@patronage/factory-ci 1.0.0-alpha.24 → 1.0.0-alpha.25

package/README.md

@@ -61,22 +61,50 @@ workflow({/* caller-owned jobs and topology */}).writeOrLint({
 });
 ```
 
-The **runner is not this package's business**. Jobs, runners, permissions, workflow topology, and deploy policy remain with the caller. The returned values are plain structural objects; this package does not depend on gagen.
-
-Candidate lifecycle support follows the same boundary. Use `FACTORY_CANDIDATE_PULL_REQUEST_TYPES` for the pull-request trigger matrix and `factoryCandidateOrPushCondition()` on each substantive job. With an optional caller-owned path condition, the helper emits the GitHub expression that runs merge-target pushes unconditionally and runs pull-request work only when GitHub's draft boolean says the pull request is a Candidate:
+`factoryWorkflow()` still does not set `runsOn`. This package does not depend on gagen. Job ids, permissions, topology, and deploy policy stay with the caller. Verify runner kinds are this package's business. Name each job's kind (or an override with a non-empty why), pass `.label` into gagen `job()`, and hand the same table to `assertVerifyRunnerPolicy` next to `assertWorkflowShellParses`:
 
 ```ts
+import {
+  assertVerifyRunnerPolicy,
+  assertWorkflowShellParses,
+  factoryVerifyRunner,
+  type FactoryVerifyRunner,
+} from "@patronage/factory-ci";
+
+type VerifyJobId = "changes" | "core";
+
+const verifyRunners: Record<VerifyJobId, FactoryVerifyRunner> = {
+  changes: factoryVerifyRunner("rounding-tax"),
+  core: factoryVerifyRunner("sustained-compute"),
+};
+
+const runsOnFor = (id: VerifyJobId) => verifyRunners[id].label;
+
 const changes = job("changes", {
   if: factoryCandidateOrPushCondition(),
-  // caller-owned runner, permissions, and steps
+  runsOn: runsOnFor("changes"),
 });
 
 const core = job("core", {
   if: factoryCandidateOrPushCondition("needs.changes.outputs.core == 'true'"),
-  // caller-owned topology
+  runsOn: runsOnFor("core"),
+});
+
+const generated = workflow({ jobs: [changes, core] });
+
+assertWorkflowShellParses(generated.toYamlString(), {
+  source: ".github/workflows/verify.ts",
+});
+assertVerifyRunnerPolicy(generated.toYamlString(), {
+  source: ".github/workflows/verify.ts",
+  jobs: verifyRunners,
 });
 ```
 
+`sustained-compute` and `rounding-tax` both resolve to `depot-ubuntu-24.04`. They stay distinct so a short billed-rounding job cannot be confused with a long compute job in the table. `app-token` resolves to `ubuntu-latest`. `deploy-credentials` also resolves to `ubuntu-latest` and is refused inside `assertVerifyRunnerPolicy`, because a Verify workflow has no Cloudflare production secret. HQ deploy keeps a literal `ubuntu-latest` and never calls this assert.
+
+Candidate lifecycle support follows the same boundary. Use `FACTORY_CANDIDATE_PULL_REQUEST_TYPES` for the pull-request trigger matrix and `factoryCandidateOrPushCondition()` on each substantive job. With an optional caller-owned path condition, the helper emits the GitHub expression that runs merge-target pushes unconditionally and runs pull-request work only when GitHub's draft boolean says the pull request is a Candidate. The runner label still comes from the kind table above.
+
 Migration: upgrade `@patronage/factory-ci`, apply the shared trigger types and job condition in the TypeScript workflow source, then regenerate and commit the emitted YAML. Draft `opened` and `synchronize` events will stop running substantive Verify work. Promotion through `ready_for_review`, later non-draft Candidate events, and merge-target pushes continue to run their applicable battery. A skipped draft run is presentation, not proof.
 
 Production impact support follows the same ownership line. A generated deploy workflow declares only its target names and consumes the returned decision step and fail-open `demandedIf(target, decisionJob)` expressions:
@@ -257,7 +285,10 @@ The audit job is `always()` so a failed destroy still runs the stage-wide check.
 ### Merge-freeze writer job
 
 ```ts
-import { factoryMergeFreezeJob } from "@patronage/factory-ci";
+import {
+  factoryMergeFreezeJob,
+  factoryVerifyRunner,
+} from "@patronage/factory-ci";
 
 const freeze = factoryMergeFreezeJob({
   createGithubAppToken: workflowArtifact.actions.createGithubAppToken,
@@ -272,7 +303,7 @@ const jobs = [
     name: freeze.jobName,
     needs: freeze.needs,
     if: freeze.if,
-    runsOn: "ubuntu-latest",
+    runsOn: factoryVerifyRunner("app-token").label,
     permissions: freeze.permissions,
     timeoutMinutes: 10,
     steps: freeze.steps,
@@ -282,7 +313,7 @@ const jobs = [
 
 A consumer's generated merge-target-push Verify workflow is the only producer of `patronage-factory/merge-freeze` generations (#356, ADR 0016 as amended; #429, #872). A red merge-target Verify completes a generation active, a green one completes it inactive, and `pr:ready` reads the generation on the candidate's own base tip. No command, scheduled job, or second workflow writes that check run; the operator override (`demand:waive --demand merge-freeze`) waives the demand for one candidate and never writes here.
 
-`factoryMergeFreezeJob` owns everything a reader trusts: the check name (`FACTORY_MERGE_FREEZE_CHECK_NAME`), the pinned Patronage Factory App identity, the `actions/create-github-app-token` inputs, the `needs.*.result` fold (`FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION`), the merge-target condition (`FACTORY_MERGE_FREEZE_IF`, built from `FACTORY_MERGE_TARGET_REF_CONDITION`), and the job's least-privilege `permissions` (an empty block: the App installation token carries the check-run write, the job uses no `GITHUB_TOKEN` scope, and it never checks out the repository). The caller owns the runner, the timeout, and the `needs` list.
+`factoryMergeFreezeJob` owns everything a reader trusts: the check name (`FACTORY_MERGE_FREEZE_CHECK_NAME`), the pinned Patronage Factory App identity, the `actions/create-github-app-token` inputs, the `needs.*.result` fold (`FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION`), the merge-target condition (`FACTORY_MERGE_FREEZE_IF`, built from `FACTORY_MERGE_TARGET_REF_CONDITION`), and the job's least-privilege `permissions` (an empty block: the App installation token carries the check-run write, the job uses no `GITHUB_TOKEN` scope, and it never checks out the repository). The caller owns the runner kind (`app-token` for the Factory App token), the timeout, and the `needs` list.
 
 That `needs` list is the whole trust input: it must name **every authoritative verification leaf**, because the fold is what decides active or inactive. An empty list is refused — a fold over no needed job always reports success, which would report a merge target nothing verified as green.
 

package/dist/.build-fingerprint.json

@@ -0,0 +1,3 @@
+{
+  "fingerprint": "43a41eecd333f5075b92a78d7d29e9d5e6b723acea5c6bb063e5bb952bf5bf9d"
+}

package/dist/index.d.ts

@@ -1577,6 +1577,53 @@ type VitestProfileReadResult = {
  */
 declare const readVitestProfileDocument: (value: unknown) => VitestProfileReadResult;
 //#endregion
+//#region src/verify-runner-policy.d.ts
+declare const DEPOT_LABEL = "depot-ubuntu-24.04";
+declare const HOSTED_LABEL = "ubuntu-latest";
+/**
+ * Why a job runs where it does. The two Depot kinds share a label. They stay
+ * distinct so billed-rounding jobs and long compute jobs cannot be confused
+ * in the declaration table.
+ *
+ * `deploy-credentials` is legal to construct (HQ deploy).
+ * `assertVerifyRunnerPolicy` refuses it, because a Verify workflow has no
+ * Cloudflare production secret.
+ */
+type FactoryRunnerKind = "sustained-compute" | "rounding-tax" | "app-token" | "deploy-credentials";
+type FactoryRunnerHome = "depot" | "hosted";
+interface FactoryRunnerOverride {
+  readonly kind: "override";
+  readonly home: FactoryRunnerHome;
+  readonly why: string;
+}
+type FactoryRunnerDecision = FactoryRunnerKind | FactoryRunnerOverride;
+interface FactoryVerifyRunner {
+  readonly decision: FactoryRunnerDecision;
+  readonly home: FactoryRunnerHome;
+  readonly label: typeof DEPOT_LABEL | typeof HOSTED_LABEL;
+  readonly why?: string;
+}
+type FactoryVerifyRunnerTable = Readonly<Record<string, FactoryVerifyRunner>>;
+interface FactoryVerifyRunnerPolicyInput {
+  readonly source: string;
+  readonly jobs: FactoryVerifyRunnerTable;
+}
+interface FactoryVerifyRunnerMismatch {
+  readonly jobId: string;
+  readonly expected: string;
+  readonly actual: string;
+}
+interface FactoryVerifyRunnerPolicyReport {
+  readonly ok: boolean;
+  readonly undeclared: readonly string[];
+  readonly missing: readonly string[];
+  readonly mismatches: readonly FactoryVerifyRunnerMismatch[];
+  readonly forbiddenKinds: readonly string[];
+}
+declare const factoryVerifyRunner: (decision: FactoryRunnerDecision) => FactoryVerifyRunner;
+declare const verifyRunnerPolicy: (yaml: string, input: FactoryVerifyRunnerPolicyInput) => FactoryVerifyRunnerPolicyReport;
+declare const assertVerifyRunnerPolicy: (yaml: string, input: FactoryVerifyRunnerPolicyInput) => FactoryVerifyRunnerPolicyReport;
+//#endregion
 //#region src/workflow-shell-lint.d.ts
 /**
  * Parse-check the shell embedded in generated workflow YAML (#376).
@@ -1628,4 +1675,4 @@ declare const assertWorkflowShellParses: (yaml: string, options: {
   readonly source: string;
 }) => void;
 //#endregion
-export { type BundleAlchemyEntryOptions, type CheckoutStepOptions, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, type ExecuteAlchemyEntryOptions, type ExecuteAlchemyEntryResult, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_PULL_REQUEST_IF, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, type FactoryCandidateImpactWorkflow, type FactoryCandidateImpactWorkflowOptions, type FactoryLifecycleContractLane, type FactoryLifecycleContractLaneOptions, type FactoryMergeFreezeJob, type FactoryMergeFreezeJobOptions, type FactoryPrStatusHudWorkflow, type FactoryPrStatusHudWorkflowOptions, type FactoryPreviewCleanupAuditJob, type FactoryPreviewCleanupDestroyJob, type FactoryPreviewCleanupTopology, type FactoryPreviewCleanupTopologyOptions, type FactoryProductionImpactWorkflow, type FactoryProductionImpactWorkflowOptions, type FactoryProofGateOptions, type FactoryProofGateReason, type FactoryProofGateReuse, type FactoryProofGateStep, type FactoryProofReusePresentationOptions, type FactoryProofReuseSummaryStep, type FactoryProofTimingStartStep, type FactoryPushIdentityConsumer, type FactoryPushIdentityConsumerOptions, type FactoryPushIdentityDisposition, type FactoryPushIdentityEnvelope, type FactoryPushIdentityProducer, type FactoryPushIdentityProducerOptions, type FactoryWorkflowArtifact, type FactoryWorkflowOptions, type FactoryWorkflowSetupOptions, GitHubApiError, GitHubAppTokenTransportError, type GithubAppCredentials, type GithubAppTokenOptions, type InstallStepOptions, type LocalPreviewStage, type LocalPreviewStageOptions, NODE_PNPM_ACTION_FAMILY_NODE24, type NodePnpmActionFamily, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, type ParseLocalPreviewStageExpected, type ParsedLocalPreviewStage, type PinnedAction, type PreviewProofCandidate, type PreviewProofCleanupOutcome, type PreviewProofCleanupStatus, type PreviewProofEnvelopeEvidence, type PreviewProofInventoryAccess, type PreviewProofInventoryCleanupInput, type PreviewProofInventoryListInput, type PreviewProofInventoryPersistInput, type PreviewProofInventoryStore, type PreviewProofInventoryTransport, type PreviewProofLifecycleEvent, type PreviewProofLifecycleState, type PreviewProofRegistration, type PreviewProofResolveQuery, PreviewProofTransportError, type ProofReuseCommand, type ProofReuseCoverageInput, type ProofReuseCoverageReport, type SetupNodeStepOptions, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, type VitestJsonReport, type VitestProfile, type VitestProfileDependencies, type VitestProfileDurationSummary, type VitestProfileEnvironment, VitestProfileError, type VitestProfileOptions, type VitestProfileReadResult, type VitestProfileSample, type VitestProfileSampleExecution, type VitestTestStatus, type WorkflowShellParseFailure, type WorkflowStep, assertProofReuseCoverage, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };
+export { type BundleAlchemyEntryOptions, type CheckoutStepOptions, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, type ExecuteAlchemyEntryOptions, type ExecuteAlchemyEntryResult, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_PULL_REQUEST_IF, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, type FactoryCandidateImpactWorkflow, type FactoryCandidateImpactWorkflowOptions, type FactoryLifecycleContractLane, type FactoryLifecycleContractLaneOptions, type FactoryMergeFreezeJob, type FactoryMergeFreezeJobOptions, type FactoryPrStatusHudWorkflow, type FactoryPrStatusHudWorkflowOptions, type FactoryPreviewCleanupAuditJob, type FactoryPreviewCleanupDestroyJob, type FactoryPreviewCleanupTopology, type FactoryPreviewCleanupTopologyOptions, type FactoryProductionImpactWorkflow, type FactoryProductionImpactWorkflowOptions, type FactoryProofGateOptions, type FactoryProofGateReason, type FactoryProofGateReuse, type FactoryProofGateStep, type FactoryProofReusePresentationOptions, type FactoryProofReuseSummaryStep, type FactoryProofTimingStartStep, type FactoryPushIdentityConsumer, type FactoryPushIdentityConsumerOptions, type FactoryPushIdentityDisposition, type FactoryPushIdentityEnvelope, type FactoryPushIdentityProducer, type FactoryPushIdentityProducerOptions, type FactoryRunnerDecision, type FactoryRunnerHome, type FactoryRunnerKind, type FactoryRunnerOverride, type FactoryVerifyRunner, type FactoryVerifyRunnerMismatch, type FactoryVerifyRunnerPolicyInput, type FactoryVerifyRunnerPolicyReport, type FactoryVerifyRunnerTable, type FactoryWorkflowArtifact, type FactoryWorkflowOptions, type FactoryWorkflowSetupOptions, GitHubApiError, GitHubAppTokenTransportError, type GithubAppCredentials, type GithubAppTokenOptions, type InstallStepOptions, type LocalPreviewStage, type LocalPreviewStageOptions, NODE_PNPM_ACTION_FAMILY_NODE24, type NodePnpmActionFamily, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, type ParseLocalPreviewStageExpected, type ParsedLocalPreviewStage, type PinnedAction, type PreviewProofCandidate, type PreviewProofCleanupOutcome, type PreviewProofCleanupStatus, type PreviewProofEnvelopeEvidence, type PreviewProofInventoryAccess, type PreviewProofInventoryCleanupInput, type PreviewProofInventoryListInput, type PreviewProofInventoryPersistInput, type PreviewProofInventoryStore, type PreviewProofInventoryTransport, type PreviewProofLifecycleEvent, type PreviewProofLifecycleState, type PreviewProofRegistration, type PreviewProofResolveQuery, PreviewProofTransportError, type ProofReuseCommand, type ProofReuseCoverageInput, type ProofReuseCoverageReport, type SetupNodeStepOptions, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, type VitestJsonReport, type VitestProfile, type VitestProfileDependencies, type VitestProfileDurationSummary, type VitestProfileEnvironment, VitestProfileError, type VitestProfileOptions, type VitestProfileReadResult, type VitestProfileSample, type VitestProfileSampleExecution, type VitestTestStatus, type WorkflowShellParseFailure, type WorkflowStep, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };

package/dist/index.js

@@ -2006,7 +2006,7 @@ if [ "${shellExpansion("GITHUB_EVENT_NAME:-")}" = 'push' ] && [ -z "${shellExpan
   # the PR-only reuse default (#863) that is every push. A consumer on
   # 'pull-request-and-default-branch' reaches it only on a ref outside its
   # merge target.
-  say '- Path: merge-target full execution'
+  say '- Path: full execution, no proof consulted'
   say '- Proof-reuse gate: did not run on this ref; the full suite ran.'
   say "- Verified head: \`${shellExpansion("GITHUB_SHA:-unknown")}\`"
   echo "::notice title=Factory proof reuse::The proof-reuse gate did not run on this ref; the full ${label} suite executed."
@@ -3342,6 +3342,123 @@ const readVitestProfileDocument = (value) => {
 	};
 };
 //#endregion
+//#region src/verify-runner-policy.ts
+const DEPOT_LABEL = "depot-ubuntu-24.04";
+const HOSTED_LABEL = "ubuntu-latest";
+const isOverride = (decision) => typeof decision === "object";
+const homeForKind = (kind) => {
+	switch (kind) {
+		case "sustained-compute":
+		case "rounding-tax": return "depot";
+		case "app-token":
+		case "deploy-credentials": return "hosted";
+		default: return kind;
+	}
+};
+const labelForHome = (home) => home === "depot" ? DEPOT_LABEL : HOSTED_LABEL;
+const assertOverrideWhy = (why) => {
+	if (why.includes("\n") || why.includes("\r") || why.trim().length === 0) throw new Error("factoryVerifyRunner override requires a non-empty single-line why");
+};
+const factoryVerifyRunner = (decision) => {
+	if (isOverride(decision)) {
+		assertOverrideWhy(decision.why);
+		return Object.freeze({
+			decision,
+			home: decision.home,
+			label: labelForHome(decision.home),
+			why: decision.why
+		});
+	}
+	const home = homeForKind(decision);
+	return Object.freeze({
+		decision,
+		home,
+		label: labelForHome(home)
+	});
+};
+const indentOf$1 = (line) => line.length - line.trimStart().length;
+const unquote$1 = (raw) => {
+	const value = raw.trim();
+	if (value.startsWith("'") && value.endsWith("'") && value.length > 1) return value.slice(1, -1).replaceAll("''", "'");
+	if (value.startsWith("\"") && value.endsWith("\"") && value.length > 1) return value.slice(1, -1);
+	return value;
+};
+const JOB_ID = /^[\w-]+$/u;
+const MATRIX_EXPRESSION = /\$\{\{\s*matrix\b/u;
+const throwNonScalarRunsOn = (jobId) => {
+	throw new Error(`job ${jobId} uses a list, group, or matrix runs-on; Verify policy accepts a scalar label only`);
+};
+const verifyWorkflowJobRunners = (yaml) => {
+	const lines = yaml.split("\n");
+	const jobsLine = lines.findIndex((line) => line.trim() === "jobs:");
+	if (jobsLine === -1) return {};
+	const jobsIndent = indentOf$1(lines[jobsLine]);
+	const jobIdIndent = jobsIndent + 2;
+	const jobKeyIndent = jobIdIndent + 2;
+	const runners = {};
+	for (let index = jobsLine + 1; index < lines.length; index += 1) {
+		const line = lines[index];
+		if (line.trim().length === 0) continue;
+		const indent = indentOf$1(line);
+		if (indent <= jobsIndent) break;
+		if (indent !== jobIdIndent) continue;
+		const trimmed = line.trim();
+		if (!trimmed.endsWith(":") || trimmed.includes(" ")) continue;
+		const jobId = trimmed.slice(0, -1);
+		if (!JOB_ID.test(jobId)) continue;
+		let runsOn;
+		for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+			const candidate = lines[cursor];
+			if (candidate.trim().length === 0) continue;
+			const candidateIndent = indentOf$1(candidate);
+			if (candidateIndent <= jobIdIndent) break;
+			if (candidateIndent !== jobKeyIndent) continue;
+			const rest = candidate.trimStart();
+			if (!rest.startsWith("runs-on:")) continue;
+			const inline = rest.slice(8).trim();
+			if (inline.length === 0) throwNonScalarRunsOn(jobId);
+			if (inline.startsWith("[") || inline.startsWith("{")) throwNonScalarRunsOn(jobId);
+			const label = unquote$1(inline);
+			if (MATRIX_EXPRESSION.test(label)) throwNonScalarRunsOn(jobId);
+			runsOn = label;
+			break;
+		}
+		if (runsOn === void 0) throw new Error(`job ${jobId} has no runs-on`);
+		runners[jobId] = runsOn;
+	}
+	return runners;
+};
+const isDeployCredentials = (runner) => runner.decision === "deploy-credentials";
+const verifyRunnerPolicy = (yaml, input) => {
+	const actual = verifyWorkflowJobRunners(yaml);
+	const declared = Object.keys(input.jobs);
+	const undeclared = Object.keys(actual).filter((jobId) => input.jobs[jobId] === void 0).toSorted();
+	const missing = declared.filter((jobId) => actual[jobId] === void 0).toSorted();
+	const mismatches = declared.filter((jobId) => actual[jobId] !== void 0 && actual[jobId] !== input.jobs[jobId].label).toSorted().map((jobId) => ({
+		actual: actual[jobId],
+		expected: input.jobs[jobId].label,
+		jobId
+	}));
+	const forbiddenKinds = declared.filter((jobId) => isDeployCredentials(input.jobs[jobId])).toSorted();
+	return Object.freeze({
+		forbiddenKinds,
+		mismatches,
+		missing,
+		ok: undeclared.length === 0 && missing.length === 0 && mismatches.length === 0 && forbiddenKinds.length === 0,
+		undeclared
+	});
+};
+const assertVerifyRunnerPolicy = (yaml, input) => {
+	const report = verifyRunnerPolicy(yaml, input);
+	if (report.ok) return report;
+	const details = [];
+	if (report.undeclared.length > 0) details.push(`undeclared jobs: ${report.undeclared.join(", ")}`);
+	if (report.missing.length > 0) details.push(`missing from YAML: ${report.missing.join(", ")}`);
+	for (const mismatch of report.mismatches) details.push(`${mismatch.jobId} runs-on ${mismatch.actual}, expected ${mismatch.expected}`);
+	if (report.forbiddenKinds.length > 0) details.push(`deploy-credentials is illegal inside Verify: ${report.forbiddenKinds.join(", ")}`);
+	throw new Error(`${input.source} Verify runner policy failed:\n${details.map((detail) => `  - ${detail}`).join("\n")}`);
+};
+//#endregion
 //#region src/workflow-shell-lint.ts
 const RUN_KEY = /^(?<indent>\s*)(?:-\s+)?run:(?<inline>.*)$/u;
 /**
@@ -3606,4 +3723,4 @@ const assertWorkflowShellParses = (yaml, options) => {
 	throw new Error(`${options.source} emits shell bash cannot parse; the runner would treat it as a no-op:\n${detail}`);
 };
 //#endregion
-export { EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_PULL_REQUEST_IF, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, GitHubApiError, GitHubAppTokenTransportError, NODE_PNPM_ACTION_FAMILY_NODE24, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, PreviewProofTransportError, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, VitestProfileError, assertProofReuseCoverage, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };
+export { EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_PULL_REQUEST_IF, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, GitHubApiError, GitHubAppTokenTransportError, NODE_PNPM_ACTION_FAMILY_NODE24, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, PreviewProofTransportError, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, VitestProfileError, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/factory-ci",
-  "version": "1.0.0-alpha.24",
+  "version": "1.0.0-alpha.25",
   "description": "Deep CI and deploy building blocks for Patronage factory projects: workflow source artifacts, hosted diff classification, Alchemy entry execution, and disposable-stage semantics",
   "keywords": [
     "alchemy",
@@ -50,7 +50,7 @@
   "scripts": {
     "cleanup:check": "knip --files --dependencies --exports",
     "prebuild": "bash ../scripts/ensure-worktree-bootstrap.sh",
-    "build": "tsdown",
+    "build": "tsdown && node ../scripts/factory-ci-dist-stamp.mjs write",
     "precheck": "bash ../scripts/ensure-worktree-bootstrap.sh",
     "check": "ultracite check",
     "prefix": "bash ../scripts/ensure-worktree-bootstrap.sh",

package/src/index.ts

@@ -209,6 +209,20 @@ export {
   readVitestProfileDocument,
   type VitestProfileReadResult,
 } from "./vitest-profile-reader.ts";
+export {
+  assertVerifyRunnerPolicy,
+  factoryVerifyRunner,
+  type FactoryRunnerDecision,
+  type FactoryRunnerHome,
+  type FactoryRunnerKind,
+  type FactoryRunnerOverride,
+  type FactoryVerifyRunner,
+  type FactoryVerifyRunnerMismatch,
+  type FactoryVerifyRunnerPolicyInput,
+  type FactoryVerifyRunnerPolicyReport,
+  type FactoryVerifyRunnerTable,
+  verifyRunnerPolicy,
+} from "./verify-runner-policy.ts";
 export {
   assertWorkflowShellParses,
   workflowRunBlocks,

package/src/proof-reuse-presentation.ts

@@ -65,7 +65,7 @@ if [ "${shellExpansion("GITHUB_EVENT_NAME:-")}" = 'push' ] && [ -z "${shellExpan
   # the PR-only reuse default (#863) that is every push. A consumer on
   # 'pull-request-and-default-branch' reaches it only on a ref outside its
   # merge target.
-  say '- Path: merge-target full execution'
+  say '- Path: full execution, no proof consulted'
   say '- Proof-reuse gate: did not run on this ref; the full suite ran.'
   say "- Verified head: \`${shellExpansion("GITHUB_SHA:-unknown")}\`"
   echo "::notice title=Factory proof reuse::The proof-reuse gate did not run on this ref; the full ${label} suite executed."

package/src/verify-runner-policy.ts

@@ -0,0 +1,290 @@
+const DEPOT_LABEL = "depot-ubuntu-24.04";
+const HOSTED_LABEL = "ubuntu-latest";
+
+/**
+ * Why a job runs where it does. The two Depot kinds share a label. They stay
+ * distinct so billed-rounding jobs and long compute jobs cannot be confused
+ * in the declaration table.
+ *
+ * `deploy-credentials` is legal to construct (HQ deploy).
+ * `assertVerifyRunnerPolicy` refuses it, because a Verify workflow has no
+ * Cloudflare production secret.
+ */
+export type FactoryRunnerKind =
+  | "sustained-compute"
+  | "rounding-tax"
+  | "app-token"
+  | "deploy-credentials";
+
+export type FactoryRunnerHome = "depot" | "hosted";
+
+export interface FactoryRunnerOverride {
+  readonly kind: "override";
+  readonly home: FactoryRunnerHome;
+  readonly why: string;
+}
+
+export type FactoryRunnerDecision = FactoryRunnerKind | FactoryRunnerOverride;
+
+export interface FactoryVerifyRunner {
+  readonly decision: FactoryRunnerDecision;
+  readonly home: FactoryRunnerHome;
+  readonly label: typeof DEPOT_LABEL | typeof HOSTED_LABEL;
+  readonly why?: string;
+}
+
+export type FactoryVerifyRunnerTable = Readonly<
+  Record<string, FactoryVerifyRunner>
+>;
+
+export interface FactoryVerifyRunnerPolicyInput {
+  readonly source: string;
+  readonly jobs: FactoryVerifyRunnerTable;
+}
+
+export interface FactoryVerifyRunnerMismatch {
+  readonly jobId: string;
+  readonly expected: string;
+  readonly actual: string;
+}
+
+export interface FactoryVerifyRunnerPolicyReport {
+  readonly ok: boolean;
+  readonly undeclared: readonly string[];
+  readonly missing: readonly string[];
+  readonly mismatches: readonly FactoryVerifyRunnerMismatch[];
+  readonly forbiddenKinds: readonly string[];
+}
+
+const isOverride = (
+  decision: FactoryRunnerDecision
+): decision is FactoryRunnerOverride => typeof decision === "object";
+
+const homeForKind = (kind: FactoryRunnerKind): FactoryRunnerHome => {
+  switch (kind) {
+    case "sustained-compute":
+    case "rounding-tax": {
+      return "depot";
+    }
+    case "app-token":
+    case "deploy-credentials": {
+      return "hosted";
+    }
+    default: {
+      const exhaustive: never = kind;
+      return exhaustive;
+    }
+  }
+};
+
+const labelForHome = (
+  home: FactoryRunnerHome
+): typeof DEPOT_LABEL | typeof HOSTED_LABEL =>
+  home === "depot" ? DEPOT_LABEL : HOSTED_LABEL;
+
+const assertOverrideWhy = (why: string): void => {
+  if (why.includes("\n") || why.includes("\r") || why.trim().length === 0) {
+    throw new Error(
+      "factoryVerifyRunner override requires a non-empty single-line why"
+    );
+  }
+};
+
+export const factoryVerifyRunner = (
+  decision: FactoryRunnerDecision
+): FactoryVerifyRunner => {
+  if (isOverride(decision)) {
+    assertOverrideWhy(decision.why);
+    return Object.freeze({
+      decision,
+      home: decision.home,
+      label: labelForHome(decision.home),
+      why: decision.why,
+    });
+  }
+
+  const home = homeForKind(decision);
+  return Object.freeze({
+    decision,
+    home,
+    label: labelForHome(home),
+  });
+};
+
+const indentOf = (line: string): number =>
+  line.length - line.trimStart().length;
+
+const unquote = (raw: string): string => {
+  const value = raw.trim();
+  if (value.startsWith("'") && value.endsWith("'") && value.length > 1) {
+    return value.slice(1, -1).replaceAll("''", "'");
+  }
+  if (value.startsWith('"') && value.endsWith('"') && value.length > 1) {
+    return value.slice(1, -1);
+  }
+  return value;
+};
+
+const JOB_ID = /^[\w-]+$/u;
+const MATRIX_EXPRESSION = /\$\{\{\s*matrix\b/u;
+
+const throwNonScalarRunsOn = (jobId: string): never => {
+  throw new Error(
+    `job ${jobId} uses a list, group, or matrix runs-on; Verify policy accepts a scalar label only`
+  );
+};
+
+const verifyWorkflowJobRunners = (
+  yaml: string
+): Readonly<Record<string, string>> => {
+  const lines = yaml.split("\n");
+  const jobsLine = lines.findIndex((line) => line.trim() === "jobs:");
+  if (jobsLine === -1) {
+    return {};
+  }
+
+  const jobsIndent = indentOf(lines[jobsLine]);
+  const jobIdIndent = jobsIndent + 2;
+  const jobKeyIndent = jobIdIndent + 2;
+  const runners: Record<string, string> = {};
+
+  for (let index = jobsLine + 1; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (line.trim().length === 0) {
+      continue;
+    }
+    const indent = indentOf(line);
+    if (indent <= jobsIndent) {
+      break;
+    }
+    if (indent !== jobIdIndent) {
+      continue;
+    }
+
+    const trimmed = line.trim();
+    if (!trimmed.endsWith(":") || trimmed.includes(" ")) {
+      continue;
+    }
+    const jobId = trimmed.slice(0, -1);
+    if (!JOB_ID.test(jobId)) {
+      continue;
+    }
+
+    let runsOn: string | undefined;
+    for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+      const candidate = lines[cursor];
+      if (candidate.trim().length === 0) {
+        continue;
+      }
+      const candidateIndent = indentOf(candidate);
+      if (candidateIndent <= jobIdIndent) {
+        break;
+      }
+      if (candidateIndent !== jobKeyIndent) {
+        continue;
+      }
+      const rest = candidate.trimStart();
+      if (!rest.startsWith("runs-on:")) {
+        continue;
+      }
+      const inline = rest.slice("runs-on:".length).trim();
+      if (inline.length === 0) {
+        throwNonScalarRunsOn(jobId);
+      }
+      if (inline.startsWith("[") || inline.startsWith("{")) {
+        throwNonScalarRunsOn(jobId);
+      }
+      const label = unquote(inline);
+      if (MATRIX_EXPRESSION.test(label)) {
+        throwNonScalarRunsOn(jobId);
+      }
+      runsOn = label;
+      break;
+    }
+    if (runsOn === undefined) {
+      throw new Error(`job ${jobId} has no runs-on`);
+    }
+    runners[jobId] = runsOn;
+  }
+
+  return runners;
+};
+
+const isDeployCredentials = (runner: FactoryVerifyRunner): boolean =>
+  runner.decision === "deploy-credentials";
+
+export const verifyRunnerPolicy = (
+  yaml: string,
+  input: FactoryVerifyRunnerPolicyInput
+): FactoryVerifyRunnerPolicyReport => {
+  const actual = verifyWorkflowJobRunners(yaml);
+  const declared = Object.keys(input.jobs);
+  const emitted = Object.keys(actual);
+
+  const undeclared = emitted
+    .filter((jobId) => input.jobs[jobId] === undefined)
+    .toSorted();
+  const missing = declared
+    .filter((jobId) => actual[jobId] === undefined)
+    .toSorted();
+  const mismatches = declared
+    .filter(
+      (jobId) =>
+        actual[jobId] !== undefined && actual[jobId] !== input.jobs[jobId].label
+    )
+    .toSorted()
+    .map((jobId) => ({
+      actual: actual[jobId],
+      expected: input.jobs[jobId].label,
+      jobId,
+    }));
+  const forbiddenKinds = declared
+    .filter((jobId) => isDeployCredentials(input.jobs[jobId]))
+    .toSorted();
+
+  return Object.freeze({
+    forbiddenKinds,
+    mismatches,
+    missing,
+    ok:
+      undeclared.length === 0 &&
+      missing.length === 0 &&
+      mismatches.length === 0 &&
+      forbiddenKinds.length === 0,
+    undeclared,
+  });
+};
+
+export const assertVerifyRunnerPolicy = (
+  yaml: string,
+  input: FactoryVerifyRunnerPolicyInput
+): FactoryVerifyRunnerPolicyReport => {
+  const report = verifyRunnerPolicy(yaml, input);
+  if (report.ok) {
+    return report;
+  }
+
+  const details: string[] = [];
+  if (report.undeclared.length > 0) {
+    details.push(`undeclared jobs: ${report.undeclared.join(", ")}`);
+  }
+  if (report.missing.length > 0) {
+    details.push(`missing from YAML: ${report.missing.join(", ")}`);
+  }
+  for (const mismatch of report.mismatches) {
+    details.push(
+      `${mismatch.jobId} runs-on ${mismatch.actual}, expected ${mismatch.expected}`
+    );
+  }
+  if (report.forbiddenKinds.length > 0) {
+    details.push(
+      `deploy-credentials is illegal inside Verify: ${report.forbiddenKinds.join(", ")}`
+    );
+  }
+
+  throw new Error(
+    `${input.source} Verify runner policy failed:\n${details
+      .map((detail) => `  - ${detail}`)
+      .join("\n")}`
+  );
+};