[Audit/Scientific integrity] OME-Zarr with matching axis letters can be processed under contradictory confirmed roles #72

Scope

Sad Catapella adversarial audit, Batch 2, main at d7a538e. Confirmed source-level defect; tests and end-to-end reproducer not executed.

Evidence

• review_axes(), lines 700–703 immediately takes the experiment mapping when f.axes == mapping.axes, including OME-Zarr, without calling declared_mapping or comparing the mapping roles against the NGFF-declared roles.
• file_mapping_for(), lines 485–491 has the same short circuit for consumers.
• axis_disagreements(), lines 117–120 skips OME-Zarr entirely, on the assumption that OME-Zarr roles were taken from the header.
• check_mapping(), lines 577–652 validates role uniqueness/geometry, not consistency with the NGFF header.
• Existing Zarr tests verify the different-arrangement path; test_axis_check establishes that header-axis check itself never flags Zarr, but does not test invalid mappings on an identical arrangement.

Minimal deterministic counterexample (source-path proof)

An OME-NGFF ZYX 3D array with Z=3 and valid declared axes is inspected as TiffMetadata(kind='ome-zarr', axes='ZYX', shape=(3, 6, 8)). Call review_axes([meta], AxisMapping('ZYX', 'TYX')) or run_experiment(root, AxisMapping('ZYX','TYX')). The mapping is unique and includes Y/X. The identical-arrangement shortcut assigns T to the NGFF Z dimension. Header check skips it; no ome_zarr_axes_mismatch or axes_contradict_header issue is created. Histograms and source roles can be silently attributed to time rather than depth.

A non-singleton unknown NGFF axis QYX similarly bypasses declared_mapping when a user assigns Q the role C/Z/T in a same-letters mapping.

Impact

Critical scientific axis identity corruption in an all-Zarr workflow; incorrect Z/T/channel coordinates in output records/manifest, and potentially invalid biological analysis downstream.

Fix and tests

For every OME-Zarr file, validate against its NGFF-declared roles, irrespective of whether the raw axis string matches. Reject role contradictions explicitly, not silently rewrite user confirmation; still support different axis orders by per-file declared role resolution and explicit singleton rules. Apply the same policy to file_mapping_for. Add tests for same-axes ZYX→TYX, ZYX→ZXY, and QYX→CYX, plus valid mixed TIFF/Zarr and changed-order controls, verifying preflight review, run rejection, source-coordinate integrity and manifest roles. Do not relabel or transpose silently.

Performance

No Numba role: metadata/axis validation is tiny relative to pixel I/O; prioritize correctness and cached per-file resolution.