@kungfu-tech/buildchain 4.0.1-alpha.6 → 4.0.1-alpha.8

package/packages/core/release-candidate-recovery.js

@@ -308,6 +308,42 @@ function validateProductPayloads({ passport, artifacts, productPayloadManifests,
   }
 }
 
+function assertAnchorEqual(actual, expected, label) {
+  assertEqual(actual, expected, "anchored-provenance-invalid", label, "Preserve both candidate runs and repair the explicit anchor provenance before retrying.");
+}
+
+function validateAnchorProvenance({ run, passport, anchorProvenance, expectedTransactionId, workflowFile, expectedWorkflowName, repository, targetRef }) {
+  const request = anchorProvenance.request;
+  const provenanceRun = anchorProvenance.run;
+  const provenanceWorkflow = anchorProvenance.workflow;
+  const provenancePassport = anchorProvenance.passport;
+  assertAnchorEqual(run?.status, "completed", "anchored candidate run status");
+  assertAnchorEqual(run?.conclusion, "success", "anchored candidate run conclusion");
+  assertAnchorEqual(run?.event, "workflow_dispatch", "anchored candidate run event");
+  assertAnchorEqual(passport?.target?.channel, "anchor", "anchored candidate channel");
+  assertAnchorEqual(passport?.target?.ref, "publish-gate/anchor", "anchored candidate ref");
+  assertAnchorEqual(run?.headSha, passport?.buildchain?.sha, "anchored candidate runtime");
+  assertAnchorEqual(request?.schema, 1, "anchor request schema");
+  assertAnchorEqual(request?.contract, "kungfu-buildchain-explicit-publish-anchor-request/v1", "anchor request contract");
+  assertAnchorEqual(Boolean(request?.assignmentId), true, "anchor request Assignment");
+  assertAnchorEqual(/^native:[0-9a-f-]+$/u.test(String(request?.attemptId || "")), true, "anchor request Attempt");
+  assertAnchorEqual(request?.transactionId, expectedTransactionId, "anchor request transaction");
+  assertAnchorEqual(String(provenanceRun?.id || ""), String(request?.supersededCandidate?.workflowRunId || ""), "superseded candidate run");
+  assertAnchorEqual(provenancePassport?.workflow?.runId, String(request?.supersededCandidate?.workflowRunId || ""), "superseded candidate Passport run");
+  assertAnchorEqual(request?.source?.sha, passport?.source?.headSha, "anchor request source SHA");
+  assertAnchorEqual(request?.source?.tree, passport?.source?.treeHash, "anchor request source tree");
+  assertAnchorEqual(request?.supersededCandidate?.sha, provenancePassport?.source?.headSha, "superseded candidate source SHA");
+  assertAnchorEqual(request?.supersededCandidate?.root, `sha256:${provenancePassport?.candidateHash || ""}`, "superseded candidate root");
+  assertAnchorEqual(request?.runtime?.sha, passport?.buildchain?.sha, "anchor request runtime");
+  const provenanceWorkflowPath = String(provenanceWorkflow?.path || provenanceRun?.path || "").split("@")[0].replace(/^\.github\/workflows\//, "");
+  assertEqual(provenanceWorkflowPath, workflowFile, "workflow-mismatch", "superseded candidate workflow file", "Use the exact trusted original candidate workflow.");
+  assertEqual(String(provenanceWorkflow?.name || provenanceRun?.name || ""), expectedWorkflowName, "workflow-mismatch", "superseded candidate workflow name", "Use the exact trusted original candidate workflow.");
+  if (provenanceWorkflow?.state && provenanceWorkflow.state !== "active") fail("untrusted-build-run", `superseded candidate workflow is not active: ${provenanceWorkflow.state}`, "Restore or select an allowed active Build workflow.");
+  const validation = validateReleaseCandidatePassport({ passport: provenancePassport, repository, targetChannel: normalizedRef(targetRef).split("/")[0], buildSummary: anchorProvenance.buildSummary });
+  if (!validation.ok) fail("anchored-provenance-invalid", `superseded candidate Passport validation failed: ${validation.errors.join("; ")}`, "Preserve both candidate runs and repair the explicit anchor provenance before retrying.");
+  return { provenanceRun, provenanceWorkflow, provenancePassport };
+}
+
 function validateCandidateProvenance({
   candidateRepository,
   targetRepository,
@@ -319,26 +355,33 @@ function validateCandidateProvenance({
   workflow,
   pullRequest,
   ancestry,
+  passport,
+  anchorProvenance,
+  expectedTransactionId,
 }) {
   const repository = required(candidateRepository, "candidateRepository");
   assertEqual(repository, required(targetRepository, "targetRepository"), "repository-mismatch", "candidate repository", "Dispatch recovery in the repository that created the candidate.");
   assertEqual(String(run?.id || ""), required(expectedRunId, "expectedRunId"), "run-mismatch", "candidate run ID", "Select the exact successful candidate run.");
   assertEqual(run?.repository, repository, "repository-mismatch", "run repository", "Use a candidate run from the target repository.");
   assertEqual(run?.headRepository, repository, "provenance-insufficient", "run head repository", "Fork candidates are not recoverable; create a same-repository candidate.");
-  if (run?.status !== "completed" || run?.conclusion !== "success" || run?.event !== "pull_request") {
-    fail("untrusted-build-run", "candidate run must be a successful completed pull_request build", "Choose a successful allowed Build workflow run.");
-  }
   const workflowFile = required(expectedWorkflowFile, "expectedWorkflowFile").replace(/^\.github\/workflows\//, "");
   const actualWorkflowPath = String(workflow?.path || run?.path || "").split("@")[0].replace(/^\.github\/workflows\//, "");
   assertEqual(actualWorkflowPath, workflowFile, "workflow-mismatch", "candidate workflow file", "Select a run from the documented trusted Build workflow.");
   assertEqual(String(workflow?.name || run?.name || ""), required(expectedWorkflowName, "expectedWorkflowName"), "workflow-mismatch", "candidate workflow name", "Select a run from the documented trusted Build workflow.");
   if (workflow?.state && workflow.state !== "active") fail("untrusted-build-run", `candidate workflow is not active: ${workflow.state}`, "Restore or select an allowed active Build workflow.");
+  const anchor = anchorProvenance ? validateAnchorProvenance({ run, passport, anchorProvenance, expectedTransactionId, workflowFile, expectedWorkflowName: required(expectedWorkflowName, "expectedWorkflowName"), repository, targetRef }) : undefined;
+  const provenanceRun = anchor?.provenanceRun || run;
+  if (provenanceRun?.status !== "completed" || provenanceRun?.conclusion !== "success" || provenanceRun?.event !== "pull_request") {
+    fail("untrusted-build-run", "candidate provenance run must be a successful completed pull_request build", "Choose a successful allowed Build workflow run.");
+  }
+  assertEqual(provenanceRun?.repository, repository, "repository-mismatch", "provenance run repository", "Use a candidate run from the target repository.");
+  assertEqual(provenanceRun?.headRepository, repository, "provenance-insufficient", "provenance run head repository", "Fork candidates are not recoverable; create a same-repository candidate.");
   if (!TRUSTED_ASSOCIATIONS.has(String(pullRequest?.authorAssociation || ""))) fail("permission-evidence-insufficient", "candidate PR author lacks trusted repository association evidence", "Have a repository member create or approve a same-repository candidate PR.");
   assertEqual(pullRequest?.headRepository, repository, "provenance-insufficient", "candidate PR head repository", "Fork candidates are outside the recovery permission boundary.");
   if (!pullRequest?.merged) fail("pr-identity-invalid", "candidate PR is not merged", "Use a merged channel candidate PR.");
   assertEqual(normalizedRef(pullRequest?.baseRef), normalizedRef(targetRef), "target-mismatch", "candidate PR target ref", "Use the original release channel target.");
-  const boundByNumber = Array.isArray(run?.pullRequestNumbers) && run.pullRequestNumbers.includes(Number(pullRequest?.number));
-  const boundByHead = run?.headSha === pullRequest?.headSha && normalizedRef(run?.headBranch) === normalizedRef(pullRequest?.headRef);
+  const boundByNumber = Array.isArray(provenanceRun?.pullRequestNumbers) && provenanceRun.pullRequestNumbers.includes(Number(pullRequest?.number));
+  const boundByHead = provenanceRun?.headSha === pullRequest?.headSha && normalizedRef(provenanceRun?.headBranch) === normalizedRef(pullRequest?.headRef);
   if (!boundByNumber && !boundByHead) fail("pr-identity-invalid", "candidate run is not bound to the merged candidate PR", "Select the exact PR-stage Build run.");
   if (!ancestry?.mergeIsAncestor && ancestry?.status !== "identical") fail("ancestry-invalid", "candidate merge is not an ancestor of the promotion SHA", "Promote a descendant of the verified merged candidate identity.");
   return { repository, workflowFile };
@@ -354,12 +397,13 @@ function validateCandidateIdentity({
   currentToolingSha,
   passport,
   buildSummary,
+  anchorProvenance,
 }) {
   const sha = exactSha(targetSha, "targetSha");
   const tree = exactSha(targetTree, "targetTree");
   const runtimeSha = exactSha(expectedRuntimeSha, "expectedRuntimeSha");
   const toolingSha = exactSha(currentToolingSha, "currentToolingSha");
-  const validation = validateReleaseCandidatePassport({ passport, repository, targetChannel: channel, buildSummary });
+  const validation = validateReleaseCandidatePassport({ passport, repository, targetChannel: anchorProvenance ? "" : channel, buildSummary });
   if (!validation.ok) fail("passport-invalid", `Release Candidate Passport validation failed: ${validation.errors.join("; ")}`, "Preserve the candidate evidence and explicitly create a new candidate after fixing the producer.");
   const expectedPassportHash = sha256Json({
     repository: passport.repository,
@@ -369,6 +413,7 @@ function validateCandidateIdentity({
     buildchain: passport.buildchain,
     ...(passport.gateProfileEvidence ? { gateProfileEvidence: passport.gateProfileEvidence } : {}),
     ...(passport.familyEvidence ? { familyEvidence: passport.familyEvidence } : {}),
+    ...(passport.consumerPolicy ? { consumerPolicy: passport.consumerPolicy } : {}),
     ...(passport.controllerReceipts ? { controllerReceipts: passport.controllerReceipts } : {}),
   });
   if (passport.candidateHash !== expectedPassportHash) fail("candidate-root-mismatch", "Release Candidate Passport candidate hash does not match its content", "Preserve the run evidence and explicitly create a new candidate after fixing the producer.");
@@ -378,7 +423,7 @@ function validateCandidateIdentity({
   return { sha, tree, runtimeSha, toolingSha };
 }
 
-function validateRecoveryTransaction({ existingTransaction, expectedTransactionId, repository, version, passport, sha, targetRef, candidateRoot }) {
+function validateRecoveryTransaction({ existingTransaction, expectedTransactionId, repository, version, passport, channel, sha, targetRef, candidateRoot }) {
   const actualTransactionId = String(existingTransaction?.id || "");
   if (expectedTransactionId && !actualTransactionId) fail("transaction-identity-conflict", `expected transaction ${expectedTransactionId} does not exist`, "Remove the stale transaction identity only if no durable transaction was ever sealed; otherwise preserve evidence and enter repair_required.");
   if (expectedTransactionId && expectedTransactionId !== actualTransactionId) fail("transaction-identity-conflict", `existing transaction ${actualTransactionId} conflicts with expected ${expectedTransactionId}`, "Enter repair_required and inspect the durable transaction before any retry.");
@@ -389,7 +434,7 @@ function validateRecoveryTransaction({ existingTransaction, expectedTransactionI
     assertEqual(normalizedRef(existingTransaction.target_ref), normalizedRef(targetRef), "transaction-identity-conflict", "durable transaction target ref", "Enter repair_required; never retarget a sealed transaction.");
     assertEqual(existingTransaction.source_sha, sha, "transaction-identity-conflict", "durable transaction source SHA", "Resume with the transaction's exact promotion SHA or enter repair_required.");
     assertEqual(existingTransaction.version, version, "transaction-identity-conflict", "durable transaction version", "Enter repair_required; never change a sealed publication version.");
-    assertEqual(existingTransaction.channel, passport.target.channel, "transaction-identity-conflict", "durable transaction channel", "Enter repair_required; never move a transaction between channels.");
+    assertEqual(existingTransaction.channel, channel || passport.target.channel, "transaction-identity-conflict", "durable transaction channel", "Enter repair_required; never move a transaction between channels.");
   }
   if (existingTransaction?.candidateRoot && existingTransaction.candidateRoot !== candidateRoot) fail("transaction-identity-conflict", "existing transaction is sealed to a different candidate root", "Enter repair_required; never reuse the conflicting transaction.");
   return actualTransactionId;
@@ -415,6 +460,7 @@ export function verifyReleaseCandidateRecovery({
   workflow,
   pullRequest,
   ancestry,
+  anchorProvenance = undefined,
   passport,
   buildSummary,
   controllerReceipts = [],
@@ -430,10 +476,11 @@ export function verifyReleaseCandidateRecovery({
   const { repository, workflowFile } = validateCandidateProvenance({
     candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile,
     expectedWorkflowName, targetRef, run, workflow, pullRequest, ancestry,
+    passport, anchorProvenance, expectedTransactionId,
   });
   const { sha, tree, runtimeSha, toolingSha } = validateCandidateIdentity({
     repository, channel, targetSha, targetTree, expectedSourceTree,
-    expectedRuntimeSha, currentToolingSha, passport, buildSummary,
+    expectedRuntimeSha, currentToolingSha, passport, buildSummary, anchorProvenance,
   });
 
   const recoveredArtifacts = artifacts.map(normalizeArtifact).sort((left, right) => left.name.localeCompare(right.name));
@@ -478,7 +525,7 @@ export function verifyReleaseCandidateRecovery({
 
   const version = required(publicationVersion || passport.target?.version, "publicationVersion");
   const actualTransactionId = validateRecoveryTransaction({
-    existingTransaction, expectedTransactionId, repository, version, passport, sha, targetRef, candidateRoot,
+    existingTransaction, expectedTransactionId, repository, version, passport, channel, sha, targetRef, candidateRoot,
   });
 
   const receipt = {
@@ -496,9 +543,17 @@ export function verifyReleaseCandidateRecovery({
       sourceSha: passport.source.headSha,
       mergeSha: String(pullRequest.mergeSha || ""),
       tree: passport.source.treeHash,
+      ...(anchorProvenance ? {
+        provenance: "anchored-rematerialization",
+        supersededCandidate: {
+          runId: String(anchorProvenance.run.id),
+          candidateRoot: String(anchorProvenance.request.supersededCandidate.root),
+          sourceSha: String(anchorProvenance.request.supersededCandidate.sha),
+        },
+      } : {}),
     },
     target: {
-      channel: passport.target.channel,
+      channel,
       ref: normalizedRef(targetRef),
       sha,
       observedRefSha: exactSha(targetRefSha, "targetRefSha"),

package/packages/core/release-candidate.js

@@ -206,7 +206,7 @@ function validateConsumerPolicyEvidence(passport, check) {
     receipt: passport.consumerPolicy.receipt,
     receiptRoot: passport.consumerPolicy.receiptRoot,
     repository: passport.repository,
-    sourceSha: passport.source?.headSha,
+    sourceSha: passport.target?.ref === "publish-gate/anchor" ? passport.consumerPolicy.receipt?.caller?.sourceSha : passport.source?.headSha,
     resolvedRuntimeSha: passport.buildchain?.sha,
   });
   for (const failure of verification.failures) {
@@ -403,7 +403,7 @@ export function createReleaseCandidatePassport({
   };
   const normalizedConsumerPolicy = normalizeConsumerPolicyEvidence(consumerPolicyReceipt, {
     repository: repository || normalizedSummary.git?.repository || "",
-    sourceSha,
+    sourceSha: normalizedSummary.publishSource?.ref === "publish-gate/anchor" ? (consumerPolicyReceipt?.receipt || consumerPolicyReceipt)?.caller?.sourceSha : sourceSha,
     runtimeSha: resolvedBuildchain.sha,
   });
   if (isV4BuildchainRuntime(resolvedBuildchain) && !normalizedConsumerPolicy) {

package/packages/core/release-passport.js

@@ -38,6 +38,7 @@ import {
   isV4PromotionRouting,
   releasePassportCertificationVerificationOptions,
   requireV4ConsumerPolicyCertification,
+  resolveV4ConsumerPolicyCertificationIdentity,
 } from "./v4-floating-consumer-release-passport.js";
 import {
   verifyV4RuntimeAuthorizationReceipt,
@@ -1112,17 +1113,25 @@ function normalizePromotionEvidence({
   release = {},
   v4ConsumerPolicyCertification: certification,
   v4ConsumerPolicyCertificationRoot: certificationRoot,
+  v4RuntimeResumeEvidence,
   repository,
   sourceSha,
   cwd,
 }) {
   const routing = normalizePromotionRouting(release.promotionRouting);
+  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+    release,
+    routing,
+    runtimeResume: v4RuntimeResumeEvidence,
+    sourceSha,
+  });
   return {
     routing,
     consumerPolicy: requireV4ConsumerPolicyCertification({
       value: certification,
       repository,
-      sourceSha,
+      sourceSha: identity.sourceSha,
+      runtimeSha: identity.runtimeSha,
       routing,
       cwd,
       certificationRoot,

package/packages/core/v4-delivery-warrant-read-candidate.js

@@ -100,7 +100,9 @@ export function validateV4DeliveryWarrantReadQualification(
 }
 
 export function projectV3QueueToV4ReadState(queueInput) {
-  const queue = normalizeDevDeliveryQueue(queueInput);
+  const queue = normalizeDevDeliveryQueue(queueInput, {
+    allowLegacyV3Readback: true,
+  });
   return {
     schema: STATE_CONTRACT,
     generation: queue.generation,
@@ -219,7 +221,9 @@ export async function runV4DeliveryWarrantReadCandidate(
   });
   if (typeof retain !== "function")
     fail("retention-required", "v4 read evidence retention is required");
-  const queue = normalizeDevDeliveryQueue(queueInput);
+  const queue = normalizeDevDeliveryQueue(queueInput, {
+    allowLegacyV3Readback: true,
+  });
   const state = projectV3QueueToV4ReadState(queue);
   const request = createV4DeliveryWarrantReadRequest(state, {
     requestId,
@@ -235,7 +239,10 @@ export async function runV4DeliveryWarrantReadCandidate(
     );
   }
   const projection = validateProjection(response, request, state);
-  const observation = observeDevDeliveryQueue(queue, { now: observedAt });
+  const observation = observeDevDeliveryQueue(queue, {
+    now: observedAt,
+    allowLegacyV3Readback: true,
+  });
   const evidence = {
     schema: V4_DELIVERY_WARRANT_READ_EVIDENCE_CONTRACT,
     authority: "typescript-v3",

package/packages/core/v4-floating-consumer-evidence.js

@@ -8,6 +8,12 @@ export const V4_FLOATING_CONSUMER_CERTIFICATION =
   "kungfu-buildchain-v4-floating-consumer-certification/v1";
 
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
+const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
+  repository: "kungfu-systems/buildchain",
+  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  workflow: ".github/workflows/.release-candidate-promote.yml",
+  selector: "alpha/v4/v4.0",
+});
 
 function stableJson(value) {
   if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
@@ -109,15 +115,23 @@ function verifyAuthorityFields(value, expected, check, label) {
 }
 
 function verifyFloatingSelector(value, check, label) {
+  const bootstrap =
+    value?.caller?.repository === ALPHA_RECOVERY_BOOTSTRAP.repository &&
+    value?.invocation?.sourcePath === ALPHA_RECOVERY_BOOTSTRAP.sourcePath &&
+    value?.invocation?.workflow === ALPHA_RECOVERY_BOOTSTRAP.workflow &&
+    value?.invocation?.visibleSelector === ALPHA_RECOVERY_BOOTSTRAP.selector &&
+    value?.invocation?.selectorClass === "protected-bootstrap" &&
+    value?.invocation?.channel === "alpha";
   check(
-    value?.invocation?.selectorClass === "floating",
+    value?.invocation?.selectorClass === "floating" || bootstrap,
     "selector-class-invalid",
-    `${label} must bind a floating selector`,
+    `${label} must bind a floating selector or the bounded protected alpha recovery bootstrap`,
   );
   check(
-    ["v4", "v4-alpha"].includes(value?.invocation?.visibleSelector),
+    ["v4", "v4-alpha"].includes(value?.invocation?.visibleSelector) ||
+      bootstrap,
     "selector-invalid",
-    `${label} selector must be v4 or v4-alpha`,
+    `${label} selector must be v4, v4-alpha, or the bounded protected alpha recovery bootstrap`,
   );
 }
 

package/packages/core/v4-floating-consumer-policy.js

@@ -26,6 +26,11 @@ const EXACT_SHA = /^[0-9a-f]{40}$/u;
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 const BUILDCHAIN_REPOSITORY = "kungfu-systems/buildchain";
 const CHANNELS = Object.freeze({ v4: "stable", "v4-alpha": "alpha" });
+const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
+  selector: "alpha/v4/v4.0",
+  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  workflow: ".github/workflows/.release-candidate-promote.yml",
+});
 const DEFAULT_STABLE_LOCK_PATH = ".buildchain/contract-lock.json";
 const DEFAULT_ALPHA_LOCK_PATH = ".buildchain/alpha-contract-lock.json";
 const TRANSIENT_ACTION =
@@ -277,7 +282,7 @@ function readContractLock(root, relative, expectedRef, label, failures) {
   }
 }
 
-function classifyBuildchainUses(records, failures) {
+function classifyBuildchainUses(records, failures, { repository } = {}) {
   const uses = [];
   for (const record of records) {
     const parsed = coordinate(record.uses);
@@ -286,15 +291,27 @@ function classifyBuildchainUses(records, failures) {
       parsed.selector === "v4" ||
       parsed.selector === "v4-alpha" ||
       /^v4(?:[./-]|$)/u.test(parsed.selector) ||
+      parsed.selector === ALPHA_RECOVERY_BOOTSTRAP.selector ||
       EXACT_SHA.test(parsed.selector.toLowerCase()) ||
       parsed.selector.includes("${{");
     if (!v4Candidate) continue;
-    const channel = CHANNELS[parsed.selector] || "";
+    const protectedBootstrap =
+      repository === BUILDCHAIN_REPOSITORY &&
+      normalizeWorkflowPath(parsed.path) ===
+        ALPHA_RECOVERY_BOOTSTRAP.workflow &&
+      record.sourcePath === ALPHA_RECOVERY_BOOTSTRAP.sourcePath &&
+      parsed.selector === ALPHA_RECOVERY_BOOTSTRAP.selector;
+    const channel =
+      CHANNELS[parsed.selector] || (protectedBootstrap ? "alpha" : "");
     uses.push({
       ...record,
       ...parsed,
       channel,
-      selectorClass: channel ? "floating" : "rejected",
+      selectorClass: protectedBootstrap
+        ? "protected-bootstrap"
+        : channel
+          ? "floating"
+          : "rejected",
     });
     if (!channel) failures.push(selectorFailure(record, parsed.selector));
   }
@@ -320,8 +337,97 @@ function selectInvocation(uses, workflow, failures, source = "", channel = "") {
   return { expectedWorkflow, selected: invocations[0] };
 }
 
+function scanInvocationSource({
+  sourceRoot,
+  invocationRoot,
+  sourceScan,
+  sourceUses,
+  failures,
+  repository,
+}) {
+  if (invocationRoot === sourceRoot)
+    return { invocationScan: sourceScan, invocationUses: sourceUses };
+  try {
+    const invocationScan = enumerateUses(invocationRoot);
+    return {
+      invocationScan,
+      invocationUses: classifyBuildchainUses(invocationScan.records, failures, {
+        repository,
+      }),
+    };
+  } catch (error) {
+    failures.push({
+      code: "invocation-source-scan-failed",
+      message: error.message,
+    });
+    return {
+      invocationScan: { files: [], records: [] },
+      invocationUses: [],
+    };
+  }
+}
+
+function sourceScanRoot({
+  sourceRoot,
+  invocationRoot,
+  sourceScan,
+  invocationScan,
+  invocationUses,
+}) {
+  const material =
+    invocationRoot === sourceRoot
+      ? sourceScan
+      : {
+          source: sourceScan,
+          invocation: {
+            files: invocationScan.files,
+            invocations: invocationUses,
+          },
+        };
+  return sha256(stableJson(material));
+}
+
+function verifySelectedLock({
+  selected,
+  stable,
+  alpha,
+  workflowSha,
+  failures,
+}) {
+  const selectedLock = selected?.channel === "alpha" ? alpha : stable;
+  if (!selected?.channel || !selectedLock) return;
+  const authorityRef =
+    selected.selectorClass === "protected-bootstrap"
+      ? "v4-alpha"
+      : selected.selector;
+  try {
+    const compatibility = evaluateBuildchainContractLock({
+      lock: selectedLock,
+      current: createBuildchainContractWorld({ root: defaultRuntimeRoot() }),
+      runtimeRef: authorityRef,
+      runtimeSha: workflowSha,
+      runtimeClass: selected.channel,
+      workflowShellRef: authorityRef,
+      expectedChannel: selected.channel,
+      expectedMajor: "v4",
+    });
+    if (!compatibility.ok) {
+      failures.push({
+        code: "selected-lock-runtime-incompatible",
+        message: `${selected.channel} contract lock rejects resolved workflow shell ${workflowSha}: ${compatibility.reasons?.join("; ") || compatibility.status}`,
+      });
+    }
+  } catch (error) {
+    failures.push({
+      code: "selected-lock-contract-world-invalid",
+      message: `cannot evaluate ${selected.channel} contract lock against the resolved workflow shell: ${error.message}`,
+    });
+  }
+}
+
 export function scanV4FloatingConsumerPolicy({
   root = process.cwd(),
+  invocationRoot = root,
   repository = "",
   sourceSha = "",
   invokedWorkflow = "",
@@ -335,6 +441,7 @@ export function scanV4FloatingConsumerPolicy({
   scannerRoot = "",
 } = {}) {
   const resolvedRoot = path.resolve(root);
+  const resolvedInvocationRoot = path.resolve(invocationRoot);
   if (!policy || policy.contract !== V4_FLOATING_CONSUMER_POLICY) {
     throw new Error(`policy must use ${V4_FLOATING_CONSUMER_POLICY}`);
   }
@@ -374,43 +481,34 @@ export function scanV4FloatingConsumerPolicy({
   } catch (error) {
     failures.push({ code: "source-scan-failed", message: error.message });
   }
-  const buildchainUses = classifyBuildchainUses(scanned.records, failures);
+  const buildchainUses = classifyBuildchainUses(scanned.records, failures, {
+    repository,
+  });
+  const { invocationScan, invocationUses } = scanInvocationSource({
+    sourceRoot: resolvedRoot,
+    invocationRoot: resolvedInvocationRoot,
+    sourceScan: scanned,
+    sourceUses: buildchainUses,
+    failures,
+    repository,
+  });
   const sourcePath = String(invocationSourcePath || "")
     .split("@")[0]
     .replace(`${repository}/`, "");
   const { expectedWorkflow, selected } = selectInvocation(
-    buildchainUses,
+    invocationUses,
     invokedWorkflow,
     failures,
     sourcePath,
     expectedInvocationChannel,
   );
-  const selectedLock = selected?.channel === "alpha" ? alpha : stable;
-  if (selected?.channel && selectedLock) {
-    try {
-      const compatibility = evaluateBuildchainContractLock({
-        lock: selectedLock,
-        current: createBuildchainContractWorld({ root: defaultRuntimeRoot() }),
-        runtimeRef: selected.selector,
-        runtimeSha: normalizedWorkflowSha,
-        runtimeClass: selected.channel,
-        workflowShellRef: selected.selector,
-        expectedChannel: selected.channel,
-        expectedMajor: "v4",
-      });
-      if (!compatibility.ok) {
-        failures.push({
-          code: "selected-lock-runtime-incompatible",
-          message: `${selected.channel} contract lock rejects resolved workflow shell ${normalizedWorkflowSha}: ${compatibility.reasons?.join("; ") || compatibility.status}`,
-        });
-      }
-    } catch (error) {
-      failures.push({
-        code: "selected-lock-contract-world-invalid",
-        message: `cannot evaluate ${selected.channel} contract lock against the resolved workflow shell: ${error.message}`,
-      });
-    }
-  }
+  verifySelectedLock({
+    selected,
+    stable,
+    alpha,
+    workflowSha: normalizedWorkflowSha,
+    failures,
+  });
 
   const policyRoot = sha256(stableJson(policy));
   const resolvedScannerRoot = scannerRoot || policyRoot;
@@ -424,9 +522,14 @@ export function scanV4FloatingConsumerPolicy({
     stable: stable ? sha256(stableJson(stable)) : "",
     alpha: alpha ? sha256(stableJson(alpha)) : "",
   };
-  const scanRoot = sha256(
-    stableJson({ files: scanned.files, invocations: buildchainUses }),
-  );
+  const sourceScan = { files: scanned.files, invocations: buildchainUses };
+  const scanRoot = sourceScanRoot({
+    sourceRoot: resolvedRoot,
+    invocationRoot: resolvedInvocationRoot,
+    sourceScan,
+    invocationScan,
+    invocationUses,
+  });
   const receipt = {
     schema: V4_FLOATING_CONSUMER_RECEIPT,
     status: failures.length ? "failed" : "passed",
@@ -459,7 +562,7 @@ export function scanV4FloatingConsumerPolicy({
     ok: failures.length === 0,
     failures,
     scannedFiles: scanned.files,
-    invocations: buildchainUses,
+    invocations: invocationUses,
     receipt,
     receiptRoot,
   };

package/packages/core/v4-floating-consumer-release-passport.js

@@ -77,10 +77,31 @@ function normalizeCertification(value, expected) {
   return { certificationRoot: verification.certificationRoot, certification };
 }
 
+export function resolveV4ConsumerPolicyCertificationIdentity({
+  release = {},
+  routing = {},
+  runtimeResume = undefined,
+  sourceSha = "",
+} = {}) {
+  const builtSourceSha =
+    release?.builtSourceSha || release?.built_source_sha || "";
+  return {
+    sourceSha:
+      release?.treeEquivalent === true && builtSourceSha
+        ? builtSourceSha
+        : sourceSha,
+    runtimeSha:
+      runtimeResume?.lineage?.attempts?.build?.runtimeSha ||
+      routing?.runtime?.resolvedSha ||
+      "",
+  };
+}
+
 export function requireV4ConsumerPolicyCertification({
   value,
   repository,
   sourceSha,
+  runtimeSha = "",
   routing,
   cwd,
   certificationRoot,
@@ -100,7 +121,7 @@ export function requireV4ConsumerPolicyCertification({
   return normalizeCertification(value, {
     repository,
     sourceSha,
-    runtimeSha: routing?.runtime?.resolvedSha || "",
+    runtimeSha: runtimeSha || routing?.runtime?.resolvedSha || "",
     certificationRoot,
     ...(v4Routing ? resolveV4FloatingConsumerCallerLocks(value, cwd) : {}),
   });
@@ -112,12 +133,18 @@ export function releasePassportCertificationVerificationOptions({
   routing,
 }) {
   const authority = evidence?.certification?.authority || {};
+  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+    release: passport?.release,
+    routing,
+    runtimeResume: passport?.v4RuntimeResume,
+    sourceSha: passport?.release?.sourceSha || "",
+  });
   return {
     certification: evidence?.certification,
     certificationRoot: evidence?.certificationRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: passport?.release?.sourceSha || "",
-    resolvedRuntimeSha: routing?.runtime?.resolvedSha || "",
+    sourceSha: identity.sourceSha,
+    resolvedRuntimeSha: identity.runtimeSha,
     stableLockRoot: authority.contractLocks?.stable?.root || "",
     alphaLockRoot: authority.contractLocks?.alpha?.root || "",
     stableLockPath: authority.contractLocks?.stable?.path || "",

package/packages/core/workflow-yaml-contract.js

@@ -67,8 +67,7 @@ function directEntries(lines, parentLine) {
     const trimmed = line.trim();
     const indent = indentation(line);
     if (trimmed && indent <= parentIndent) break;
-    if (!trimmed || trimmed.startsWith("#") || indent !== childIndent)
-      continue;
+    if (!trimmed || trimmed.startsWith("#") || indent !== childIndent) continue;
     const match = line.match(/^\s*([A-Za-z0-9_.-]+):(?:\s*(.*))?$/);
     if (match) {
       entries.push({
@@ -263,6 +262,28 @@ export function parseWorkflowCallJobs(text) {
     .filter((job) => job.uses);
 }
 
+export function parseWorkflowJobs(text) {
+  const lines = String(text || "").split(/\r?\n/);
+  const jobs = topLevelEntry(lines, "jobs");
+  if (!jobs) return [];
+  return directEntries(lines, jobs.line)
+    .map((job) => {
+      const properties = directEntries(lines, job.line);
+      const property = (name) =>
+        properties.find((entry) => entry.key === name) || null;
+      return {
+        id: job.key,
+        name: unquote(property("name")?.value || job.key),
+        uses: unquote(property("uses")?.value || ""),
+        runsOn: unquote(property("runs-on")?.value || ""),
+        timeoutMinutes: property("timeout-minutes")
+          ? scalar(property("timeout-minutes").value)
+          : null,
+      };
+    })
+    .sort((left, right) => compareCodeUnits(left.id, right.id));
+}
+
 function blockScalarIndent(lines, lineIndex, parentIndent) {
   for (let index = lineIndex + 1; index < lines.length; index += 1) {
     if (!lines[index].trim()) continue;
@@ -315,6 +336,7 @@ export function parseWorkflowDocument(text) {
   return {
     triggers: parseTriggers(String(text || "").split(/\r?\n/)),
     interface: parseReusableWorkflowInterface(text),
+    jobs: parseWorkflowJobs(text),
     callJobs: parseWorkflowCallJobs(text),
   };
 }