@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/packages/core/kfd-adopter-manifest.js

@@ -21,7 +21,7 @@ export const KFD_LEGACY_SUPPORT_MATRIX_CONTRACT = "kungfu-kfd-support-matrix";
 
 const BUILDCHAIN_ADOPTER_ID = "kungfu-systems/buildchain";
 const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
+const SHA_PATTERN = /^[0-9a-f]{40}$/, SOURCE_REPOSITORY_PATTERN = /^[^@\s]+$/;
 const REQUIRED_DECISIONS = Object.freeze(["KFD-1", "KFD-2", "KFD-3", "KFD-4", "KFD-5", "KFD-7"]);
 const PRODUCT_GATE_STANDARDS = Object.freeze(["kfd-4", "kfd-5", "kfd-7"]);
 const PRODUCT_GATE_SET = new Set(PRODUCT_GATE_STANDARDS);
@@ -77,29 +77,27 @@ function verifyPublishedManifest(manifest, packageOptions, issues) {
   }
 }
 
-function manifestSourceSha(manifest) {
-  const match = /^kungfu-systems\/buildchain@([0-9a-f]{40})$/.exec(text(manifest?.adopter?.artifact?.coordinate));
-  return match?.[1] || "";
-}
+function adopterExpectation({ expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "" } = {}) { const adopterId = text(expectedAdopterId) || BUILDCHAIN_ADOPTER_ID; return { adopterId, sourceRepository: text(expectedSourceRepository) || adopterId }; }
 
-function validateManifestIdentity(manifest, packageArtifactRoot, expectedSourceSha, issues) {
-  if (manifest?.adopter?.id !== BUILDCHAIN_ADOPTER_ID) {
-    issues.push(issue("adopter-identity", "manifest.adopter.id", `manifest adopter must be ${BUILDCHAIN_ADOPTER_ID}`));
-  }
+function manifestSource(manifest) { const coordinate = text(manifest?.adopter?.artifact?.coordinate), match = /^([^@\s]+)@([0-9a-f]{40})$/.exec(coordinate); return { coordinate, repository: match?.[1] || "", sha: match?.[2] || "" }; }
+
+function validateManifestIdentity(manifest, packageArtifactRoot, expectation, expectedSourceSha, issues) {
+  if (manifest?.adopter?.id !== expectation.adopterId) issues.push(issue("adopter-identity", "manifest.adopter.id", `manifest adopter must be ${expectation.adopterId}`));
   const pinned = manifest?.kfdCut?.package;
   if (pinned?.name !== kfdPackageJson.name
     || pinned?.version !== kfdPackageJson.version
     || pinned?.artifactRoot !== packageArtifactRoot) {
     issues.push(issue("adopter-package-cut", "manifest.kfdCut.package", "manifest must bind the exact installed KFD package cut"));
   }
-  const sourceSha = manifestSourceSha(manifest);
-  if (manifest?.adopter?.artifact?.kind !== "git-commit" || !sourceSha
-    || !ROOT_PATTERN.test(text(manifest?.adopter?.artifact?.root))) {
-    issues.push(issue("adopter-source", "manifest.adopter.artifact", "Buildchain adopter authority must bind one exact git commit and artifact root"));
-  } else if (expectedSourceSha && sourceSha !== expectedSourceSha) {
+  const source = manifestSource(manifest);
+  if (!SOURCE_REPOSITORY_PATTERN.test(expectation.sourceRepository) || manifest?.adopter?.artifact?.kind !== "git-commit" || !source.sha || !ROOT_PATTERN.test(text(manifest?.adopter?.artifact?.root))) {
+    issues.push(issue("adopter-source", "manifest.adopter.artifact", "adopter authority must bind one exact repository, git commit, and artifact root"));
+  } else if (source.repository !== expectation.sourceRepository) {
+    issues.push(issue("adopter-source", "manifest.adopter.artifact.coordinate", `manifest source repository must be ${expectation.sourceRepository}`));
+  } else if (expectedSourceSha && source.sha !== expectedSourceSha) {
     issues.push(issue("adopter-source", "manifest.adopter.artifact.coordinate", "manifest source does not match the requested release source"));
   }
-  return sourceSha;
+  return source;
 }
 
 function validateRequiredDecisions(decisions, issues) {
@@ -131,7 +129,7 @@ function collectProductGates(gateResults, decisions, verificationCut, issues) {
   for (const [index, gate] of gateResults.entries()) {
     const validation = validateKfdProductGateResult(gate, verificationCut);
     if (!validation.valid) {
-      issues.push(issue("adopter-gate-invalid", `gateResults[${index}]`, "Buildchain product gate is invalid", {
+      issues.push(issue("adopter-gate-invalid", `gateResults[${index}]`, "adopter product gate is invalid", {
         gateIssues: validation.issues,
       }));
     }
@@ -141,15 +139,16 @@ function collectProductGates(gateResults, decisions, verificationCut, issues) {
     if (gates.has(gate?.standard)) {
       issues.push(issue("adopter-gate-duplicate", `gateResults[${index}].standard`, `${gate.standard} gate is duplicated`));
     }
+    if (gate?.source?.repository !== verificationCut.expectedSourceRepository) issues.push(issue("adopter-gate-source", `gateResults[${index}].source.repository`, "product gate repository must match the adopter source repository"));
     gates.set(gate?.standard, gate);
   }
   for (const standard of PRODUCT_GATE_STANDARDS) {
     const gate = gates.get(standard);
     const id = standard.toUpperCase();
     if (!gate) {
-      issues.push(issue("adopter-gate-missing", `gateResults.${standard}`, `${id} requires its existing Buildchain product gate`));
+      issues.push(issue("adopter-gate-missing", `gateResults.${standard}`, `${id} requires its exact adopter product gate`));
     } else if (!(decisions.get(id)?.verificationEvidence || []).some((entry) => entry?.root === gate.gateRoot)) {
-      issues.push(issue("adopter-gate-unbound", `manifest.decisions.${id}.verificationEvidence`, `${id} must bind the exact Buildchain gate root`));
+      issues.push(issue("adopter-gate-unbound", `manifest.decisions.${id}.verificationEvidence`, `${id} must bind the exact adopter gate root`));
     }
   }
   return gates;
@@ -159,12 +158,12 @@ function projectedProductGates(gates) {
   return PRODUCT_GATE_STANDARDS.map((standard) => {
     const gate = gates.get(standard);
     return gate
-      ? { standard, sourceSha: gate.source.sha, gateRoot: gate.gateRoot, status: gate.status }
-      : { standard, sourceSha: "", gateRoot: "", status: "missing" };
+      ? { standard, sourceRepository: gate.source.repository, sourceSha: gate.source.sha, gateRoot: gate.gateRoot, status: gate.status }
+      : { standard, sourceRepository: "", sourceSha: "", gateRoot: "", status: "missing" };
   });
 }
 
-function createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, sourceSha, checkedAt, maxAgeSeconds, issues }) {
+function createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, source, checkedAt, maxAgeSeconds, issues }) {
   const gate = {
     schemaVersion: 1,
     contract: KFD_ADOPTER_MANIFEST_GATE_CONTRACT,
@@ -174,10 +173,8 @@ function createGateDocument({ manifest, bundle, gates, authorityPath, packageArt
       contract: text(manifest?.contract),
       manifestRoot: bundle?.roots?.manifestRoot || "",
     },
-    source: {
-      sha: sourceSha,
-      artifactRoot: text(manifest?.adopter?.artifact?.root),
-    },
+    adopter: { id: text(manifest?.adopter?.id) },
+    source: { repository: source.repository, coordinate: source.coordinate, sha: source.sha, artifactRoot: text(manifest?.adopter?.artifact?.root) },
     verificationCut: { checkedAt, maxAgeSeconds },
     standardPackage: {
       name: kfdPackageJson.name,
@@ -211,28 +208,28 @@ export function createKfdAdopterManifestGate({
   packageArtifactRoot = "",
   gateResults = [],
   authorityPath = ".buildchain/kfd/adopter-manifest.json",
-  expectedSourceSha = "",
+  expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "", expectedSourceSha = "",
   checkedAt = new Date().toISOString(),
   maxAgeSeconds = 86400,
 } = {}) {
-  const issues = [];
+  const issues = [], expectation = adopterExpectation({ expectedAdopterId, expectedSourceRepository });
   const bundle = verifyPublishedManifest(manifest, {
     packageArtifactRoot,
     verifiedAt: checkedAt,
     maxAgeSeconds,
   }, issues);
   const decisions = new Map((manifest?.decisions || []).map((row) => [row.id, row]));
-  let sourceSha = manifestSourceSha(manifest);
+  let source = manifestSource(manifest);
   if (bundle) {
-    sourceSha = validateManifestIdentity(manifest, packageArtifactRoot, expectedSourceSha, issues);
+    source = validateManifestIdentity(manifest, packageArtifactRoot, expectation, expectedSourceSha, issues);
     validateRequiredDecisions(decisions, issues);
     validateWarrantWitness(decisions, issues);
   }
-  const gates = collectProductGates(gateResults, decisions, { expectedSourceSha: sourceSha || expectedSourceSha, checkedAt }, issues);
-  return createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, sourceSha, checkedAt, maxAgeSeconds, issues });
+  const gates = collectProductGates(gateResults, decisions, { expectedSourceRepository: expectation.sourceRepository, expectedSourceSha: source.sha || expectedSourceSha, checkedAt }, issues);
+  return createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, source, checkedAt, maxAgeSeconds, issues });
 }
 
-function validateGateDocument(gate, issues) {
+function validateGateDocument(gate, expectation, issues) {
   const copy = structuredClone(gate);
   const root = copy.gateRoot;
   delete copy.gateRoot;
@@ -244,12 +241,13 @@ function validateGateDocument(gate, issues) {
     || !ROOT_PATTERN.test(text(gate?.authority?.manifestRoot))) {
     issues.push(issue("adopter-gate-authority", "authority", "adopter gate must bind the standard manifest contract and root"));
   }
+  if (gate?.adopter?.id !== expectation.adopterId) issues.push(issue("adopter-gate-identity", "adopter.id", `adopter gate must bind ${expectation.adopterId}`));
   if (gate?.standardPackage?.name !== kfdPackageJson.name || gate?.standardPackage?.version !== kfdPackageJson.version
     || ![gate?.standardPackage?.artifactRoot, gate?.standardPackage?.registryRoot, gate?.standardPackage?.verifierSetRoot].every((value) => ROOT_PATTERN.test(text(value)))) {
     issues.push(issue("adopter-gate-package", "standardPackage", "adopter gate uses stale KFD package metadata"));
   }
-  if (!SHA_PATTERN.test(text(gate?.source?.sha)) || !ROOT_PATTERN.test(text(gate?.source?.artifactRoot))) {
-    issues.push(issue("adopter-gate-source", "source", "adopter gate must bind one exact Buildchain source commit and artifact root"));
+  if (gate?.source?.repository !== expectation.sourceRepository || gate?.source?.coordinate !== `${expectation.sourceRepository}@${gate?.source?.sha || ""}` || !SHA_PATTERN.test(text(gate?.source?.sha)) || !ROOT_PATTERN.test(text(gate?.source?.artifactRoot))) {
+    issues.push(issue("adopter-gate-source", "source", "adopter gate must bind the expected repository, exact source commit, coordinate, and artifact root"));
   }
   if (gate?.decisionWitness?.rootAlgorithm !== "sha256-buildchain-stable-json-v1"
     || !ROOT_PATTERN.test(text(gate?.decisionWitness?.root))
@@ -259,7 +257,7 @@ function validateGateDocument(gate, issues) {
   }
 }
 
-function validateProjectedGates(gate, expectedSourceSha, issues) {
+function validateProjectedGates(gate, expectation, expectedSourceSha, issues) {
   const seenStandards = new Set();
   for (const [index, productGate] of (gate.gateResults || []).entries()) {
     if (!PRODUCT_GATE_SET.has(productGate?.standard) || productGate?.status !== "passed" || !ROOT_PATTERN.test(text(productGate?.gateRoot))) {
@@ -267,7 +265,7 @@ function validateProjectedGates(gate, expectedSourceSha, issues) {
     }
     if (seenStandards.has(productGate?.standard)) issues.push(issue("adopter-gate-result-set", `gateResults[${index}]`, "product gate standards must be unique"));
     seenStandards.add(productGate?.standard);
-    if (productGate?.sourceSha !== gate?.source?.sha || (expectedSourceSha && productGate?.sourceSha !== expectedSourceSha)) {
+    if (productGate?.sourceRepository !== gate?.source?.repository || productGate?.sourceRepository !== expectation.sourceRepository || productGate?.sourceSha !== gate?.source?.sha || (expectedSourceSha && productGate?.sourceSha !== expectedSourceSha)) {
       issues.push(issue("adopter-gate-source", `gateResults[${index}].sourceSha`, "product gate source must match the release source"));
     }
   }
@@ -277,15 +275,15 @@ function validateProjectedGates(gate, expectedSourceSha, issues) {
 }
 
 export function validateKfdAdopterManifestGate(gate, {
-  expectedSourceSha = "",
+  expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "", expectedSourceSha = "",
   checkedAt = gate?.checkedAt || new Date().toISOString(),
 } = {}) {
-  const issues = [];
+  const issues = [], expectation = adopterExpectation({ expectedAdopterId, expectedSourceRepository });
   if (!gate || gate.schemaVersion !== 1 || gate.contract !== KFD_ADOPTER_MANIFEST_GATE_CONTRACT) {
     return { valid: false, issues: [issue("adopter-gate-contract", "", `gate must use ${KFD_ADOPTER_MANIFEST_GATE_CONTRACT} v1`)] };
   }
-  validateGateDocument(gate, issues);
-  validateProjectedGates(gate, expectedSourceSha, issues);
+  validateGateDocument(gate, expectation, issues);
+  validateProjectedGates(gate, expectation, expectedSourceSha, issues);
   if (gate.checkedAt !== checkedAt || gate?.verificationCut?.checkedAt !== checkedAt || !Number.isFinite(Date.parse(checkedAt))
     || !Number.isSafeInteger(gate?.verificationCut?.maxAgeSeconds) || gate.verificationCut.maxAgeSeconds < 0) {
     issues.push(issue("adopter-gate-time", "verificationCut", "adopter gate verification cut does not match the requested cut"));
@@ -300,7 +298,7 @@ function legacyStatus(row) {
   return row.state;
 }
 
-function legacyRow(row, gates) {
+function legacyRow(row, gates, adopterId) {
   const key = row.id.toLowerCase();
   const productGate = gates.get(key);
   return {
@@ -318,7 +316,7 @@ function legacyRow(row, gates) {
     releaseQualification: { shippedSupport: false },
     claimClass: "standard-adopter-manifest-projection",
     knownLimitations: [...row.gaps],
-    owner: BUILDCHAIN_ADOPTER_ID,
+    owner: adopterId,
     nextGate: "Release Passport artifact binding and independent release decision",
     declaration: { state: row.state, usage: row.usage, root: kfdProductGateDigest(decisionWitnessRow(row)) },
   };
@@ -326,7 +324,7 @@ function legacyRow(row, gates) {
 
 export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate } = {}) {
   const validation = validateKfdAdopterManifestGate(manifestGate, {
-    expectedSourceSha: manifestGate?.source?.sha,
+    expectedAdopterId: manifestGate?.adopter?.id, expectedSourceRepository: manifestGate?.source?.repository, expectedSourceSha: manifestGate?.source?.sha,
     checkedAt: manifestGate?.checkedAt,
   });
   if (!validation.valid || manifest?.contract !== "kfd.adopter-conformance-manifest/v1") {
@@ -338,9 +336,9 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
     verifiedAt: manifestGate.verificationCut.checkedAt,
     maxAgeSeconds: manifestGate.verificationCut.maxAgeSeconds,
   }, authorityIssues);
-  const sourceSha = validateManifestIdentity(manifest, manifestGate.standardPackage.artifactRoot, manifestGate.source.sha, authorityIssues);
+  const source = validateManifestIdentity(manifest, manifestGate.standardPackage.artifactRoot, { adopterId: manifestGate.adopter.id, sourceRepository: manifestGate.source.repository }, manifestGate.source.sha, authorityIssues);
   const decisionRoot = kfdProductGateDigest(manifest.decisions.map(decisionWitnessRow));
-  if (!bundle || sourceSha !== manifestGate.source.sha || manifest.adopter.artifact.root !== manifestGate.source.artifactRoot
+  if (!bundle || source.sha !== manifestGate.source.sha || source.repository !== manifestGate.source.repository || source.coordinate !== manifestGate.source.coordinate || manifest.adopter.artifact.root !== manifestGate.source.artifactRoot
     || bundle.roots.manifestRoot !== manifestGate.authority.manifestRoot
     || bundle.roots.verificationReportRoot !== manifestGate.manifestVerificationReportRoot
     || bundle.bundleRoot !== manifestGate.manifestBundleRoot
@@ -364,7 +362,8 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
       path: manifestGate.authority.path,
       contract: manifest.contract,
       root: manifestGate.authority.manifestRoot,
-      gateRoot: manifestGate.gateRoot,
+      gateRoot: manifestGate.gateRoot, adopterId: manifestGate.adopter.id,
+      sourceRepository: manifestGate.source.repository, sourceSha: manifestGate.source.sha,
     },
     upstream: {
       package: manifestGate.standardPackage.name,
@@ -374,7 +373,7 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
       verifierSetRoot: manifestGate.standardPackage.verifierSetRoot,
       standardsSha256: standardsFileDigest(),
     },
-    rows: manifest.decisions.map((row) => legacyRow(row, gates)),
+    rows: manifest.decisions.map((row) => legacyRow(row, gates, manifestGate.adopter.id)),
   };
 }
 

package/packages/core/next-development-projection.js

@@ -175,7 +175,13 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-08-11
+last_reviewed: 2026-09-07
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-07
+  visible_context: Release completion, protected development provider, and independent review sources.
+  invisible_context_boundary: No private credentials or external unpublished release state.
 ---
 
 # Next-development Transition
@@ -229,6 +235,23 @@ can settle, Patrol reads every prepared version path at the candidate SHA and
 requires the exact reserved blob identities; missing or stale state blocks
 before a Release Cut or heavy candidate build.
 
+## Stable publication and the next patch
+
+A completed stable publication with \`semver/auto\` schedules the next patch at
+Alpha zero: \`4.0.2\` prepares \`4.0.3-alpha.0\`. Publication settlement is
+retained before the development PR starts. Preparation reads the exact current
+protected Dev commit and regenerates only its declared version files, preserving
+code that arrived after the stable candidate. The independent reviewer verifies
+the completed stable publication and reconstructs every tracked byte from the
+protected parent; a PR body alone grants no authority.
+
+A replay returns \`already-current\` or \`already-advanced\` when Dev already
+contains the target or a later version. A late Alpha completion cannot regress
+Dev to an older patch. A moved protected base fails before creating the version
+commit and requires a fresh preparation attempt. Pending review leaves the
+completed publication intact. Anchored version models still require a reviewed
+manual anchor.
+
 ## Version models
 
 \`semver/auto\` increments the Alpha sequence on the same semantic patch. For
@@ -243,8 +266,8 @@ invalid.
 
 ## Public self-dogfood and adoption
 
-\`.github/workflows/v4-public-consumer-dogfood.yml\` remains the exact thin
-consumer of the public \`v4-stage-capsule-canary.yml@v4-alpha\` contract. Its
+\`.github/workflows/self-build-public-consumer-dogfood.yml\` remains the exact thin
+consumer of the public \`public-build-stage-capsule-canary.yml@v4-alpha\` contract. Its
 declared \`lifecycle.verify\` runs \`pnpm run check\`, so the same public path
 executes pure recovery tests that inject a transient durable-state write
 failure, restore the adapter operation on a fresh runner, supersede stale work

package/packages/core/next-development-transition.js

@@ -159,15 +159,14 @@ function normalizeModel(value = {}) {
   return model;
 }
 
-function normalizeCompletedAlpha(value = {}) {
+function normalizeCompletedAlpha(value = {}, model) {
   const version = String(value.version || "").trim();
-  if (!ALPHA.test(version))
+  const expression = model?.strategy === "anchored" ? /-alpha\.(0|[1-9]\d*)$/u : ALPHA;
+  if (!SEMVER.test(version) || !expression.test(version))
     throw new Error("completedAlpha.version must be an alpha semantic version");
   const exactTag = String(value.exactTag || "").trim();
   if (exactTag !== `v${version}`)
-    throw new Error(
-      "completedAlpha.exactTag must match completedAlpha.version",
-    );
+    throw new Error("completedAlpha.exactTag must match completedAlpha.version");
   const normalized = {
     outcome: String(value.outcome || "").trim(),
     version,
@@ -251,8 +250,8 @@ function initialStateRoot(status, idempotencyKey) {
 }
 
 export function createNextDevelopmentTransition(input = {}) {
-  const completedAlpha = normalizeCompletedAlpha(input.completedAlpha);
   const model = normalizeModel(input.model);
+  const completedAlpha = normalizeCompletedAlpha(input.completedAlpha, model);
   const adapter = normalizeAdapter(input);
   const declaredPaths = [
     ...adapter.sourcePaths,

package/packages/core/oci-compose-qualification.js

@@ -0,0 +1,143 @@
+import { domainContentRoot } from "./canonical-contracts.js";
+import { releaseTailRoot } from "./release-tail-provider-plane.js";
+import { ociPublicationTag } from "./oci-publication-graph.js";
+
+function check(condition, message) {
+  if (!condition) throw new Error(`Compose preview: ${message}`);
+}
+
+export function verifyComposePublication({
+  family,
+  readback,
+  documents,
+  repository,
+  tag,
+}) {
+  const { root, ...body } = family;
+  const version = tag.replace(/^v/u, "");
+  const operation = documents.productState.operations.find(
+    (entry) => entry.capabilityId === "product.oci.publish",
+  );
+  check(
+    family.schema === "kungfu-buildchain-oci-family/v2" &&
+      root === domainContentRoot("oci-publication-family", body) &&
+      family.repository === repository &&
+      family.version === version &&
+      family.sourceSha === documents.passport.source.builtSourceSha &&
+      documents.passport.source.builtSourceTreeSha ===
+        documents.invocation.candidate.tree &&
+      readback.sourceSha === documents.invocation.candidate.commit &&
+      readback.familyRoot === root &&
+      readback.version === version &&
+      readback.candidateSourceSha === family.sourceSha &&
+      operation?.receipt.evidenceRoots.includes(releaseTailRoot(readback)),
+    "unbound public OCI family",
+  );
+  const applications = family.images.filter(
+    (entry) => entry.kind === "compose" && entry.preview,
+  );
+  check(applications.length === 1, "expected one declared Compose preview");
+  const application = applications[0],
+    policy = application.preview;
+  check(
+    policy.alias === "compose-preview" &&
+      /^\.github\/workflows\/[a-z0-9-]+\.yml$/u.test(
+        policy.qualificationWorkflow,
+      ) &&
+      /^(none|sha256:[0-9a-f]{64})$/u.test(policy.previousDigest),
+    "invalid preview policy",
+  );
+  const image = family.images.find(
+    (entry) =>
+      entry.name === application.targetImage && entry.kind !== "compose",
+  );
+  check(
+    image &&
+      application.repository === image.repository &&
+      image.repository === `ghcr.io/${repository}/${image.name}` &&
+      /^[a-z0-9][a-z0-9._-]*$/u.test(image.name),
+    "foreign application destination",
+  );
+  for (const entry of [image, application])
+    check(
+      readback.images.some(
+        (observed) =>
+          observed.name === entry.name &&
+          observed.repository === entry.repository &&
+          observed.digest === entry.digest &&
+          observed.ref === ociPublicationTag(entry, version) &&
+          observed.anonymous === true,
+      ),
+      "missing public artifact readback",
+    );
+  return {
+    application,
+    image,
+    policy,
+    familyRoot: root,
+    repository,
+    tag,
+    sourceSha: documents.product.publication.releaseSha,
+    publicationReceiptRoot: documents.receipt.receiptRoot,
+  };
+}
+
+export function verifyComposeQualification(context, run, receipt) {
+  const { application, image, policy, repository, tag, sourceSha, familyRoot } =
+    context;
+  check(
+    run.repository?.full_name === repository &&
+      run.head_repository?.full_name === repository &&
+      run.event === "workflow_dispatch" &&
+      run.status === "completed" &&
+      run.conclusion === "success" &&
+      run.head_sha === sourceSha &&
+      run.path.split("@")[0] === policy.qualificationWorkflow,
+    "qualification run is not the exact published source",
+  );
+  if (!receipt) return;
+  check(
+    receipt.schema === "kungfu-buildchain-compose-qualification/v1" &&
+      receipt.repository === repository &&
+      receipt.tag === tag &&
+      receipt.sourceSha === sourceSha &&
+      receipt.familyRoot === familyRoot &&
+      String(receipt.runId) === String(run.id) &&
+      Number(receipt.runAttempt) === run.run_attempt &&
+      receipt.image === `${image.repository}@${image.digest}` &&
+      receipt.application ===
+        `${application.repository}@${application.digest}` &&
+      receipt.previousDigest === policy.previousDigest &&
+      receipt.passed === true,
+    "qualification receipt identity mismatch",
+  );
+  for (const name of [
+    "freshInstall",
+    "restartPersistence",
+    "upgradePersistence",
+    "rollbackPersistence",
+    "accountIsolation",
+    "hardenedRuntime",
+  ])
+    check(receipt.checks?.[name] === true, `qualification lacks ${name}`);
+  check(
+    Array.isArray(image.platforms) &&
+      image.platforms.length === 2 &&
+      JSON.stringify([...image.platforms].sort()) ===
+        JSON.stringify(["linux/amd64", "linux/arm64"]) &&
+      image.platforms.every(
+        (platform) => receipt.platforms?.[platform]?.passed === true,
+      ),
+    "qualification lacks both platforms",
+  );
+  check(
+    Array.isArray(receipt.evidence) &&
+      receipt.evidence.length > 0 &&
+      receipt.evidence.every(
+        (entry) =>
+          /^[a-zA-Z0-9][a-zA-Z0-9._-]*\.json$/u.test(entry.path) &&
+          /^sha256:[0-9a-f]{64}$/u.test(entry.sha256),
+      ),
+    "missing qualification evidence bindings",
+  );
+}