@kungfu-tech/buildchain 4.0.0 → 4.0.1-alpha.2

package/packages/core/release-candidate.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { verifyV4FloatingConsumerPolicyReceipt } from "./v4-floating-consumer-policy.js";
 import { normalizeControllerReceiptReferences, validateControllerReceiptReference } from "./controller-evidence.js";
 
 export const RELEASE_CANDIDATE_PASSPORT_CONTRACT = "kungfu-buildchain-release-candidate-passport";
@@ -171,6 +172,64 @@ function normalizeGateProfileEvidence(gateAggregate = undefined) {
   };
 }
 
+function isV4BuildchainRuntime(buildchain = {}) {
+  return [buildchain.ref, buildchain.workflowShellRef]
+    .some((value) => /^v4(?:-alpha)?$/u.test(String(value || "")))
+    || /^4\./u.test(String(buildchain.version || ""));
+}
+
+function normalizeConsumerPolicyEvidence(value, expected = {}) {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("consumerPolicyReceipt must be an object");
+  }
+  const receipt = value.receipt || value;
+  const verification = verifyV4FloatingConsumerPolicyReceipt({
+    receipt,
+    receiptRoot: value.receiptRoot || "",
+    repository: expected.repository,
+    sourceSha: expected.sourceSha,
+    resolvedRuntimeSha: expected.runtimeSha,
+  });
+  if (!verification.ok) {
+    throw new Error(`consumer policy receipt invalid: ${verification.failures.map((failure) => failure.code).join(", ")}`);
+  }
+  return { receiptRoot: verification.receiptRoot, receipt };
+}
+
+function validateConsumerPolicyEvidence(passport, check) {
+  if (isV4BuildchainRuntime(passport.buildchain)) {
+    check(Boolean(passport.consumerPolicy), "Buildchain v4 release candidate requires consumer policy evidence");
+  }
+  if (!passport.consumerPolicy) return;
+  const verification = verifyV4FloatingConsumerPolicyReceipt({
+    receipt: passport.consumerPolicy.receipt,
+    receiptRoot: passport.consumerPolicy.receiptRoot,
+    repository: passport.repository,
+    sourceSha: passport.source?.headSha,
+    resolvedRuntimeSha: passport.buildchain?.sha,
+  });
+  for (const failure of verification.failures) {
+    check(false, `consumer policy evidence invalid: ${failure.code}`);
+  }
+}
+
+function validateEvidenceBoundCandidateHash(passport, check) {
+  if (!passport.familyEvidence && !passport.consumerPolicy) return;
+  const expectedCandidateHash = sha256Json({
+    repository: passport.repository,
+    target: passport.target,
+    source: passport.source,
+    platformMatrix: passport.platformMatrix,
+    buildchain: passport.buildchain,
+    ...(passport.gateProfileEvidence ? { gateProfileEvidence: passport.gateProfileEvidence } : {}),
+    ...(passport.familyEvidence ? { familyEvidence: passport.familyEvidence } : {}),
+    ...(passport.consumerPolicy ? { consumerPolicy: passport.consumerPolicy } : {}),
+    ...(passport.controllerReceipts ? { controllerReceipts: passport.controllerReceipts } : {}),
+  });
+  check(passport.candidateHash === expectedCandidateHash, "candidate hash mismatch");
+}
+
 function normalizeFamilyReleaseEvidence(value = undefined) {
   if (value === undefined || value === null || value === "") return undefined;
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -320,6 +379,7 @@ export function createReleaseCandidatePassport({
   buildchain = {},
   gateAggregate = undefined,
   familyEvidence = undefined,
+  consumerPolicyReceipt = undefined,
   controllerReceipts = [],
   controllerReceiptReferences = [],
   workflow = {},
@@ -335,6 +395,20 @@ export function createReleaseCandidatePassport({
   const resolvedVersion = version || normalizedSummary.publishSource?.consumerVersion || inferVersionFromReleaseManifest(normalizedSummary);
   const gateProfileEvidence = normalizeGateProfileEvidence(gateAggregate);
   const normalizedFamilyEvidence = normalizeFamilyReleaseEvidence(familyEvidence);
+  const resolvedBuildchain = {
+    ref: optionalString(buildchain.ref || normalizedSummary.runtime?.ref),
+    sha: optionalString(buildchain.sha || normalizedSummary.runtime?.sha),
+    version: optionalString(buildchain.version),
+    workflowShellRef: optionalString(buildchain.workflowShellRef || normalizedSummary.runtime?.workflowShellRef),
+  };
+  const normalizedConsumerPolicy = normalizeConsumerPolicyEvidence(consumerPolicyReceipt, {
+    repository: repository || normalizedSummary.git?.repository || "",
+    sourceSha,
+    runtimeSha: resolvedBuildchain.sha,
+  });
+  if (isV4BuildchainRuntime(resolvedBuildchain) && !normalizedConsumerPolicy) {
+    throw new Error("Buildchain v4 release candidate passport requires a valid floating consumer policy receipt");
+  }
   const controllerReceiptEvidence = normalizeControllerReceiptReferences({
     receipts: controllerReceipts,
     references: controllerReceiptReferences,
@@ -366,12 +440,7 @@ export function createReleaseCandidatePassport({
       builtSourceSha: nonEmptyString(mergeRefSha || sourceSha, "builtSourceSha"),
       builtSourceTreeSha: resolvedTreeHash,
     },
-    buildchain: {
-      ref: optionalString(buildchain.ref || normalizedSummary.runtime?.ref),
-      sha: optionalString(buildchain.sha || normalizedSummary.runtime?.sha),
-      version: optionalString(buildchain.version),
-      workflowShellRef: optionalString(buildchain.workflowShellRef || normalizedSummary.runtime?.workflowShellRef),
-    },
+    buildchain: resolvedBuildchain,
     workflow: {
       name: optionalString(workflow.name),
       runId: optionalString(workflow.runId || normalizedSummary.git?.runId),
@@ -386,6 +455,7 @@ export function createReleaseCandidatePassport({
     },
     ...(gateProfileEvidence ? { gateProfileEvidence } : {}),
     ...(normalizedFamilyEvidence ? { familyEvidence: normalizedFamilyEvidence } : {}),
+    ...(normalizedConsumerPolicy ? { consumerPolicy: normalizedConsumerPolicy } : {}),
     ...(controllerReceiptEvidence.length > 0 ? { controllerReceipts: controllerReceiptEvidence } : {}),
   };
   candidate.candidateHash = sha256Json({
@@ -396,6 +466,7 @@ export function createReleaseCandidatePassport({
     buildchain: candidate.buildchain,
     ...(candidate.gateProfileEvidence ? { gateProfileEvidence: candidate.gateProfileEvidence } : {}),
     ...(candidate.familyEvidence ? { familyEvidence: candidate.familyEvidence } : {}),
+    ...(candidate.consumerPolicy ? { consumerPolicy: candidate.consumerPolicy } : {}),
     ...(candidate.controllerReceipts ? { controllerReceipts: candidate.controllerReceipts } : {}),
   });
   return candidate;
@@ -463,6 +534,7 @@ export function validateReleaseCandidatePassport({
     check(Boolean(passport.gateProfileEvidence.digest), "gate profile evidence digest is required");
     check(Boolean(passport.gateProfileEvidence.matrixDigest), "gate profile matrix digest is required");
   }
+  validateConsumerPolicyEvidence(passport, check);
   if (requireFamilyEvidence || familyEvidenceRoot || familyInitiativeId || familyAssignmentId) {
     check(Boolean(passport.familyEvidence), "family evidence is required");
   }
@@ -514,18 +586,6 @@ export function validateReleaseCandidatePassport({
       controllerIds.add(reference.controllerId);
     }
   }
-  if (passport.familyEvidence) {
-    const expectedCandidateHash = sha256Json({
-      repository: passport.repository,
-      target: passport.target,
-      source: passport.source,
-      platformMatrix: passport.platformMatrix,
-      buildchain: passport.buildchain,
-      ...(passport.gateProfileEvidence ? { gateProfileEvidence: passport.gateProfileEvidence } : {}),
-      familyEvidence: passport.familyEvidence,
-      ...(passport.controllerReceipts ? { controllerReceipts: passport.controllerReceipts } : {}),
-    });
-    check(passport.candidateHash === expectedCandidateHash, "candidate hash mismatch");
-  }
+  validateEvidenceBoundCandidateHash(passport, check);
   return { ok: errors.length === 0, errors };
 }

package/packages/core/release-passport.js

@@ -33,6 +33,16 @@ import { normalizeControllerReceiptReferences } from "./controller-evidence.js";
 import {
   normalizeGitHubArtifactAttestationPolicy,
 } from "./github-artifact-attestation.js";
+import { verifyV4FloatingConsumerPolicyCertification } from "./v4-floating-consumer-evidence.js";
+import {
+  isV4PromotionRouting,
+  releasePassportCertificationVerificationOptions,
+  requireV4ConsumerPolicyCertification,
+} from "./v4-floating-consumer-release-passport.js";
+import {
+  verifyV4RuntimeAuthorizationReceipt,
+  verifyV4RuntimeResumeLineage,
+} from "./v4-runtime-ref-resume-authority.js";
 
 export { RELEASE_CHECK_REPORT_CONTRACT, RELEASE_PASSPORT_CONTRACT };
 export const ARTIFACT_EVIDENCE_CONTRACT = "kungfu-buildchain-artifact-evidence";
@@ -390,6 +400,13 @@ function parseJsonInputWithMeta(value, fallback = undefined, { cwd = process.cwd
   };
 }
 
+function parseV4ConsumerPolicyCertification(input, cwd) {
+  return parseJsonInputWithMeta(input, undefined, {
+    cwd,
+    label: "v4ConsumerPolicyCertificationJson",
+  });
+}
+
 function mergeAuthoritativePassportBase(passport, basePassport = undefined, { requireKfd = false } = {}) {
   if (!basePassport) {
     if (requireKfd) {
@@ -1085,6 +1102,123 @@ function normalizePromotionRouting(value = undefined) {
   return JSON.parse(JSON.stringify(value));
 }
 
+function normalizePromotionEvidence({
+  release = {},
+  v4ConsumerPolicyCertification: certification,
+  v4ConsumerPolicyCertificationRoot: certificationRoot,
+  repository,
+  sourceSha,
+  cwd,
+}) {
+  const routing = normalizePromotionRouting(release.promotionRouting);
+  return {
+    routing,
+    consumerPolicy: requireV4ConsumerPolicyCertification({
+      value: certification,
+      repository,
+      sourceSha,
+      routing,
+      cwd,
+      certificationRoot,
+    }),
+  };
+}
+
+function normalizeV4RuntimeResumeEvidence(value, expected = {}) {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("v4RuntimeResumeEvidence must be a JSON object");
+  }
+  const authorizationVerification = verifyV4RuntimeAuthorizationReceipt({
+    receipt: value.authorization,
+    receiptRoot: value.authorizationRoot,
+    repository: expected.repository,
+    sourceSha: expected.sourceSha,
+    runtimeSha: expected.resumeRuntimeSha,
+    consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
+  });
+  if (!authorizationVerification.ok) {
+    throw new Error(`v4 runtime authorization invalid: ${authorizationVerification.failures.join(", ")}`);
+  }
+  const lineageVerification = verifyV4RuntimeResumeLineage({
+    lineage: value.lineage,
+    lineageRoot: value.lineageRoot,
+    repository: expected.repository,
+    sourceSha: expected.sourceSha,
+    resumeRuntimeSha: expected.resumeRuntimeSha,
+    consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
+  });
+  if (!lineageVerification.ok) {
+    throw new Error(`v4 runtime resume lineage invalid: ${lineageVerification.failures.join(", ")}`);
+  }
+  if (value.lineage?.authorizationRoot !== value.authorizationRoot) {
+    throw new Error("v4 runtime resume lineage authorization root mismatch");
+  }
+  return {
+    authorizationRoot: value.authorizationRoot,
+    authorization: structuredClone(value.authorization),
+    lineageRoot: value.lineageRoot,
+    lineage: structuredClone(value.lineage),
+  };
+}
+
+function prepareBuildEvidence({
+  buildSummary,
+  buildFacts,
+  platformArtifactManifests,
+  distTagPromotionEvidence,
+}) {
+  return {
+    buildSummary: buildSummary
+      ? normalizeEvidenceDocument(buildSummary, "buildSummary")
+      : undefined,
+    buildFacts: (buildFacts || [])
+      .map((value, index) =>
+        normalizeEvidenceDocument(value, `buildFacts[${index}]`),
+      )
+      .filter(Boolean),
+    platformArtifactManifests: (platformArtifactManifests || [])
+      .map((manifest, index) =>
+        normalizePlatformArtifactManifest(manifest, index),
+      )
+      .filter(Boolean),
+    distTagPromotionEvidence: distTagPromotionEvidence
+      ? normalizeEvidenceDocument(
+          distTagPromotionEvidence,
+          "distTagPromotionEvidence",
+        )
+      : undefined,
+  };
+}
+
+function preparePromotionBuild(options) {
+  return {
+    promotion: normalizePromotionEvidence(options),
+    buildEvidence: prepareBuildEvidence(options),
+  };
+}
+
+function normalizeReleaseSourceFields(release) {
+  return {
+    builtSourceSha: releaseField(release, "builtSourceSha", "built_source_sha"),
+    builtSourceTreeSha: releaseField(
+      release,
+      "builtSourceTreeSha",
+      "built_source_tree_sha",
+    ),
+    promotionChannelSha: releaseField(
+      release,
+      "promotionChannelSha",
+      "promotion_channel_sha",
+    ),
+    promotionChannelTreeSha: releaseField(
+      release,
+      "promotionChannelTreeSha",
+      "promotion_channel_tree_sha",
+    ),
+  };
+}
+
 export function createArtifactEvidence({ assets = [], repository = "", tag = "", sourceSha = "", workflow = {}, kfdAdopter = undefined } = {}) {
   const normalizedAssets = assets.map((asset, index) => normalizeAsset(asset, index));
   return buildReleaseArtifactEvidence({ normalizedAssets, repository, tag, sourceSha, workflow, kfdAdopter });
@@ -1120,7 +1254,8 @@ function prepareReleaseKfdAdopterArtifacts({ kfdAdopter, assets, repository, tag
   };
 }
 
-export function createReleasePassport({
+export function createReleasePassport(options = {}) {
+  const {
   cwd = process.cwd(),
   repository = "",
   tag = "",
@@ -1161,13 +1296,16 @@ export function createReleasePassport({
   kfdSupportEvidencePath = "",
   invariantPassports = undefined,
   releaseEvidence = [],
+  v4ConsumerPolicyCertification = undefined,
+  v4ConsumerPolicyCertificationRoot = "",
+  v4RuntimeResumeEvidence = undefined,
   kfdAgentHubEvidence = undefined,
   kfdAgentHubEvidencePath = "",
   controllerReceipts = [],
   controllerReceiptReferences = [],
   githubArtifactAttestations = [],
   checkedAt = "",
-} = {}) {
+  } = options;
   const normalizedTag = nonEmptyString(tag, "tag");
   const { normalized: normalizedKfdAdopter, artifactEvidence } = prepareReleaseKfdAdopterArtifacts({
     kfdAdopter, assets, repository, tag: normalizedTag, sourceSha, workflow,
@@ -1176,17 +1314,13 @@ export function createReleasePassport({
   const normalizedPackageSet = normalizePackageSet(packageSet, { packageName, packageVersion, publish });
   const normalizedTrustedPublishing = normalizeTrustedPublishing(trustedPublishing, { workflow, publish });
   const normalizedTransaction = normalizeTransaction(transaction);
-  const normalizedPromotionRouting = normalizePromotionRouting(release.promotionRouting);
-  const normalizedBuildSummary = buildSummary ? normalizeEvidenceDocument(buildSummary, "buildSummary") : undefined;
-  const normalizedBuildFacts = (buildFacts || [])
-    .map((fact, index) => normalizeEvidenceDocument(fact, `buildFacts[${index}]`))
-    .filter(Boolean);
-  const normalizedPlatformArtifactManifests = (platformArtifactManifests || [])
-    .map((manifest, index) => normalizePlatformArtifactManifest(manifest, index))
-    .filter(Boolean);
-  const normalizedDistTagPromotionEvidence = distTagPromotionEvidence
-    ? normalizeEvidenceDocument(distTagPromotionEvidence, "distTagPromotionEvidence")
-    : undefined;
+  const { promotion, buildEvidence } = preparePromotionBuild(options);
+  const normalizedV4RuntimeResume = normalizeV4RuntimeResumeEvidence(v4RuntimeResumeEvidence, {
+    repository,
+    sourceSha,
+    resumeRuntimeSha: promotion.routing?.runtime?.resolvedSha || "",
+    consumerPolicyReceiptRoot: promotion.consumerPolicy?.certification?.receiptRoot || "",
+  });
   const normalizedImpact = normalizeImpactLedger(impact, { tag: normalizedTag, line });
   const generatedAt = optionalString(checkedAt) || nowIso();
   const kfd1Metadata = resolveKfd1Metadata();
@@ -1205,16 +1339,13 @@ export function createReleasePassport({
       support: kfdSupportEvidencePath,
     },
   });
-  const builtSourceSha = releaseField(release, "builtSourceSha", "built_source_sha");
-  const builtSourceTreeSha = releaseField(release, "builtSourceTreeSha", "built_source_tree_sha");
-  const promotionChannelSha = releaseField(release, "promotionChannelSha", "promotion_channel_sha");
-  const promotionChannelTreeSha = releaseField(release, "promotionChannelTreeSha", "promotion_channel_tree_sha");
+  const sourceFields = normalizeReleaseSourceFields(release);
   const treeEquivalent = release.treeEquivalent === true;
   const recoveryTreeEquivalent = Boolean(
     treeEquivalent &&
-    builtSourceTreeSha &&
-    promotionChannelTreeSha &&
-    builtSourceTreeSha === promotionChannelTreeSha,
+    sourceFields.builtSourceTreeSha &&
+    sourceFields.promotionChannelTreeSha &&
+    sourceFields.builtSourceTreeSha === sourceFields.promotionChannelTreeSha,
   );
   const normalizedControllerReceipts = normalizeControllerReceiptReferences({
     receipts: controllerReceipts,
@@ -1222,8 +1353,8 @@ export function createReleasePassport({
     expectedSourceSha: sourceSha,
     acceptedSourceShas: acceptedControllerSourceShas({
       treeEquivalent,
-      builtSourceSha,
-      promotionChannelSha,
+      builtSourceSha: sourceFields.builtSourceSha,
+      promotionChannelSha: sourceFields.promotionChannelSha,
       sourceSha,
       recoveryTreeEquivalent,
     }),
@@ -1285,9 +1416,9 @@ export function createReleasePassport({
       releaseSha,
       releaseMaterialSha,
       builtSourceSha: optionalString(release.builtSourceSha || release.built_source_sha),
-      builtSourceTreeSha,
+      builtSourceTreeSha: sourceFields.builtSourceTreeSha,
       promotionChannelSha: optionalString(release.promotionChannelSha || release.promotion_channel_sha),
-      promotionChannelTreeSha,
+      promotionChannelTreeSha: sourceFields.promotionChannelTreeSha,
       treeEquivalent: release.treeEquivalent === undefined ? undefined : Boolean(release.treeEquivalent),
       publishToolingSha: optionalString(
         release.publishToolingSha ||
@@ -1325,15 +1456,17 @@ export function createReleasePassport({
       ["versionMaterial", versionMaterial],
       ["trustedPublishing", normalizedTrustedPublishing],
       ["transaction", normalizedTransaction],
-      ["promotionRouting", normalizedPromotionRouting],
-      ["buildSummary", normalizedBuildSummary],
-      ["buildFacts", normalizedBuildFacts],
-      ["platformArtifactManifests", normalizedPlatformArtifactManifests],
-      ["distTagPromotion", normalizedDistTagPromotionEvidence],
+      ["promotionRouting", promotion.routing],
+      ["buildSummary", buildEvidence.buildSummary],
+      ["buildFacts", buildEvidence.buildFacts],
+      ["platformArtifactManifests", buildEvidence.platformArtifactManifests],
+      ["distTagPromotion", buildEvidence.distTagPromotionEvidence],
       ...kfdParts.sectionEntries,
       ["kfdAgentHub", normalizedKfdAgentHub],
       ["invariantPassports", invariantPassports],
       ["releaseEvidence", releaseEvidence],
+      ["v4ConsumerPolicy", promotion.consumerPolicy],
+      ["v4RuntimeResume", normalizedV4RuntimeResume],
       ["controllerReceipts", normalizedControllerReceipts],
       ["githubArtifactAttestations", normalizedGitHubArtifactAttestations],
     ]),
@@ -1360,21 +1493,21 @@ export function createReleasePassport({
       artifactEvidence: artifactEvidencePath,
       publishEvidence: publishEvidencePath,
       transactionState: transactionStatePath,
-      buildSummary: normalizedBuildSummary?.path || "",
-      buildFacts: normalizedBuildFacts.map((fact) => ({
+      buildSummary: buildEvidence.buildSummary?.path || "",
+      buildFacts: buildEvidence.buildFacts.map((fact) => ({
         path: fact.path || "",
         sha256: fact.sha256 || "",
         contract: fact.fields?.contract || "",
         id: fact.fields?.id || "",
         digest: fact.fields?.digest || "",
       })),
-      platformArtifactManifests: normalizedPlatformArtifactManifests.map((manifest) => ({
+      platformArtifactManifests: buildEvidence.platformArtifactManifests.map((manifest) => ({
         path: manifest.path,
         sha256: manifest.sha256,
         platform: manifest.platform,
         artifactName: manifest.artifactName,
       })),
-      distTagPromotionEvidence: normalizedDistTagPromotionEvidence?.path || "",
+      distTagPromotionEvidence: buildEvidence.distTagPromotionEvidence?.path || "",
       ...kfdParts.evidence,
       kfdAgentHub: normalizedKfdAgentHub ? optionalString(kfdAgentHubEvidencePath || "kfd-agent-hub-evidence.json") : "",
       invariantPassports: invariantPassports ? "invariantPassports" : "",
@@ -1456,6 +1589,9 @@ export function collectGitHubReleasePassport({
   invariantPassportJsons = [],
   invariantPassportCommand = "",
   releaseEvidenceJsons = [],
+  v4ConsumerPolicyCertificationJson = "",
+  v4ConsumerPolicyCertificationRoot = "",
+  v4RuntimeResumeEvidenceJson = "",
   kfdAgentHubEvidenceJson = "",
   controllerReceiptReferences = [],
   githubArtifactAttestationPolicyJsons = [],
@@ -1531,6 +1667,12 @@ export function collectGitHubReleasePassport({
       }),
     )
     .filter((meta) => meta.value);
+  const v4ConsumerPolicyCertificationMeta =
+    parseV4ConsumerPolicyCertification(v4ConsumerPolicyCertificationJson, cwd);
+  const v4RuntimeResumeEvidence = parseJsonInput(v4RuntimeResumeEvidenceJson, undefined, {
+    cwd,
+    label: "v4RuntimeResumeEvidenceJson",
+  });
   const kfdAgentHubEvidenceMeta = parseJsonInputWithMeta(
     kfdAgentHubEvidenceJson,
     undefined,
@@ -1656,6 +1798,9 @@ export function collectGitHubReleasePassport({
     kfdSupportEvidencePath: kfdSupport ? "kfd-support.json" : "",
     invariantPassports,
     releaseEvidence: releaseEvidenceAttachments.map(({ reference }) => reference),
+    v4ConsumerPolicyCertification: v4ConsumerPolicyCertificationMeta.value,
+    v4ConsumerPolicyCertificationRoot,
+    v4RuntimeResumeEvidence,
     kfdAgentHubEvidence: kfdAgentHubEvidenceMeta.value
       ? { ...kfdAgentHubEvidenceMeta, path: "kfd-agent-hub-evidence.json" }
       : undefined,
@@ -2125,6 +2270,65 @@ function validateReleaseEvidenceAttachments({
   return { evidenceArtifacts, releaseEvidence };
 }
 
+function validateV4ConsumerPolicyPassportSection({ passport, issues }) {
+  const routing = passport?.promotionRouting;
+  const evidence = passport?.v4ConsumerPolicy;
+  if (isV4PromotionRouting(routing) && !evidence) {
+    issues.push(issue(
+      "error",
+      "v4ConsumerPolicy.missing",
+      "Buildchain v4 Release Passport requires an external floating consumer policy certification",
+    ));
+    return;
+  }
+  if (!evidence) return;
+  const verification = verifyV4FloatingConsumerPolicyCertification(
+    releasePassportCertificationVerificationOptions({
+      evidence,
+      passport,
+      routing,
+    }),
+  );
+  for (const failure of verification.failures) {
+    issues.push(issue("error", `v4ConsumerPolicy.${failure.code}`, failure.message));
+  }
+}
+
+function validateV4RuntimeResumePassportSection({ passport, issues }) {
+  const evidence = passport?.v4RuntimeResume;
+  if (!evidence) return;
+  const consumerPolicyReceiptRoot = passport?.v4ConsumerPolicy?.certification?.receiptRoot || "";
+  const authorization = verifyV4RuntimeAuthorizationReceipt({
+    receipt: evidence.authorization,
+    receiptRoot: evidence.authorizationRoot,
+    repository: passport?.product?.repository || "",
+    sourceSha: passport?.release?.sourceSha || "",
+    runtimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
+    consumerPolicyReceiptRoot,
+  });
+  for (const failure of authorization.failures) {
+    issues.push(issue("error", `v4RuntimeResume.authorization.${failure}`, failure));
+  }
+  const lineage = verifyV4RuntimeResumeLineage({
+    lineage: evidence.lineage,
+    lineageRoot: evidence.lineageRoot,
+    repository: passport?.product?.repository || "",
+    sourceSha: passport?.release?.sourceSha || "",
+    resumeRuntimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
+    consumerPolicyReceiptRoot,
+  });
+  for (const failure of lineage.failures) {
+    issues.push(issue("error", `v4RuntimeResume.lineage.${failure}`, failure));
+  }
+  if (evidence.lineage?.authorizationRoot !== evidence.authorizationRoot) {
+    issues.push(issue(
+      "error",
+      "v4RuntimeResume.authorization-root-mismatch",
+      "runtime resume lineage must bind the embedded authorization receipt root",
+    ));
+  }
+}
+
 function validatePublishEvidenceSection({ passport, publishEvidence, normalizedPublishEvidence, issues }) {
   const publishEvidenceSupplied =
     Boolean(passport?.evidence?.publishEvidence) ||
@@ -2597,6 +2801,8 @@ export function createReleaseCheckReport({
     releaseEvidenceDocuments,
     issues,
   });
+  validateV4ConsumerPolicyPassportSection({ passport, issues });
+  validateV4RuntimeResumePassportSection({ passport, issues });
   validatePublishEvidenceSection({ passport, publishEvidence, normalizedPublishEvidence, issues });
   const evidenceIndex = indexEvidenceArtifacts(evidenceArtifacts);
   validateReleaseArtifacts({ artifacts, evidenceIndex, issues });