@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.55

package/packages/core/v4-cross-platform-adopter-qualification.js

@@ -0,0 +1,343 @@
+import { adopterDeliveryGateDigest } from "./adopter-delivery-json.js";
+
+export const V4_CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT =
+  "kungfu-buildchain-v4-cross-platform-adopter-report/v1";
+export const V4_CROSS_PLATFORM_ADOPTER_QUALIFICATION_CONTRACT =
+  "kungfu-buildchain-v4-cross-platform-adopter-qualification/v1";
+export const V4_CROSS_PLATFORM_ADOPTER_PLATFORMS = Object.freeze([
+  "linux-x64",
+  "macos-arm64",
+  "windows-x64",
+]);
+export const V4_CROSS_PLATFORM_NEUTRAL_DRIVER = "ledger-specification-driver";
+
+const SHA = /^[0-9a-f]{40}$/u;
+const ROOT = /^sha256:[0-9a-f]{64}$/u;
+const CONSUMER = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
+
+function fail(message) {
+  throw new Error(`v4 cross-platform adopter qualification: ${message}`);
+}
+
+function exactKeys(value, keys, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail(`${label} must be an object`);
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  if (
+    actual.length !== expected.length ||
+    actual.some((key, index) => key !== expected[index])
+  )
+    fail(`${label} has an unsupported field set`);
+  return value;
+}
+
+function same(left, right) {
+  return adopterDeliveryGateDigest(left) === adopterDeliveryGateDigest(right);
+}
+
+export function summarizeV3V4CapabilityInventory(inventory) {
+  exactKeys(
+    inventory,
+    [
+      "capabilities",
+      "contract",
+      "extraction",
+      "reverseHistory",
+      "schemaVersion",
+      "sourceCuts",
+      "summary",
+    ],
+    "capability inventory",
+  );
+  if (
+    inventory.schemaVersion !== 1 ||
+    inventory.contract !==
+      "kungfu-buildchain-v3-v4-live-capability-inventory" ||
+    !Array.isArray(inventory.capabilities) ||
+    inventory.capabilities.length === 0
+  )
+    fail("capability inventory contract is unsupported");
+
+  const categoryCounts = {};
+  const dispositionCounts = {};
+  const ids = new Set();
+  for (const [index, capability] of inventory.capabilities.entries()) {
+    if (
+      !capability ||
+      typeof capability !== "object" ||
+      typeof capability.id !== "string" ||
+      typeof capability.category !== "string" ||
+      typeof capability.disposition !== "string" ||
+      !capability.sourceEvidence ||
+      !capability.v4Route ||
+      typeof capability.v4Route.capabilityId !== "string" ||
+      capability.v4Route.capabilityId.length === 0 ||
+      !capability.v4Route.evidence ||
+      capability.residual !== null
+    )
+      fail(
+        `capability ${index} does not bind an exact v3 source to a v4 route`,
+      );
+    if (ids.has(capability.id))
+      fail(`duplicate capability id ${capability.id}`);
+    ids.add(capability.id);
+    categoryCounts[capability.category] =
+      (categoryCounts[capability.category] || 0) + 1;
+    dispositionCounts[capability.disposition] =
+      (dispositionCounts[capability.disposition] || 0) + 1;
+  }
+  const summary = {
+    capabilityCount: inventory.capabilities.length,
+    categoryCounts: Object.fromEntries(
+      Object.entries(categoryCounts).sort(([left], [right]) =>
+        left.localeCompare(right, "en"),
+      ),
+    ),
+    dispositionCounts: Object.fromEntries(
+      Object.entries(dispositionCounts).sort(([left], [right]) =>
+        left.localeCompare(right, "en"),
+      ),
+    ),
+    residualCount: 0,
+    unknownCount: 0,
+    unownedCount: 0,
+  };
+  if (!same(summary, inventory.summary))
+    fail("capability inventory summary does not match its raw rows");
+  return {
+    inventoryRoot: adopterDeliveryGateDigest(inventory),
+    sourceCuts: structuredClone(inventory.sourceCuts),
+    summary,
+    categories: Object.entries(summary.categoryCounts).map(
+      ([category, count]) => ({
+        category,
+        count,
+        applicability: "exact-source-route",
+        status: "passed",
+      }),
+    ),
+  };
+}
+
+function validateSourceBinding(binding) {
+  exactKeys(
+    binding,
+    ["runtimeSha", "consumerSha", "inventoryRoot", "sourceCuts"],
+    "source binding",
+  );
+  if (
+    !SHA.test(binding.runtimeSha || "") ||
+    !SHA.test(binding.consumerSha || "") ||
+    !ROOT.test(binding.inventoryRoot || "")
+  )
+    fail("report requires exact runtime, consumer and inventory roots");
+}
+
+function completeCategory(entry, counts) {
+  return (
+    entry &&
+    typeof entry.category === "string" &&
+    Number.isSafeInteger(entry.count) &&
+    entry.count > 0 &&
+    entry.applicability === "exact-source-route" &&
+    entry.status === "passed" &&
+    counts[entry.category] === entry.count
+  );
+}
+
+function sumCounts(counts) {
+  return Object.values(counts).reduce((total, count) => total + count, 0);
+}
+
+function validateCapabilityMatrix(matrix) {
+  exactKeys(
+    matrix,
+    ["capabilityCount", "categoryCounts", "dispositionCounts", "categories"],
+    "capability matrix",
+  );
+  const complete =
+    Number.isSafeInteger(matrix.capabilityCount) &&
+    matrix.capabilityCount > 0 &&
+    Array.isArray(matrix.categories) &&
+    matrix.categories.length > 0 &&
+    matrix.categories.every((entry) =>
+      completeCategory(entry, matrix.categoryCounts),
+    ) &&
+    Object.keys(matrix.categoryCounts).length === matrix.categories.length &&
+    sumCounts(matrix.categoryCounts) === matrix.capabilityCount &&
+    sumCounts(matrix.dispositionCounts) === matrix.capabilityCount;
+  if (!complete)
+    fail("platform report does not carry the complete raw capability matrix");
+}
+
+function validateExecutionEvidence(execution) {
+  exactKeys(
+    execution,
+    [
+      "initialRun",
+      "tamperFailure",
+      "retryRun",
+      "terminalVerify",
+      "bootstrap",
+      "neutralDriver",
+    ],
+    "execution evidence",
+  );
+  const complete =
+    execution.initialRun?.status === "passed" &&
+    ROOT.test(execution.initialRun?.readbackRoot || "") &&
+    execution.tamperFailure?.status === "failed-as-required" &&
+    Number.isSafeInteger(execution.tamperFailure?.exitCode) &&
+    execution.tamperFailure.exitCode > 0 &&
+    execution.retryRun?.status === "passed" &&
+    execution.retryRun?.readbackRoot === execution.initialRun.readbackRoot &&
+    execution.terminalVerify?.status === "passed" &&
+    execution.terminalVerify?.readbackRoot ===
+      execution.retryRun.readbackRoot &&
+    execution.bootstrap?.status === "passed" &&
+    ROOT.test(execution.bootstrap?.resultRoot || "") &&
+    execution.neutralDriver?.id === V4_CROSS_PLATFORM_NEUTRAL_DRIVER &&
+    execution.neutralDriver?.status === "passed" &&
+    execution.neutralDriver?.kfdDependencyPresent === false;
+  if (!complete)
+    fail("failure, retry, terminal or neutral-driver evidence is incomplete");
+}
+
+function validateAuthorityCeiling(authority) {
+  exactKeys(
+    authority,
+    [
+      "productionWrites",
+      "providerEffects",
+      "releaseEffects",
+      "stablePublication",
+    ],
+    "authority ceiling",
+  );
+  if (Object.values(authority).some((value) => value !== false))
+    fail("qualification report must not grant production or release authority");
+}
+
+export function validateV4CrossPlatformAdopterReport(report) {
+  exactKeys(
+    report,
+    [
+      "schemaVersion",
+      "contract",
+      "platform",
+      "consumer",
+      "sourceBinding",
+      "capabilityMatrix",
+      "execution",
+      "authority",
+      "reportRoot",
+    ],
+    "platform report",
+  );
+  if (
+    report.schemaVersion !== 1 ||
+    report.contract !== V4_CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT
+  )
+    fail("platform report contract is unsupported");
+  if (!V4_CROSS_PLATFORM_ADOPTER_PLATFORMS.includes(report.platform))
+    fail(`undeclared platform ${report.platform}`);
+  if (!CONSUMER.test(report.consumer || ""))
+    fail("consumer must be a stable lowercase identity");
+  validateSourceBinding(report.sourceBinding);
+  validateCapabilityMatrix(report.capabilityMatrix);
+  validateExecutionEvidence(report.execution);
+  validateAuthorityCeiling(report.authority);
+  if (!ROOT.test(report.reportRoot || "")) fail("report root is invalid");
+  const body = structuredClone(report);
+  delete body.reportRoot;
+  if (adopterDeliveryGateDigest(body) !== report.reportRoot)
+    fail("report root does not match exact report bytes");
+  return structuredClone(report);
+}
+
+export function createV4CrossPlatformAdopterReport(input) {
+  const body = structuredClone(input);
+  const report = {
+    schemaVersion: 1,
+    contract: V4_CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT,
+    ...body,
+  };
+  report.reportRoot = adopterDeliveryGateDigest(report);
+  return validateV4CrossPlatformAdopterReport(report);
+}
+
+export function qualifyV4CrossPlatformAdopters({ reports, consumers }) {
+  if (!Array.isArray(reports) || reports.length === 0)
+    fail("at least one raw platform report is required");
+  if (
+    !Array.isArray(consumers) ||
+    consumers.length === 0 ||
+    consumers.some((consumer) => !CONSUMER.test(consumer)) ||
+    new Set(consumers).size !== consumers.length
+  )
+    fail("required consumers must be unique stable lowercase identities");
+  const normalized = reports.map(validateV4CrossPlatformAdopterReport);
+  const expectedKeys = consumers.flatMap((consumer) =>
+    V4_CROSS_PLATFORM_ADOPTER_PLATFORMS.map(
+      (platform) => `${consumer}:${platform}`,
+    ),
+  );
+  const reportByKey = new Map();
+  for (const report of normalized) {
+    const key = `${report.consumer}:${report.platform}`;
+    if (reportByKey.has(key)) fail(`duplicate report ${key}`);
+    reportByKey.set(key, report);
+  }
+  const missing = expectedKeys.filter((key) => !reportByKey.has(key));
+  const unexpected = [...reportByKey.keys()].filter(
+    (key) => !expectedKeys.includes(key),
+  );
+  if (missing.length || unexpected.length)
+    fail(
+      `platform matrix mismatch; missing=${missing.join(",") || "none"}; unexpected=${unexpected.join(",") || "none"}`,
+    );
+  const reference = normalized[0].sourceBinding;
+  for (const report of normalized.slice(1)) {
+    if (
+      report.sourceBinding.runtimeSha !== reference.runtimeSha ||
+      report.sourceBinding.inventoryRoot !== reference.inventoryRoot ||
+      !same(report.sourceBinding.sourceCuts, reference.sourceCuts) ||
+      !same(report.capabilityMatrix, normalized[0].capabilityMatrix)
+    )
+      fail("all platform reports must bind the same exact source and matrix");
+  }
+  const orderedReports = expectedKeys.map((key) => reportByKey.get(key));
+  const body = {
+    schemaVersion: 1,
+    contract: V4_CROSS_PLATFORM_ADOPTER_QUALIFICATION_CONTRACT,
+    sourceBinding: {
+      runtimeSha: reference.runtimeSha,
+      inventoryRoot: reference.inventoryRoot,
+      sourceCuts: structuredClone(reference.sourceCuts),
+    },
+    consumers: [...consumers],
+    platforms: [...V4_CROSS_PLATFORM_ADOPTER_PLATFORMS],
+    capabilityMatrix: structuredClone(normalized[0].capabilityMatrix),
+    reports: orderedReports.map(({ consumer, platform, reportRoot }) => ({
+      consumer,
+      platform,
+      reportRoot,
+    })),
+    neutralDriver: {
+      id: V4_CROSS_PLATFORM_NEUTRAL_DRIVER,
+      platformCoverage: [...V4_CROSS_PLATFORM_ADOPTER_PLATFORMS],
+      status: "passed",
+    },
+    authority: {
+      productionWrites: false,
+      providerEffects: false,
+      releaseEffects: false,
+      stablePublication: false,
+    },
+  };
+  return {
+    ...body,
+    qualificationRoot: adopterDeliveryGateDigest(body),
+  };
+}

package/packages/core/v4-delivery-warrant-read-candidate.js

@@ -100,7 +100,9 @@ export function validateV4DeliveryWarrantReadQualification(
 }
 
 export function projectV3QueueToV4ReadState(queueInput) {
-  const queue = normalizeDevDeliveryQueue(queueInput);
+  const queue = normalizeDevDeliveryQueue(queueInput, {
+    allowLegacyV3Readback: true,
+  });
   return {
     schema: STATE_CONTRACT,
     generation: queue.generation,
@@ -219,7 +221,9 @@ export async function runV4DeliveryWarrantReadCandidate(
   });
   if (typeof retain !== "function")
     fail("retention-required", "v4 read evidence retention is required");
-  const queue = normalizeDevDeliveryQueue(queueInput);
+  const queue = normalizeDevDeliveryQueue(queueInput, {
+    allowLegacyV3Readback: true,
+  });
   const state = projectV3QueueToV4ReadState(queue);
   const request = createV4DeliveryWarrantReadRequest(state, {
     requestId,
@@ -235,7 +239,10 @@ export async function runV4DeliveryWarrantReadCandidate(
     );
   }
   const projection = validateProjection(response, request, state);
-  const observation = observeDevDeliveryQueue(queue, { now: observedAt });
+  const observation = observeDevDeliveryQueue(queue, {
+    now: observedAt,
+    allowLegacyV3Readback: true,
+  });
   const evidence = {
     schema: V4_DELIVERY_WARRANT_READ_EVIDENCE_CONTRACT,
     authority: "typescript-v3",

package/packages/core/v4-floating-consumer-evidence.js

@@ -8,6 +8,12 @@ export const V4_FLOATING_CONSUMER_CERTIFICATION =
   "kungfu-buildchain-v4-floating-consumer-certification/v1";
 
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
+const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
+  repository: "kungfu-systems/buildchain",
+  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  workflow: ".github/workflows/.release-candidate-promote.yml",
+  selector: "alpha/v4/v4.0",
+});
 
 function stableJson(value) {
   if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
@@ -109,15 +115,23 @@ function verifyAuthorityFields(value, expected, check, label) {
 }
 
 function verifyFloatingSelector(value, check, label) {
+  const bootstrap =
+    value?.caller?.repository === ALPHA_RECOVERY_BOOTSTRAP.repository &&
+    value?.invocation?.sourcePath === ALPHA_RECOVERY_BOOTSTRAP.sourcePath &&
+    value?.invocation?.workflow === ALPHA_RECOVERY_BOOTSTRAP.workflow &&
+    value?.invocation?.visibleSelector === ALPHA_RECOVERY_BOOTSTRAP.selector &&
+    value?.invocation?.selectorClass === "protected-bootstrap" &&
+    value?.invocation?.channel === "alpha";
   check(
-    value?.invocation?.selectorClass === "floating",
+    value?.invocation?.selectorClass === "floating" || bootstrap,
     "selector-class-invalid",
-    `${label} must bind a floating selector`,
+    `${label} must bind a floating selector or the bounded protected alpha recovery bootstrap`,
   );
   check(
-    ["v4", "v4-alpha"].includes(value?.invocation?.visibleSelector),
+    ["v4", "v4-alpha"].includes(value?.invocation?.visibleSelector) ||
+      bootstrap,
     "selector-invalid",
-    `${label} selector must be v4 or v4-alpha`,
+    `${label} selector must be v4, v4-alpha, or the bounded protected alpha recovery bootstrap`,
   );
 }
 

package/packages/core/v4-floating-consumer-policy.js

@@ -26,6 +26,11 @@ const EXACT_SHA = /^[0-9a-f]{40}$/u;
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 const BUILDCHAIN_REPOSITORY = "kungfu-systems/buildchain";
 const CHANNELS = Object.freeze({ v4: "stable", "v4-alpha": "alpha" });
+const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
+  selector: "alpha/v4/v4.0",
+  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  workflow: ".github/workflows/.release-candidate-promote.yml",
+});
 const DEFAULT_STABLE_LOCK_PATH = ".buildchain/contract-lock.json";
 const DEFAULT_ALPHA_LOCK_PATH = ".buildchain/alpha-contract-lock.json";
 const TRANSIENT_ACTION =
@@ -277,7 +282,7 @@ function readContractLock(root, relative, expectedRef, label, failures) {
   }
 }
 
-function classifyBuildchainUses(records, failures) {
+function classifyBuildchainUses(records, failures, { repository } = {}) {
   const uses = [];
   for (const record of records) {
     const parsed = coordinate(record.uses);
@@ -286,15 +291,28 @@ function classifyBuildchainUses(records, failures) {
       parsed.selector === "v4" ||
       parsed.selector === "v4-alpha" ||
       /^v4(?:[./-]|$)/u.test(parsed.selector) ||
+      parsed.selector === ALPHA_RECOVERY_BOOTSTRAP.selector ||
       EXACT_SHA.test(parsed.selector.toLowerCase()) ||
       parsed.selector.includes("${{");
     if (!v4Candidate) continue;
-    const channel = CHANNELS[parsed.selector] || "";
+    const bootstrapShape =
+      normalizeWorkflowPath(parsed.path) ===
+        ALPHA_RECOVERY_BOOTSTRAP.workflow &&
+      record.sourcePath === ALPHA_RECOVERY_BOOTSTRAP.sourcePath &&
+      parsed.selector === ALPHA_RECOVERY_BOOTSTRAP.selector;
+    const protectedBootstrap =
+      repository === BUILDCHAIN_REPOSITORY && bootstrapShape;
+    const channel =
+      CHANNELS[parsed.selector] || (protectedBootstrap ? "alpha" : "");
     uses.push({
       ...record,
       ...parsed,
       channel,
-      selectorClass: channel ? "floating" : "rejected",
+      selectorClass: protectedBootstrap
+        ? "protected-bootstrap"
+        : channel
+          ? "floating"
+          : "rejected",
     });
     if (!channel) failures.push(selectorFailure(record, parsed.selector));
   }
@@ -320,8 +338,97 @@ function selectInvocation(uses, workflow, failures, source = "", channel = "") {
   return { expectedWorkflow, selected: invocations[0] };
 }
 
+function scanInvocationSource({
+  sourceRoot,
+  invocationRoot,
+  sourceScan,
+  sourceUses,
+  failures,
+  repository,
+}) {
+  if (invocationRoot === sourceRoot)
+    return { invocationScan: sourceScan, invocationUses: sourceUses };
+  try {
+    const invocationScan = enumerateUses(invocationRoot);
+    return {
+      invocationScan,
+      invocationUses: classifyBuildchainUses(invocationScan.records, failures, {
+        repository,
+      }),
+    };
+  } catch (error) {
+    failures.push({
+      code: "invocation-source-scan-failed",
+      message: error.message,
+    });
+    return {
+      invocationScan: { files: [], records: [] },
+      invocationUses: [],
+    };
+  }
+}
+
+function sourceScanRoot({
+  sourceRoot,
+  invocationRoot,
+  sourceScan,
+  invocationScan,
+  invocationUses,
+}) {
+  const material =
+    invocationRoot === sourceRoot
+      ? sourceScan
+      : {
+          source: sourceScan,
+          invocation: {
+            files: invocationScan.files,
+            invocations: invocationUses,
+          },
+        };
+  return sha256(stableJson(material));
+}
+
+function verifySelectedLock({
+  selected,
+  stable,
+  alpha,
+  workflowSha,
+  failures,
+}) {
+  const selectedLock = selected?.channel === "alpha" ? alpha : stable;
+  if (!selected?.channel || !selectedLock) return;
+  const authorityRef =
+    selected.selectorClass === "protected-bootstrap"
+      ? "v4-alpha"
+      : selected.selector;
+  try {
+    const compatibility = evaluateBuildchainContractLock({
+      lock: selectedLock,
+      current: createBuildchainContractWorld({ root: defaultRuntimeRoot() }),
+      runtimeRef: authorityRef,
+      runtimeSha: workflowSha,
+      runtimeClass: selected.channel,
+      workflowShellRef: authorityRef,
+      expectedChannel: selected.channel,
+      expectedMajor: "v4",
+    });
+    if (!compatibility.ok) {
+      failures.push({
+        code: "selected-lock-runtime-incompatible",
+        message: `${selected.channel} contract lock rejects resolved workflow shell ${workflowSha}: ${compatibility.reasons?.join("; ") || compatibility.status}`,
+      });
+    }
+  } catch (error) {
+    failures.push({
+      code: "selected-lock-contract-world-invalid",
+      message: `cannot evaluate ${selected.channel} contract lock against the resolved workflow shell: ${error.message}`,
+    });
+  }
+}
+
 export function scanV4FloatingConsumerPolicy({
   root = process.cwd(),
+  invocationRoot = root,
   repository = "",
   sourceSha = "",
   invokedWorkflow = "",
@@ -335,6 +442,7 @@ export function scanV4FloatingConsumerPolicy({
   scannerRoot = "",
 } = {}) {
   const resolvedRoot = path.resolve(root);
+  const resolvedInvocationRoot = path.resolve(invocationRoot);
   if (!policy || policy.contract !== V4_FLOATING_CONSUMER_POLICY) {
     throw new Error(`policy must use ${V4_FLOATING_CONSUMER_POLICY}`);
   }
@@ -374,43 +482,34 @@ export function scanV4FloatingConsumerPolicy({
   } catch (error) {
     failures.push({ code: "source-scan-failed", message: error.message });
   }
-  const buildchainUses = classifyBuildchainUses(scanned.records, failures);
+  const buildchainUses = classifyBuildchainUses(scanned.records, failures, {
+    repository,
+  });
+  const { invocationScan, invocationUses } = scanInvocationSource({
+    sourceRoot: resolvedRoot,
+    invocationRoot: resolvedInvocationRoot,
+    sourceScan: scanned,
+    sourceUses: buildchainUses,
+    failures,
+    repository,
+  });
   const sourcePath = String(invocationSourcePath || "")
     .split("@")[0]
     .replace(`${repository}/`, "");
   const { expectedWorkflow, selected } = selectInvocation(
-    buildchainUses,
+    invocationUses,
     invokedWorkflow,
     failures,
     sourcePath,
     expectedInvocationChannel,
   );
-  const selectedLock = selected?.channel === "alpha" ? alpha : stable;
-  if (selected?.channel && selectedLock) {
-    try {
-      const compatibility = evaluateBuildchainContractLock({
-        lock: selectedLock,
-        current: createBuildchainContractWorld({ root: defaultRuntimeRoot() }),
-        runtimeRef: selected.selector,
-        runtimeSha: normalizedWorkflowSha,
-        runtimeClass: selected.channel,
-        workflowShellRef: selected.selector,
-        expectedChannel: selected.channel,
-        expectedMajor: "v4",
-      });
-      if (!compatibility.ok) {
-        failures.push({
-          code: "selected-lock-runtime-incompatible",
-          message: `${selected.channel} contract lock rejects resolved workflow shell ${normalizedWorkflowSha}: ${compatibility.reasons?.join("; ") || compatibility.status}`,
-        });
-      }
-    } catch (error) {
-      failures.push({
-        code: "selected-lock-contract-world-invalid",
-        message: `cannot evaluate ${selected.channel} contract lock against the resolved workflow shell: ${error.message}`,
-      });
-    }
-  }
+  verifySelectedLock({
+    selected,
+    stable,
+    alpha,
+    workflowSha: normalizedWorkflowSha,
+    failures,
+  });
 
   const policyRoot = sha256(stableJson(policy));
   const resolvedScannerRoot = scannerRoot || policyRoot;
@@ -424,9 +523,14 @@ export function scanV4FloatingConsumerPolicy({
     stable: stable ? sha256(stableJson(stable)) : "",
     alpha: alpha ? sha256(stableJson(alpha)) : "",
   };
-  const scanRoot = sha256(
-    stableJson({ files: scanned.files, invocations: buildchainUses }),
-  );
+  const sourceScan = { files: scanned.files, invocations: buildchainUses };
+  const scanRoot = sourceScanRoot({
+    sourceRoot: resolvedRoot,
+    invocationRoot: resolvedInvocationRoot,
+    sourceScan,
+    invocationScan,
+    invocationUses,
+  });
   const receipt = {
     schema: V4_FLOATING_CONSUMER_RECEIPT,
     status: failures.length ? "failed" : "passed",
@@ -459,7 +563,7 @@ export function scanV4FloatingConsumerPolicy({
     ok: failures.length === 0,
     failures,
     scannedFiles: scanned.files,
-    invocations: buildchainUses,
+    invocations: invocationUses,
     receipt,
     receiptRoot,
   };