@kungfu-tech/buildchain 3.0.9-alpha.0 → 3.0.9-alpha.10

package/packages/core/adopter-delivery-passport.js

@@ -0,0 +1,259 @@
+import {
+  ADOPTER_DELIVERY_GATE_RESULT_CONTRACT,
+  adopterDeliveryGateDigest,
+} from "./adopter-delivery-gate.js";
+
+export const ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT =
+  "kungfu-buildchain-adopter-delivery-passport-binding";
+
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+
+function issue(code, message, details = {}) {
+  return { code, message, details };
+}
+
+function validateRootedJson(value, rootField, code, label) {
+  const root = value?.[rootField];
+  if (!ROOT_PATTERN.test(root ?? "")) {
+    return [issue(code, `${label} must be a canonical sha256 root`)];
+  }
+  try {
+    const preimage = structuredClone(value);
+    delete preimage[rootField];
+    return adopterDeliveryGateDigest(preimage) === root
+      ? []
+      : [issue(code, `${label} does not match its exact JSON closure`)];
+  } catch {
+    return [issue(code, `${label} requires finite acyclic JSON`)];
+  }
+}
+
+function validateGateIdentity(result) {
+  const issues = [];
+  if (
+    result.schemaVersion !== 1 ||
+    result.contract !== ADOPTER_DELIVERY_GATE_RESULT_CONTRACT
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.contract",
+        "adopter delivery gate result contract is unsupported",
+      ),
+    );
+  }
+  if (
+    !result.project ||
+    !result.artifact ||
+    !result.protocol ||
+    !result.artifactProfile
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.closure",
+        "gate result must retain project, artifact, protocol, and artifact-profile bindings",
+      ),
+    );
+  }
+  if (!ROOT_PATTERN.test(result.artifact?.root ?? "")) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.artifact.root",
+        "delivery artifact root must be a canonical sha256 root",
+      ),
+    );
+  }
+  if (result.qualifying !== false || result.selfCertified !== false) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.nonClaims",
+        "delivery evidence must remain non-qualifying and non-self-certifying",
+      ),
+    );
+  }
+  return issues;
+}
+
+function validatePassedGate(result) {
+  if (result.status !== "passed") {
+    return result.status === "failed"
+      ? []
+      : [
+          issue(
+            "adopterDelivery.gateResult.status",
+            "gate status must be passed or failed",
+          ),
+        ];
+  }
+  const passed =
+    result.protocol?.loaded === true &&
+    ROOT_PATTERN.test(result.protocol?.reportRoot ?? "") &&
+    result.artifactProfile?.loaded === true &&
+    result.artifactProfile?.valid === true &&
+    result.semanticReport !== null &&
+    (result.issues?.length ?? -1) === 0;
+  return passed
+    ? []
+    : [
+        issue(
+          "adopterDelivery.gateResult.status",
+          "a passed gate must retain successful exact driver and artifact-profile evidence",
+        ),
+      ];
+}
+
+export function validateAdopterDeliveryGateResult(result) {
+  if (!result || typeof result !== "object" || Array.isArray(result)) {
+    return {
+      valid: false,
+      passed: false,
+      issues: [
+        issue(
+          "adopterDelivery.gateResult",
+          "adopter delivery gate result must be an object",
+        ),
+      ],
+    };
+  }
+  const issues = [
+    ...validateGateIdentity(result),
+    ...validateRootedJson(
+      result,
+      "gateRoot",
+      "adopterDelivery.gateResult.gateRoot",
+      "adopter delivery gate root",
+    ),
+    ...validatePassedGate(result),
+  ];
+  const valid = issues.length === 0;
+  return { valid, passed: valid && result.status === "passed", issues };
+}
+
+export function createAdopterDeliveryPassportBinding(gateResult) {
+  const normalized = structuredClone(gateResult);
+  const validation = validateAdopterDeliveryGateResult(normalized);
+  const binding = {
+    schemaVersion: 1,
+    contract: ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT,
+    valid: validation.passed,
+    qualifying: false,
+    selfCertified: false,
+    gateResult: normalized,
+    validationIssues: validation.issues,
+    nonClaims: [
+      "A passing adopter delivery gate does not grant runtime permission or release authority.",
+      "The selected protocol driver retains semantic authority; Buildchain only binds its exact result into delivery evidence.",
+    ],
+  };
+  binding.bindingRoot = adopterDeliveryGateDigest(binding);
+  return binding;
+}
+
+export function normalizeAdopterDeliveryPassportBinding(value) {
+  if (!value) return undefined;
+  return value.contract === ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT
+    ? structuredClone(value)
+    : createAdopterDeliveryPassportBinding(value);
+}
+
+export function validateAdopterDeliveryPassportBinding(
+  binding,
+  { expectedProjectRepository = "" } = {},
+) {
+  if (!binding || typeof binding !== "object" || Array.isArray(binding)) {
+    return [
+      issue(
+        "adopterDelivery.binding",
+        "adopter delivery passport binding must be an object",
+      ),
+    ];
+  }
+  const gateValidation = validateAdopterDeliveryGateResult(binding.gateResult);
+  const issues = [
+    ...validateRootedJson(
+      binding,
+      "bindingRoot",
+      "adopterDelivery.binding.bindingRoot",
+      "adopter delivery binding root",
+    ),
+    ...gateValidation.issues,
+  ];
+  if (
+    binding.schemaVersion !== 1 ||
+    binding.contract !== ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.binding.contract",
+        "adopter delivery passport binding contract is unsupported",
+      ),
+    );
+  }
+  if (
+    binding.valid !== gateValidation.passed ||
+    binding.qualifying !== false ||
+    binding.selfCertified !== false
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.binding.status",
+        "binding status must preserve a passing non-authoritative gate result",
+      ),
+    );
+  }
+  if (!gateValidation.passed) {
+    issues.push(
+      issue(
+        "adopterDelivery.status",
+        "release passport requires a passed adopter delivery gate",
+      ),
+    );
+  }
+  if (
+    expectedProjectRepository &&
+    binding.gateResult?.project?.adopterId !== expectedProjectRepository
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.project",
+        "delivery project must match the release passport product repository",
+      ),
+    );
+  }
+  return issues;
+}
+
+function sameJson(left, right) {
+  try {
+    return adopterDeliveryGateDigest(left) === adopterDeliveryGateDigest(right);
+  } catch {
+    return false;
+  }
+}
+
+export function validateAdopterDeliveryReleaseEvidence({
+  binding,
+  artifactBinding,
+  expectedProjectRepository = "",
+} = {}) {
+  if (!binding && !artifactBinding) return [];
+  if (!binding) {
+    return [
+      issue(
+        "adopterDelivery.passport",
+        "artifact evidence cannot introduce delivery authority absent from the passport",
+      ),
+    ];
+  }
+  const issues = validateAdopterDeliveryPassportBinding(binding, {
+    expectedProjectRepository,
+  });
+  if (!artifactBinding || !sameJson(artifactBinding, binding)) {
+    issues.push(
+      issue(
+        "adopterDelivery.artifactEvidence",
+        "passport and artifact evidence must bind the same exact delivery result",
+      ),
+    );
+  }
+  return issues;
+}

package/packages/core/adopter-delivery-vectors.js

@@ -0,0 +1,158 @@
+import vectorSuite from "./adopter-delivery-vectors.json" with { type: "json" };
+
+import { adopterDeliveryGateDigest } from "./adopter-delivery-gate.js";
+
+export const ADOPTER_DELIVERY_VECTOR_SUITE_CONTRACT =
+  "kungfu-buildchain-adopter-delivery-vectors/v1";
+
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const REQUIRED_CASES = new Map([
+  ["golden-two-driver-offline-replay", "golden"],
+  ["negative-driver-mismatch", "negative"],
+  ["negative-category-conflict", "negative"],
+  ["negative-evidence-substitution", "negative"],
+  ["negative-stale-package-cut", "negative"],
+  ["fault-driver-throw", "fault"],
+]);
+
+function freezeJson(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value)) freezeJson(child);
+  }
+  return value;
+}
+
+function issue(code, path, message) {
+  return { code, path, message };
+}
+
+function suiteDigest(suite) {
+  const preimage = structuredClone(suite);
+  delete preimage.suiteRoot;
+  return adopterDeliveryGateDigest(preimage);
+}
+
+export function validateAdopterDeliveryVectorSuite(suite) {
+  const issues = [];
+  if (!suite || typeof suite !== "object" || Array.isArray(suite)) {
+    return {
+      valid: false,
+      issues: [
+        issue(
+          "adopter-delivery-vectors.invalid",
+          "/",
+          "Vector suite must be a JSON object.",
+        ),
+      ],
+    };
+  }
+  if (
+    suite.schemaVersion !== 1 ||
+    suite.contract !== ADOPTER_DELIVERY_VECTOR_SUITE_CONTRACT
+  ) {
+    issues.push(
+      issue(
+        "adopter-delivery-vectors.contract",
+        "/contract",
+        "Vector suite contract is unsupported.",
+      ),
+    );
+  }
+  if (!Array.isArray(suite.cases)) {
+    issues.push(
+      issue(
+        "adopter-delivery-vectors.cases",
+        "/cases",
+        "Vector suite cases must be an array.",
+      ),
+    );
+  } else {
+    const seen = new Set();
+    for (const [index, entry] of suite.cases.entries()) {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+        issues.push(
+          issue(
+            "adopter-delivery-vectors.case",
+            `/cases/${index}`,
+            "Vector case must be an object.",
+          ),
+        );
+        continue;
+      }
+      if (typeof entry.id !== "string" || seen.has(entry.id)) {
+        issues.push(
+          issue(
+            "adopter-delivery-vectors.case-id",
+            `/cases/${index}/id`,
+            "Vector case id must be non-empty and unique.",
+          ),
+        );
+      }
+      seen.add(entry.id);
+      if (!entry.expected || typeof entry.expected !== "object") {
+        issues.push(
+          issue(
+            "adopter-delivery-vectors.expected",
+            `/cases/${index}/expected`,
+            "Vector case must declare its expected result.",
+          ),
+        );
+      }
+    }
+    for (const [id, className] of REQUIRED_CASES) {
+      const entry = suite.cases.find((candidate) => candidate?.id === id);
+      if (!entry || entry.class !== className) {
+        issues.push(
+          issue(
+            "adopter-delivery-vectors.required-case",
+            "/cases",
+            `Required ${className} vector ${id} is missing.`,
+          ),
+        );
+      }
+    }
+  }
+  if (!ROOT_PATTERN.test(suite.suiteRoot ?? "")) {
+    issues.push(
+      issue(
+        "adopter-delivery-vectors.root",
+        "/suiteRoot",
+        "Vector suite root must be a canonical sha256 root.",
+      ),
+    );
+  } else {
+    try {
+      if (suiteDigest(suite) !== suite.suiteRoot) {
+        issues.push(
+          issue(
+            "adopter-delivery-vectors.root",
+            "/suiteRoot",
+            "Vector suite root does not match the exact JSON closure.",
+          ),
+        );
+      }
+    } catch {
+      issues.push(
+        issue(
+          "adopter-delivery-vectors.root",
+          "/suiteRoot",
+          "Vector suite must contain finite acyclic JSON.",
+        ),
+      );
+    }
+  }
+  return { valid: issues.length === 0, issues };
+}
+
+export const ADOPTER_DELIVERY_VECTOR_SUITE = freezeJson(
+  structuredClone(vectorSuite),
+);
+
+export function getAdopterDeliveryVector(id) {
+  const entry = ADOPTER_DELIVERY_VECTOR_SUITE.cases.find(
+    (candidate) => candidate.id === id,
+  );
+  if (!entry) throw new RangeError(`Unknown adopter delivery vector: ${id}`);
+  return structuredClone(entry);
+}

package/packages/core/adopter-delivery-vectors.json

@@ -0,0 +1,77 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-adopter-delivery-vectors/v1",
+  "rootAlgorithm": "sha256-buildchain-canonical-json-v1",
+  "authorities": {
+    "kfdPackage": "@kungfu-tech/kfd@1.0.0-alpha.62",
+    "categoryProfileVectors": "@kungfu-tech/kfd/adopter-conformance/category-profile-vectors.json",
+    "categoryInstanceVectors": "@kungfu-tech/kfd/adopter-conformance/category-instance-vectors.json"
+  },
+  "cases": [
+    {
+      "id": "golden-two-driver-offline-replay",
+      "class": "golden",
+      "surface": "protocol-neutral-gate",
+      "operation": "evaluate identical exact requests with two isolated protocol drivers and replay each request offline",
+      "expected": {
+        "statuses": ["passed", "passed"],
+        "issueCodes": [],
+        "deterministicRoots": true,
+        "qualifying": false,
+        "selfCertified": false
+      }
+    },
+    {
+      "id": "negative-driver-mismatch",
+      "class": "negative",
+      "surface": "protocol-neutral-gate",
+      "operation": "select an exact protocol identity and version that are not registered",
+      "expected": {
+        "status": "failed",
+        "issueCodes": ["delivery-driver-unknown"]
+      }
+    },
+    {
+      "id": "negative-category-conflict",
+      "class": "negative",
+      "surface": "published-kfd-category-driver",
+      "operation": "append a duplicate published category profile to the exact KFD instance selection",
+      "expected": {
+        "status": "failed",
+        "issueCodes": ["acp-composition-invalid"]
+      }
+    },
+    {
+      "id": "negative-evidence-substitution",
+      "class": "negative",
+      "surface": "release-passport-binding",
+      "operation": "substitute the artifact root in artifact evidence after binding the passport",
+      "expected": {
+        "status": "failed",
+        "issueCodes": ["adopterDelivery.artifactEvidence"]
+      }
+    },
+    {
+      "id": "negative-stale-package-cut",
+      "class": "negative",
+      "surface": "published-kfd-category-driver",
+      "operation": "replace the KFD instance package version with an uninstalled stale cut",
+      "expected": {
+        "status": "failed",
+        "issueCodes": ["delivery-kfd-package-cut-mismatch"]
+      }
+    },
+    {
+      "id": "fault-driver-throw",
+      "class": "fault",
+      "surface": "protocol-neutral-gate",
+      "operation": "throw a private exception from the selected protocol driver",
+      "expected": {
+        "status": "failed",
+        "issueCodes": ["delivery-driver-error"],
+        "privateDetailRedacted": true
+      }
+    }
+  ],
+  "suiteRoot": "sha256:cf329805d928a9883cbafbdfdf21ef66c6a0889ed8dfe14356b4e0d25d6738f9"
+}

package/packages/core/artifact-verification-envelope.js

@@ -417,7 +417,7 @@ function kfdBindingBody({ manifest, manifestGate, legacyProjection, paths }) {
       gatePath: paths.gate,
       gateRoot: manifestGate.gateRoot,
     },
-    source: jsonClone(manifestGate.source),
+    adopter: jsonClone(manifestGate.adopter), source: jsonClone(manifestGate.source),
     standardPackage: jsonClone(manifestGate.standardPackage),
     witness: {
       decisionRoot: manifestGate.decisionWitness.root,
@@ -445,10 +445,10 @@ export function createKfdAdopterReleaseBinding({
   manifestPath = "kfd-adopter-manifest.json",
   gatePath = "kfd-adopter-manifest-gate.json",
   legacyProjectionPath = "kfd-support.json",
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const gate = validateKfdAdopterManifestGate(manifestGate, {
-    expectedSourceSha,
+    expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     checkedAt: manifestGate?.checkedAt,
   });
   const legacy = validateKfdLegacySupportMatrixProjection(legacyProjection, { manifest, manifestGate });
@@ -468,7 +468,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
   manifest,
   manifestGate,
   legacyProjection,
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const issues = [];
   if (!binding || binding.schemaVersion !== 1 || binding.contract !== KFD_ADOPTER_RELEASE_BINDING_CONTRACT) {
@@ -488,7 +488,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
       manifestPath: binding.authority?.manifestPath,
       gatePath: binding.authority?.gatePath,
       legacyProjectionPath: binding.legacyProjection?.path,
-      expectedSourceSha,
+      expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     });
     if (stableJson(binding) !== stableJson(expected)) {
       issues.push({ code: "adopter-release-binding-drift", path: "", message: "release binding differs from the exact manifest, gate, or legacy projection closure" });

package/packages/core/buildchain-agent-manuals.js

@@ -10,6 +10,7 @@ export const BUILDCHAIN_AGENT_MANUALS = Object.freeze([
   { id: "github-governance-authority", title: "GitHub governance authority", path: "docs/github-governance-authority.md", plane: "verify" },
   { id: "release-candidate", title: "Release Candidate Passport", path: "docs/release-candidate.md", plane: "verify" },
   { id: "release-train", title: "Release Train and Release Cut", path: "docs/release-train.md", plane: "verify" },
+  { id: "next-development-transition", title: "Next-development transition", path: "docs/next-development-transition.md", plane: "verify" },
   { id: "release-propagation", title: "Release propagation", path: "docs/release-propagation.md", plane: "use" },
   { id: "readme-badges", title: "README badge blocks", path: "docs/readme-badges.md", plane: "use" },
   { id: "homebrew", title: "Homebrew distribution indexes", path: "docs/homebrew.md", plane: "use" },

package/packages/core/buildchain-channel-identity.js

@@ -0,0 +1,118 @@
+const EXACT_SHA_RE = /^[0-9a-f]{40}$/i;
+const OFFICIAL_REF_RE = /^v(\d+)(?:\.\d+)?(-alpha)?$/;
+const STABLE_RELEASE_RE = /^v(\d+)\.\d+\.\d+$/;
+const ALPHA_RELEASE_RE = /^v(\d+)\.\d+\.\d+-alpha\.\d+$/;
+const TRAIN_REF_RE = /^train\/v(\d+)\/v(\d+)\.\d+\/[A-Za-z0-9._/-]+$/;
+const AUTHORITY_REF_RE = /^authority\/v(\d+)\/v(\d+)\.\d+\/[A-Za-z0-9._/-]+$/;
+
+export const BUILDCHAIN_CHANNELS = new Set(["stable", "alpha"]);
+
+export function normalizeBuildchainRef(ref = "") {
+  const value = String(ref || "").trim();
+  const workflowRef = value.includes("/.github/workflows/") ? value.split("@").pop() || "" : value;
+  return workflowRef.replace(/^refs\/(?:heads|tags)\//, "");
+}
+
+export function parseBuildchainRefIdentity(ref = "") {
+  const value = normalizeBuildchainRef(ref);
+  if (!value) return { ref: value, kind: "missing", channel: null, major: null };
+  if (EXACT_SHA_RE.test(value)) return { ref: value, kind: "exact-sha", channel: null, major: null };
+
+  for (const [pattern, channel, kind] of [
+    [OFFICIAL_REF_RE, null, "official-channel"],
+    [STABLE_RELEASE_RE, "stable", "release"],
+    [ALPHA_RELEASE_RE, "alpha", "release"],
+  ]) {
+    const match = value.match(pattern);
+    if (match) {
+      return {
+        ref: value,
+        kind,
+        channel: channel || (match[2] ? "alpha" : "stable"),
+        major: Number(match[1]),
+      };
+    }
+  }
+
+  for (const [pattern, kind] of [
+    [TRAIN_REF_RE, "train"],
+    [AUTHORITY_REF_RE, "authority"],
+  ]) {
+    const match = value.match(pattern);
+    if (match) {
+      return {
+        ref: value,
+        kind,
+        channel: null,
+        major: Number(match[1]),
+        coherentMajor: match[1] === match[2],
+      };
+    }
+  }
+  return { ref: value, kind: "development", channel: null, major: null };
+}
+
+function expectedIdentity({ workflowShellRef, expectedChannel, expectedMajor }) {
+  const shell = parseBuildchainRefIdentity(workflowShellRef);
+  const channel =
+    String(expectedChannel || "")
+      .trim()
+      .toLowerCase() || shell.channel;
+  const majorText = String(expectedMajor ?? "").trim();
+  const major = majorText ? Number(majorText.replace(/^v/, "")) : shell.major;
+  return { shell, channel, major };
+}
+
+function expectedReasons(expected, { expectedChannel, expectedMajor }) {
+  const reasons = [];
+  if (!BUILDCHAIN_CHANNELS.has(expected.channel)) reasons.push("Buildchain channel is missing or ambiguous");
+  if (!Number.isInteger(expected.major) || expected.major < 1) reasons.push("Buildchain major is missing or ambiguous");
+  if (expected.shell.channel && expected.shell.channel !== expected.channel) {
+    reasons.push(`workflow shell ${expected.shell.ref} is ${expected.shell.channel}, expected ${expected.channel}`);
+  }
+  if (Number.isInteger(expected.shell.major) && expected.shell.major !== expected.major) {
+    reasons.push(`workflow shell ${expected.shell.ref} is v${expected.shell.major}, expected v${expected.major}`);
+  }
+  if (!expected.shell.channel && !expectedChannel) reasons.push(`workflow shell ${expected.shell.ref || "(missing)"} does not declare a stable or alpha channel`);
+  if (!Number.isInteger(expected.shell.major) && !expectedMajor) reasons.push(`workflow shell ${expected.shell.ref || "(missing)"} does not declare a Buildchain major`);
+  return reasons;
+}
+
+function runtimeReasons(expected, runtime, allowOpaqueRuntime) {
+  if (runtime.channel) {
+    return [runtime.channel !== expected.channel ? `runtime ${runtime.ref} is ${runtime.channel}, expected ${expected.channel}` : "", runtime.major !== expected.major ? `runtime ${runtime.ref} is v${runtime.major}, expected v${expected.major}` : ""].filter(Boolean);
+  }
+  if (new Set(["train", "authority", "exact-sha"]).has(runtime.kind) && allowOpaqueRuntime) {
+    return [runtime.coherentMajor === false ? `runtime ${runtime.ref} has inconsistent major segments` : "", Number.isInteger(runtime.major) && runtime.major !== expected.major ? `runtime ${runtime.ref} is v${runtime.major}, expected v${expected.major}` : ""].filter(Boolean);
+  }
+  return [`runtime ${runtime.ref || "(missing)"} does not prove the ${expected.channel || "selected"} channel`];
+}
+
+function lockReasons(expected, lock, lockMajor, lockMajorLine) {
+  if (!lock.ref) return ["Buildchain contract lock is required for a channel-bound run"];
+  return [lock.channel !== expected.channel ? `contract lock ref ${lock.ref} does not prove the ${expected.channel} channel` : "", lock.major !== expected.major ? `contract lock ref ${lock.ref} does not prove major v${expected.major}` : "", lockMajorLine && lockMajor.major !== expected.major ? `contract lock major line ${lockMajor.ref} does not match v${expected.major}` : ""].filter(Boolean);
+}
+
+export function evaluateBuildchainChannelBinding({ workflowShellRef = "", runtimeRef = "", lockRef = "", lockMajorLine = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false } = {}) {
+  const expected = expectedIdentity({
+    workflowShellRef,
+    expectedChannel,
+    expectedMajor,
+  });
+  const runtime = parseBuildchainRefIdentity(runtimeRef);
+  const lock = parseBuildchainRefIdentity(lockRef);
+  const lockMajor = parseBuildchainRefIdentity(lockMajorLine);
+  const reasons = [...expectedReasons(expected, { expectedChannel, expectedMajor }), ...runtimeReasons(expected, runtime, allowOpaqueRuntime), ...lockReasons(expected, lock, lockMajor, lockMajorLine)];
+
+  return {
+    ok: reasons.length === 0,
+    status: reasons.length === 0 ? "channel-bound" : "channel-binding-mismatch",
+    channel: expected.channel || null,
+    major: Number.isInteger(expected.major) ? expected.major : null,
+    shell: expected.shell,
+    runtime,
+    lock,
+    lockMajor,
+    reasons,
+  };
+}