@dynamicalsystems/idl-conformance 0.12.0 → 0.13.0

package/assets/vectors/dsg.run.workload-artifact_1/reject/tag-bearing-repository.json

@@ -0,0 +1,8 @@
+{
+  "profile": "dsg.run.workload-artifact/1",
+  "shape": "workloadArtifact",
+  "name": "tag-bearing-repository",
+  "verdict": "reject",
+  "rule": "tag-bearing-repository",
+  "bytes": "eyJwcm9maWxlIjoiZHNnLnJ1bi53b3JrbG9hZC1hcnRpZmFjdC8xIiwic2NoZW1hVmVyc2lvbiI6MSwia2luZCI6Indvcmtsb2FkLWFydGlmYWN0IiwiaWQiOiJwcm9iZSIsImZvcm1hdCI6Im9jaS1pbWFnZSIsInNvdXJjZSI6eyJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9leGFtcGxlLmludmFsaWQvd29ya2xvYWRzLmdpdCIsInJldmlzaW9uIjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMSIsInNvdXJjZURpZ2VzdCI6ImY3NTAwMDFlYjY0NDc0YTJlYWI3YmU1ZmY0M2YwNWVkZDA2MzUwNGE4YzQyN2Q4YmU2ZjEzNzM0NzM2YWRjM2UifSwiaW5kZXgiOnsic2hhMjU2IjoiNWM0YjZkY2UyOTg2MjgxMDQ1ZmVlZGNkMWM0N2M4MWVmY2M3NGUzYTM4MjVhY2E2ZjI0Yjk4NWI3YTlhYjljMSIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UuaW5kZXgudjEranNvbiJ9LCJleGVjdXRhYmxlIjp7InBsYXRmb3JtIjp7Im9zIjoibGludXgiLCJhcmNoaXRlY3R1cmUiOiJhbWQ2NCJ9LCJtYW5pZmVzdCI6eyJzaGEyNTYiOiI2M2E2M2IwYzkzOTdkYmI4NTUxMGFiODIxN2Q4NTkzNzNmZjE1Mjk4N2E1MzVkYTAzODY1MzA3YzczODM2NGE5IiwibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5tYW5pZmVzdC52MStqc29uIn0sImNvbmZpZyI6eyJzaGEyNTYiOiI0N2FiN2ZlZGNjNWM3MzJhZmY0NTljYTBlM2ZlZDNlOGFmMDViZDUxNzY4NzgwOWQ0OGM2ZDE1OWE0NjU2YWNmIiwibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5jb25maWcudjEranNvbiJ9LCJyZXBvc2l0b3J5IjoidXMtY2VudHJhbDEtZG9ja2VyLnBrZy5kZXYvZHNnLXJ1bi93b3JrbG9hZHMvZ3B1LXByb2JlOmxhdGVzdCJ9LCJlbnRyeXBvaW50IjpbInB5dGhvbiIsIi1jIiwicHJpbnQoJ29rJykiXX0="
+}

package/checklist.json

@@ -18,6 +18,12 @@
     "dsg.core.refusal/2": 11,
     "dsg.core.refusal/3": 15,
     "dsg.core.google-identity/1": 5,
-    "dsg.organization.source/2": 2
+    "dsg.organization.source/2": 2,
+    "dsg.organization.source/3": 11,
+    "dsg.extension.release/1": 13,
+    "dsg.organization.release/1": 54,
+    "dsg.run.job-class/1": 3,
+    "dsg.run.workload-artifact/1": 12,
+    "dsg.run.execution-binding/1": 39
   }
 }

package/dist/cli.cjs

@@ -1,4 +1,4 @@
-const require_reference_adapter = require("./reference-adapter-B9dycZns.cjs");
+const require_reference_adapter = require("./reference-adapter-C6kR4r8N.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let node_url = require("node:url");

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { n as runVectors, t as referenceAdapter } from "./reference-adapter-DDCyFCeV.mjs";
+import { n as runVectors, t as referenceAdapter } from "./reference-adapter-BJ-RkYd3.mjs";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/index.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_reference_adapter = require("./reference-adapter-B9dycZns.cjs");
+const require_reference_adapter = require("./reference-adapter-C6kR4r8N.cjs");
 exports.referenceAdapter = require_reference_adapter.referenceAdapter;
 exports.runVectors = require_reference_adapter.runVectors;

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../src/adapter.ts","../src/runner.ts","../src/reference-adapter.ts"],"mappings":";KAIY;WACG;WAAmB;;WACnB;WAAoB;;KAEvB,UAAU,SAAS,gBAAgB,OAAO,eAAe;;;;KAKzD;WACD;WACA;WACA;WACA;WACA;WACA;;;;;WAKA;;;;;;WAMA;;;;KC1BC;WACD;WACA;WACA;WACA;;KAGC;WACD;WACA;WACA,mBAAmB;;KAGzB;WAAuB,UAAU,SAAS;;;;;iBAK/B,WAAW,SAAS,SAAS,mBAAmB,WAAW,YAAY;;;iBCXvE,oBAAoB"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/adapter.ts","../src/runner.ts","../src/reference-adapter.ts"],"mappings":";KAIY;WACG;WAAmB;;WACnB;WAAoB;;KAEvB,UAAU,SAAS,gBAAgB,OAAO,eAAe;;;;KAKzD;WACD;WACA;WACA;WACA;WACA;WACA;;;;;WAKA;;;;;;WAMA;;;;KC1BC;WACD;WACA;WACA;WACA;;KAGC;WACD;WACA;WACA,mBAAmB;;KAGzB;WAAuB,UAAU,SAAS;;;;;iBAK/B,WAAW,SAAS,SAAS,mBAAmB,WAAW,YAAY;;;iBCVvE,oBAAoB"}

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/adapter.ts","../src/runner.ts","../src/reference-adapter.ts"],"mappings":";KAIY;WACG;WAAmB;;WACnB;WAAoB;;KAEvB,UAAU,SAAS,gBAAgB,OAAO,eAAe;;;;KAKzD;WACD;WACA;WACA;WACA;WACA;WACA;;;;;WAKA;;;;;;WAMA;;;;KC1BC;WACD;WACA;WACA;WACA;;KAGC;WACD;WACA;WACA,mBAAmB;;KAGzB;WAAuB,UAAU,SAAS;;;;;iBAK/B,WAAW,SAAS,SAAS,mBAAmB,WAAW,YAAY;;;iBCXvE,oBAAoB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/adapter.ts","../src/runner.ts","../src/reference-adapter.ts"],"mappings":";KAIY;WACG;WAAmB;;WACnB;WAAoB;;KAEvB,UAAU,SAAS,gBAAgB,OAAO,eAAe;;;;KAKzD;WACD;WACA;WACA;WACA;WACA;WACA;;;;;WAKA;;;;;;WAMA;;;;KC1BC;WACD;WACA;WACA;WACA;;KAGC;WACD;WACA;WACA,mBAAmB;;KAGzB;WAAuB,UAAU,SAAS;;;;;iBAK/B,WAAW,SAAS,SAAS,mBAAmB,WAAW,YAAY;;;iBCVvE,oBAAoB"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { n as runVectors, t as referenceAdapter } from "./reference-adapter-DDCyFCeV.mjs";
+import { n as runVectors, t as referenceAdapter } from "./reference-adapter-BJ-RkYd3.mjs";
 export { referenceAdapter, runVectors };

package/dist/{reference-adapter-DDCyFCeV.mjs → reference-adapter-BJ-RkYd3.mjs}

@@ -1,8 +1,8 @@
 import { readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, createPublicKey, verify } from "node:crypto";
 import { jcsStringify } from "@dynamicalsystems/orn-schemas";
-import { EVENT_LINE_PREFIX, EVENT_PROFILE, EventSchema, PROFILES } from "@dynamicalsystems/idl";
+import { AcceptedSchema, ActiveSetSchema, AdmissionRecordSchema, CatalogSchema, DependencyLockSchema, DispatchLeaseSchema, EVENT_LINE_PREFIX, EVENT_PROFILE, EventSchema, ExecutionRequestEnvelopeSchema, ExtensionReleaseSchema, ExtensionReleaseSignatureSchema, OrganizationBuildSchema, OrganizationReleaseSchema, PROFILES, Reference, ReleaseEligibilitySchema, UtcSecond, closed } from "@dynamicalsystems/idl";
 //#region src/runner.ts
 /** Runs every vector under `assetsDir` through the adapter. The checklist
 * is the coverage floor: a profile listed there with fewer vectors on disk
@@ -1430,6 +1430,255 @@ function streamDigest(bytes) {
 	}
 }
 //#endregion
+//#region src/release-semantics.ts
+function digest(value) {
+	return createHash("sha256").update(jcsStringify(value)).digest("hex");
+}
+function same(a, b) {
+	return a.orn === b.orn && a.sha256 === b.sha256;
+}
+function unique(values) {
+	return new Set(values).size === values.length;
+}
+function ordered(values) {
+	return values.every((value, index) => index === 0 || values[index - 1] < value);
+}
+function graphError(entries, roots) {
+	if (!unique(entries.map((entry) => entry.id))) return "duplicate-member-id";
+	const byId = new Map(entries.map((entry) => [entry.id, entry]));
+	const visiting = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	function visit(id) {
+		if (visiting.has(id)) return "dependency-cycle";
+		if (visited.has(id)) return;
+		const entry = byId.get(id);
+		if (!entry) return "unresolved-dependency";
+		visiting.add(id);
+		for (const dependency of entry.dependsOn) {
+			const error = visit(dependency);
+			if (error) return error;
+		}
+		visiting.delete(id);
+		visited.add(id);
+	}
+	for (const root of roots) {
+		const error = visit(root);
+		if (error) return error;
+	}
+	return visited.size === entries.length ? void 0 : "extraneous-lock-entry";
+}
+function parse(schema, refine) {
+	return (bytes) => {
+		let value;
+		try {
+			value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+		} catch (error) {
+			return {
+				ok: false,
+				reason: `not UTF-8 JSON: ${String(error)}`
+			};
+		}
+		if (!Check(schema, value)) {
+			const error = Errors(schema, value).First();
+			return {
+				ok: false,
+				reason: `${error?.path ?? ""}: ${error?.message ?? "schema mismatch"}`
+			};
+		}
+		const error = refine(value);
+		return error ? {
+			ok: false,
+			reason: error
+		} : { ok: true };
+	};
+}
+const ExecutionIdentityContext = ExecutionRequestEnvelopeSchema;
+const ExecutionAuthorizationContext = closed({
+	request: ExecutionRequestEnvelopeSchema,
+	lease: DispatchLeaseSchema,
+	accepted: AcceptedSchema,
+	checkedAt: UtcSecond
+});
+const ReleaseSignatureContext = closed({
+	release: ExtensionReleaseSchema,
+	signature: ExtensionReleaseSignatureSchema
+});
+const OrganizationBuildContext = closed({
+	build: OrganizationBuildSchema,
+	dependencyLock: DependencyLockSchema
+});
+const ReleaseEligibilityContext = closed({
+	eligibility: ReleaseEligibilitySchema,
+	currentActiveSet: Reference,
+	activeSet: ActiveSetSchema
+});
+function releaseSemanticAdapters() {
+	return {
+		"dsg.organization.release/1#dependencyLock": parse(DependencyLockSchema, (lock) => {
+			if (!ordered(lock.roots) || !ordered(lock.entries.map((entry) => entry.id))) return "unsorted-lock";
+			for (const entry of lock.entries) {
+				if (!ordered(entry.dependsOn) || !ordered(entry.selectedMemberIds)) return "unsorted-lock";
+				if (entry.kind === "extension-release" && !entry.reference.orn.startsWith("orn:dsg.core.extension.release:")) return "wrong-release-space";
+				if (entry.kind === "workload-artifact" && !entry.reference.orn.startsWith("orn:dsg.core.extension.workload-artifact:")) return "wrong-artifact-space";
+			}
+			return graphError(lock.entries, lock.roots);
+		}),
+		"dsg.extension.release/1#semantic.signatureBinding": parse(ReleaseSignatureContext, ({ release, signature }) => {
+			const bodySha256 = digest(release);
+			if (signature.bodySha256 !== bodySha256 || signature.release.sha256 !== bodySha256) return "signature-body-digest-mismatch";
+			if (signature.release.orn !== release.releaseOrn || signature.publisher !== release.publisher) return "signature-identity-mismatch";
+			try {
+				const publicKey = createPublicKey({
+					key: Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), Buffer.from(signature.publicKey, "hex")]),
+					format: "der",
+					type: "spki"
+				});
+				if (!verify(null, Buffer.from(jcsStringify(release), "utf8"), publicKey, Buffer.from(signature.signature, "hex"))) return "invalid-release-signature";
+			} catch {
+				return "invalid-release-signature";
+			}
+		}),
+		"dsg.extension.release/1#release": parse(ExtensionReleaseSchema, (release) => {
+			if (release.releaseOrn !== `orn:dsg.core.extension.release:${release.namespace}/${release.name}@${release.version}`) return "release-name-mismatch";
+			if (!unique(release.dependencies.map((dependency) => dependency.id))) return "duplicate-dependency-id";
+			const error = graphError(release.components, release.components.map((component) => component.id));
+			if (error) return error;
+			const kinds = new Set(release.components.map((component) => component.kind));
+			if (release.compute && (!kinds.has("job-class") || !kinds.has("workload-artifact"))) return "missing-compute-component";
+			for (const component of release.components) if (component.kind === "workload-artifact" && !component.reference.orn.startsWith("orn:dsg.core.extension.workload-artifact:")) return "wrong-artifact-space";
+		}),
+		"dsg.organization.release/1#organizationBuild": parse(OrganizationBuildSchema, (build) => {
+			const orderedBy = (values, key) => ordered(values.map(key));
+			if (!orderedBy(build.sourceDocuments, (document) => document.path)) return "unsorted-source-closure";
+			if (!orderedBy(build.projects, (project) => project.id) || !orderedBy(build.selections, (selection) => selection.id) || build.selections.some((selection) => !orderedBy(selection.members, (member) => member.id)) || !orderedBy(build.components, (component) => [
+				component.extensionRelease.orn,
+				component.extensionRelease.sha256,
+				component.memberId
+			].join("\0")) || !orderedBy(build.typedReleases, (release) => release.id) || !orderedBy(build.instructions, (reference) => `${reference.orn}\0${reference.sha256}`) || !orderedBy(build.handling, (reference) => `${reference.orn}\0${reference.sha256}`) || !orderedBy(build.releaseDeclarations, (reference) => `${reference.orn}\0${reference.sha256}`) || !orderedBy(build.releaseMembers, (member) => member.id)) return "unsorted-build";
+			if (!unique(build.projects.map((project) => project.id)) || !unique(build.selections.map((selection) => selection.id)) || !unique(build.releaseMembers.map((member) => member.id))) return "duplicate-member-id";
+			const components = /* @__PURE__ */ new Map();
+			for (const component of build.components) {
+				const key = `${component.extensionRelease.orn}\0${component.extensionRelease.sha256}\0${component.memberId}`;
+				if (components.has(key)) return "duplicate-component-id";
+				components.set(key, component);
+			}
+			for (const selection of build.selections) {
+				if (!unique(selection.members.map((member) => member.id))) return "duplicate-member-id";
+				for (const member of selection.members) {
+					const component = components.get(`${selection.extensionRelease.orn}\0${selection.extensionRelease.sha256}\0${member.id}`);
+					if (!component || component.kind !== member.kind || !same(component.reference, member.reference)) return "selected-component-mismatch";
+				}
+			}
+		}),
+		"dsg.organization.release/1#semantic.organizationBuild": parse(OrganizationBuildContext, ({ build, dependencyLock }) => {
+			if (build.dependencyLock.sha256 !== digest(dependencyLock)) return "dependency-lock-digest-mismatch";
+			if (jcsStringify(build.typedReleases) !== jcsStringify(dependencyLock.entries)) return "typed-release-lock-mismatch";
+		}),
+		"dsg.organization.release/1#organizationRelease": parse(OrganizationReleaseSchema, (release) => unique(release.members.map((member) => member.id)) ? void 0 : "duplicate-member-id"),
+		"dsg.organization.release/1#admissionRecord": parse(AdmissionRecordSchema, (admission) => {
+			if (!unique(admission.components.map((component) => component.id))) return "duplicate-member-id";
+			if (admission.status === "admitted" && !unique(admission.approvedUses.map((use) => use.use))) return "duplicate-approved-use";
+		}),
+		"dsg.organization.release/1#activeSet": parse(ActiveSetSchema, (activeSet) => {
+			if (!unique(activeSet.members.map((member) => `${member.selectionId}\0${member.memberId}`))) return "duplicate-active-member";
+			for (const member of activeSet.members) if (!unique(member.components.map((component) => component.id))) return "duplicate-member-id";
+		}),
+		"dsg.organization.release/1#catalog": parse(CatalogSchema, (catalog) => {
+			if (!unique(catalog.entries.map((entry) => entry.id))) return "duplicate-catalog-entry";
+			for (const entry of catalog.entries) {
+				if (!same(entry.activeSet, catalog.activeSet)) return "catalog-active-set-mismatch";
+				if (entry.jobClass === null !== (entry.workloadArtifact === null)) return "incomplete-compute-provenance";
+			}
+		}),
+		"dsg.organization.release/1#releaseEligibility": parse(ReleaseEligibilitySchema, (eligibility) => {
+			if (!same(eligibility.release, eligibility.observation.subject)) return "status-subject-mismatch";
+			if (!same(eligibility.trustView, eligibility.observation.trustView)) return "stale-trust-view";
+			if (eligibility.observation.status === "revoked") return "release-revoked";
+			if (eligibility.observation.status === "retired" && (eligibility.operation !== "execute" || eligibility.activeSet === null)) return "release-retired";
+		}),
+		"dsg.organization.release/1#semantic.releaseEligibility": parse(ReleaseEligibilityContext, ({ eligibility, currentActiveSet, activeSet }) => {
+			if (!same(eligibility.release, eligibility.observation.subject)) return "status-subject-mismatch";
+			if (!same(eligibility.trustView, eligibility.observation.trustView)) return "stale-trust-view";
+			if (eligibility.observation.status === "revoked") return "release-revoked";
+			if (eligibility.observation.status !== "retired") return;
+			if (eligibility.operation !== "execute" || eligibility.activeSet === null) return "release-retired";
+			if (!same(eligibility.activeSet, currentActiveSet) || currentActiveSet.sha256 !== digest(activeSet)) return "inactive-set";
+			if (!activeSet.members.some((member) => same(member.extensionRelease, eligibility.release))) return "release-not-active";
+		}),
+		"dsg.run.execution-binding/1#semantic.executionAuthorization": parse(ExecutionAuthorizationContext, ({ request, lease, accepted, checkedAt }) => {
+			if (accepted.generation !== request.operation.expectedGeneration + 1) return "accepted-generation-mismatch";
+			if (accepted.operationId !== request.operation.operationId) return "accepted-operation-mismatch";
+			if (accepted.planDigest !== request.operation.planDigest) return "accepted-plan-mismatch";
+			const { operation, binding } = request;
+			if (!same(binding.reservation, operation.reservation)) return "binding-reservation-mismatch";
+			if (lease.operationId !== operation.operationId) return "lease-operation-mismatch";
+			if (lease.generation !== accepted.generation) return "lease-generation-mismatch";
+			if (lease.caseOrn !== operation.case.orn) return "lease-case-mismatch";
+			if (lease.envelopeSha256 !== digest(operation)) return "lease-envelope-mismatch";
+			if (lease.lawSha256 !== operation.document.law.bundle.sha256) return "lease-law-mismatch";
+			if (!same(lease.reservation, binding.reservation)) return "lease-reservation-mismatch";
+			if (Date.parse(lease.expiresAt) <= Date.parse(lease.consumedAt)) return "invalid-dispatch-lease-window";
+			if (Date.parse(checkedAt) >= Date.parse(lease.expiresAt)) return "expired-dispatch-lease";
+		}),
+		"dsg.run.execution-binding/1#semantic.executionIdentity": parse(ExecutionIdentityContext, ({ binding, operation, jobClass, workloadArtifact: artifact, workloadArtifactProvenance: provenance, admission, activeSet, releaseEligibility, selection, catalogEntry }) => {
+			if (releaseEligibility.operation !== "execute") return "eligibility-operation-mismatch";
+			if (releaseEligibility.observation.status === "revoked") return "release-revoked";
+			if (!same(releaseEligibility.observation.subject, releaseEligibility.release)) return "eligibility-subject-mismatch";
+			if (!same(releaseEligibility.observation.trustView, releaseEligibility.trustView)) return "eligibility-observation-trust-mismatch";
+			if (releaseEligibility.observation.status === "retired" && (releaseEligibility.operation !== "execute" || releaseEligibility.activeSet === null || !same(releaseEligibility.activeSet, binding.activeSet))) return "release-retired";
+			if (binding.selection.sha256 !== digest(selection)) return "selection-digest-mismatch";
+			if (selection.id !== catalogEntry.selectionId || selection.id !== admission.selectionId) return "selection-id-mismatch";
+			if (!same(selection.extensionRelease, binding.extensionRelease) || !same(catalogEntry.extensionRelease, binding.extensionRelease)) return "selection-release-mismatch";
+			if (catalogEntry.availability !== "available") return "catalog-entry-unavailable";
+			if (!same(catalogEntry.activeSet, binding.activeSet) || !same(catalogEntry.workflow, binding.workflow) || catalogEntry.jobClass === null || !same(catalogEntry.jobClass, binding.jobClass) || catalogEntry.workloadArtifact === null || !same(catalogEntry.workloadArtifact, binding.workloadArtifact)) return "catalog-binding-mismatch";
+			if (!same(releaseEligibility.release, binding.extensionRelease)) return "eligibility-release-mismatch";
+			if (!same(releaseEligibility.trustView, binding.trustView)) return "eligibility-trust-view-mismatch";
+			if (releaseEligibility.activeSet === null || !same(releaseEligibility.activeSet, binding.activeSet)) return "eligibility-active-set-mismatch";
+			if (admission.status !== "admitted") return "admission-refused";
+			if (!admission.approvedUses.some((approved) => approved.use === "execute" && same(approved.binding, binding.jobClass))) return "execution-use-not-approved";
+			if (operation.document.resources.maxRunSeconds > jobClass.bounds.maxRunSeconds) return "run-seconds-exceed-class";
+			if (operation.document.resources.maxGpuSeconds > jobClass.bounds.maxGpuSeconds) return "gpu-seconds-exceed-class";
+			if (operation.document.resources.maxParallelism > jobClass.bounds.maxParallelism) return "parallelism-exceeds-class";
+			if (binding.admission.sha256 !== digest(admission)) return "admission-digest-mismatch";
+			if (binding.activeSet.sha256 !== digest(activeSet)) return "active-set-digest-mismatch";
+			if (binding.installation !== admission.installation || binding.installation !== activeSet.installation) return "installation-mismatch";
+			if (!same(binding.organizationBuild, admission.build) || !same(binding.organizationBuild, activeSet.build)) return "organization-build-mismatch";
+			if (!same(binding.organizationRelease, admission.release) || !same(binding.organizationRelease, activeSet.release)) return "organization-release-mismatch";
+			if (!same(binding.extensionRelease, admission.extensionRelease)) return "admission-release-mismatch";
+			const activeMember = activeSet.members.find((member) => same(member.admission, binding.admission) && same(member.extensionRelease, binding.extensionRelease));
+			if (!activeMember) return "release-not-active";
+			if (activeMember.selectionId !== selection.id || activeMember.memberId !== catalogEntry.memberId) return "active-member-identity-mismatch";
+			const selectedComponents = selection.members.map((component) => component.reference);
+			const activeComponents = activeMember.components.map((component) => component.reference);
+			const admittedComponents = admission.components.map((component) => component.reference);
+			for (const required of [
+				binding.workflow,
+				binding.jobClass,
+				binding.workloadArtifact,
+				binding.eventCatalog
+			]) {
+				if (!selectedComponents.some((component) => same(component, required))) return "selected-component-mismatch";
+				if (!activeComponents.some((component) => same(component, required))) return "active-component-mismatch";
+				if (!admittedComponents.some((component) => same(component, required))) return "admitted-component-mismatch";
+			}
+			if (binding.operation.sha256 !== digest(operation)) return "operation-digest-mismatch";
+			if (!same(binding.target, operation.document.placement)) return "operation-target-mismatch";
+			if (!same(binding.jobClass, operation.document.classContract)) return "operation-job-class-mismatch";
+			if (!same(binding.workloadArtifact, operation.document.workload)) return "operation-workload-mismatch";
+			if (!same(binding.law, operation.document.law.bundle)) return "operation-law-mismatch";
+			if (binding.workloadArtifact.sha256 !== digest(artifact)) return "artifact-metadata-digest-mismatch";
+			if (binding.jobClass.sha256 !== digest(jobClass)) return "job-class-digest-mismatch";
+			if (!same(jobClass.workloadArtifact, binding.workloadArtifact)) return "job-class-artifact-mismatch";
+			if (!same(jobClass.eventCatalog, binding.eventCatalog)) return "event-catalog-mismatch";
+			if (!same(provenance.artifact, binding.workloadArtifact)) return "provenance-subject-mismatch";
+			if (jcsStringify(provenance.source) !== jcsStringify(artifact.source)) return "source-provenance-mismatch";
+			if (binding.executableManifestSha256 !== artifact.executable.manifest.sha256) return "wrong-executable-digest-role";
+			if (artifact.executable.platform.os !== "linux" || artifact.executable.platform.architecture !== "amd64") return "unsupported-executable-platform";
+			if (!jobClass.platforms.includes(`${artifact.executable.platform.os}/${artifact.executable.platform.architecture}`)) return "job-class-platform-mismatch";
+		})
+	};
+}
+//#endregion
 //#region src/reference-adapter.ts
 function referenceAdapter() {
 	const adapter = {};
@@ -1468,9 +1717,10 @@ function referenceAdapter() {
 		};
 	}
 	adapter[`${EVENT_PROFILE}#digest.streamSeal`] = streamDigest;
+	Object.assign(adapter, releaseSemanticAdapters());
 	return adapter;
 }
 //#endregion
 export { runVectors as n, referenceAdapter as t };
 
-//# sourceMappingURL=reference-adapter-DDCyFCeV.mjs.map
+//# sourceMappingURL=reference-adapter-BJ-RkYd3.mjs.map