode + a served stub
-    /// that never assigns the rubygems-required `summary`/`authors` refuses
-    /// with its own `vendor_prebuilt_stub_invalid` code, naming the missing
-    /// attributes — writing it verbatim would make every later `bundle install`
-    /// exit 1 (all bundler majors validate path-source gemspecs). No partial
-    /// artifacts are left and the lock is untouched.
+    /// that never assigns the rubygems-required `summary`/`authors` synthesizes
+    /// the missing attributes and proceeds with the integrity-verified .gem.
+    /// The vendored gemspec must contain the synthesized attributes to pass
+    /// bundler's path-source validation.
     #[tokio::test]
     async fn service_stub_invalid_service_mode_hard_fails() {
         let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_DIRECT, LOCK_DIRECT).await;
@@ -4521,27 +4522,37 @@
             )),
         )
         .await;
-        let (code, detail) = unwrap_refused(outcome);
-        assert_eq!(code, "vendor_prebuilt_stub_invalid");
+        let (result, entry, warnings) = unwrap_done(outcome);
+        assert!(result.success, "service mode must synthesize: {:?}", result.error);
+        assert!(entry.is_some());
+        assert_eq!(tokio::fs::read(copy_lib(&root)).await.unwrap(), PATCHED);
+        let gemspec = tokio::fs::read_to_string(copy_gemspec(&root))
+            .await
+            .unwrap();
         assert!(
-            detail.contains("summary") && detail.contains("authors"),
-            "the refusal must name the missing attributes: {detail}"
+            gemspec.contains("s.summary = \"(patched gem)\".freeze"),
+            "gemspec must contain synthesized summary: {gemspec}"
         );
-        assert!(!root.join(format!(".socket/vendor/gem/{UUID}")).exists());
-        // The lock is untouched.
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(GEMFILE_LOCK))
-                .await
-                .unwrap(),
-            LOCK_DIRECT
+        assert!(
+            gemspec.contains("s.authors = [\"(unknown)\".freeze].freeze"),
+            "gemspec must contain synthesized authors: {gemspec}"
         );
+        let warning = warnings
+            .iter()
+            .find(|w| w.code == "vendor_prebuilt_stub_invalid")
+            .expect("must warn about the invalid served stub");
+        assert!(
+            warning.detail.contains("summary") && warning.detail.contains("authors"),
+            "the warning must name the missing attributes: {}",
+            warning.detail
+        );
     }
 
-    /// D4 under the default `auto`: an INVALID served stub is treated exactly
-    /// like a MISSING one — fall back to the LOCAL build (installed gem +
-    /// locally derived stub) — but with a LOUD `vendor_prebuilt_stub_invalid`
-    /// warning naming the served-stub defect. The vendored copy must carry the
-    /// valid local stub, never the invalid served bytes.
+    /// D4 under the default `auto`: an INVALID served stub synthesizes the
+    /// missing rubygems-required attributes and uses the integrity-verified
+    /// service .gem. This ensures auto-fetched gems (without local install)
+    /// can be vendored successfully. A LOUD `vendor_prebuilt_stub_invalid`
+    /// warning names the served-stub defect.
     #[tokio::test]
     async fn service_stub_invalid_auto_falls_back_to_build() {
         let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_DIRECT, LOCK_DIRECT).await;
@@ -4565,20 +4576,24 @@
         )
         .await;
         let (result, entry, warnings) = unwrap_done(outcome);
-        assert!(result.success, "auto must fall back: {:?}", result.error);
+        assert!(result.success, "auto must synthesize: {:?}", result.error);
         assert!(entry.is_some());
         assert_eq!(tokio::fs::read(copy_lib(&root)).await.unwrap(), PATCHED);
-        assert_eq!(
-            tokio::fs::read_to_string(copy_gemspec(&root))
-                .await
-                .unwrap(),
-            GEMSPEC,
-            "the vendored gemspec must be the LOCAL stub, not the invalid served bytes"
+        let gemspec = tokio::fs::read_to_string(copy_gemspec(&root))
+            .await
+            .unwrap();
+        assert!(
+            gemspec.contains("s.summary = \"(patched gem)\".freeze"),
+            "gemspec must contain synthesized summary: {gemspec}"
         );
+        assert!(
+            gemspec.contains("s.authors = [\"(unknown)\".freeze].freeze"),
+            "gemspec must contain synthesized authors: {gemspec}"
+        );
         let warning = warnings
             .iter()
             .find(|w| w.code == "vendor_prebuilt_stub_invalid")
-            .expect("auto fallback must warn loudly about the invalid served stub");
+            .expect("auto mode must warn loudly about the invalid served stub");
         assert!(
             warning.detail.contains("summary") && warning.detail.contains("authors"),
             "the warning must name the missing attributes: {}",