@codyswann/lisa 4.71.2 → 4.71.4

package/all/copy-overwrite/scripts/lib/github-attestation-provider.mjs

@@ -163,6 +163,28 @@ export function verifyHistoricalProvider(
   return providerOrigin(policy, descriptor, true, execute);
 }
 
+/** Cancellation authenticates an old origin against a separately observed current main. */
+export function verifyStaleOriginProvider(
+  policy,
+  descriptor,
+  currentParent,
+  execute = boundedSpawnSync
+) {
+  requireProof(
+    typeof currentParent === "string" &&
+      /^[a-f0-9]{40}$/.test(currentParent) &&
+      currentParent !== descriptor.parent,
+    "cancellation requires a distinct current parent"
+  );
+  const read = endpoint =>
+    ghJson(policy, [API, HOST_FLAG, PUBLIC_HOST, endpoint], execute);
+  repositoryState(read, policy, currentParent);
+  return {
+    run: runState(read, policy, descriptor, true),
+    claim: claimState(read, policy, descriptor),
+  };
+}
+
 /** Fresh permission checks its own invocation and the exact observed destination. */
 export function verifyRecoveryProvider(
   policy,

package/all/copy-overwrite/scripts/lib/npm-update-allocate.mjs

@@ -8,6 +8,8 @@ import { locateCheckpoint } from "./npm-update-recovery.mjs";
 import { runProcess } from "./npm-update-process.mjs";
 import { sha256 } from "./github-attestation-verifier.mjs";
 import { registryVersion } from "./npm-update-npm.mjs";
+import { discoverSupersession } from "./npm-update-supersession.mjs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
 import {
   buildDraft,
   qualityGates,
@@ -72,7 +74,7 @@ export async function filingEvidence(api, proposal, config, cwd) {
 }
 
 /** Same selected versions are discovered before deriving a new parent-bound key. */
-export async function discoverPrior(api, proposal) {
+export async function discoverPrior(api, proposal, context) {
   const query = `repo:${proposal.repository} "${proposal.selectionKey}" is:issue in:body`;
   const found = await api.request(
     `search/issues?q=${encodeURIComponent(query)}&per_page=100`
@@ -80,12 +82,14 @@ export async function discoverPrior(api, proposal) {
   required(
     found.incomplete_results === false &&
       Number.isSafeInteger(found.total_count) &&
-      found.total_count <= 1 &&
+      found.total_count <= (context ? 100 : 1) &&
       Array.isArray(found.items) &&
       found.items.length === found.total_count,
     "prior selection search is incomplete or ambiguous"
   );
   if (!found.total_count) return { status: "new" };
+  if (context && (found.total_count > 1 || found.items[0].state === "closed"))
+    return discoverSupersession(api, proposal, found.items, context);
   const issue = await api.issue(found.items[0].number);
   required(
     issue.state === "open" &&
@@ -254,7 +258,7 @@ export async function allocateLeaf({
   let proposal = suppliedProposal;
   validateProposal(proposal, policy);
   await api.main(proposal.parent);
-  const prior = await discoverPrior(api, proposal);
+  const prior = await discoverPrior(api, proposal, { cwd, config });
   if (prior.status === "stale-outstanding")
     return {
       status: prior.status,
@@ -263,6 +267,12 @@ export async function allocateLeaf({
     };
   await api.assignable(policy.maintainer);
   const currentEvidence = await filingEvidence(api, proposal, config, cwd);
+  if (prior.supersession)
+    currentEvidence.supersession = {
+      workItem: prior.supersession.workItem,
+      cancellationSha256: sha256(`${canonicalJson(prior.supersession)}\n`),
+      proposalKey: prior.supersession.oldProposalKey,
+    };
   const checkpoint = prior.issue
     ? locateCheckpoint(prior.issue.comments, proposal, policy)
     : undefined;

package/all/copy-overwrite/scripts/lib/npm-update-cancel-origin.mjs

@@ -0,0 +1,291 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Cancellation reads immutable old authority without granting that authority to new bytes. */
+import { join } from "node:path";
+import { writeFileSync } from "node:fs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import {
+  required,
+  keys,
+  OBJECT,
+  validatePolicy,
+  validateProposal,
+} from "./npm-update-contract.mjs";
+import {
+  runProcess,
+  withPrivateRoot,
+  writeJson,
+} from "./npm-update-process.mjs";
+import { decodeCheckpoint } from "./npm-update-checkpoint.mjs";
+import {
+  buildDraft,
+  historicalFiling,
+  inspectLeaf,
+  inspectCancelledLeaf,
+  qualityGates,
+} from "./npm-update-leaf.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import { verifyStaleOriginProvider } from "./github-attestation-provider.mjs";
+import { verifyHistoricalDescriptor } from "./github-attestation-recovery.mjs";
+import { DESCRIPTOR_KEYS } from "./automation-provenance-contract.mjs";
+
+/** Only complete, digest-checked transport is considered; incomplete chunks grant nothing. */
+export function completeCheckpoints(comments) {
+  required(
+    Array.isArray(comments) && comments.length <= 2000,
+    "checkpoint inventory exceeds bound"
+  );
+  const digests = new Set();
+  for (const comment of comments) {
+    const match = /^\[lisa-npm-checkpoint\] v1 ([a-f0-9]{64}) complete\n/.exec(
+      comment.body ?? ""
+    );
+    if (match) digests.add(match[1]);
+  }
+  required(digests.size <= 100, "completed checkpoint inventory exceeds bound");
+  return [...digests].map(digest => ({
+    digest,
+    payload: decodeCheckpoint(comments, digest),
+  }));
+}
+
+/** Named committed objects, never ignored config or candidate paths, select historical authority. */
+export async function committedCancellationConfig(cwd, parent) {
+  required(
+    typeof parent === "string" && OBJECT.test(parent),
+    "invalid committed cancellation parent"
+  );
+  const result = await runProcess(
+    "git",
+    ["show", `${parent}:.lisa.config.json`],
+    {
+      cwd,
+      env: {
+        PATH: process.env.PATH,
+        HOME: "/nonexistent",
+        GIT_TERMINAL_PROMPT: "0",
+      },
+      maximum: 1_048_576,
+    }
+  );
+  const config = JSON.parse(result.stdout.toString());
+  required(
+    config.automationProvenance?.enabled === true,
+    "original committed authority is disabled"
+  );
+  validatePolicy(config.npmUpdater, config);
+  required(
+    config.automationProvenance.repository === config.npmUpdater.repository,
+    "original committed authority repository differs"
+  );
+  return config;
+}
+
+/** One original signed checkpoint is required, even if an unsigned filing or cancellation is present. */
+function originCheckpoint(issue) {
+  const origins = completeCheckpoints(issue.comments).filter(
+    ({ payload }) => payload.preview?.descriptor
+  );
+  required(
+    origins.length === 1 && origins[0].payload.bundle.length > 0,
+    "complete original signed checkpoint is missing or ambiguous"
+  );
+  return origins[0];
+}
+
+/** Original chunk bytes must be the unedited Bot's posts during its witnessed run, not later copied markers. */
+export function assertOriginTransport(comments, digest, policy, run) {
+  const start = Date.parse(run.run_started_at),
+    end = Date.parse(run.updated_at);
+  required(
+    Number.isFinite(start) && Number.isFinite(end) && start <= end,
+    "invalid original transport chronology"
+  );
+  const selected = comments.filter(comment =>
+    comment.body?.startsWith(`[lisa-npm-checkpoint] v1 ${digest} `)
+  );
+  required(selected.length > 0, "original transport is missing");
+  for (const comment of selected) {
+    const posted = Date.parse(comment.created_at);
+    required(
+      comment.user?.type === "Bot" &&
+        String(comment.user.id) === policy.claimActorId &&
+        comment.updated_at === comment.created_at &&
+        Number.isFinite(posted) &&
+        posted >= start - 60_000 &&
+        posted <= end + 60_000,
+      "original checkpoint was edited, copied or posted by a foreign actor"
+    );
+  }
+}
+
+/** Original claim, body, policy and proposal are checked separately from current authority. */
+async function inspectOrigin(api, issue, payload, oldConfig, currentConfig) {
+  const policy = validatePolicy(oldConfig.npmUpdater, oldConfig);
+  const proposal = validateProposal(payload.proposal, policy);
+  const allocation = payload.allocation;
+  keys(allocation, [
+    "number",
+    "workItem",
+    "claimCommentId",
+    "claimSha256",
+    "draft",
+    "evidence",
+    "quality",
+  ]);
+  const evidence = historicalFiling(issue);
+  const draft = buildDraft(proposal, policy, oldConfig, evidence);
+  required(
+    canonicalJson(allocation.evidence) === canonicalJson(evidence) &&
+      canonicalJson(allocation.draft) === canonicalJson(draft) &&
+      allocation.number === issue.number &&
+      allocation.workItem === `${policy.repository}#${issue.number}`,
+    "original allocation differs"
+  );
+  // The current qualified classifier checks present holds; historical config only supplies the original draft.
+  const state = await (
+    issue.state === "open" ? inspectLeaf : inspectCancelledLeaf
+  )(issue, draft, policy, currentConfig);
+  required(
+    state.claimed &&
+      !state.unassigned &&
+      state.claims.length === 1 &&
+      String(state.claims[0].id) === allocation.claimCommentId &&
+      sha256(state.claims[0].body) === allocation.claimSha256 &&
+      String(state.claims[0].user?.id) === api.policy.claimActorId &&
+      state.claims[0].user?.type === "Bot",
+    "original managed claim changed"
+  );
+  qualityGates(
+    { ...draft, body: issue.body, title: issue.title },
+    proposal,
+    policy,
+    oldConfig,
+    evidence
+  );
+  return { policy, proposal, allocation };
+}
+
+/** Descriptor fields preserve the complete original immutable proposal and claim. */
+function originalDescriptor(checkpoint, old, allocation, authority) {
+  const preview = checkpoint.payload.preview;
+  keys(preview, ["descriptor", "message", "epoch"]);
+  const d = preview.descriptor;
+  keys(d, DESCRIPTOR_KEYS);
+  required(
+    d.version === 1 &&
+      d.parent === old.parent &&
+      d.queue === old.repository &&
+      d.workItem === allocation.workItem &&
+      d.claimCommentId === allocation.claimCommentId &&
+      d.claimSha256 === allocation.claimSha256 &&
+      d.proposalKey === old.bindingKey &&
+      d.policySha256 === sha256(canonicalJson(authority)) &&
+      canonicalJson(d.files) === canonicalJson(old.hashes) &&
+      canonicalJson(d.updates) === canonicalJson(old.updates) &&
+      typeof preview.message === "string" &&
+      sha256(preview.message) === d.messageSha256 &&
+      checkpoint.digest === sha256(`${canonicalJson(d)}\n`),
+    "original descriptor differs"
+  );
+  return d;
+}
+
+/** The original fixed signing purpose and native transport chronology remain mandatory. */
+async function verifyOriginalSubject(checkpoint, authority, d, issue, parent) {
+  await withPrivateRoot(async root => {
+    const paths = {
+      descriptor: join(root, "descriptor.json"),
+      bundle: join(root, "bundle.json"),
+    };
+    writeJson(paths.descriptor, d);
+    required(
+      Buffer.byteLength(checkpoint.payload.bundle) <= 1_048_576,
+      "origin bundle exceeds bound"
+    );
+    writeFileSync(paths.bundle, checkpoint.payload.bundle, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    const observed = verifyStaleOriginProvider(authority, d, parent);
+    assertOriginTransport(
+      issue.comments,
+      checkpoint.digest,
+      authority,
+      observed.run
+    );
+    verifyHistoricalDescriptor(
+      authority,
+      d,
+      paths,
+      checkpoint.digest,
+      observed.run,
+      observed.claim
+    );
+  });
+}
+
+/** Proof reads use the actual original pin and original run, while live main remains the replacement parent. */
+export async function authenticateStaleOrigin({
+  api,
+  cwd,
+  issue,
+  proposal,
+  config,
+}) {
+  await api.main(proposal.parent);
+  const checkpoint = originCheckpoint(issue);
+  const old = checkpoint.payload.proposal;
+  required(
+    old.parent !== proposal.parent &&
+      old.selectionKey === proposal.selectionKey,
+    "origin is not this stale selection"
+  );
+  const oldConfig = await committedCancellationConfig(cwd, old.parent);
+  const authority = oldConfig.automationProvenance;
+  required(
+    [
+      "repository",
+      "repositoryId",
+      "ownerId",
+      "claimActorId",
+      "ghExecutable",
+      "ghSha256",
+    ].every(key => authority[key] === api.policy[key]),
+    "original and current repository/transport identity differs"
+  );
+  const inspected = await inspectOrigin(
+    api,
+    issue,
+    checkpoint.payload,
+    oldConfig,
+    config
+  );
+  const manifest = await runProcess(
+    "git",
+    ["show", `${old.parent}:package.json`],
+    {
+      cwd,
+      env: {
+        PATH: process.env.PATH,
+        HOME: "/nonexistent",
+        GIT_TERMINAL_PROMPT: "0",
+      },
+      maximum: 1_048_576,
+    }
+  );
+  required(
+    canonicalJson(JSON.parse(manifest.stdout.toString())) ===
+      canonicalJson(old.before),
+    "original committed manifest differs"
+  );
+  const d = originalDescriptor(
+    checkpoint,
+    old,
+    inspected.allocation,
+    authority
+  );
+  await verifyOriginalSubject(checkpoint, authority, d, issue, proposal.parent);
+  return { ...inspected, checkpoint, oldConfig, descriptor: d };
+}

package/all/copy-overwrite/scripts/lib/npm-update-cancellation-proof.mjs

@@ -0,0 +1,327 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** A manual cancellation is a third fixed signing purpose, never publication or review authority. */
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required, keys, FILES, OBJECT } from "./npm-update-contract.mjs";
+import {
+  verifiedRole,
+  matchSigningTime,
+  officialResult,
+  sha256,
+} from "./github-attestation-verifier.mjs";
+
+export const CANCELLATION_PREDICATE =
+  "https://lisa.dev/attestations/npm-cancellation/v1";
+const DIGEST = /^[a-f0-9]{64}$/;
+const DECIMAL = /^[1-9]\d*$/;
+const RECORD_KEYS = [
+  "version",
+  "purpose",
+  "repository",
+  "repositoryId",
+  "ownerId",
+  "selectionKey",
+  "workItem",
+  "oldProposalKey",
+  "oldParent",
+  "parent",
+  "proposalKey",
+  "proposalHashes",
+  "originDescriptorSha256",
+  "originCheckpointSha256",
+  "claimCommentId",
+  "claimSha256",
+  "leafBodySha256",
+  "policySha256",
+  "npmPolicySha256",
+  "maintainer",
+  "operatorId",
+  "runId",
+  "runAttempt",
+  "destination",
+];
+
+/** Manual intent comes from the provider's actual run and collaborator, not a comment or environment assertion. */
+export function assertManualCancellation(
+  run,
+  permission,
+  policy,
+  maintainer,
+  proposal,
+  request,
+  invocation
+) {
+  keys(request, ["number", "proposalKey", "parent"]);
+  keys(invocation, ["runId", "runAttempt"]);
+  required(
+    Number.isSafeInteger(request.number) &&
+      request.number > 0 &&
+      typeof request.proposalKey === "string" &&
+      DIGEST.test(request.proposalKey) &&
+      request.parent === proposal.parent &&
+      OBJECT.test(request.parent),
+    "invalid exact cancellation intent"
+  );
+  required(
+    [invocation.runId, invocation.runAttempt].every(
+      value => typeof value === "string" && DECIMAL.test(value)
+    ) &&
+      String(run.id) === invocation.runId &&
+      String(run.run_attempt) === invocation.runAttempt &&
+      run.event === "workflow_dispatch" &&
+      policy.allowedTriggers?.includes("workflow_dispatch") &&
+      run.status === "in_progress" &&
+      run.head_sha === proposal.parent &&
+      run.head_branch === "main" &&
+      run.path === policy.callerWorkflow.slice(policy.repository.length + 1) &&
+      String(run.head_repository?.id) === policy.repositoryId &&
+      Array.isArray(run.referenced_workflows) &&
+      run.referenced_workflows.some(
+        workflow =>
+          workflow.path?.split("@")[0] === policy.signerWorkflow &&
+          workflow.sha === policy.signerDigest
+      ),
+    "cancellation requires the actual manual main invocation"
+  );
+  const actor = run.triggering_actor;
+  required(
+    actor?.type === "User" &&
+      actor.login === maintainer &&
+      [actor.id, permission.user?.id].every(id =>
+        typeof id === "string"
+          ? DECIMAL.test(id)
+          : Number.isSafeInteger(id) && id > 0
+      ) &&
+      permission.user?.type === "User" &&
+      permission.user.login === maintainer &&
+      String(permission.user.id) === String(actor.id) &&
+      ["write", "admin"].includes(permission.permission),
+    "cancellation requires the configured operator's current repository authority"
+  );
+  return String(actor.id);
+}
+
+/** The closed subject preserves one stale origin and one exact replacement, with no published destination. */
+export function validateCancellation(value, expected) {
+  keys(value, RECORD_KEYS);
+  keys(value.proposalHashes, FILES);
+  keys(value.destination, ["branch", "expectedBranchHead", "prNumber"]);
+  required(
+    value.version === 1 &&
+      value.purpose === "cancel-stale-prepublication-npm-proposal" &&
+      typeof value.repository === "string" &&
+      /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(value.repository) &&
+      typeof value.maintainer === "string" &&
+      /^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(value.maintainer) &&
+      typeof value.oldParent === "string" &&
+      typeof value.parent === "string" &&
+      OBJECT.test(value.oldParent) &&
+      OBJECT.test(value.parent) &&
+      value.oldParent !== value.parent &&
+      value.oldProposalKey !== value.proposalKey &&
+      typeof value.workItem === "string" &&
+      value.workItem.startsWith(`${value.repository}#`) &&
+      DECIMAL.test(value.workItem.slice(value.repository.length + 1)),
+    "invalid stale cancellation scope"
+  );
+  required(
+    [
+      "repositoryId",
+      "ownerId",
+      "claimCommentId",
+      "operatorId",
+      "runId",
+      "runAttempt",
+    ].every(
+      key => typeof value[key] === "string" && DECIMAL.test(value[key])
+    ) &&
+      [
+        "selectionKey",
+        "oldProposalKey",
+        "proposalKey",
+        "originDescriptorSha256",
+        "originCheckpointSha256",
+        "claimSha256",
+        "leafBodySha256",
+        "policySha256",
+        "npmPolicySha256",
+      ].every(
+        key => typeof value[key] === "string" && DIGEST.test(value[key])
+      ) &&
+      Object.values(value.proposalHashes).every(
+        hash => typeof hash === "string" && DIGEST.test(hash)
+      ),
+    "invalid cancellation identity or digest"
+  );
+  required(
+    value.destination.branch === `lisa/npm-${value.oldProposalKey}` &&
+      value.destination.expectedBranchHead === null &&
+      value.destination.prNumber === null &&
+      canonicalJson(value) === canonicalJson(expected),
+    "cancellation subject or prepublication destination differs"
+  );
+  return value;
+}
+
+/** A durable cancellation still proves its own actual manual operator; completion is not fresh publication authority. */
+export function assertRecordedOperator(run, permission, policy, record) {
+  required(
+    ["in_progress", "completed"].includes(run.status) &&
+      String(run.id) === record.runId &&
+      String(run.run_attempt) === record.runAttempt &&
+      run.event === "workflow_dispatch" &&
+      policy.allowedTriggers?.includes("workflow_dispatch") &&
+      run.head_sha === record.parent &&
+      run.head_branch === "main" &&
+      run.path === policy.callerWorkflow.slice(policy.repository.length + 1) &&
+      String(run.head_repository?.id) === policy.repositoryId &&
+      run.triggering_actor?.type === "User" &&
+      run.triggering_actor.login === record.maintainer &&
+      String(run.triggering_actor.id) === record.operatorId &&
+      permission.user?.type === "User" &&
+      permission.user.login === record.maintainer &&
+      String(permission.user.id) === record.operatorId &&
+      ["write", "admin"].includes(permission.permission) &&
+      Array.isArray(run.referenced_workflows) &&
+      run.referenced_workflows.some(
+        workflow =>
+          workflow.path?.split("@")[0] === policy.signerWorkflow &&
+          workflow.sha === policy.signerDigest
+      ),
+    "recorded cancellation operator or invocation differs"
+  );
+}
+
+/** The same fixed constructor is used before issuance and after independent provider verification. */
+export function cancellationRecord(
+  origin,
+  proposal,
+  config,
+  invocation,
+  operatorId
+) {
+  const authority = config.automationProvenance;
+  return {
+    version: 1,
+    purpose: "cancel-stale-prepublication-npm-proposal",
+    repository: proposal.repository,
+    repositoryId: authority.repositoryId,
+    ownerId: authority.ownerId,
+    selectionKey: proposal.selectionKey,
+    workItem: origin.allocation.workItem,
+    oldProposalKey: origin.proposal.key,
+    oldParent: origin.proposal.parent,
+    parent: proposal.parent,
+    proposalKey: proposal.key,
+    proposalHashes: proposal.hashes,
+    originDescriptorSha256: origin.checkpoint.digest,
+    originCheckpointSha256: sha256(canonicalJson(origin.checkpoint.payload)),
+    claimCommentId: origin.allocation.claimCommentId,
+    claimSha256: origin.allocation.claimSha256,
+    leafBodySha256: sha256(origin.allocation.draft.body),
+    policySha256: sha256(canonicalJson(authority)),
+    npmPolicySha256: proposal.policySha256,
+    maintainer: config.npmUpdater.maintainer,
+    operatorId,
+    runId: invocation.runId,
+    runAttempt: invocation.runAttempt,
+    destination: {
+      branch: `lisa/npm-${origin.proposal.key}`,
+      expectedBranchHead: null,
+      prNumber: null,
+    },
+  };
+}
+
+/** Fresh cancellation always uses its fixed subject, predicate and ordinary expiration. */
+export function assertCancellationAttestation(
+  results,
+  record,
+  digest,
+  policy,
+  now = Date.now()
+) {
+  const result = verifiedRole(
+    results,
+    record,
+    digest,
+    policy,
+    CANCELLATION_PREDICATE,
+    "cancellation.json"
+  );
+  matchSigningTime(result.verifiedTimestamps, policy, now);
+  return result.signature.certificate;
+}
+
+/** A recorded cancellation authenticates historical bytes within the actual provider run chronology. */
+export function assertRecordedCancellation(
+  results,
+  record,
+  digest,
+  policy,
+  run,
+  now = Date.now()
+) {
+  const result = verifiedRole(
+    results,
+    record,
+    digest,
+    policy,
+    CANCELLATION_PREDICATE,
+    "cancellation.json"
+  );
+  const started = Date.parse(run.run_started_at);
+  const updated = Date.parse(run.updated_at);
+  required(
+    [started, updated].every(Number.isFinite) &&
+      started <= updated &&
+      updated <= now + 60_000,
+    "invalid cancellation provider chronology"
+  );
+  matchSigningTime(
+    result.verifiedTimestamps,
+    { ...policy, maxAgeSeconds: Number.MAX_SAFE_INTEGER },
+    now
+  );
+  for (const time of result.verifiedTimestamps) {
+    const signed = Date.parse(time.timestamp);
+    required(
+      signed >= started - 60_000 && signed <= updated + 60_000,
+      "cancellation signed outside provider chronology"
+    );
+  }
+  return result.signature.certificate;
+}
+
+/** Both fixed roles run the same official binary and cancellation-only subject/predicate. */
+function cancellationResult(policy, record, paths) {
+  return officialResult(
+    policy,
+    record,
+    paths.cancellation,
+    paths.cancellationBundle,
+    CANCELLATION_PREDICATE
+  );
+}
+
+/** Verification never substitutes an operator's ambient GH binary for the immutable Linux policy. */
+export function verifyCancellationAttestation(policy, record, paths, digest) {
+  return assertCancellationAttestation(
+    cancellationResult(policy, record, paths),
+    record,
+    digest,
+    policy
+  );
+}
+
+/** This fixed historical entry point grants no current publication authority. */
+export function verifyRecordedCancellation(policy, record, paths, digest, run) {
+  return assertRecordedCancellation(
+    cancellationResult(policy, record, paths),
+    record,
+    digest,
+    policy,
+    run
+  );
+}