@aipt/idp-deploy 0.1.2

package/src/release.mjs

@@ -0,0 +1,1760 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { rollbackManagedBindingsCas, syncManagedBindings } from './bindings.mjs';
+import { doctorConfig, generateSecrets, initializeConfig, resolveConfiguredOrasTool } from './config.mjs';
+import { IdpError, invariant } from './errors.mjs';
+import { hashFile, sha256, stableJson } from './hash.mjs';
+import { lockImages } from './images.mjs';
+import { dockerOfficialMirrorRef } from './oci-mirror.mjs';
+import {
+  composeOperation,
+  createBackup,
+  readActiveProfileState,
+  testRestore,
+  verifyBackup,
+  verifyDeployment,
+  withInstanceLock,
+  writeReceipt,
+} from './operations.mjs';
+import { run } from './process.mjs';
+import { resolveProfile } from './profiles.mjs';
+import { readRuntimeGenerationManifest, renderRuntimeBundles } from './render.mjs';
+import { assertSafeDirectory, assertSafeRegularFile, atomicWrite, createExclusiveFile, parseEnv, resolveContained } from './security.mjs';
+
+const REQUIRED_PLATFORMS = Object.freeze(['linux/amd64', 'linux/arm64']);
+const RELEASE_LABEL_KEYS = Object.freeze([
+  'org.opencontainers.image.version',
+  'org.opencontainers.image.revision',
+  'dev.idp.release.plan',
+  'dev.idp.release.component',
+]);
+const VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-z0-9][a-z0-9.-]*)?$/u;
+const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+const PINNED_IMAGE_PATTERN = /^\S+@sha256:[0-9a-f]{64}$/u;
+const SBOM_GENERATOR = 'mirror.gcr.io/docker/buildkit-syft-scanner:stable-1@sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9';
+const OCI_REPOSITORY_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?::[1-9][0-9]{0,4})?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)+$/u;
+const SMARTGO_PUBLIC_REGISTRY_ALIAS = 'host.docker.internal';
+const SMARTGO_PRIVATE_REGISTRY_ALIAS = 'smartgo-private-registry.internal';
+const SMARTGO_OFFLINE_DEPLOY_ROUTE_ARGS = Object.freeze([
+  `--config.registry=http://${SMARTGO_PUBLIC_REGISTRY_ALIAS}:4873/`,
+  `--config.@aipt:registry=http://${SMARTGO_PRIVATE_REGISTRY_ALIAS}:4873/`,
+  `--config.@bench:registry=http://${SMARTGO_PRIVATE_REGISTRY_ALIAS}:4873/`,
+]);
+const SMARTGO_PNPM_CACHE_MOUNT = 'type=cache,id=smartgo-pnpm,target=/pnpm/store';
+const SMARTGO_NPMRC_SECRET_MOUNT = 'type=secret,id=npmrc,target=/root/.npmrc,required=true';
+const SMARTGO_PERSISTENCE_PREFLIGHT_DIRECTORY = '/tmp/smartgo-persistence-runtime-closure-preflight';
+const SMARTGO_PERSISTENCE_PREFLIGHT_SEGMENTS = Object.freeze([
+  'pnpm install --frozen-lockfile --prefer-offline --network-concurrency=4',
+  'pnpm --filter @smartgo/persistence db:generate >/dev/null',
+  `pnpm --filter @smartgo/persistence --prod deploy --legacy ${SMARTGO_PERSISTENCE_PREFLIGHT_DIRECTORY} >/dev/null`,
+  `rm -rf ${SMARTGO_PERSISTENCE_PREFLIGHT_DIRECTORY}`,
+]);
+const SMARTGO_INSTALL_SETUP_SEGMENTS = Object.freeze([
+  '(test "$SMARTGO_NPM_CACHE_MODE" = "proxy" || test "$SMARTGO_NPM_CACHE_MODE" = "direct-prime")',
+  'pnpm config set store-dir /pnpm/store',
+  'pnpm config set link-workspace-packages true --location project',
+  'pnpm config set fetch-timeout 300000 --location project',
+  'pnpm config set fetch-retries 5 --location project',
+  'pnpm config set fetch-retry-mintimeout 10000 --location project',
+  'pnpm config set fetch-retry-maxtimeout 60000 --location project',
+]);
+const SMARTGO_BUILD_PACKAGE_SEGMENTS = Object.freeze([
+  'pnpm --filter @smartgo/persistence db:generate',
+  'pnpm --recursive --if-present build',
+  'node /workspace/deploy/package-next-standalone.mjs gotology',
+  'node /workspace/deploy/package-next-standalone.mjs operations',
+  'node /workspace/deploy/package-next-standalone.mjs studio-poc',
+]);
+const SMARTGO_RUNTIME_DEPLOYS = Object.freeze([
+  Object.freeze({ selector: '@smartgo/api-contracts', target: '/runtime/packages/api-contracts', sourceDirectory: 'packages/api-contracts' }),
+  Object.freeze({ selector: '@smartgo/domain', target: '/runtime/packages/domain', sourceDirectory: 'packages/domain' }),
+  Object.freeze({ selector: '@smartgo/application', target: '/runtime/packages/application', sourceDirectory: 'packages/application' }),
+  Object.freeze({ selector: '@smartgo/object-store', target: '/runtime/packages/object-store', sourceDirectory: 'packages/object-store' }),
+  Object.freeze({ selector: '@smartgo/platform-session', target: '/runtime/packages/platform-session', sourceDirectory: 'packages/platform-session' }),
+  Object.freeze({ selector: '@smartgo/persistence', target: '/runtime/packages/persistence', sourceDirectory: 'packages/persistence' }),
+  Object.freeze({ selector: 'smartgo-api', target: '/runtime/services/smartgo-api', sourceDirectory: 'services/smartgo-api' }),
+  Object.freeze({ selector: 'agent-runtime', target: '/runtime/services/agent-runtime', sourceDirectory: 'services/agent-runtime' }),
+  Object.freeze({ selector: 'worker', target: '/runtime/services/worker', sourceDirectory: 'services/worker' }),
+]);
+const SMARTGO_RUNTIME_ROOTS = Object.freeze(['@smartgo/persistence', 'smartgo-api', 'agent-runtime', 'worker']);
+const SMARTGO_RUNTIME_COPY_SOURCES = Object.freeze([
+  '/runtime/packages',
+  '/runtime/services/smartgo-api',
+  '/runtime/services/agent-runtime',
+  '/runtime/services/worker',
+  '/workspace/apps/gotology/.artifacts/standalone',
+  '/workspace/apps/operations/.artifacts/standalone',
+  '/workspace/apps/studio-poc/.artifacts/standalone',
+  '/workspace/tooling/config-dir.mjs',
+  '/workspace/deploy/container-entrypoint.mjs',
+  '/workspace/deploy/backup-boundary.mjs',
+  '/workspace/deploy/component-contract.json',
+]);
+const SMARTGO_RUNTIME_POST_DEPLOY_SEGMENTS = Object.freeze([
+  'rm -rf /runtime/services/smartgo-api/src /runtime/services/agent-runtime/src /runtime/services/worker/src',
+  "find /runtime/services -type f \\( -name '*.test.*' -o -name '*.map' -o -name 'tsconfig*.json' -o -name 'vitest.config.*' \\) -delete",
+  '/runtime/packages/persistence/node_modules/.bin/prisma generate --schema /runtime/packages/persistence/prisma/schema.prisma >/dev/null',
+  'node /workspace/deploy/sanitize-runtime-closure.mjs /runtime',
+  '/runtime/packages/persistence/node_modules/.bin/prisma --version >/dev/null',
+  '/runtime/packages/persistence/node_modules/.bin/tsx --version >/dev/null',
+  'node --input-type=module -e "await import(\'/runtime/packages/persistence/dist/index.js\')"',
+]);
+const SMARTGO_TYPESCRIPT_LINKS = Object.freeze([
+  'packages/persistence/node_modules/.pnpm/@prisma+client@6.19.3_prisma@6.19.3_typescript@6.0.3__typescript@6.0.3/node_modules/typescript',
+  'packages/persistence/node_modules/.pnpm/node_modules/typescript',
+  'packages/persistence/node_modules/.pnpm/prisma@6.19.3_typescript@6.0.3/node_modules/typescript',
+]);
+const SMARTGO_TYPESCRIPT_SHIMS = Object.freeze([
+  'packages/persistence/node_modules/.pnpm/@prisma+client@6.19.3_prisma@6.19.3_typescript@6.0.3__typescript@6.0.3/node_modules/@prisma/client/node_modules/.bin/tsc',
+  'packages/persistence/node_modules/.pnpm/@prisma+client@6.19.3_prisma@6.19.3_typescript@6.0.3__typescript@6.0.3/node_modules/@prisma/client/node_modules/.bin/tsserver',
+  'packages/persistence/node_modules/.pnpm/node_modules/.bin/tsc',
+  'packages/persistence/node_modules/.pnpm/node_modules/.bin/tsserver',
+  'packages/persistence/node_modules/.pnpm/prisma@6.19.3_typescript@6.0.3/node_modules/prisma/node_modules/.bin/tsc',
+  'packages/persistence/node_modules/.pnpm/prisma@6.19.3_typescript@6.0.3/node_modules/prisma/node_modules/.bin/tsserver',
+]);
+
+const BUILD_CONTRACTS = Object.freeze({
+  tech: {
+    environmentKey: 'IDP_TECH_IMAGE', sourceDirectory: 'tech', context: '.',
+    dockerfile: 'apps/knowledge-service/Dockerfile', repositorySuffix: '', prebuildContract: 'none',
+  },
+  flow: {
+    environmentKey: 'IDP_FLOW_IMAGE', sourceDirectory: 'flow', context: '.',
+    dockerfile: 'deploy/Dockerfile', repositorySuffix: '/flow', prebuildContract: 'none',
+  },
+  portal: {
+    environmentKey: 'IDP_PORTAL_IMAGE', sourceDirectory: 'portal', context: '.',
+    dockerfile: 'packages/backend/Dockerfile', repositorySuffix: '/portal', prebuildContract: 'portal-backstage-v1',
+  },
+  smartgo: {
+    environmentKey: 'IDP_SMARTGO_IMAGE', sourceDirectory: 'smartGO', context: '.',
+    dockerfile: 'Dockerfile', repositorySuffix: '/smartgo', prebuildContract: 'smartgo-managed-v1',
+  },
+});
+
+const THIRD_PARTY_BY_SERVICE = Object.freeze({
+  postgresql: 'IDP_POSTGRES_IMAGE',
+  edge: 'IDP_CADDY_IMAGE',
+  registry: 'IDP_REGISTRY_IMAGE',
+  smartgoObjectStore: 'IDP_SMARTGO_OBJECT_STORE_IMAGE',
+  smartgoObjectStoreClient: 'IDP_SMARTGO_OBJECT_STORE_CLIENT_IMAGE',
+});
+
+function exactKeys(value, expected, code, role) {
+  invariant(value && typeof value === 'object' && !Array.isArray(value), code, `${role}必须是对象`);
+  invariant(stableJson(Object.keys(value).sort()) === stableJson([...expected].sort()), code, `${role}字段集合无效`);
+}
+
+function validateReleaseDefaults(document) {
+  exactKeys(document, ['schemaVersion', 'releaseVersion', 'ociRepositoryRoot', 'platforms', 'thirdPartyImages', 'buildImages'], 'IDP_RELEASE_DEFAULTS_INVALID', 'Release defaults');
+  invariant(document.schemaVersion === 1, 'IDP_RELEASE_DEFAULTS_VERSION_UNSUPPORTED', '只支持Release defaults v1');
+  invariant(VERSION_PATTERN.test(document.releaseVersion ?? ''), 'IDP_RELEASE_VERSION_INVALID', 'Release defaults版本号无效');
+  invariant(OCI_REPOSITORY_PATTERN.test(document.ociRepositoryRoot ?? ''), 'IDP_RELEASE_OCI_REPOSITORY_INVALID', 'Release defaults OCI仓库根无效');
+  invariant(stableJson(document.platforms) === stableJson(REQUIRED_PLATFORMS), 'IDP_RELEASE_PLATFORMS_INVALID', 'Release defaults必须固定包含linux/amd64与linux/arm64');
+  exactKeys(document.thirdPartyImages, ['IDP_POSTGRES_IMAGE', 'IDP_CADDY_IMAGE', 'IDP_REGISTRY_IMAGE', 'IDP_SMARTGO_OBJECT_STORE_IMAGE', 'IDP_SMARTGO_OBJECT_STORE_CLIENT_IMAGE'], 'IDP_RELEASE_DEFAULTS_INVALID', '第三方镜像默认值');
+  for (const [key, ref] of Object.entries(document.thirdPartyImages)) {
+    invariant(PINNED_IMAGE_PATTERN.test(ref ?? ''), 'IDP_RELEASE_DEFAULT_IMAGE_NOT_PINNED', `${key}必须使用OCI digest固定`);
+  }
+  exactKeys(document.buildImages, Object.keys(BUILD_CONTRACTS), 'IDP_RELEASE_DEFAULTS_INVALID', '自研镜像构建默认值');
+  for (const [name, expected] of Object.entries(BUILD_CONTRACTS)) {
+    const build = document.buildImages[name];
+    exactKeys(build, ['environmentKey', 'sourceDirectory', 'context', 'dockerfile', 'repositorySuffix', 'buildArgs', 'buildSecretFiles', 'prebuildContract'], 'IDP_RELEASE_DEFAULTS_INVALID', `${name}构建合同`);
+    for (const [key, value] of Object.entries(expected)) invariant(build[key] === value, 'IDP_RELEASE_BUILD_CONTRACT_DRIFT', `${name}构建合同${key}已偏移`);
+    exactKeys(build.buildArgs, ['tech', 'smartgo'].includes(name) ? ['NODE_IMAGE'] : [], 'IDP_RELEASE_BUILD_ARGS_INVALID', `${name}构建参数`);
+    if (['tech', 'smartgo'].includes(name)) invariant(PINNED_IMAGE_PATTERN.test(build.buildArgs.NODE_IMAGE ?? ''), 'IDP_RELEASE_NODE_IMAGE_NOT_PINNED', `${name} NODE_IMAGE必须使用OCI digest固定`);
+    exactKeys(build.buildSecretFiles, name === 'smartgo' ? ['npmrc'] : [], 'IDP_RELEASE_BUILD_SECRETS_INVALID', `${name}构建Secret`);
+    if (name === 'smartgo') invariant(build.buildSecretFiles.npmrc === 'SMARTGO_NPMRC_FILE', 'IDP_RELEASE_BUILD_SECRETS_INVALID', 'SmartGo构建只能读取SMARTGO_NPMRC_FILE');
+  }
+  return document;
+}
+
+export function readReleaseDefaults(repositoryRoot) {
+  const candidate = path.join(repositoryRoot, 'release', 'defaults.v1.json');
+  assertSafeRegularFile(candidate, 0o644, { allowEmpty: false, role: 'Release defaults' });
+  let document;
+  try { document = JSON.parse(fs.readFileSync(candidate, 'utf8')); }
+  catch { throw new IdpError('IDP_RELEASE_DEFAULTS_JSON_INVALID', 'Release defaults不是有效JSON'); }
+  return validateReleaseDefaults(document);
+}
+
+function imageRepository(ref) {
+  const withoutDigest = String(ref ?? '').replace(/@sha256:[0-9a-f]{64}$/u, '');
+  const slash = withoutDigest.lastIndexOf('/');
+  const colon = withoutDigest.lastIndexOf(':');
+  return colon > slash ? withoutDigest.slice(0, colon) : withoutDigest;
+}
+
+export function resolveOciRepositoryRoot(env, explicit, fallback) {
+  const configured = env.IDP_OCI_REPOSITORY_ROOT;
+  const candidate = explicit ?? (configured && configured !== 'UNCONFIGURED'
+    ? configured
+    : (env.IDP_TECH_IMAGE && env.IDP_TECH_IMAGE !== 'UNCONFIGURED'
+      ? imageRepository(env.IDP_TECH_IMAGE)
+      : fallback));
+  invariant(candidate && candidate !== 'UNCONFIGURED' && OCI_REPOSITORY_PATTERN.test(candidate), 'IDP_OCI_REPOSITORY_ROOT_REQUIRED', '请配置有效的默认OCI仓库根、IDP_OCI_REPOSITORY_ROOT或可推导仓库路径的IDP_TECH_IMAGE');
+  return candidate;
+}
+
+function updateHashFromFile(hash, candidate) {
+  const descriptor = fs.openSync(candidate, 'r');
+  const buffer = Buffer.allocUnsafe(64 * 1024);
+  try {
+    for (;;) {
+      const bytes = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+      if (bytes === 0) break;
+      hash.update(buffer.subarray(0, bytes));
+    }
+  } finally { fs.closeSync(descriptor); }
+}
+
+function dockerIgnoreRegex(rawPattern) {
+  let pattern = rawPattern.replaceAll('\\', '/').replace(/^\.\//u, '').replace(/^\//u, '').replace(/\/$/u, '');
+  const containsSlash = pattern.includes('/');
+  let body = '';
+  for (let index = 0; index < pattern.length; index += 1) {
+    const character = pattern[index];
+    if (character === '*' && pattern[index + 1] === '*') {
+      index += 1;
+      if (pattern[index + 1] === '/') { index += 1; body += '(?:.*/)?'; }
+      else body += '.*';
+    } else if (character === '*') body += '[^/]*';
+    else if (character === '?') body += '[^/]';
+    else body += character.replace(/[|\\{}()[\]^$+?.]/gu, '\\$&');
+  }
+  return new RegExp(`${containsSlash ? '^' : '(?:^|/)'}${body}(?:/|$)`, 'u');
+}
+
+function readDockerIgnoreRules(sourceRoot) {
+  const candidate = path.join(sourceRoot, '.dockerignore');
+  assertSafeRegularFile(candidate, 0o644, { allowEmpty: false, role: 'SmartGo .dockerignore' });
+  return fs.readFileSync(candidate, 'utf8').split(/\r?\n/u).map((line) => line.trim()).filter((line) => line && !line.startsWith('#')).map((line) => {
+    const negated = line.startsWith('!');
+    const pattern = negated ? line.slice(1) : line;
+    invariant(pattern.length > 0 && !pattern.includes('\0'), 'IDP_RELEASE_DOCKERIGNORE_INVALID', 'SmartGo .dockerignore包含无效规则');
+    return { negated, pattern, regex: dockerIgnoreRegex(pattern) };
+  });
+}
+
+function inspectDockerContext(sourceRoot) {
+  const rules = readDockerIgnoreRules(sourceRoot);
+  const files = [];
+  const generatedSegments = new Set(['.git', '.dyyto', 'node_modules', '.next', '.artifacts', 'dist', 'coverage', 'test-results', 'playwright-report']);
+  const ignored = (relative) => {
+    let result = false;
+    for (const rule of rules) if (rule.regex.test(relative)) result = !rule.negated;
+    return result;
+  };
+  const visit = (directory, prefix = '') => {
+    for (const name of fs.readdirSync(directory).sort()) {
+      const relative = prefix ? `${prefix}/${name}` : name;
+      const candidate = path.join(directory, name);
+      const entry = fs.lstatSync(candidate);
+      invariant(!entry.isSymbolicLink(), 'IDP_RELEASE_NON_GIT_LINK_FORBIDDEN', `非Git构建上下文禁止链接：${relative}`);
+      const segments = relative.split('/');
+      if (segments.some((segment) => generatedSegments.has(segment))) continue;
+      invariant(!(name === '.env' || (name.startsWith('.env.') && name !== '.env.example')), 'IDP_RELEASE_NON_GIT_SECRET_FILE_FORBIDDEN', `非Git构建上下文禁止环境文件：${relative}`);
+      if (ignored(relative)) continue;
+      if (entry.isDirectory()) visit(candidate, relative);
+      else {
+        invariant(entry.isFile() && entry.nlink === 1, 'IDP_RELEASE_SOURCE_ENTRY_INVALID', `非Git构建源包含不支持的文件类型：${relative}`);
+        files.push(relative);
+      }
+    }
+  };
+  visit(sourceRoot);
+  invariant(files.includes('.dockerignore') && files.includes('Dockerfile'), 'IDP_RELEASE_NON_GIT_CONTEXT_INVALID', '非Git构建上下文必须包含Dockerfile与.dockerignore');
+  return files.sort();
+}
+
+export function inspectSource(sourceRoot, { sourceRunner = run, allowNonGit = false } = {}) {
+  const stat = fs.lstatSync(sourceRoot);
+  invariant(stat.isDirectory() && !stat.isSymbolicLink(), 'IDP_RELEASE_SOURCE_INVALID', `构建源必须是普通目录：${sourceRoot}`);
+  let files;
+  let sourceMode = 'git-worktree';
+  try {
+    const listed = sourceRunner('git', ['-C', sourceRoot, 'ls-files', '--cached', '--others', '--exclude-standard', '-z'], { capture: true });
+    files = String(listed.stdout ?? '').split('\0').filter(Boolean).sort();
+  } catch (error) {
+    invariant(allowNonGit, 'IDP_RELEASE_NON_GIT_SOURCE_FORBIDDEN', `构建源不是可审计Git工作区：${sourceRoot}`);
+    files = inspectDockerContext(sourceRoot);
+    sourceMode = 'dockerignore-development';
+  }
+  invariant(files.length > 0, 'IDP_RELEASE_SOURCE_EMPTY', `构建源没有Git管理或未忽略的文件：${sourceRoot}`);
+  const hash = crypto.createHash('sha256');
+  for (const relative of files) {
+    invariant(!path.isAbsolute(relative) && !relative.split(/[\\/]/u).includes('..') && !relative.includes('\0'), 'IDP_RELEASE_SOURCE_PATH_INVALID', '构建源包含不安全路径');
+    const candidate = path.resolve(sourceRoot, relative);
+    const contained = path.relative(sourceRoot, candidate);
+    invariant(contained && !contained.startsWith('..') && !path.isAbsolute(contained), 'IDP_RELEASE_SOURCE_PATH_INVALID', '构建源路径逃逸');
+    hash.update(`${Buffer.byteLength(relative)}:${relative}\0`);
+    if (!fs.existsSync(candidate)) {
+      hash.update('deleted\0');
+      continue;
+    }
+    const entry = fs.lstatSync(candidate);
+    hash.update(`${entry.mode & 0o7777}\0`);
+    if (entry.isFile()) updateHashFromFile(hash, candidate);
+    else if (entry.isSymbolicLink() && sourceMode === 'git-worktree') hash.update(`link:${fs.readlinkSync(candidate)}`);
+    else invariant(false, 'IDP_RELEASE_SOURCE_ENTRY_INVALID', `构建源包含不支持的文件类型：${relative}`);
+    hash.update('\0');
+  }
+  return { digest: `sha256:${hash.digest('hex')}`, fileCount: files.length, sourceMode };
+}
+
+function defaultProbe(command, args, options = {}) {
+  const result = spawnSync(command, args, { encoding: 'utf8', stdio: 'pipe', ...options });
+  if (result.error) throw new IdpError('IDP_PROCESS_START_FAILED', `${command}启动失败：${result.error.message}`);
+  return result;
+}
+
+function inspectionPlatforms(document) {
+  return [...new Set((document?.manifest?.manifests ?? [])
+    .map((manifest) => `${manifest?.platform?.os}/${manifest?.platform?.architecture}`)
+    .filter((platform) => REQUIRED_PLATFORMS.includes(platform)))].sort();
+}
+
+function inspectionPlatformCounts(document) {
+  const counts = Object.fromEntries(REQUIRED_PLATFORMS.map((platform) => [platform, 0]));
+  for (const manifest of document?.manifest?.manifests ?? []) {
+    const platform = `${manifest?.platform?.os}/${manifest?.platform?.architecture}`;
+    if (Object.hasOwn(counts, platform)) counts[platform] += 1;
+  }
+  return counts;
+}
+
+function inspectionReleaseLabels(document) {
+  return Object.fromEntries(REQUIRED_PLATFORMS.map((platform) => {
+    const labels = document?.image?.[platform]?.config?.Labels;
+    return [platform, Object.fromEntries(RELEASE_LABEL_KEYS.map((key) => [
+      key,
+      labels && typeof labels === 'object' && !Array.isArray(labels) && typeof labels[key] === 'string'
+        ? labels[key]
+        : null,
+    ]))];
+  }));
+}
+
+export function inspectPublishedImage(ref, { probeRunner = defaultProbe, allowMissing = false } = {}) {
+  const mirrorRef = dockerOfficialMirrorRef(ref);
+  // 固定 digest 的 Docker Official Image 可先从 Google 官方镜像缓存读取
+  // 同一 OCI 事实，避免无意义消耗 Docker Hub 匿名限额；缓存不可用时
+  // 再回到原始引用，私有仓库始终只检查原引用。
+  let result = probeRunner('docker', ['buildx', 'imagetools', 'inspect', mirrorRef ?? ref, '--format', '{{json .}}'], { capture: true });
+  if (result.status !== 0 && mirrorRef) {
+    result = probeRunner('docker', ['buildx', 'imagetools', 'inspect', ref, '--format', '{{json .}}'], { capture: true });
+  }
+  if (result.status !== 0) {
+    const message = `${result.stderr ?? ''}\n${result.stdout ?? ''}`;
+    if (allowMissing && /(?:not found|manifest unknown|no such manifest|\b404\b)/iu.test(message)) return null;
+    throw new IdpError('IDP_RELEASE_IMAGE_INSPECT_FAILED', `无法检查OCI镜像：${ref}`);
+  }
+  let document;
+  try { document = JSON.parse(String(result.stdout ?? '')); }
+  catch { throw new IdpError('IDP_RELEASE_IMAGE_INSPECT_INVALID', `OCI镜像检查结果不是有效JSON：${ref}`); }
+  const digest = document?.manifest?.digest;
+  const platforms = inspectionPlatforms(document);
+  invariant(DIGEST_PATTERN.test(digest ?? ''), 'IDP_RELEASE_IMAGE_DIGEST_INVALID', `OCI镜像缺少Index digest：${ref}`);
+  invariant(stableJson(platforms) === stableJson([...REQUIRED_PLATFORMS].sort()), 'IDP_RELEASE_IMAGE_PLATFORM_MISSING', `OCI镜像必须同时包含linux/amd64与linux/arm64：${ref}`);
+  return {
+    digest,
+    platforms: REQUIRED_PLATFORMS,
+    platformCounts: inspectionPlatformCounts(document),
+    releaseLabelsByPlatform: inspectionReleaseLabels(document),
+  };
+}
+
+function expectedReleaseLabels(plan, planned) {
+  return {
+    'org.opencontainers.image.version': plan.releaseTag,
+    'org.opencontainers.image.revision': planned.sourceDigest,
+    'dev.idp.release.plan': plan.planDigest,
+    'dev.idp.release.component': planned.component,
+  };
+}
+
+function verifyPublishedReleaseIdentity(published, plan, planned, code, { allowLegacyComponent = false } = {}) {
+  const expected = expectedReleaseLabels(plan, planned);
+  for (const platform of REQUIRED_PLATFORMS) {
+    invariant(
+      published.platformCounts?.[platform] === 1,
+      code,
+      `OCI镜像${platform}必须且只能有一个应用Manifest：${planned.tag}`,
+    );
+    const observed = published.releaseLabelsByPlatform?.[platform];
+    const accepted = stableJson(observed) === stableJson(expected) || (
+      allowLegacyComponent &&
+      observed?.['dev.idp.release.component'] === null &&
+      stableJson({ ...observed, 'dev.idp.release.component': planned.component }) === stableJson(expected)
+    );
+    invariant(accepted, code, `OCI镜像${platform}发布身份与当前不可变Plan不一致：${planned.tag}`);
+  }
+  return published.releaseLabelsByPlatform;
+}
+
+function ensurePrivateDirectory(candidate, role) {
+  if (!fs.existsSync(candidate)) fs.mkdirSync(candidate, { recursive: true, mode: 0o700 });
+  const stat = assertSafeDirectory(candidate, 0o700, { role });
+  invariant((stat.mode & 0o777) === 0o700, 'IDP_RELEASE_DIRECTORY_MODE_INVALID', `${role}权限必须是0700`);
+}
+
+function persistPlan(configRoot, facts) {
+  const planDigest = sha256(stableJson(facts));
+  const directory = resolveContained(configRoot, 'releases/oci-plans', 'OCI Release Plan目录');
+  ensurePrivateDirectory(directory, 'OCI Release Plan目录');
+  const candidate = path.join(directory, `${planDigest.slice(7)}.json`);
+  if (fs.existsSync(candidate)) {
+    assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: 'OCI Release Plan' });
+    let existing;
+    try { existing = JSON.parse(fs.readFileSync(candidate, 'utf8')); }
+    catch { throw new IdpError('IDP_RELEASE_PLAN_INVALID', '已有OCI Release Plan不是有效JSON'); }
+    const { createdAt: _createdAt, digest, planDigest: existingPlanDigest, ...existingFacts } = existing;
+    invariant(existingPlanDigest === planDigest && DIGEST_PATTERN.test(digest ?? '') && digest === sha256(stableJson({ ...existingFacts, planDigest: existingPlanDigest, createdAt: existing.createdAt })) && stableJson(existingFacts) === stableJson(facts), 'IDP_RELEASE_PLAN_CONFLICT', '已有OCI Release Plan与当前事实冲突');
+    return { plan: existing, relativePath: path.relative(configRoot, candidate) };
+  }
+  const body = { ...facts, planDigest, createdAt: new Date().toISOString() };
+  const plan = { ...body, digest: sha256(stableJson(body)) };
+  createExclusiveFile(candidate, `${JSON.stringify(plan, null, 2)}\n`, 0o600);
+  return { plan, relativePath: path.relative(configRoot, candidate) };
+}
+
+function persistDeploymentPlan(configRoot, facts) {
+  const planDigest = sha256(stableJson(facts));
+  const directory = resolveContained(configRoot, 'releases/deployment-plans', 'Deployment Plan目录');
+  ensurePrivateDirectory(directory, 'Deployment Plan目录');
+  const candidate = path.join(directory, `${planDigest.slice(7)}.json`);
+  if (fs.existsSync(candidate)) {
+    assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: 'Deployment Plan' });
+    let existing;
+    try { existing = JSON.parse(fs.readFileSync(candidate, 'utf8')); }
+    catch { throw new IdpError('IDP_RELEASE_DEPLOYMENT_PLAN_INVALID', '已有Deployment Plan不是有效JSON'); }
+    const { createdAt: _createdAt, digest, planDigest: existingPlanDigest, ...existingFacts } = existing;
+    invariant(
+      existingPlanDigest === planDigest && DIGEST_PATTERN.test(digest ?? '') &&
+      digest === sha256(stableJson({ ...existingFacts, planDigest: existingPlanDigest, createdAt: existing.createdAt })) &&
+      stableJson(existingFacts) === stableJson(facts),
+      'IDP_RELEASE_DEPLOYMENT_PLAN_CONFLICT', '已有Deployment Plan与当前事实冲突',
+    );
+    return { plan: existing, relativePath: path.relative(configRoot, candidate) };
+  }
+  const body = { ...facts, planDigest, createdAt: new Date().toISOString() };
+  const plan = { ...body, digest: sha256(stableJson(body)) };
+  createExclusiveFile(candidate, `${JSON.stringify(plan, null, 2)}\n`, 0o600);
+  return { plan, relativePath: path.relative(configRoot, candidate) };
+}
+
+function artifactPath(configRoot, planDigest, component) {
+  const directory = resolveContained(configRoot, path.join('releases', 'oci-artifacts', planDigest.slice(7)), 'OCI Release Artifact目录');
+  ensurePrivateDirectory(directory, 'OCI Release Artifact目录');
+  return path.join(directory, `${component}.json`);
+}
+
+function readArtifact(candidate) {
+  if (!fs.existsSync(candidate)) return null;
+  assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: 'OCI Release Artifact' });
+  let document;
+  try { document = JSON.parse(fs.readFileSync(candidate, 'utf8')); }
+  catch { throw new IdpError('IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact不是有效JSON'); }
+  const { digest, ...body } = document ?? {};
+  invariant(DIGEST_PATTERN.test(digest ?? '') && digest === sha256(stableJson(body)), 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact摘要无效');
+  const commonKeys = ['schemaVersion', 'planDigest', 'component', 'tag', 'imageDigest', 'sourceDigest', 'platforms', 'createdAt', 'digest'];
+  if (document.schemaVersion === 1) {
+    exactKeys(document, [...commonKeys, 'buildxMetadataDigest'], 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact v1');
+    invariant(DIGEST_PATTERN.test(document.buildxMetadataDigest ?? ''), 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact v1缺少Buildx metadata摘要');
+  } else {
+    invariant(document.schemaVersion === 2, 'IDP_RELEASE_ARTIFACT_VERSION_UNSUPPORTED', '只支持OCI Release Artifact v1/v2');
+    exactKeys(document, [...commonKeys, 'evidence'], 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact v2');
+    invariant(document.evidence && typeof document.evidence === 'object' && !Array.isArray(document.evidence), 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact v2 evidence无效');
+    if (document.evidence.type === 'buildx-metadata') {
+      exactKeys(document.evidence, ['type', 'metadataImageDigest', 'labelsByPlatform'], 'IDP_RELEASE_ARTIFACT_INVALID', 'Buildx Artifact evidence');
+      invariant(DIGEST_PATTERN.test(document.evidence.metadataImageDigest ?? ''), 'IDP_RELEASE_ARTIFACT_INVALID', 'Buildx Artifact evidence摘要无效');
+    } else if (document.evidence.type === 'host-oci-layout-oras') {
+      exactKeys(document.evidence, ['type', 'layoutImageDigest', 'orasVersion', 'orasBinaryDigest', 'labelsByPlatform'], 'IDP_RELEASE_ARTIFACT_INVALID', '宿主OCI Layout Artifact evidence');
+      invariant(DIGEST_PATTERN.test(document.evidence.layoutImageDigest ?? ''), 'IDP_RELEASE_ARTIFACT_INVALID', '宿主OCI Layout evidence摘要无效');
+      invariant(/^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$/u.test(document.evidence.orasVersion ?? ''), 'IDP_RELEASE_ARTIFACT_INVALID', '宿主OCI Layout evidence ORAS版本无效');
+      invariant(DIGEST_PATTERN.test(document.evidence.orasBinaryDigest ?? ''), 'IDP_RELEASE_ARTIFACT_INVALID', '宿主OCI Layout evidence ORAS工具摘要无效');
+    } else {
+      invariant(document.evidence.type === 'registry-label-adoption', 'IDP_RELEASE_ARTIFACT_EVIDENCE_UNSUPPORTED', 'OCI Release Artifact evidence类型无效');
+      exactKeys(document.evidence, ['type', 'labelsByPlatform'], 'IDP_RELEASE_ARTIFACT_INVALID', 'Registry收养Artifact evidence');
+    }
+    exactKeys(document.evidence.labelsByPlatform, REQUIRED_PLATFORMS, 'IDP_RELEASE_ARTIFACT_INVALID', 'Artifact平台标签');
+    for (const platform of REQUIRED_PLATFORMS) {
+      exactKeys(document.evidence.labelsByPlatform[platform], RELEASE_LABEL_KEYS, 'IDP_RELEASE_ARTIFACT_INVALID', `${platform} Artifact标签`);
+      invariant(
+        RELEASE_LABEL_KEYS.every((key) => typeof document.evidence.labelsByPlatform[platform][key] === 'string'),
+        'IDP_RELEASE_ARTIFACT_INVALID', `${platform} Artifact标签值无效`,
+      );
+    }
+  }
+  invariant(DIGEST_PATTERN.test(document.planDigest ?? '') && DIGEST_PATTERN.test(document.imageDigest ?? '') && DIGEST_PATTERN.test(document.sourceDigest ?? ''), 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact事实摘要无效');
+  invariant(/^[a-z][a-z0-9-]*$/u.test(document.component ?? '') && typeof document.tag === 'string' && document.tag.length > 0, 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact组件或tag无效');
+  invariant(stableJson(document.platforms) === stableJson(REQUIRED_PLATFORMS), 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact平台集合无效');
+  invariant(typeof document.createdAt === 'string' && !Number.isNaN(Date.parse(document.createdAt)), 'IDP_RELEASE_ARTIFACT_INVALID', 'OCI Release Artifact时间无效');
+  return document;
+}
+
+function persistArtifact(candidate, body) {
+  const document = { ...body, digest: sha256(stableJson(body)) };
+  if (fs.existsSync(candidate)) {
+    const existing = readArtifact(candidate);
+    invariant(stableJson(existing) === stableJson(document), 'IDP_RELEASE_ARTIFACT_CONFLICT', '已有OCI Release Artifact与新构建结果冲突');
+    return existing;
+  }
+  createExclusiveFile(candidate, `${JSON.stringify(document, null, 2)}\n`, 0o600);
+  return document;
+}
+
+function artifactMatchesPublished(artifact, published, plan, planned, observedLabels) {
+  const commonIdentity = artifact.planDigest === plan.planDigest && artifact.component === planned.component &&
+    artifact.tag === planned.tag && artifact.imageDigest === published.digest && artifact.sourceDigest === planned.sourceDigest &&
+    stableJson(artifact.platforms) === stableJson(REQUIRED_PLATFORMS);
+  if (!commonIdentity) return false;
+  if (artifact.schemaVersion === 1) return artifact.buildxMetadataDigest === published.digest;
+  if (stableJson(artifact.evidence.labelsByPlatform) !== stableJson(observedLabels)) return false;
+  if (artifact.evidence.type === 'buildx-metadata') return artifact.evidence.metadataImageDigest === published.digest;
+  if (artifact.evidence.type === 'host-oci-layout-oras') return artifact.evidence.layoutImageDigest === published.digest;
+  return artifact.evidence.type === 'registry-label-adoption';
+}
+
+function dockerfileLogicalInstructions(dockerfile) {
+  const instructions = [];
+  let current = '';
+  for (const line of dockerfile.replaceAll('\r\n', '\n').split('\n')) {
+    const rightTrimmed = line.replace(/[ \t]+$/u, '');
+    if (!current && (!rightTrimmed.trim() || rightTrimmed.trimStart().startsWith('#'))) continue;
+    const continued = rightTrimmed.endsWith('\\');
+    const fragment = continued ? rightTrimmed.slice(0, -1) : rightTrimmed;
+    current = `${current}${current ? ' ' : ''}${fragment.trim()}`;
+    if (!continued) {
+      if (current) instructions.push(current);
+      current = '';
+    }
+  }
+  invariant(!current, 'IDP_RELEASE_SMARTGO_DOCKERFILE_INVALID', 'SmartGo Dockerfile包含未结束的续行指令');
+  return instructions;
+}
+
+export function validateSmartGoCorepackContract(dockerfile) {
+  const instructions = dockerfileLogicalInstructions(dockerfile);
+  const prepareRuns = instructions.filter((instruction) => /^RUN\s+/u.test(instruction) && /\bcorepack\s+prepare\b/u.test(instruction));
+  invariant(prepareRuns.length > 0, 'IDP_RELEASE_SMARTGO_COREPACK_REGISTRY_INVALID', 'SmartGo Dockerfile必须显式准备锁定版本的Corepack包管理器');
+  const protectedPrepare = /(?:^|[\s;&|])COREPACK_NPM_REGISTRY=http:\/\/host\.docker\.internal:4873[ \t]+corepack\s+prepare\b/gu;
+  for (const instruction of prepareRuns) {
+    const prepareCount = (instruction.match(/\bcorepack\s+prepare\b/gu) ?? []).length;
+    const protectedCount = (instruction.match(protectedPrepare) ?? []).length;
+    invariant(
+      prepareCount === protectedCount,
+      'IDP_RELEASE_SMARTGO_COREPACK_REGISTRY_INVALID',
+      'SmartGo每个corepack prepare必须在同一RUN内立即使用COREPACK_NPM_REGISTRY=http://host.docker.internal:4873',
+    );
+  }
+  invariant(
+    !/\bCOREPACK_NPM_(?:TOKEN|USERNAME|PASSWORD)\b/u.test(instructions.join('\n')),
+    'IDP_RELEASE_SMARTGO_COREPACK_CREDENTIAL_FORBIDDEN',
+    'SmartGo Corepack公共代理不得声明Token或用户凭据',
+  );
+  const integrityAssignmentDisabled = /\bCOREPACK_INTEGRITY_KEYS\s*=\s*(?:0|'0'|"0"|''|"")(?=$|[\s;&|])/u;
+  const integrityEnvDisabled = /^(?:ENV|ARG)\s+COREPACK_INTEGRITY_KEYS\s+(?:0|'0'|"0"|''|"")(?=$|\s)/u;
+  invariant(
+    !instructions.some((instruction) => integrityAssignmentDisabled.test(instruction) || integrityEnvDisabled.test(instruction)),
+    'IDP_RELEASE_SMARTGO_COREPACK_INTEGRITY_DISABLED',
+    'SmartGo Dockerfile不得关闭Corepack integrity校验',
+  );
+}
+
+export function validateSmartGoPostInstallNetworkContract(dockerfile) {
+  const instructions = dockerfileLogicalInstructions(dockerfile);
+  invariant(
+    !/\bPRISMA_(?:ENGINES_CHECKSUM_IGNORE_MISSING|ENGINES_MIRROR|QUERY_ENGINE_BINARY|QUERY_ENGINE_LIBRARY|SCHEMA_ENGINE_BINARY|FMT_BINARY)\b/u.test(instructions.join('\n')),
+    'IDP_RELEASE_SMARTGO_PRISMA_ENGINE_OVERRIDE_FORBIDDEN',
+    'SmartGo不得关闭Prisma引擎checksum或覆盖冻结引擎镜像与路径',
+  );
+  const runs = instructions.filter((instruction) => /^RUN\s+/u.test(instruction));
+  const parsed = runs.map((instruction) => Object.freeze({ instruction, ...splitRunInstruction(instruction) }));
+  const allowedDirectives = new Set([
+    '--network=none',
+    `--mount=${SMARTGO_PNPM_CACHE_MOUNT}`,
+    `--mount=${SMARTGO_NPMRC_SECRET_MOUNT}`,
+  ]);
+  invariant(parsed.every(({ directives }) => directives.every((directive) => allowedDirectives.has(directive))),
+    'IDP_RELEASE_SMARTGO_POST_INSTALL_NETWORK_ISOLATION_INVALID', 'SmartGo RUN只允许批准的network=none、pnpm cache与npmrc Secret前缀');
+
+  const installRuns = parsed.filter(({ command }) => /(?:^|[\s;&|])pnpm\s+install\b/u.test(command));
+  invariant(installRuns.length === 1 && stableJson(installRuns[0].directives) === stableJson([
+    `--mount=${SMARTGO_PNPM_CACHE_MOUNT}`,
+    `--mount=${SMARTGO_NPMRC_SECRET_MOUNT}`,
+  ]), 'IDP_RELEASE_SMARTGO_POST_INSTALL_NETWORK_ISOLATION_INVALID', 'SmartGo唯一install/closure-preflight RUN必须保留受控网络与固定cache/Secret');
+
+  const packageRuns = parsed.filter(({ command }) =>
+    /\bpnpm\s+[^;&|]*\bbuild\b/u.test(command) || /\bpackage-next-standalone\.mjs\b/u.test(command));
+  invariant(packageRuns.length === 1 && stableJson(packageRuns[0].directives) === stableJson(['--network=none']),
+    'IDP_RELEASE_SMARTGO_POST_INSTALL_NETWORK_ISOLATION_INVALID', 'SmartGo build/package RUN必须且只能使用BuildKit network=none');
+  invariant(stableJson(shellInstructionSegments(packageRuns[0].instruction)) === stableJson(SMARTGO_BUILD_PACKAGE_SEGMENTS),
+    'IDP_RELEASE_SMARTGO_BUILD_PACKAGE_COMMAND_INVALID', 'SmartGo build/package断网RUN必须按固定顺序执行Workspace Prisma generate、build与三个Next package');
+
+  const assemblyRuns = parsed.filter(({ command }) => !/(?:^|[\s;&|])pnpm\s+install\b/u.test(command) &&
+    shellInstructionSegments(`RUN ${command}`).some((segment) => /\bpnpm\s+[^;&|]*\bdeploy\b/u.test(segment)));
+  invariant(assemblyRuns.length === 1 && stableJson(assemblyRuns[0].directives) === stableJson([
+    '--network=none',
+    `--mount=${SMARTGO_PNPM_CACHE_MOUNT}`,
+  ]), 'IDP_RELEASE_SMARTGO_POST_INSTALL_NETWORK_ISOLATION_INVALID', 'SmartGo runtime assembly RUN必须按固定顺序使用network=none与唯一pnpm cache');
+
+  const networks = parsed.flatMap(({ directives }) => directives.filter((directive) => directive.startsWith('--network=')));
+  invariant(stableJson(networks) === stableJson(['--network=none', '--network=none']),
+    'IDP_RELEASE_SMARTGO_POST_INSTALL_NETWORK_ISOLATION_INVALID', 'SmartGo Dockerfile必须且只能在build/package与runtime assembly使用两个network=none');
+}
+
+function splitRunInstruction(instruction) {
+  let command = instruction.replace(/^RUN\s+/u, '').trim();
+  const mounts = [];
+  const directives = [];
+  while (command.startsWith('--')) {
+    const match = command.match(/^--([a-z][a-z0-9-]*)(?:=([^\s]+))?(?:\s+|$)/u);
+    invariant(match, 'IDP_RELEASE_SMARTGO_DOCKERFILE_INVALID', 'SmartGo Dockerfile包含无法解析的RUN前缀选项');
+    const directive = match[0].trim();
+    directives.push(directive);
+    if (match[1] === 'mount') {
+      invariant(match[2], 'IDP_RELEASE_SMARTGO_DOCKERFILE_INVALID', 'SmartGo Dockerfile包含无效RUN mount');
+      mounts.push(match[2]);
+    }
+    command = command.slice(match[0].length).trim();
+  }
+  return { command, directives, mounts };
+}
+
+function shellInstructionSegments(instruction) {
+  return splitRunInstruction(instruction).command.split(/\s+(?:&&|\|\|)\s+|(?<!\\);\s*/u)
+    .map((segment) => segment.trim()).filter(Boolean);
+}
+
+function mountOptions(mount) {
+  return new Map(mount.split(',').map((part) => {
+    const separator = part.indexOf('=');
+    return separator < 0 ? [part, 'true'] : [part.slice(0, separator), part.slice(separator + 1)];
+  }));
+}
+
+function hasSecretMount(instruction) {
+  return [...instruction.matchAll(/--mount=([^\s]+)/gu)]
+    .some((match) => mountOptions(match[1]).get('type') === 'secret');
+}
+
+function hasNpmrcSecretMount(instruction) {
+  for (const match of instruction.matchAll(/--mount=([^\s]+)/gu)) {
+    const options = mountOptions(match[1]);
+    if (options.get('type') !== 'secret') continue;
+    const target = options.get('target') ?? options.get('dst') ?? options.get('destination') ?? '';
+    if (options.get('id') === 'npmrc' || /(?:^|\/)\.?npmrc$/u.test(target)) return true;
+  }
+  return false;
+}
+
+function hasDependencyNetworkCommand(instruction) {
+  const command = splitRunInstruction(instruction).command;
+  return /(?:^|[\s;&|])(?:npm|npx|yarn|corepack|curl|wget)(?=$|[\s;&|])/u.test(command) ||
+    /(?:^|[\s;&|])pnpm\b[^;&|]*\b(?:install|fetch|view|info|add|update|up|publish|audit|outdated)\b/u.test(command) ||
+    /(?:^|[\s;&|])git\s+(?:clone|fetch|pull|ls-remote|submodule\s+update)\b/u.test(command) ||
+    /(?:^|[\s;&|])(?:apk|apt|apt-get|yum|dnf)\s+(?:add|install|update|upgrade)\b/u.test(command);
+}
+
+function dockerCopySources(instruction) {
+  const tokens = instruction.trim().split(/\s+/u);
+  invariant(tokens[0] === 'COPY', 'IDP_RELEASE_SMARTGO_RUNTIME_COPY_INVALID', 'SmartGo runtime COPY指令无法解析');
+  let index = 1;
+  while (tokens[index]?.startsWith('--')) index += 1;
+  invariant(tokens.length - index >= 2, 'IDP_RELEASE_SMARTGO_RUNTIME_COPY_INVALID', 'SmartGo runtime COPY必须包含来源与目标');
+  return tokens.slice(index, -1);
+}
+
+function readSmartGoManifest(manifestPath) {
+  let manifest;
+  try { manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')); }
+  catch { throw new IdpError('IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo Manifest不是有效JSON：${path.basename(path.dirname(manifestPath))}`); }
+  invariant(manifest && typeof manifest === 'object' && !Array.isArray(manifest) && typeof manifest.name === 'string' && manifest.name,
+    'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', 'SmartGo production Workspace Manifest必须包含有效name');
+  return manifest;
+}
+
+function deriveSmartGoProductionClosure(sourceRoot) {
+  const manifests = new Map();
+  for (const kind of ['packages', 'services']) {
+    const root = path.join(sourceRoot, kind);
+    invariant(fs.existsSync(root), 'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo缺少${kind}目录`);
+    for (const entry of fs.readdirSync(root, { withFileTypes: true }).filter((candidate) => candidate.isDirectory()).sort((left, right) => left.name.localeCompare(right.name))) {
+      const sourceDirectory = `${kind}/${entry.name}`;
+      const manifestPath = path.join(root, entry.name, 'package.json');
+      if (!fs.existsSync(manifestPath)) continue;
+      const manifest = readSmartGoManifest(manifestPath);
+      invariant(!manifests.has(manifest.name), 'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo Workspace存在重复Package名：${manifest.name}`);
+      manifests.set(manifest.name, Object.freeze({ manifest, sourceDirectory }));
+    }
+  }
+
+  const closure = new Set();
+  const pending = [...SMARTGO_RUNTIME_ROOTS];
+  while (pending.length) {
+    const name = pending.shift();
+    if (closure.has(name)) continue;
+    const entry = manifests.get(name);
+    invariant(entry, 'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo production Workspace缺少入口：${name}`);
+    closure.add(name);
+    for (const section of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+      const dependencies = entry.manifest[section] ?? {};
+      invariant(dependencies && typeof dependencies === 'object' && !Array.isArray(dependencies),
+        'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo ${name} 的 ${section}必须是对象`);
+      for (const [dependency, version] of Object.entries(dependencies)) {
+        invariant(typeof version === 'string' && version,
+          'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo ${name} 的 ${dependency}版本无效`);
+        invariant(dependency !== 'vitest' && dependency !== 'typescript' && !dependency.startsWith('@types/') &&
+          dependency !== '@aipt/testkit' && !dependency.startsWith('@bench/'),
+          'IDP_RELEASE_SMARTGO_RUNTIME_DEV_DEPENDENCY_FORBIDDEN', `SmartGo production闭包不得声明开发工具：${name} -> ${dependency}`);
+        if (!version.startsWith('workspace:')) continue;
+        invariant(manifests.has(dependency), 'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo production Workspace依赖不存在：${dependency}`);
+        pending.push(dependency);
+      }
+    }
+  }
+
+  const expectedNames = SMARTGO_RUNTIME_DEPLOYS.map(({ selector }) => selector);
+  invariant(stableJson([...closure].sort()) === stableJson([...expectedNames].sort()),
+    'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', 'SmartGo production Workspace闭包必须精确为六个Package与三个Service');
+  for (const { selector, sourceDirectory } of SMARTGO_RUNTIME_DEPLOYS) {
+    invariant(manifests.get(selector)?.sourceDirectory === sourceDirectory,
+      'IDP_RELEASE_SMARTGO_RUNTIME_CLOSURE_INVALID', `SmartGo production Workspace入口目录漂移：${selector}`);
+  }
+}
+
+function frozenArrayStringValues(source, name) {
+  const match = source.match(new RegExp(`const\\s+${name}\\s*=\\s*Object\\.freeze\\(\\[([\\s\\S]*?)\\]\\);`, 'u'));
+  invariant(match, 'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', `SmartGo sanitizer缺少冻结集合：${name}`);
+  return [...match[1].matchAll(/"(?:[^"\\]|\\.)*"/gu)].map(([value]) => JSON.parse(value));
+}
+
+export function validateSmartGoRuntimeSanitizerContract(sanitizer) {
+  const expectedEntryValues = SMARTGO_RUNTIME_DEPLOYS.flatMap(({ sourceDirectory, selector }) => [sourceDirectory, selector]);
+  invariant(stableJson(frozenArrayStringValues(sanitizer, 'runtimeEntries')) === stableJson(expectedEntryValues),
+    'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', 'SmartGo sanitizer必须验证九个production入口的精确目录与Package名');
+  invariant(stableJson(frozenArrayStringValues(sanitizer, 'expectedTypeScriptLinks')) === stableJson(SMARTGO_TYPESCRIPT_LINKS),
+    'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', 'SmartGo sanitizer的Prisma peer TypeScript symlink集合无效');
+  invariant(stableJson(frozenArrayStringValues(sanitizer, 'expectedTypeScriptShims')) === stableJson(SMARTGO_TYPESCRIPT_SHIMS),
+    'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', 'SmartGo sanitizer的TypeScript executable shim集合无效');
+
+  const requiredEvidence = [
+    'const TYPESCRIPT_VERSION = "6.0.3";',
+    'const expectedRoot = resolve(options.expectedRoot ?? "/runtime");',
+    'if (requestedRoot !== expectedRoot)',
+    'if (root !== await realpath(expectedRoot))',
+    'await assertRuntimeEntries(root);',
+    'if (!dist?.isDirectory())',
+    'if (await lstat(resolve(root, "services", service, "src")).catch(() => null))',
+    'const artifacts = await collectTypeScriptArtifacts(root, typeScriptRoot);',
+    'sameSet(artifacts.links, expectedTypeScriptLinks, "TypeScript symlink");',
+    'sameSet(artifacts.shims, expectedTypeScriptShims, "TypeScript shim");',
+    'for (const relativePath of [...artifacts.links, ...artifacts.shims]) await rm(resolve(root, relativePath));',
+    'await rm(typeScriptRoot, { recursive: true });',
+    'if (entry.isSymbolicLink() && !(await realpath(path).catch(() => null))) broken.push(relativePath);',
+    'if (forbidden.length) throw new Error(',
+    'if (broken.length) throw new Error(',
+    'await verifySanitizedClosure(root);',
+    'export async function verifyRuntimeClosure(runtimeRoot, options = {})',
+    'await verifyRuntimeClosure(root, { expectedRoot: root });',
+    'const result = await sanitizeRuntimeClosure(process.argv[2] ?? "");',
+  ];
+  invariant(requiredEvidence.every((snippet) => sanitizer.includes(snippet)),
+    'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', 'SmartGo sanitizer缺少精确根、入口、删除、断链或开发工具失败证明');
+  for (const marker of ['typescript', 'vitest', '@types', '@aipt\\/testkit', 'tsc', 'tsserver']) {
+    invariant(sanitizer.includes(marker), 'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', `SmartGo sanitizer缺少开发工具拒绝标记：${marker}`);
+  }
+  invariant((sanitizer.match(/\bawait\s+rm\(/gu) ?? []).length === 2 && !/\brm\([^\n;]*\{[^}]*force\s*:\s*true/u.test(sanitizer),
+    'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', 'SmartGo sanitizer只允许精确删除冻结link/shim与TypeScript Package');
+  invariant(!/(?:node:child_process|\bexec(?:File)?\(|\bspawn\(|\bfetch\(|https?:\/\/)/u.test(sanitizer),
+    'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', 'SmartGo sanitizer不得执行子进程或网络访问');
+}
+
+export function validateSmartGoProductionClosureContract(dockerfile, sourceRoot) {
+  deriveSmartGoProductionClosure(sourceRoot);
+  const sanitizerPath = path.join(sourceRoot, 'deploy', 'sanitize-runtime-closure.mjs');
+  invariant(fs.existsSync(sanitizerPath), 'IDP_RELEASE_SMARTGO_SANITIZER_INVALID', 'SmartGo缺少受控runtime closure sanitizer');
+  validateSmartGoRuntimeSanitizerContract(fs.readFileSync(sanitizerPath, 'utf8'));
+  const manifestPath = path.join(sourceRoot, 'packages', 'persistence', 'package.json');
+  let manifest;
+  try { manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')); }
+  catch { throw new IdpError('IDP_RELEASE_SMARTGO_PERSISTENCE_MANIFEST_INVALID', 'SmartGo Persistence Manifest不是有效JSON'); }
+  invariant(manifest && typeof manifest === 'object' && !Array.isArray(manifest), 'IDP_RELEASE_SMARTGO_PERSISTENCE_MANIFEST_INVALID', 'SmartGo Persistence Manifest必须是对象');
+  invariant(
+    manifest.dependencies?.prisma === '6.19.3' && manifest.dependencies?.tsx === '4.20.6',
+    'IDP_RELEASE_SMARTGO_PERSISTENCE_RUNTIME_DEPENDENCY_INVALID',
+    'SmartGo Persistence必须把固定版本prisma与tsx声明为生产依赖',
+  );
+  invariant(
+    manifest.devDependencies?.prisma === undefined && manifest.devDependencies?.tsx === undefined,
+    'IDP_RELEASE_SMARTGO_PERSISTENCE_RUNTIME_DEPENDENCY_INVALID',
+    'SmartGo Persistence不得把prisma或tsx保留在devDependencies',
+  );
+  for (const section of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+    const dependencies = manifest[section] ?? {};
+    invariant(dependencies && typeof dependencies === 'object' && !Array.isArray(dependencies), 'IDP_RELEASE_SMARTGO_PERSISTENCE_MANIFEST_INVALID', `SmartGo Persistence ${section}必须是对象`);
+    for (const name of Object.keys(dependencies)) {
+      invariant(
+        name !== 'vitest' && name !== 'typescript' && !name.startsWith('@types/') && name !== '@aipt/testkit' && !name.startsWith('@bench/'),
+        'IDP_RELEASE_SMARTGO_PERSISTENCE_DEV_DEPENDENCY_FORBIDDEN',
+        `SmartGo Persistence生产闭包不得声明开发工具：${name}`,
+      );
+    }
+  }
+
+  const instructions = dockerfileLogicalInstructions(dockerfile);
+  const runs = instructions.filter((instruction) => /^RUN\s+/u.test(instruction));
+  invariant(
+    !runs.some((instruction) => /(?:^|[\s;&|])pnpm\s+view\b/u.test(instruction)),
+    'IDP_RELEASE_SMARTGO_METADATA_PRIME_FORBIDDEN',
+    'SmartGo production-only runtime闭包不得保留pnpm view或metadata-prime',
+  );
+  const installIndexes = runs.map((instruction, index) => ({ index, instruction }))
+    .filter(({ instruction }) => /(?:^|[\s;&|])pnpm\s+install\b/u.test(instruction));
+  invariant(installIndexes.length === 1, 'IDP_RELEASE_SMARTGO_INSTALL_BOUNDARY_INVALID', 'SmartGo Dockerfile必须且只能有一个依赖安装RUN');
+  const { index: installIndex, instruction: installInstruction } = installIndexes[0];
+  invariant(
+    stableJson(splitRunInstruction(installInstruction).mounts) === stableJson([SMARTGO_PNPM_CACHE_MOUNT, SMARTGO_NPMRC_SECRET_MOUNT]),
+    'IDP_RELEASE_SMARTGO_INSTALL_MOUNT_INVALID',
+    'SmartGo依赖安装RUN只能挂载固定pnpm store cache与受控npmrc Secret',
+  );
+  const installSegments = shellInstructionSegments(installInstruction);
+  invariant(
+    stableJson(installSegments.slice(-SMARTGO_PERSISTENCE_PREFLIGHT_SEGMENTS.length)) === stableJson(SMARTGO_PERSISTENCE_PREFLIGHT_SEGMENTS),
+    'IDP_RELEASE_SMARTGO_CLOSURE_PREFLIGHT_INVALID',
+    'SmartGo frozen install后必须立即执行并清理唯一的Persistence production closure-preflight',
+  );
+  invariant(
+    splitRunInstruction(installInstruction).command === [...SMARTGO_INSTALL_SETUP_SEGMENTS, ...SMARTGO_PERSISTENCE_PREFLIGHT_SEGMENTS].join(' && '),
+    'IDP_RELEASE_SMARTGO_INSTALL_COMMAND_INVALID',
+    'SmartGo install Secret窗口只能执行批准的配置、frozen install、closure-preflight与同RUN清理',
+  );
+  const preflightMentions = runs.flatMap((instruction) => shellInstructionSegments(instruction))
+    .filter((segment) => segment.includes(SMARTGO_PERSISTENCE_PREFLIGHT_DIRECTORY));
+  invariant(
+    stableJson(preflightMentions) === stableJson(SMARTGO_PERSISTENCE_PREFLIGHT_SEGMENTS.filter((segment) => segment.includes(SMARTGO_PERSISTENCE_PREFLIGHT_DIRECTORY))),
+    'IDP_RELEASE_SMARTGO_CLOSURE_PREFLIGHT_INVALID',
+    'SmartGo closure-preflight临时目录只能由固定deploy与同RUN清理命令使用',
+  );
+  invariant(
+    !runs.slice(installIndex + 1).some(hasSecretMount),
+    'IDP_RELEASE_SMARTGO_POST_INSTALL_SECRET_FORBIDDEN',
+    'SmartGo依赖安装之后不得再挂载任何Secret',
+  );
+  invariant(
+    !runs.slice(installIndex + 1).some(hasDependencyNetworkCommand),
+    'IDP_RELEASE_SMARTGO_POST_INSTALL_NETWORK_FORBIDDEN',
+    'SmartGo依赖安装之后不得执行网络依赖或下载命令',
+  );
+  const runtimeStageIndex = instructions.findIndex((instruction) => /^FROM\s+\$\{NODE_IMAGE\}\s+AS\s+runtime$/u.test(instruction));
+  invariant(runtimeStageIndex >= 0, 'IDP_RELEASE_SMARTGO_RUNTIME_STAGE_MISSING', 'SmartGo Dockerfile缺少受控runtime stage');
+  const runtimeCopies = instructions.slice(runtimeStageIndex + 1).filter((instruction) => /^COPY\s+/u.test(instruction));
+  const copySources = runtimeCopies.flatMap(dockerCopySources);
+  for (const source of copySources) {
+    invariant(
+      source !== '/workspace' && !source.startsWith('/workspace/packages') &&
+        source !== '/workspace/deploy/sanitize-runtime-closure.mjs' &&
+        !/(?:^|\/)node_modules\/(?:vitest|typescript|@types|@aipt\/testkit)(?:\/|$)/u.test(source),
+      'IDP_RELEASE_SMARTGO_RUNTIME_DEV_TOOL_COPY_FORBIDDEN',
+      'SmartGo runtime不得复制Package源码根、整个Workspace、sanitizer或已知开发工具路径',
+    );
+  }
+  invariant(
+    stableJson(copySources) === stableJson(SMARTGO_RUNTIME_COPY_SOURCES),
+    'IDP_RELEASE_SMARTGO_RUNTIME_COPY_INVALID',
+    'SmartGo runtime COPY必须与批准的production deploy、standalone与最小入口文件白名单精确相等',
+  );
+}
+
+export function validateSmartGoRuntimePackagingContract(dockerfile) {
+  validateSmartGoPostInstallNetworkContract(dockerfile);
+  const instructions = dockerfileLogicalInstructions(dockerfile);
+  const runs = instructions.filter((instruction) => /^RUN\s+/u.test(instruction));
+  const runtimeRuns = runs.filter((instruction) => !/(?:^|[\s;&|])pnpm\s+install\b/u.test(instruction));
+  const deploySegments = runtimeRuns.flatMap((instruction) => shellInstructionSegments(instruction)
+    .filter((segment) => /\bpnpm\s+[^;&|]*\bdeploy\b/u.test(segment)));
+  invariant(
+    deploySegments.length > 0,
+    'IDP_RELEASE_SMARTGO_RUNTIME_DEPLOY_NOT_OFFLINE',
+    'SmartGo Dockerfile必须使用pnpm deploy生成runtime产物',
+  );
+  invariant(
+    deploySegments.every((segment) => /(?:^|\s)--offline(?=\s|$)/u.test(segment)),
+    'IDP_RELEASE_SMARTGO_RUNTIME_DEPLOY_NOT_OFFLINE',
+    'SmartGo每个runtime pnpm deploy必须显式使用--offline',
+  );
+  for (const segment of deploySegments) {
+    const tokens = segment.split(/\s+/u);
+    invariant(
+      tokens[0] === 'pnpm' && tokens[1] === '--offline' &&
+        SMARTGO_OFFLINE_DEPLOY_ROUTE_ARGS.every((expected, index) => tokens[index + 2] === expected),
+      'IDP_RELEASE_SMARTGO_RUNTIME_REGISTRY_INVALID',
+      'SmartGo每个runtime pnpm deploy必须使用固定顺序的公共与私有Registry路由',
+    );
+    const configured = tokens.filter((token) => token.startsWith('--config.'));
+    invariant(
+      stableJson(configured) === stableJson(SMARTGO_OFFLINE_DEPLOY_ROUTE_ARGS),
+      'IDP_RELEASE_SMARTGO_RUNTIME_REGISTRY_INVALID',
+      'SmartGo runtime pnpm deploy只允许三条固定Registry路由且各出现一次',
+    );
+    invariant(
+      !tokens.some((token) =>
+        /^--(?:registry|proxy|https-proxy|userconfig|_authToken|_auth|_password|username|password|token)(?:=|$)/iu.test(token) ||
+        /^(?:NPM_CONFIG_[A-Z0-9_]*|npm_config_[a-z0-9_]*|NODE_AUTH_TOKEN|NPM_TOKEN|NPM_AUTH_TOKEN)=/u.test(token)),
+      'IDP_RELEASE_SMARTGO_RUNTIME_CREDENTIAL_FORBIDDEN',
+      'SmartGo runtime pnpm deploy不得夹带Registry、Proxy或凭据覆盖',
+    );
+  }
+  const expectedDeploySegments = SMARTGO_RUNTIME_DEPLOYS.map(({ selector, target }) =>
+    `pnpm --offline ${SMARTGO_OFFLINE_DEPLOY_ROUTE_ARGS.join(' ')} --filter ${selector} --prod deploy --legacy ${target}`);
+  invariant(
+    stableJson(deploySegments) === stableJson(expectedDeploySegments),
+    'IDP_RELEASE_SMARTGO_RUNTIME_DEPLOY_SET_INVALID',
+    'SmartGo必须按固定顺序为六个Package与三个Service生成九个production-only runtime闭包',
+  );
+  const deployRuns = runtimeRuns.filter((instruction) => shellInstructionSegments(instruction)
+    .some((segment) => /\bpnpm\s+[^;&|]*\bdeploy\b/u.test(segment)));
+  invariant(deployRuns.length === 1, 'IDP_RELEASE_SMARTGO_RUNTIME_DEPLOY_RUN_INVALID', 'SmartGo runtime deploy必须位于独立的单一RUN');
+  const deployRun = splitRunInstruction(deployRuns[0]);
+  invariant(
+    stableJson(deployRun.mounts) === stableJson([SMARTGO_PNPM_CACHE_MOUNT]),
+    'IDP_RELEASE_SMARTGO_RUNTIME_DEPLOY_MOUNT_INVALID',
+    'SmartGo runtime deploy RUN只能挂载固定pnpm store cache',
+  );
+  invariant(
+    !/\bpnpm\s+[^;&|]*\bbuild\b/u.test(deployRun.command) && !/\bpackage-next-standalone\.mjs\b/u.test(deployRun.command),
+    'IDP_RELEASE_SMARTGO_RUNTIME_DEPLOY_RUN_INVALID',
+    'SmartGo build/package不得与runtime deploy混入同一RUN',
+  );
+  invariant(
+    stableJson(shellInstructionSegments(deployRuns[0])) === stableJson([...expectedDeploySegments, ...SMARTGO_RUNTIME_POST_DEPLOY_SEGMENTS]),
+    'IDP_RELEASE_SMARTGO_RUNTIME_ASSEMBLY_PROOF_INVALID',
+    'SmartGo九个runtime deploy后必须按固定顺序清理Service源码、生成runtime Prisma Client、执行sanitizer并验证Prisma、tsx与Persistence模块',
+  );
+  const allRuntimeSegments = runtimeRuns.flatMap(shellInstructionSegments);
+  for (const expected of SMARTGO_RUNTIME_POST_DEPLOY_SEGMENTS.slice(2)) {
+    invariant(allRuntimeSegments.filter((segment) => segment === expected).length === 1,
+      'IDP_RELEASE_SMARTGO_RUNTIME_ASSEMBLY_PROOF_INVALID', 'SmartGo runtime assembly证明命令必须且只能出现一次');
+  }
+  const packageBoundary = runs.findIndex((instruction) =>
+    /\bpnpm\s+[^;&|]*\bbuild\b/u.test(instruction) || /\bpackage-next-standalone\.mjs\b/u.test(instruction));
+  invariant(packageBoundary >= 0, 'IDP_RELEASE_SMARTGO_RUNTIME_PACKAGE_MISSING', 'SmartGo Dockerfile缺少可验证的build/package阶段');
+  invariant(
+    !runs.slice(packageBoundary).some(hasNpmrcSecretMount),
+    'IDP_RELEASE_SMARTGO_POST_BUILD_SECRET_FORBIDDEN',
+    'SmartGo build/package及其后续RUN不得重新挂载npmrc Secret',
+  );
+}
+
+function runPrebuild(contract, sourceRoot, runner) {
+  if (contract === 'none') return;
+  if (contract === 'smartgo-managed-v1') {
+    const dockerfile = fs.readFileSync(path.join(sourceRoot, 'Dockerfile'), 'utf8');
+    invariant(/^ARG NODE_IMAGE=/mu.test(dockerfile) && (dockerfile.match(/^FROM \$\{NODE_IMAGE\}/gmu) ?? []).length >= 2, 'IDP_RELEASE_SMARTGO_BASE_IMAGE_UNPINNED', 'SmartGo Dockerfile必须让build/runtime都通过受控NODE_IMAGE构建参数固定基础镜像');
+    validateSmartGoCorepackContract(dockerfile);
+    validateSmartGoProductionClosureContract(dockerfile, sourceRoot);
+    validateSmartGoRuntimePackagingContract(dockerfile);
+    const dockerignore = fs.readFileSync(path.join(sourceRoot, '.dockerignore'), 'utf8');
+    invariant(!/^apps\/studio-poc\s*$/mu.test(dockerignore), 'IDP_RELEASE_SMARTGO_STUDIO_EXCLUDED', 'SmartGo .dockerignore不得排除有效Studio App');
+    return;
+  }
+  invariant(contract === 'portal-backstage-v1', 'IDP_RELEASE_PREBUILD_UNKNOWN', `未知受控Prebuild合同：${contract}`);
+  for (const args of [
+    ['yarn', 'install', '--immutable'],
+    ['yarn', 'tsc'],
+    ['yarn', 'build:backend'],
+  ]) runner('corepack', args, { cwd: sourceRoot });
+}
+
+function buildMetadataFile(configRoot, component, planDigest) {
+  invariant(/^[a-z][a-z0-9-]*$/u.test(component), 'IDP_RELEASE_COMPONENT_INVALID', '构建组件名称无效');
+  const relativeDirectory = path.join('releases', 'oci-staging');
+  const directory = resolveContained(configRoot, relativeDirectory, 'Buildx metadata staging目录');
+  ensurePrivateDirectory(directory, 'Buildx metadata staging目录');
+  const relativeCandidate = path.join(
+    relativeDirectory,
+    `${planDigest.slice(7, 19)}.${component}.${process.pid}.${crypto.randomUUID()}.metadata.json`,
+  );
+  const candidate = resolveContained(configRoot, relativeCandidate, 'Buildx metadata文件');
+  invariant(path.dirname(candidate) === directory, 'IDP_RELEASE_BUILD_METADATA_PATH_INVALID', 'Buildx metadata文件必须位于安全staging目录');
+  createExclusiveFile(candidate, '', 0o600);
+  const stat = assertSafeRegularFile(candidate, 0o600, { role: 'Buildx metadata文件' });
+  invariant((stat.mode & 0o777) === 0o600, 'IDP_RELEASE_BUILD_METADATA_MODE_INVALID', 'Buildx metadata文件权限必须是0600');
+  return candidate;
+}
+
+function readBuildMetadata(candidate) {
+  let descriptor;
+  try { descriptor = fs.openSync(candidate, fs.constants.O_RDWR | fs.constants.O_NOFOLLOW); }
+  catch { throw new IdpError('IDP_RELEASE_BUILD_METADATA_UNSAFE', 'Buildx metadata文件无法以禁止链接的方式读取'); }
+  let text;
+  try {
+    let stat = fs.fstatSync(descriptor);
+    invariant(stat.isFile() && stat.nlink === 1, 'IDP_RELEASE_BUILD_METADATA_UNSAFE', 'Buildx metadata必须是无链接的普通文件');
+    if ((stat.mode & 0o777) !== 0o600) {
+      fs.fchmodSync(descriptor, 0o600);
+      stat = fs.fstatSync(descriptor);
+    }
+    invariant((stat.mode & 0o777) === 0o600, 'IDP_RELEASE_BUILD_METADATA_MODE_INVALID', 'Buildx metadata文件权限必须是0600');
+    invariant(stat.size > 0 && stat.size <= 1024 * 1024, 'IDP_RELEASE_BUILD_METADATA_INVALID', 'Buildx metadata文件大小无效');
+    text = fs.readFileSync(descriptor, 'utf8');
+  } finally { fs.closeSync(descriptor); }
+  let document;
+  try { document = JSON.parse(text); }
+  catch { throw new IdpError('IDP_RELEASE_BUILD_METADATA_INVALID', 'Buildx metadata不是有效JSON'); }
+  invariant(document && typeof document === 'object' && !Array.isArray(document), 'IDP_RELEASE_BUILD_METADATA_INVALID', 'Buildx metadata必须是对象');
+  const imageDigest = document['containerimage.digest'];
+  invariant(DIGEST_PATTERN.test(imageDigest ?? ''), 'IDP_RELEASE_BUILD_METADATA_DIGEST_INVALID', 'Buildx metadata缺少有效的containerimage.digest');
+  return { imageDigest };
+}
+
+function invalidSmartGoNpmrc(lineNumber, reason) {
+  throw new IdpError('IDP_RELEASE_BUILD_NPMRC_INVALID', `SmartGo npmrc第${lineNumber}行${reason}`);
+}
+
+function parseSmartGoRegistry(value, lineNumber) {
+  if (!/^http:\/\/(?:127\.0\.0\.1|localhost|\[::1\]):4873\/$/u.test(value)) {
+    invalidSmartGoNpmrc(lineNumber, '必须精确使用HTTP回环Registry的4873端口和根路径');
+  }
+}
+
+function transformSmartGoNpmrc(original) {
+  invariant(original.length > 0 && !original.includes('\0'), 'IDP_RELEASE_BUILD_SECRET_INVALID', 'SmartGo npmrc必须是非空文本');
+  const requiredRegistryKeys = ['registry', '@aipt:registry', '@bench:registry'];
+  const seen = new Set();
+  const transformed = original.split(/\r?\n/u).map((line, offset) => {
+    const lineNumber = offset + 1;
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';')) return line;
+    const separator = trimmed.indexOf('=');
+    if (separator <= 0) invalidSmartGoNpmrc(lineNumber, '不在允许键白名单');
+    const key = trimmed.slice(0, separator).trim();
+    const value = trimmed.slice(separator + 1).trim();
+    if (!value) invalidSmartGoNpmrc(lineNumber, '值不得为空');
+    if (requiredRegistryKeys.includes(key)) {
+      if (seen.has(key)) invalidSmartGoNpmrc(lineNumber, '不得重复声明');
+      seen.add(key);
+      parseSmartGoRegistry(value, lineNumber);
+      const alias = key === 'registry' ? SMARTGO_PUBLIC_REGISTRY_ALIAS : SMARTGO_PRIVATE_REGISTRY_ALIAS;
+      return `${key}=http://${alias}:4873/`;
+    }
+    const token = key.match(/^\/\/(?:127\.0\.0\.1|localhost|\[::1\]):4873\/:_authToken$/u);
+    if (token) {
+      if (seen.has('authority:_authToken')) invalidSmartGoNpmrc(lineNumber, '包含重复Token authority');
+      if (/\s/u.test(value)) invalidSmartGoNpmrc(lineNumber, 'Token必须是非空单行值');
+      seen.add('authority:_authToken');
+      return `//${SMARTGO_PRIVATE_REGISTRY_ALIAS}:4873/:_authToken=${value}`;
+    }
+    invalidSmartGoNpmrc(lineNumber, '不在允许键白名单');
+  });
+  for (const key of [...requiredRegistryKeys, 'authority:_authToken']) {
+    invariant(seen.has(key), 'IDP_RELEASE_BUILD_NPMRC_INVALID', `SmartGo npmrc缺少必需白名单键：${key}`);
+  }
+  return transformed.join('\n');
+}
+
+function stageSmartGoNpmrc(source, runtimeRoot) {
+  ensurePrivateDirectory(runtimeRoot, 'Runtime目录');
+  const temporaryRoot = path.join(runtimeRoot, 'tmp');
+  ensurePrivateDirectory(temporaryRoot, 'Runtime tmp目录');
+  const original = fs.readFileSync(source, 'utf8');
+  const transformed = transformSmartGoNpmrc(original);
+  const directory = path.join(temporaryRoot, `smartgo-build-secret-${process.pid}-${crypto.randomUUID()}`);
+  fs.mkdirSync(directory, { mode: 0o700 });
+  const candidate = path.join(directory, 'npmrc');
+  try { createExclusiveFile(candidate, transformed, 0o600); }
+  catch (error) {
+    try { fs.rmSync(directory, { recursive: true, force: true }); } catch {}
+    throw error;
+  }
+  return { candidate, directory };
+}
+
+function verifyOrasToolVersion(tool, runner) {
+  if (!tool) return null;
+  let result;
+  try { result = runner(tool.binary, ['version'], { capture: true }); }
+  catch (error) {
+    throw new IdpError('IDP_RELEASE_ORAS_VERSION_PROBE_FAILED', '无法验证Config Dir中ORAS工具的固定版本', { originalCode: error?.code });
+  }
+  const output = String(result?.stdout ?? '');
+  const matches = [...output.matchAll(/^Version:\s*([^\s]+)\s*$/gmu)].map((match) => match[1]);
+  invariant(matches.length === 1 && matches[0] === tool.version, 'IDP_RELEASE_ORAS_VERSION_MISMATCH', 'ORAS工具实际版本与IDP_ORAS_VERSION不一致');
+  return tool;
+}
+
+function verifyOciLayoutBuilder(name, runner) {
+  let inspected;
+  try {
+    inspected = runner('docker', ['buildx', 'inspect', name], { capture: true, maxBuffer: 4 * 1024 * 1024 });
+  } catch (error) {
+    throw new IdpError('IDP_RELEASE_OCI_BUILDER_INSPECT_FAILED', '无法验证已配置的OCI Layout Builder', { originalCode: error?.code });
+  }
+  const output = String(inspected?.stdout ?? '').replaceAll('\r\n', '\n');
+  const nodesMarker = /^Nodes:\s*$/mu.exec(output);
+  invariant(nodesMarker && typeof nodesMarker.index === 'number', 'IDP_RELEASE_OCI_BUILDER_INSPECT_INVALID', 'Buildx Builder inspect结果缺少Nodes边界');
+  const header = output.slice(0, nodesMarker.index);
+  const nodesText = output.slice(nodesMarker.index + nodesMarker[0].length);
+  const names = [...header.matchAll(/^Name:\s+(\S+)\s*$/gmu)].map((match) => match[1]);
+  const drivers = [...header.matchAll(/^Driver:\s+(\S+)\s*$/gmu)].map((match) => match[1]);
+  invariant(names.length === 1 && names[0] === name, 'IDP_RELEASE_OCI_BUILDER_INSPECT_INVALID', 'Buildx Builder inspect名称与配置不一致');
+  invariant(drivers.length === 1, 'IDP_RELEASE_OCI_BUILDER_INSPECT_INVALID', 'Buildx Builder inspect缺少唯一driver');
+  const driver = drivers[0];
+  invariant(
+    ['docker-container', 'kubernetes', 'remote'].includes(driver),
+    'IDP_RELEASE_OCI_BUILDER_DRIVER_UNSUPPORTED',
+    'OCI Layout Builder driver不在批准白名单',
+  );
+  const nodeStarts = [...nodesText.matchAll(/^Name:\s+\S+\s*$/gmu)].map((match) => match.index);
+  invariant(nodeStarts.length > 0, 'IDP_RELEASE_OCI_BUILDER_INSPECT_INVALID', 'Buildx Builder inspect没有节点');
+  const runningPlatforms = new Set();
+  let runningNodes = 0;
+  for (const [index, start] of nodeStarts.entries()) {
+    const end = nodeStarts[index + 1] ?? nodesText.length;
+    const node = nodesText.slice(start, end);
+    const statuses = [...node.matchAll(/^Status:\s+(\S+)\s*$/gmu)].map((match) => match[1]);
+    const platforms = [...node.matchAll(/^Platforms:\s+(.+)\s*$/gmu)].map((match) => match[1]);
+    invariant(statuses.length === 1, 'IDP_RELEASE_OCI_BUILDER_INSPECT_INVALID', 'Buildx Builder节点缺少唯一运行状态');
+    if (statuses[0] !== 'running') continue;
+    runningNodes += 1;
+    invariant(platforms.length === 1, 'IDP_RELEASE_OCI_BUILDER_INSPECT_INVALID', '运行中的Buildx Builder节点缺少平台集合');
+    for (const platform of platforms[0].split(',').map((value) => value.trim().replace(/\*$/u, '')).filter(Boolean)) runningPlatforms.add(platform);
+  }
+  invariant(runningNodes > 0, 'IDP_RELEASE_OCI_BUILDER_NOT_RUNNING', 'OCI Layout Builder没有运行中的节点');
+  invariant(
+    REQUIRED_PLATFORMS.every((platform) => runningPlatforms.has(platform)),
+    'IDP_RELEASE_OCI_BUILDER_PLATFORM_MISSING',
+    'OCI Layout Builder必须同时支持linux/amd64与linux/arm64',
+  );
+  return Object.freeze({ name, driver });
+}
+
+function revalidateOrasTool(configRoot, expected) {
+  let envFile;
+  let env;
+  try {
+    envFile = resolveContained(configRoot, '.env', '根配置');
+    assertSafeRegularFile(envFile, 0o600, { allowEmpty: false, role: '根.env' });
+    env = parseEnv(fs.readFileSync(envFile, 'utf8'), envFile);
+  } catch {
+    throw new IdpError('IDP_RELEASE_ORAS_CONFIG_CHANGED_DURING_BUILD', '根配置在构建期间变为不安全状态，拒绝回退推送');
+  }
+  const observed = resolveConfiguredOrasTool(configRoot, env);
+  invariant(
+    observed && stableJson(observed) === stableJson(expected),
+    'IDP_RELEASE_ORAS_TOOL_CHANGED_DURING_BUILD',
+    'ORAS工具固定事实在构建期间发生变化，拒绝回退推送',
+  );
+  return observed;
+}
+
+function createOciLayoutDirectory(runtimeRoot, component, planDigest) {
+  invariant(!/[,\r\n]/u.test(runtimeRoot), 'IDP_RELEASE_OCI_LAYOUT_PATH_INVALID', 'OCI Layout Runtime Root不得包含逗号或换行');
+  const temporaryRoot = path.join(runtimeRoot, 'tmp');
+  const prefix = path.join(temporaryRoot, `oci-layout-${planDigest.slice(7, 19)}-${component}-`);
+  let candidate;
+  let stat;
+  try {
+    ensurePrivateDirectory(runtimeRoot, 'Runtime目录');
+    ensurePrivateDirectory(temporaryRoot, 'Runtime tmp目录');
+    candidate = fs.mkdtempSync(prefix);
+    fs.chmodSync(candidate, 0o700);
+    stat = assertSafeDirectory(candidate, 0o700, { role: 'OCI Layout staging目录' });
+  } catch {
+    throw new IdpError('IDP_RELEASE_OCI_LAYOUT_STAGING_FAILED', '无法创建安全的OCI Layout staging目录');
+  }
+  invariant((stat.mode & 0o777) === 0o700, 'IDP_RELEASE_OCI_LAYOUT_MODE_INVALID', 'OCI Layout staging目录权限必须是0700');
+  return candidate;
+}
+
+function inspectOciLayout(directory, releaseTag, expectedDigest) {
+  let root;
+  try { root = assertSafeDirectory(directory, 0o700, { role: 'OCI Layout staging目录' }); }
+  catch { throw new IdpError('IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout staging目录不安全'); }
+  invariant((root.mode & 0o777) === 0o700, 'IDP_RELEASE_OCI_LAYOUT_MODE_INVALID', 'OCI Layout staging目录权限必须是0700');
+  let topLevel;
+  try { topLevel = fs.readdirSync(directory).sort(); }
+  catch { throw new IdpError('IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout顶层文件集合无法安全读取'); }
+  invariant(stableJson(topLevel) === stableJson(['blobs', 'index.json', 'oci-layout']), 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout顶层文件集合无效');
+  const layoutFile = path.join(directory, 'oci-layout');
+  const indexFile = path.join(directory, 'index.json');
+  const blobsDirectory = path.join(directory, 'blobs');
+  let indexStat;
+  try {
+    assertSafeRegularFile(layoutFile, 0o644, { allowEmpty: false, role: 'OCI Layout版本文件' });
+    indexStat = assertSafeRegularFile(indexFile, 0o644, { allowEmpty: false, role: 'OCI Layout Index' });
+    assertSafeDirectory(blobsDirectory, 0o755, { role: 'OCI Layout blobs目录' });
+    invariant(stableJson(fs.readdirSync(blobsDirectory).sort()) === stableJson(['sha256']), 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout blobs只能使用sha256目录');
+    const audit = (candidate) => {
+      for (const name of fs.readdirSync(candidate)) {
+        const child = path.join(candidate, name);
+        const stat = fs.lstatSync(child);
+        invariant(!stat.isSymbolicLink(), 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout不得包含符号链接');
+        if (stat.isDirectory()) audit(child);
+        else invariant(stat.isFile() && stat.nlink === 1, 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout只能包含单硬链接普通文件');
+      }
+    };
+    audit(blobsDirectory);
+  } catch (error) {
+    if (error instanceof IdpError && error.code === 'IDP_RELEASE_OCI_LAYOUT_INVALID') throw error;
+    throw new IdpError('IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout文件边界不安全');
+  }
+  invariant(indexStat.size <= 1024 * 1024, 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout Index不能超过1 MiB');
+  let layout;
+  let index;
+  try {
+    layout = JSON.parse(fs.readFileSync(layoutFile, 'utf8'));
+    index = JSON.parse(fs.readFileSync(indexFile, 'utf8'));
+  } catch {
+    throw new IdpError('IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout元数据不是有效JSON');
+  }
+  invariant(
+    stableJson(layout) === stableJson({ imageLayoutVersion: '1.0.0' }),
+    'IDP_RELEASE_OCI_LAYOUT_INVALID',
+    'OCI Layout版本合同无效',
+  );
+  invariant(index?.schemaVersion === 2 && Array.isArray(index.manifests), 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout Index合同无效');
+  const descriptors = index.manifests.filter((descriptor) => descriptor?.annotations?.['org.opencontainers.image.ref.name'] === releaseTag);
+  invariant(descriptors.length === 1, 'IDP_RELEASE_OCI_LAYOUT_REFERENCE_INVALID', 'OCI Layout必须且只能包含当前Release tag引用');
+  invariant(descriptors[0].digest === expectedDigest, 'IDP_RELEASE_OCI_LAYOUT_DIGEST_MISMATCH', 'OCI Layout引用摘要与Buildx metadata不一致');
+  invariant(Number.isSafeInteger(descriptors[0].size) && descriptors[0].size > 0, 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout引用大小无效');
+  const descriptorBlob = path.join(directory, 'blobs', 'sha256', descriptors[0].digest.slice(7));
+  let descriptorStat;
+  try { descriptorStat = assertSafeRegularFile(descriptorBlob, 0o644, { allowEmpty: false, role: 'OCI Layout引用Blob' }); }
+  catch { throw new IdpError('IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout引用Blob缺失或不安全'); }
+  invariant(descriptorStat.size === descriptors[0].size, 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout引用Blob大小不一致');
+  let descriptorDigest;
+  try { descriptorDigest = hashFile(descriptorBlob); }
+  catch { throw new IdpError('IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout引用Blob无法安全读取'); }
+  invariant(descriptorDigest === descriptors[0].digest, 'IDP_RELEASE_OCI_LAYOUT_INVALID', 'OCI Layout引用Blob摘要不一致');
+}
+
+function buildxArguments({ build, component, sourceRoot, tag, sourceDigest, planDigest, metadataFile, publication, builderName }) {
+  const releaseTag = tag.slice(tag.lastIndexOf(':') + 1);
+  const transport = publication.type === 'registry-push'
+    ? ['--push']
+    : ['--output', `type=oci,dest=${publication.directory},tar=false,name=${releaseTag}`];
+  const selectedBuilder = builderName ? ['--builder', builderName] : [];
+  const args = [
+    'buildx', 'build', ...selectedBuilder, '--platform', REQUIRED_PLATFORMS.join(','), '--pull', ...transport,
+    '--provenance=mode=max', `--attest=type=sbom,generator=${SBOM_GENERATOR}`, '--file', path.resolve(sourceRoot, build.dockerfile), '--tag', tag,
+    '--metadata-file', metadataFile,
+    '--label', `org.opencontainers.image.version=${releaseTag}`,
+    '--label', `org.opencontainers.image.revision=${sourceDigest}`,
+    '--label', `dev.idp.release.plan=${planDigest}`,
+    '--label', `dev.idp.release.component=${component}`,
+  ];
+  for (const [key, value] of Object.entries(build.buildArgs).sort(([left], [right]) => left.localeCompare(right))) args.push('--build-arg', `${key}=${value}`);
+  if (component === 'smartgo') {
+    args.push('--add-host', `${SMARTGO_PUBLIC_REGISTRY_ALIAS}=host-gateway`);
+    args.push('--add-host', `${SMARTGO_PRIVATE_REGISTRY_ALIAS}=host-gateway`);
+  }
+  return args;
+}
+
+function runBuildx({ build, component, sourceRoot, tag, sourceDigest, planDigest, configRoot, publication, builderName, secretArguments, runner }) {
+  const metadataFile = buildMetadataFile(configRoot, component, planDigest);
+  try {
+    const args = buildxArguments({ build, component, sourceRoot, tag, sourceDigest, planDigest, metadataFile, publication, builderName });
+    args.push(...secretArguments, path.resolve(sourceRoot, build.context));
+    runner('docker', args);
+    return readBuildMetadata(metadataFile);
+  } finally {
+    try { fs.unlinkSync(metadataFile); }
+    catch (error) {
+      if (fs.existsSync(metadataFile)) throw new IdpError('IDP_RELEASE_BUILD_METADATA_CLEANUP_FAILED', '无法清理Buildx metadata staging', { causeCode: error?.code });
+    }
+  }
+}
+
+function publishWithHostOciLayout({ build, component, sourceRoot, tag, sourceDigest, planDigest, configRoot, runtimeRoot, builderName, secretArguments, orasTool, runner }) {
+  const directory = createOciLayoutDirectory(runtimeRoot, component, planDigest);
+  let primaryError;
+  try {
+    let metadata;
+    try {
+      metadata = runBuildx({
+        build, component, sourceRoot, tag, sourceDigest, planDigest, configRoot,
+        publication: { type: 'oci-layout', directory }, builderName, secretArguments, runner,
+      });
+    } catch (error) {
+      if (error?.code !== 'IDP_PROCESS_FAILED') throw error;
+      throw new IdpError('IDP_RELEASE_OCI_LAYOUT_BUILD_FAILED', 'Buildx导出OCI Layout失败', { originalCode: error.code });
+    }
+    const releaseTag = tag.slice(tag.lastIndexOf(':') + 1);
+    inspectOciLayout(directory, releaseTag, metadata.imageDigest);
+    const verifiedTool = revalidateOrasTool(configRoot, orasTool);
+    try {
+      runner(verifiedTool.binary, ['cp', '--from-oci-layout', `${directory}:${releaseTag}`, tag, '--concurrency', '1'], { capture: true, maxBuffer: 16 * 1024 * 1024 });
+    } catch (error) {
+      throw new IdpError('IDP_RELEASE_ORAS_COPY_FAILED', 'ORAS单并发复制OCI Layout失败', { originalCode: error?.code });
+    }
+    return {
+      imageDigest: metadata.imageDigest,
+      evidence: {
+        type: 'host-oci-layout-oras',
+        layoutImageDigest: metadata.imageDigest,
+        orasVersion: verifiedTool.version,
+        orasBinaryDigest: verifiedTool.digest,
+      },
+    };
+  } catch (error) {
+    primaryError = error;
+    throw error;
+  } finally {
+    try { fs.rmSync(directory, { recursive: true, force: false }); }
+    catch (error) {
+      throw new IdpError('IDP_RELEASE_OCI_LAYOUT_CLEANUP_FAILED', '无法清理OCI Layout staging，拒绝继续发布', { originalCode: primaryError?.code, causeCode: error?.code });
+    }
+  }
+}
+
+function buildAndPublish({ build, component, sourceRoot, tag, sourceDigest, planDigest, configRoot, runtimeRoot, builderName, orasTool, runner }) {
+  if (orasTool) invariant(!/[,\r\n]/u.test(runtimeRoot), 'IDP_RELEASE_OCI_LAYOUT_PATH_INVALID', 'OCI Layout Runtime Root不得包含逗号或换行');
+  runPrebuild(build.prebuildContract, sourceRoot, runner);
+  const dockerfile = path.resolve(sourceRoot, build.dockerfile);
+  const context = path.resolve(sourceRoot, build.context);
+  invariant(fs.existsSync(dockerfile) && fs.lstatSync(dockerfile).isFile() && !fs.lstatSync(dockerfile).isSymbolicLink(), 'IDP_RELEASE_DOCKERFILE_MISSING', `${component} Dockerfile不存在或不安全`);
+  invariant(fs.existsSync(context) && fs.lstatSync(context).isDirectory() && !fs.lstatSync(context).isSymbolicLink(), 'IDP_RELEASE_BUILD_CONTEXT_MISSING', `${component}构建Context不存在或不安全`);
+  const stagedSecrets = [];
+  const secretArguments = [];
+  try {
+    if (Object.keys(build.buildSecretFiles).length > 0) {
+      const componentRoot = resolveContained(configRoot, `components/${component}`, `${component}构建配置目录`);
+      const envFile = resolveContained(componentRoot, '.env', `${component}构建配置`);
+      assertSafeRegularFile(envFile, 0o600, { allowEmpty: false, role: `${component}构建配置` });
+      const values = parseEnv(fs.readFileSync(envFile, 'utf8'), envFile);
+      for (const [id, key] of Object.entries(build.buildSecretFiles).sort(([left], [right]) => left.localeCompare(right))) {
+        const reference = values[key];
+        invariant(typeof reference === 'string' && reference.length > 0, 'IDP_RELEASE_BUILD_SECRET_REFERENCE_MISSING', `${component}.${key}必须声明Config Dir相对路径`);
+        const configured = resolveContained(componentRoot, reference, `${component}.${key}`);
+        assertSafeRegularFile(configured, 0o600, { allowEmpty: false, role: `${component}.${key}` });
+        const staged = component === 'smartgo' && id === 'npmrc' ? stageSmartGoNpmrc(configured, runtimeRoot) : null;
+        if (staged) stagedSecrets.push(staged);
+        secretArguments.push('--secret', `id=${id},src=${staged?.candidate ?? configured}`);
+      }
+    }
+    try {
+      const metadata = runBuildx({
+        build, component, sourceRoot, tag, sourceDigest, planDigest, configRoot,
+        publication: { type: 'registry-push' }, builderName, secretArguments, runner,
+      });
+      return {
+        imageDigest: metadata.imageDigest,
+        evidence: { type: 'buildx-metadata', metadataImageDigest: metadata.imageDigest },
+      };
+    } catch (error) {
+      if (!orasTool || error?.code !== 'IDP_PROCESS_FAILED') throw error;
+      return publishWithHostOciLayout({
+        build, component, sourceRoot, tag, sourceDigest, planDigest, configRoot, runtimeRoot,
+        builderName, secretArguments, orasTool, runner,
+      });
+    }
+  } finally {
+    for (const staged of stagedSecrets) {
+      try { fs.rmSync(staged.directory, { recursive: true, force: false }); }
+      catch (error) { throw new IdpError('IDP_RELEASE_BUILD_SECRET_CLEANUP_FAILED', '无法清理临时BuildKit Secret staging，拒绝继续发布', { causeCode: error?.code }); }
+    }
+  }
+}
+
+function snapshotConfig(configRoot) {
+  const envPath = path.join(configRoot, '.env');
+  const lockPath = path.join(configRoot, 'images.lock.json');
+  return {
+    envPath, lockPath,
+    envText: fs.readFileSync(envPath, 'utf8'),
+    lockText: fs.existsSync(lockPath) ? fs.readFileSync(lockPath, 'utf8') : null,
+  };
+}
+
+function currentText(candidate) {
+  return fs.existsSync(candidate) ? fs.readFileSync(candidate, 'utf8') : null;
+}
+
+export function restoreConfigCas(before, after) {
+  invariant(currentText(after.envPath) === after.envText && currentText(after.lockPath) === after.lockText, 'IDP_RELEASE_CONFIG_CAS_CONFLICT', '发布失败后检测到用户或其他进程修改了.env/images.lock.json，拒绝覆盖');
+  try {
+    atomicWrite(before.envPath, before.envText, 0o600);
+    if (before.lockText === null) {
+      if (fs.existsSync(before.lockPath)) fs.unlinkSync(before.lockPath);
+    }
+    else atomicWrite(before.lockPath, before.lockText, 0o600);
+  } catch (error) {
+    try {
+      atomicWrite(after.envPath, after.envText, 0o600);
+      if (after.lockText === null) {
+        if (fs.existsSync(after.lockPath)) fs.unlinkSync(after.lockPath);
+      } else atomicWrite(after.lockPath, after.lockText, 0o600);
+    } catch (recoveryError) {
+      throw new IdpError('IDP_RELEASE_CONFIG_RECOVERY_REQUIRED', `发布配置回滚失败且无法恢复CAS后状态：${recoveryError.message}`, { originalError: error.message });
+    }
+    throw new IdpError('IDP_RELEASE_CONFIG_ROLLBACK_FAILED', `发布配置回滚失败：${error.message}`);
+  }
+}
+
+function selectedBuilds(defaults, active) {
+  return ['tech', 'flow', 'portal', 'smartgo'].filter((component) => active.has(component)).map((component) => [component, defaults.buildImages[component]]);
+}
+
+function selectedThirdParty(defaults, active, env) {
+  const result = {};
+  for (const [service, key] of Object.entries(THIRD_PARTY_BY_SERVICE)) {
+    const selected = ['smartgoObjectStore', 'smartgoObjectStoreClient'].includes(service)
+      ? active.has('smartgo')
+      : active.has(service);
+    if (!selected) continue;
+    const configured = env[key];
+    result[key] = configured && configured !== 'UNCONFIGURED' ? configured : defaults.thirdPartyImages[key];
+  }
+  return result;
+}
+
+function backupProfilesForActive(profile) {
+  if (profile === 'flow') return [];
+  if (profile === 'foundation') return ['tech-only', 'registry'];
+  return [profile];
+}
+
+function createVerifiedBackups({
+  repositoryRoot, configRoot, activeProfile, instanceLease,
+  backupCreator, backupVerifier, restoreTester,
+}) {
+  const results = [];
+  for (const backupProfile of backupProfilesForActive(activeProfile)) {
+    const created = backupCreator({ repositoryRoot, configRoot, profile: backupProfile, instanceLease, allowLegacyImageLock: true });
+    const generationId = created?.receipt?.generationId;
+    invariant(typeof generationId === 'string' && generationId.length > 0, 'IDP_RELEASE_BACKUP_EVIDENCE_INVALID', `${backupProfile}备份未返回Generation ID`);
+    const verified = backupVerifier({ configRoot, generationId, instanceLease });
+    const restored = restoreTester({ repositoryRoot, configRoot, generationId, instanceLease, allowLegacyImageLock: true });
+    results.push({
+      profile: backupProfile,
+      generationId,
+      manifestDigest: created.receipt.manifestDigest,
+      createReceiptDigest: created.receipt.digest,
+      verifyReceiptDigest: verified.receipt.digest,
+      restoreTestReceiptDigest: restored.receipt.digest,
+    });
+  }
+  return results;
+}
+
+function configSnapshotDigest(snapshot) {
+  return sha256(stableJson({
+    envDigest: sha256(snapshot.envText),
+    imageLockDigest: snapshot.lockText === null ? null : sha256(snapshot.lockText),
+  }));
+}
+
+function snapshotUsesLegacyImageLock(snapshot) {
+  if (snapshot.lockText === null) return false;
+  try { return JSON.parse(snapshot.lockText).schemaVersion === 1; }
+  catch { return false; }
+}
+
+export function releaseDeploy({
+  repositoryRoot,
+  configRoot,
+  profile = 'foundation',
+  version,
+  ociRepositoryRoot: suppliedOciRepositoryRoot,
+  runner = run,
+  probeRunner = defaultProbe,
+  locker = lockImages,
+  compose = composeOperation,
+  verifier = verifyDeployment,
+  bindingSync = syncManagedBindings,
+  bindingRollbacker = rollbackManagedBindingsCas,
+  backupCreator = createBackup,
+  backupVerifier = verifyBackup,
+  restoreTester = testRestore,
+  receiptWriter = writeReceipt,
+  activeStateReader = readActiveProfileState,
+  runtimeRenderer = renderRuntimeBundles,
+  runtimeManifestReader = readRuntimeGenerationManifest,
+  instanceLocker = withInstanceLock,
+  defaults: suppliedDefaults,
+  sourceInspector = inspectSource,
+} = {}) {
+  invariant(path.isAbsolute(repositoryRoot ?? ''), 'IDP_RELEASE_REPOSITORY_ROOT_INVALID', 'repositoryRoot必须是绝对路径');
+  const active = new Set(resolveProfile(profile));
+  const defaults = validateReleaseDefaults(suppliedDefaults ?? readReleaseDefaults(repositoryRoot));
+  const selectedVersion = version ?? defaults.releaseVersion;
+  invariant(VERSION_PATTERN.test(selectedVersion), 'IDP_RELEASE_VERSION_INVALID', '--version必须是安全的SemVer版本号');
+  initializeConfig(configRoot);
+  const preliminary = doctorConfig(configRoot, { requireConfigured: false, profile });
+  return instanceLocker(preliminary.root, preliminary.env, `release:deploy:${profile}`, (instanceLease) => {
+  generateSecrets(configRoot);
+  const transactionStart = doctorConfig(configRoot, { requireConfigured: false, profile });
+  invariant(
+    transactionStart.report.digest === preliminary.report.digest && transactionStart.env.IDP_RUNTIME_DIR === preliminary.env.IDP_RUNTIME_DIR,
+    'IDP_RELEASE_CONFIG_CHANGED_BEFORE_TRANSACTION',
+    'Config Dir在发布总锁建立前发生变化，请重新执行发布',
+  );
+  invariant(
+    transactionStart.report.unconfigured.length === 0,
+    'IDP_RELEASE_INPUTS_UNCONFIGURED',
+    `构建前置配置尚未完成：${transactionStart.report.unconfigured.map(({ key, reason }) => `${key}(${reason})`).join('、')}`,
+  );
+  const previousActiveProfile = activeStateReader(transactionStart.env);
+  const previousActiveDigest = previousActiveProfile?.digest ?? null;
+  if (previousActiveProfile?.status === 'active') {
+    const renderedPrevious = runtimeRenderer(configRoot, previousActiveProfile.profile);
+    const sameProjection = renderedPrevious.manifest.digest === previousActiveProfile.renderDigest ||
+      stableJson(runtimeManifestReader(
+        transactionStart.env.IDP_RUNTIME_DIR,
+        previousActiveProfile.profile,
+        previousActiveProfile.renderDigest,
+      ).files) === stableJson(renderedPrevious.manifest.files);
+    invariant(
+      sameProjection,
+      'IDP_RELEASE_ACTIVE_RUNTIME_CONFIG_DRIFT',
+      '当前配置无法重现活动Profile的运行时投影；请先处理配置漂移，再执行一键更新',
+    );
+  }
+  const ociRepositoryRoot = resolveOciRepositoryRoot(transactionStart.env, suppliedOciRepositoryRoot, defaults.ociRepositoryRoot);
+  const workspaceRoot = path.dirname(repositoryRoot);
+  const builds = selectedBuilds(defaults, active);
+  const sourceFacts = builds.map(([component, build]) => {
+    const sourceRoot = path.join(workspaceRoot, build.sourceDirectory);
+    const allowNonGit = component === 'smartgo' && transactionStart.env.IDP_ALLOW_NON_GIT_SMARTGO_SOURCE === 'true' && transactionStart.env.IDP_ENVIRONMENT !== 'production';
+    const source = sourceInspector(sourceRoot, { sourceRunner: runner, allowNonGit });
+    return { component, sourceDigest: source.digest, fileCount: source.fileCount, sourceMode: source.sourceMode ?? 'git-worktree', buildContractDigest: sha256(stableJson(build)) };
+  });
+  const defaultsDigest = sha256(stableJson(defaults));
+  const sourceDigest = sha256(stableJson({ defaultsDigest, sources: sourceFacts }));
+  const releaseTag = `${selectedVersion}-r${sourceDigest.slice(7, 19)}`;
+  const plannedBuilds = builds.map(([component, build]) => ({
+    component,
+    environmentKey: build.environmentKey,
+    tag: `${ociRepositoryRoot}${build.repositorySuffix}:${releaseTag}`,
+    sourceDigest: sourceFacts.find((entry) => entry.component === component).sourceDigest,
+    buildContractDigest: sourceFacts.find((entry) => entry.component === component).buildContractDigest,
+  }));
+  const planFacts = {
+    schemaVersion: 1, profile, version: selectedVersion, releaseTag,
+    platforms: REQUIRED_PLATFORMS, defaultsDigest, sourceDigest,
+    ociRepositoryRoot, builds: plannedBuilds,
+  };
+  const { plan, relativePath: planPath } = persistPlan(configRoot, planFacts);
+  const artifacts = [];
+  let orasTool;
+  let ociLayoutBuilder;
+  let orasToolPrepared = false;
+  for (const planned of plannedBuilds) {
+    const build = defaults.buildImages[planned.component];
+    const candidate = artifactPath(configRoot, plan.planDigest, planned.component);
+    const localArtifact = readArtifact(candidate);
+    const published = inspectPublishedImage(planned.tag, { probeRunner, allowMissing: true });
+    if (published) {
+      const observedLabels = verifyPublishedReleaseIdentity(
+        published,
+        plan,
+        planned,
+        localArtifact ? 'IDP_RELEASE_TAG_CONFLICT' : 'IDP_RELEASE_TAG_UNOWNED',
+        { allowLegacyComponent: localArtifact?.schemaVersion === 1 },
+      );
+      if (!localArtifact) {
+        artifacts.push(persistArtifact(candidate, {
+          schemaVersion: 2,
+          planDigest: plan.planDigest,
+          component: planned.component,
+          tag: planned.tag,
+          imageDigest: published.digest,
+          sourceDigest: planned.sourceDigest,
+          platforms: REQUIRED_PLATFORMS,
+          evidence: {
+            type: 'registry-label-adoption',
+            labelsByPlatform: observedLabels,
+          },
+          createdAt: new Date().toISOString(),
+        }));
+        continue;
+      }
+      invariant(
+        artifactMatchesPublished(localArtifact, published, plan, planned, observedLabels),
+        'IDP_RELEASE_TAG_CONFLICT', `tag与本地Plan Artifact不一致，请提升版本：${planned.tag}`,
+      );
+      artifacts.push(localArtifact);
+      continue;
+    }
+    invariant(!localArtifact, 'IDP_RELEASE_ARTIFACT_REMOTE_MISSING', `本地Artifact已存在但远程tag缺失，拒绝使用同版本重建：${planned.tag}`);
+    if (!orasToolPrepared) {
+      orasTool = verifyOrasToolVersion(resolveConfiguredOrasTool(configRoot, transactionStart.env), runner);
+      if (orasTool) invariant(!/[,\r\n]/u.test(transactionStart.env.IDP_RUNTIME_DIR), 'IDP_RELEASE_OCI_LAYOUT_PATH_INVALID', 'OCI Layout Runtime Root不得包含逗号或换行');
+      ociLayoutBuilder = orasTool ? verifyOciLayoutBuilder(orasTool.builder, runner) : null;
+      orasToolPrepared = true;
+    }
+    const sourceRoot = path.join(workspaceRoot, build.sourceDirectory);
+    const buildResult = buildAndPublish({
+      build, component: planned.component, sourceRoot, tag: planned.tag,
+      sourceDigest: planned.sourceDigest, planDigest: plan.planDigest, configRoot,
+      runtimeRoot: transactionStart.env.IDP_RUNTIME_DIR, builderName: ociLayoutBuilder?.name, orasTool, runner,
+    });
+    const inspected = inspectPublishedImage(planned.tag, { probeRunner, allowMissing: false });
+    invariant(
+      buildResult.imageDigest === inspected.digest,
+      'IDP_RELEASE_BUILD_DIGEST_MISMATCH',
+      `Buildx metadata与推送后的OCI Index digest不一致，拒绝锁定tag：${planned.tag}`,
+    );
+    const observedLabels = verifyPublishedReleaseIdentity(
+      inspected, plan, planned, 'IDP_RELEASE_BUILD_IDENTITY_MISMATCH',
+    );
+    const artifactBody = {
+      schemaVersion: 2, planDigest: plan.planDigest, component: planned.component,
+      tag: planned.tag, imageDigest: inspected.digest,
+      sourceDigest: planned.sourceDigest,
+      platforms: REQUIRED_PLATFORMS,
+      evidence: {
+        ...buildResult.evidence,
+        labelsByPlatform: observedLabels,
+      },
+      createdAt: new Date().toISOString(),
+    };
+    artifacts.push(persistArtifact(candidate, artifactBody));
+  }
+
+  for (const fact of sourceFacts) {
+    const build = defaults.buildImages[fact.component];
+    const allowNonGit = fact.component === 'smartgo' && transactionStart.env.IDP_ALLOW_NON_GIT_SMARTGO_SOURCE === 'true' && transactionStart.env.IDP_ENVIRONMENT !== 'production';
+    const observed = sourceInspector(path.join(workspaceRoot, build.sourceDirectory), { sourceRunner: runner, allowNonGit });
+    invariant(
+      observed.digest === fact.sourceDigest && observed.fileCount === fact.fileCount && (observed.sourceMode ?? 'git-worktree') === fact.sourceMode,
+      'IDP_RELEASE_SOURCE_CHANGED_DURING_BUILD',
+      `${fact.component}源码在构建期间发生变化，拒绝Apply镜像配置`,
+    );
+  }
+  const transactionReady = doctorConfig(configRoot, { requireConfigured: false, profile });
+  invariant(
+    transactionReady.report.digest === transactionStart.report.digest,
+    'IDP_RELEASE_CONFIG_CHANGED_DURING_BUILD',
+    'Config Dir在镜像构建期间发生变化，拒绝Apply',
+  );
+  const observedActive = activeStateReader(transactionReady.env);
+  invariant(
+    (observedActive?.digest ?? null) === previousActiveDigest,
+    'IDP_RELEASE_ACTIVE_PROFILE_CHANGED_DURING_BUILD',
+    '活动Profile在镜像构建期间发生变化，拒绝Apply',
+  );
+  const overrides = selectedThirdParty(defaults, active, transactionReady.env);
+  for (const planned of plannedBuilds) {
+    const artifact = artifacts.find((entry) => entry.component === planned.component);
+    invariant(artifact && DIGEST_PATTERN.test(artifact.imageDigest ?? ''), 'IDP_RELEASE_ARTIFACT_INVALID', `${planned.component}缺少可信镜像摘要`);
+    overrides[planned.environmentKey] = `${planned.tag}@${artifact.imageDigest}`;
+  }
+  for (const key of Object.values(THIRD_PARTY_BY_SERVICE)) {
+    if (overrides[key]) inspectPublishedImage(overrides[key], { probeRunner, allowMissing: false });
+  }
+  const backups = previousActiveProfile?.status === 'active'
+    ? createVerifiedBackups({
+      repositoryRoot, configRoot, activeProfile: previousActiveProfile.profile, instanceLease,
+      backupCreator, backupVerifier, restoreTester,
+    })
+    : [];
+  const before = snapshotConfig(configRoot);
+  const { plan: deploymentPlan, relativePath: deploymentPlanPath } = persistDeploymentPlan(configRoot, {
+    schemaVersion: 1,
+    ociPlanDigest: plan.planDigest,
+    targetProfile: profile,
+    previousActiveProfileDigest: previousActiveDigest,
+    configPreimageDigest: configSnapshotDigest(before),
+    images: Object.entries(overrides).sort(([left], [right]) => left.localeCompare(right)).map(([key, ref]) => ({ key, ref })),
+    backups,
+  });
+  let after;
+  let imageLock;
+  let runtimeAttempted = false;
+  let bindingRollback = null;
+  try {
+    imageLock = locker(configRoot, { profile, overrides, requireProfileImages: true, instanceLease });
+    after = snapshotConfig(configRoot);
+    // 远端 Index 与平台身份已在 Apply 前逐项验证。这里仍拉取本机缺失内容，
+    // 但不对已按 digest 存在的官方基础镜像重复访问 Docker Hub，避免限流
+    // 在备份和恢复演练之后制造与镜像事实无关的事务失败。
+    const pull = compose({ repositoryRoot, configRoot, profile, command: ['pull', '--policy', 'missing'], requireConfigured: true, instanceLease });
+    runtimeAttempted = true;
+    const switched = compose({ repositoryRoot, configRoot, profile, command: ['up', '-d', '--wait'], requireConfigured: true, allowProfileSwitch: true, instanceLease });
+    const verified = verifier({ repositoryRoot, configRoot, profile, instanceLease });
+    const bindings = active.has('tech') || active.has('registry') ? bindingSync({ configRoot, profile, instanceLease }) : null;
+    bindingRollback = bindings?.rollback ?? null;
+    invariant(
+      currentText(after.envPath) === after.envText && currentText(after.lockPath) === after.lockText,
+      'IDP_RELEASE_CONFIG_CHANGED_AFTER_APPLY',
+      '发布Apply后检测到.env或images.lock.json并发变化，拒绝写入成功回执',
+    );
+    const refreshed = doctorConfig(configRoot, { requireConfigured: true, profile });
+    const releaseReceipt = receiptWriter(refreshed.env, 'release-deploy', {
+      profile, version: selectedVersion, releaseTag, planDigest: plan.planDigest,
+      deploymentPlanDigest: deploymentPlan.planDigest,
+      imageLockDigest: imageLock.lockDigest,
+      images: artifacts.map(({ component, tag, imageDigest }) => ({ component, tag, imageDigest })),
+      backups,
+      pullReceiptDigest: pull.receipt.digest, switchReceiptDigest: switched.receipt.digest,
+      verifyReceiptDigest: verified.receipt.digest, bindingPlanDigest: bindings?.planDigest ?? null,
+    }).receipt;
+    return {
+      schemaVersion: 1, status: 'deployed', profile, version: selectedVersion, releaseTag,
+      planDigest: plan.planDigest, planPath,
+      deploymentPlanDigest: deploymentPlan.planDigest, deploymentPlanPath,
+      imageLockDigest: imageLock.lockDigest, backups,
+      images: artifacts.map(({ component, tag, imageDigest, platforms }) => ({ component, tag, imageDigest, platforms })),
+      verifyReceiptDigest: verified.receipt.digest, bindingPlanDigest: bindings?.planDigest ?? null,
+      receiptDigest: releaseReceipt.digest,
+    };
+  } catch (error) {
+    if (!after) throw error;
+    let bindingRecoveryError;
+    if (bindingRollback) {
+      try { bindingRollbacker({ configRoot, rollback: bindingRollback, instanceLease }); }
+      catch (rollbackError) { bindingRecoveryError = rollbackError; }
+    }
+    try { restoreConfigCas(before, after); }
+    catch (configRollbackError) {
+      throw new IdpError(
+        'IDP_RELEASE_RECOVERY_REQUIRED',
+        `发布失败且配置无法安全回滚：${configRollbackError.message}`,
+        { originalError: error.message, bindingRecoveryError: bindingRecoveryError?.message, backupGenerationIds: backups.map(({ generationId }) => generationId) },
+      );
+    }
+    let runtimeRecoveryError;
+    if (previousActiveProfile?.status === 'active') {
+      const allowLegacyImageLock = snapshotUsesLegacyImageLock(before);
+      try {
+        compose({
+          repositoryRoot, configRoot, profile: previousActiveProfile.profile,
+          command: ['up', '-d', '--wait'], requireConfigured: true, allowProfileSwitch: true, allowLegacyImageLock, instanceLease,
+        });
+        verifier({ repositoryRoot, configRoot, profile: previousActiveProfile.profile, allowLegacyImageLock, instanceLease });
+      } catch (rollbackError) { runtimeRecoveryError = rollbackError; }
+    } else if (runtimeAttempted) {
+      try {
+        compose({
+          repositoryRoot, configRoot, profile,
+          command: ['down'], requireConfigured: false, allowProfileSwitch: false, instanceLease,
+        });
+        const restored = doctorConfig(configRoot, { requireConfigured: false, profile });
+        const stopped = activeStateReader(restored.env);
+        invariant(stopped?.status === 'stopped' && stopped.profile === profile, 'IDP_RELEASE_RUNTIME_CLEANUP_UNPROVEN', '首次部署失败后的容器停止状态无法证明');
+      } catch (cleanupError) { runtimeRecoveryError = cleanupError; }
+    }
+    if (bindingRecoveryError || runtimeRecoveryError) {
+      const reasons = [
+        bindingRecoveryError ? `Binding恢复失败：${bindingRecoveryError.message}` : null,
+        runtimeRecoveryError ? `运行态恢复失败：${runtimeRecoveryError.message}` : null,
+      ].filter(Boolean).join('；');
+      throw new IdpError(
+        'IDP_RELEASE_RECOVERY_REQUIRED',
+        `发布配置已恢复，但仍需人工恢复：${reasons}`,
+        { originalError: error.message, backupGenerationIds: backups.map(({ generationId }) => generationId) },
+      );
+    }
+    throw new IdpError(
+      'IDP_RELEASE_DEPLOY_FAILED_ROLLED_BACK',
+      `发布失败，配置、运行态与受管Binding已恢复：${error.message}`,
+      { originalCode: error.code, backupGenerationIds: backups.map(({ generationId }) => generationId) },
+    );
+  }
+  });
+}