@qijenchen/design-system 0.1.0-beta.104 → 0.1.0-beta.105

package/ds-canonical/fork/codex/agents/skills/code-quality-audit/SKILL.md

@@ -45,8 +45,8 @@ Scope:**tsx / ts code hygiene**,跟 design canonical 正交。
      與 long-function remediation 都是工程決策，依 Standing Authorization 自主完成並驗證。
    - 只有修法會改變 public component semantics、產品 workflow、interaction 或其他產品／
      UI／UX SSOT，且證據收斂後仍有真實取捨時，才停下取得 exact target-bound decision。
-   - 無法分類時 fail closed 並補 source/evidence/independent review；不得用泛用 user
-     approval 代替工程判斷。
+   - 無法分類時 fail closed 並補 source/evidence；task／deliverable 明確要求時才加
+     independent review，不得用泛用 user approval 代替工程判斷。
 
 ## 禁止
 

package/ds-canonical/fork/codex/agents/skills/product-ui-audit/references/report-template.md

@@ -47,7 +47,7 @@ scope / 設計決策 / 業務判斷:
 
 **處理**:
 - **P2E**:engineering/governance/refactor/a11y/performance 或既有 SSOT 唯一落地，依
-  evidence + independent review + hard gates 自主修。
+  evidence + hard gates 自主修；task／deliverable 明確要求時才加 independent review。
 - **P2H**:只有會改變產品／UI／UX SSOT 且證據收斂後仍存在真實取捨，才由 user
   逐項做 exact target-bound decision。
 

package/ds-canonical/fork/codex/agents/skills/scan-similar-bugs/SKILL.md

@@ -108,7 +108,7 @@ Phase 1 found N candidates of same anti-pattern:
 
 Execution:
 - deterministic fix → Auto-fix all confirmed N
-- engineering judgment → 依 owning spec + highest certified capability + independent review逐檔收斂
+- engineering judgment → 依 owning spec + highest certified capability 逐檔收斂；task／deliverable 明確要求時才加 independent review
 - 不屬 frozen scope → Backlog with evidence；不得用 defer 逃避 scope 內修復
 - 會改產品／UI／UX SSOT 且仍有真取捨 → batch-at-end human-only decision
 ```

package/ds-canonical/fork/codex/agents/skills/visual-audit/SKILL.md

@@ -217,7 +217,7 @@ FAIL 項摘要:
 
 後續路由:
 1. FAIL 可由既有 canonical 決定 → P2E，由 primary context 依 Standing Authorization remediation + verify
-2. 純工程／治理原因尚未收斂 → P2E，依 Engineering Decision Policy、tests、independent review 與 hard gates 收斂；無法收斂則 fail closed 回報 technical blocker
+2. 純工程／治理原因尚未收斂 → P2E，依 Engineering Decision Policy、tests 與 hard gates 收斂；task／deliverable 明確要求時才加 independent review，optional review 缺席不得阻擋一般工程；無法收斂則 fail closed 回報 technical blocker
 3. 必須改變產品／UI／UX SSOT 且仍有真實選擇或取捨 → P2H，batch-at-end 請 user 拍板
 4. 證據不足 → 補足 screenshot／量測，不以猜測結案
 

package/ds-canonical/fork/consumer/governance-check.mjs

@@ -259,12 +259,22 @@ const readJson = (path, ruleId) => {
   try { return JSON.parse(readFileSync(path, 'utf8')) }
   catch (error) { add(ruleId, 'BLOCKER', `${relative(repo, path)} invalid JSON`, error.message); return null }
 }
-const treeInventory = (root) => {
+const treeInventory = (root, { frozenCanonicalSnapshot = false } = {}) => {
   if (!existsSync(root)) return null
   const rows = []
   const visit = (absolute, rel = '') => {
     const stat = lstatSync(absolute)
-    const mode = (stat.mode & 0o777).toString(8).padStart(4, '0')
+    const observedMode = stat.mode & 0o777
+    let projectedMode = observedMode
+    if (frozenCanonicalSnapshot) {
+      if (stat.isDirectory() && observedMode === 0o500) projectedMode = 0o755
+      else if (stat.isFile() && observedMode === 0o400) projectedMode = 0o644
+      else if (stat.isFile() && observedMode === 0o500) projectedMode = 0o755
+      else projectedMode = -1
+    }
+    const mode = projectedMode < 0
+      ? `invalid-frozen-${observedMode.toString(8).padStart(4, '0')}`
+      : projectedMode.toString(8).padStart(4, '0')
     if (stat.isSymbolicLink()) { rows.push(`link:${rel}:${mode}:${readlinkSync(absolute)}`); return }
     if (stat.isDirectory()) {
       rows.push(`dir:${rel || '.'}:${mode}`)
@@ -282,8 +292,14 @@ const assertTreeEqual = (ruleId, label, actual, canonical) => {
     add(ruleId, 'BLOCKER', `${label} contains an unsafe symlink path component`)
     return false
   }
-  const actualRows = treeInventory(actual)
-  const canonicalRows = treeInventory(canonical)
+  const isFrozenCanonicalPath = path => entrypointIsPrivateSnapshot
+    && (path === forkRoot || path.startsWith(`${forkRoot}${sep}`))
+  const actualRows = treeInventory(actual, {
+    frozenCanonicalSnapshot: isFrozenCanonicalPath(actual),
+  })
+  const canonicalRows = treeInventory(canonical, {
+    frozenCanonicalSnapshot: isFrozenCanonicalPath(canonical),
+  })
   if (!actualRows || !canonicalRows || JSON.stringify(actualRows) !== JSON.stringify(canonicalRows)) {
     add(ruleId, 'BLOCKER', `${label} is not a recursive path/type/mode/hash match of the installed canonical projection`)
     return false

package/ds-canonical/fork/consumer/lock.json

@@ -3,8 +3,8 @@
   "schemaVersion": 1,
   "role": "template-consumer",
   "release": {
-    "designSystem": "0.1.0-beta.104",
-    "storybookConfig": "0.1.0-beta.104"
+    "designSystem": "0.1.0-beta.105",
+    "storybookConfig": "0.1.0-beta.105"
   },
   "upgradeTrust": {
     "schemaVersion": 1,
@@ -42,10 +42,10 @@
     "implementationSha256": "98b74118fb5b410b77ad2994aa9105fa7609c7353822f8c5213cce54d94f0af4"
   },
   "payload": {
-    "forkCorpusLockSha256": "dd68020ddcc2980e47d17b0db09cfcce5c593f29382270cc6328395ce9fc3285",
+    "forkCorpusLockSha256": "0d2489d8bb989a6cd7c039f2c7262deb6fcd0be26e67a21ede951003da953455",
     "discoveryPolicySha256": "fba289aeeb5a3f11139b9589f7ab08b5e8c8799c7bdf8f0ea57ebfeb8e7c9da6",
     "providerMaterializersSha256": "732e85b01a12e7dd19469e26e4427f0e0cfe5117a78fc9f69c2f0f89702f463a",
-    "providerLifecycleSha256": "d68d37b0c362b38ac70bffd135aeea6eb483d078db49e68cc69ec3ea7bae01d8",
+    "providerLifecycleSha256": "43c6b2abb99a2b185eb143e5a5be12db0a3e096475cba58b1bde3a29dfb64940",
     "providerInventorySha256": "00adf1c4f6b3367055a9cc3fdfe658660771b4c9931f696e12761a95076ad92c",
     "executionRuntimeSha256": "3fca4ba4094e855412a22308e13f2b5f91dcfeb009512eb8318b3bd1bace8d9a",
     "commonInstructionSha256": "3d40f4b5d3ea78f6c9ca5bd18daa531dc758d77df21a5e7ef35a3336cd71f906",
@@ -53,13 +53,13 @@
       "claude": {
         "instructionSha256": "f56a44c730506258cc7e2581dbdd31bfd1e6d13d60dc8a8ee8bcc398228453fb",
         "hookSha256": "6398e6b20f6558392bdce1d7123815042047952be473b8fda6d2491aa1648a05",
-        "skillsSha256": "f5767bb43b442af15cbe45307365388953552c6b57b8fd58cfabe391b73fe228",
+        "skillsSha256": "617994510c71b6cb717dd3f06dc2dbf2ea6bd68849b5be83ca6a624ac409f697",
         "treeDigests": {}
       },
       "codex": {
         "instructionSha256": "3d40f4b5d3ea78f6c9ca5bd18daa531dc758d77df21a5e7ef35a3336cd71f906",
         "hookSha256": "697d186cfe0882ee2ce1b02ecc4c3258ab42b125bab6d70c7be868fa271132f7",
-        "skillsSha256": "f2f34252fa8bc0be9ddd6a7ca2a7243a184f1b1a951f98f1f2e9773850573a3e",
+        "skillsSha256": "a4f57953384153f393c3db3008f1967f637e0dc1d7cb149b8c47f020b62278ee",
         "treeDigests": {}
       },
       "generic": {
@@ -72,9 +72,9 @@
     "mergeSurfaceDigests": {
       "claude": "6398e6b20f6558392bdce1d7123815042047952be473b8fda6d2491aa1648a05"
     },
-    "governanceCheckSha256": "363b6af5c1e9c87cc11a53bb9868cb17e591c64f5545a09dc66f66e86f70e66f",
-    "utilityRegistrySha256": "310f92cc9aa57880d8f81464ac4191907bda9c9af31847a450497e6a9f97dce3",
-    "sharedSkillsSha256": "9a79b48a6543929a7b94952c1bd3be90faa15d3dc963e8487df0dd6bb8474aa7",
+    "governanceCheckSha256": "393f5a016baac5a345e9c08a93c14bdb575b66570fd475a7fa86bc2e8002dd33",
+    "utilityRegistrySha256": "ac430d50ee82c19eb678f725c00eec23a0e25b33ec4bad81d3bf6e2fa9fa64ff",
+    "sharedSkillsSha256": "8b0a4563714a8b6226890f2a94b5fa28036960035e040c0224d4c127fc17efe6",
     "sharedSkillCount": 11,
     "requiredScripts": {
       "audit:a11y": "node scripts/audit-consumer-a11y.mjs",
@@ -93,7 +93,7 @@
       ".github/workflows/audit.yml": "3cb259c8d83d8d378a6d282b0cde0a8884d96c51cf49e655405c3e416e646726",
       ".github/workflows/governance-anchor.yml": "3e280e67fd72886b0686a6d296947ee3270b4899e9914c1e3a9c61c951dcc2ee",
       ".npmrc": "79eff2d98653857c11ab6a0354fa62685a72ec214545e7fdfabc450e91b7ba63",
-      "governance/consumer-governance.md": "abbded0a31cf3a6fb0de62975b749d10f27ac0adcc9bbf5e95ef410b64073396",
+      "governance/consumer-governance.md": "bc58561386e0df62306a5d7246e51647847732efa3de84426bada9978ff6da5c",
       "governance/provider-cli-toolchain.json": "6bc607cb6ac299b332d35ca871c838b54e367d96775ad0e759c827a0e3ca10cc",
       "governance/provider-cli-toolchain.package-lock.json": "fe7115dcbb9c096cc9c2aff069282636b942995399ace5dfd9ba68a7280d465f",
       "governance/schemas/issuer-registry.schema.json": "52616f59420942b96b33001e00d2c9a23ca3aa14dc236d8cb2aa9756787bfb90",
@@ -121,13 +121,13 @@
       "scripts/schemas/product-template-scaffold-lock.schema.json": "1318af59f12546b3cda059a1d94923d9a969bef4c5a476ebb46e42f8c853d19a",
       "scripts/schemas/release-bom.schema.json": "6969482588a25533dc1896be63c3c9629aced1cbeb745b99822db764682dc4a4",
       "scripts/schemas/upgrade-evidence-receipt.schema.json": "e2da0a86241d8d019545b63e6285d2ca049ce95fe6aed4264149df2108c4ade0",
-      "scripts/setup-governance.mjs": "5297a0c6dace974c1233a95825a6ffceef8823373eb4bb96947961f3979e4339",
+      "scripts/setup-governance.mjs": "2d5bf5ef149595854681c5744a431c2c231ead7d8699571a453783b39e556518",
       "scripts/setup-provider-cli-toolchain.mjs": "b34e11d02a7aa71d001ef8f1a42af4cf97d1b8b82360f5779cb927370f5ee15a",
       "scripts/setup-workspace.mjs": "95dc0fef1f7570efe277a66f7edf4640055ad6abbae0245615eceb9b041560e9",
       "scripts/sync-all.mjs": "938c706cad79a4bd538359c9b74cb9253a4c74b5f1342cbfc1625600425d8bfd",
       "scripts/verify-consumer-css-entry.mjs": "a16545ea8d4f5224d8133f0bb0b68d5489d8e106fe7594488a78e0e5718b99cc",
       "scripts/verify-upgrade-evidence.mjs": "f4452640d34cb28dbddbca9919f4bc5d3caec7c35879f9e69fd5f6c8485b2ffc",
-      "scripts/verify-upgrade-provenance.mjs": "be8be9b993199d0eb01da1b57cd0e395a4bfceea70a78ff45e436f626c290ed3",
+      "scripts/verify-upgrade-provenance.mjs": "1902716115df20d4b8831e7c497abc82f9d3b848a06ca6b7cc1fe64def37a31b",
       "scripts/workflow-static-validation.mjs": "8e12bf2d73fc5e1200ddc6cc8437b27433fcd71f7d85d79b56756dcaac667305"
     }
   },

package/ds-canonical/fork/consumer/managed-files/794bb911ba8ebef58ab0d44a55b9968a19d2c62bcfb310b1ee3a84166f087f21.blob

@@ -3,7 +3,7 @@
 //
 // Security boundary:
 //   verified npm/Sigstore bundle -> exact GitHub workflow/tag/commit
-//   -> direct GitHub-verified signed annotated tag object -> exact commit/tree
+//   -> exact GitHub lightweight commit tag or direct annotated tag object -> exact commit/tree
 //   -> immutable GitHub Release closed asset set (six core files plus optional finalizer evidence) -> receipt/trust/BOM/scaffold/package/SBOM bytes
 //   -> exact npm SRI.
 // This file is loaded from the current trusted consumer before an incoming package is installed;
@@ -466,7 +466,7 @@ export function validateImmutableReleaseSnapshot({
   policy,
   expectedFinalizerRun = null,
   // Lane selector, fail-closed by default:false = high-assurance(governance anchor /
-  // enterprise finalizer)— GitHub-verified signed tag + full 8-asset closure required。
+  // enterprise finalizer)— GitHub-verified signed annotated tag + full 8-asset closure required。
   // true = ordinary consumer upgrade lane(tag→commit→tree + BOM + SLSA provenance;
   // 簽章與 finalizer evidence assets 是 opt-in 加值)。Ordinary 入口必須顯式傳 true。
   ordinaryRelease = false,
@@ -742,44 +742,61 @@ export async function resolveImmutableReleaseSnapshot({
     `GitHub tag ${tag}`,
   )
   const reference = await referenceResponse.json()
-  if (reference?.ref !== `refs/tags/${tag}`
-    || reference?.object?.type !== 'tag'
-    || !COMMIT_RE.test(reference.object.sha || '')) {
-    throw new Error(`GitHub tag ${tag} must directly reference one annotated tag object; lightweight tags are forbidden`)
+  const referenceType = reference?.object?.type
+  if (!reference
+    || typeof reference !== 'object'
+    || Array.isArray(reference)
+    || reference.ref !== `refs/tags/${tag}`
+    || !['commit', 'tag'].includes(referenceType)
+    || !COMMIT_RE.test(reference.object?.sha || '')) {
+    throw new Error(`GitHub tag ${tag} must return one exact lightweight commit ref or annotated tag ref`)
+  }
+
+  const annotated = referenceType === 'tag'
+  if (!annotated && !ordinaryRelease) {
+    throw new Error(`GitHub tag ${tag} high-assurance lane requires a directly verified signed annotated tag object`)
   }
   const tagObjectSha = reference.object.sha
-  const tagObjectResponse = await fetchOk(
-    fetchImpl,
-    `${apiBase}/git/tags/${tagObjectSha}`,
-    { headers: githubHeaders(token) },
-    `GitHub annotated tag ${tag}`,
-  )
-  const tagObject = await tagObjectResponse.json()
-  if (tagObject?.sha !== tagObjectSha
-    || tagObject?.tag !== tag
-    || tagObject?.object?.type !== 'commit'
-    || !COMMIT_RE.test(tagObject.object.sha || '')) {
-    throw new Error(`GitHub tag ${tag} annotated tag object/name/direct commit binding is invalid`)
-  }
-  const verification = tagObject.verification
-  // Ordinary releases push an annotated tag whose authority comes from the exact
-  // tag → commit → tree binding plus the BOM digests and npm SLSA provenance.
-  // A GitHub-verified signature (verified === true, reason 'valid') is the opt-in
-  // high-assurance finalizer's extra guarantee, not an ordinary requirement — but a
-  // BROKEN signature claim (bad_signature etc. on a signed tag) still fails closed.
-  const signedAndValid = verification?.verified === true && verification?.reason === 'valid'
-  const unsignedOrdinary = ordinaryRelease
-    && verification?.verified === false
-    && ['unsigned', 'unknown_signature_type'].includes(verification?.reason)
-  if (!signedAndValid && !unsignedOrdinary) {
-    throw new Error(`GitHub tag ${tag} is not a directly verified signed annotated tag object:${verification?.reason || '<missing>'}`)
-  }
-  if (signedAndValid) {
-    if (typeof verification.signature !== 'string' || !verification.signature
-      || typeof verification.payload !== 'string' || !verification.payload) {
-      throw new Error(`GitHub tag ${tag} is not a directly verified signed annotated tag object`)
+  let commitSha
+  let signedAndValid = false
+  let verification = null
+  if (annotated) {
+    const tagObjectResponse = await fetchOk(
+      fetchImpl,
+      `${apiBase}/git/tags/${tagObjectSha}`,
+      { headers: githubHeaders(token) },
+      `GitHub annotated tag ${tag}`,
+    )
+    const tagObject = await tagObjectResponse.json()
+    if (tagObject?.sha !== tagObjectSha
+      || tagObject?.tag !== tag
+      || tagObject?.object?.type !== 'commit'
+      || !COMMIT_RE.test(tagObject.object.sha || '')) {
+      throw new Error(`GitHub tag ${tag} annotated tag object/name/direct commit binding is invalid`)
+    }
+    commitSha = tagObject.object.sha
+    verification = tagObject.verification
+    // An annotated ordinary release accepts signed-valid or explicitly unsigned tag objects.
+    // A broken signature claim (bad_signature etc.) still fails closed.
+    signedAndValid = verification?.verified === true && verification?.reason === 'valid'
+    const unsignedOrdinary = ordinaryRelease
+      && verification?.verified === false
+      && ['unsigned', 'unknown_signature_type'].includes(verification?.reason)
+    if (!signedAndValid && !unsignedOrdinary) {
+      throw new Error(`GitHub tag ${tag} is not an acceptable direct annotated tag object:${verification?.reason || '<missing>'}`)
     }
-    canonicalTimestamp(verification.verified_at, `GitHub tag ${tag} verified_at`)
+    if (signedAndValid) {
+      if (typeof verification.signature !== 'string' || !verification.signature
+        || typeof verification.payload !== 'string' || !verification.payload) {
+        throw new Error(`GitHub tag ${tag} is not a directly verified signed annotated tag object`)
+      }
+      canonicalTimestamp(verification.verified_at, `GitHub tag ${tag} verified_at`)
+    }
+  } else {
+    // The formal release orchestrator publishes one exact lightweight tag. Its authority is the
+    // ref → commit → tree binding plus the immutable BOM and npm SLSA provenance; no tag object
+    // exists to carry a signature, so tagObject intentionally equals the direct commit object.
+    commitSha = tagObjectSha
   }
   const confirmedReferenceResponse = await fetchOk(
     fetchImpl,
@@ -788,12 +805,14 @@ export async function resolveImmutableReleaseSnapshot({
     `GitHub tag ${tag} confirmation`,
   )
   const confirmedReference = await confirmedReferenceResponse.json()
-  if (confirmedReference?.ref !== reference.ref
-    || confirmedReference?.object?.type !== 'tag'
+  if (!confirmedReference
+    || typeof confirmedReference !== 'object'
+    || Array.isArray(confirmedReference)
+    || confirmedReference.ref !== reference.ref
+    || confirmedReference?.object?.type !== referenceType
     || confirmedReference.object.sha !== tagObjectSha) {
-    throw new Error(`GitHub tag ${tag} changed while its signed annotated object was being verified`)
+    throw new Error(`GitHub tag ${tag} changed while its exact object binding was being verified`)
   }
-  const commitSha = tagObject.object.sha
   const commitResponse = await fetchOk(
     fetchImpl,
     `${apiBase}/git/commits/${commitSha}`,
@@ -813,7 +832,15 @@ export async function resolveImmutableReleaseSnapshot({
       tagObject: tagObjectSha,
       commit: commitSha,
       tree: commit.tree.sha,
-      verification: signedAndValid
+      verification: !annotated
+        ? {
+          verified: false,
+          reason: 'unsigned',
+          verifiedAt: null,
+          signatureSha256: null,
+          payloadSha256: null,
+        }
+        : signedAndValid
         ? {
           verified: true,
           reason: 'valid',

package/ds-canonical/fork/consumer/managed-files/884721550b56308812b20917adac7a12f36fdb4ecda6b02460a7f5a219c0c966.blob

@@ -54,21 +54,18 @@ authorizes its own next execution. Reviewed paths run from the DS authority, mat
 fresh snapshot, execute no candidate code, and emit proposals rather than applying to the live
 consumer or inventory.
 
-## Automated upgrade trust chain
+## Release mirror and protected PR trust chain
 
-Repository Actions defaults stay read-only, and **Allow GitHub Actions to create and approve pull
-requests** stays disabled. The credential-free certifier and fresh read-only verifier first bind the
-exact base, paths, patch, tree, and incoming bytes. Only the protected-branch `governance-upgrade`
-environment may mint the short-lived Governance Writer App token with contents and pull-request
-write permissions. The Writer App may create or strictly reuse one deterministic upgrade branch and
-PR; it cannot publish checks, approve, merge, bypass protection, or write directly to `main`.
+Automatic template delivery is owned upstream by the release mirror. It opens a normal PR containing
+the exact published snapshot; a consumer does not carry a second release-dispatch/updater workflow.
+Repository Actions defaults remain read-only, and ordinary delivery requires no hosted environment or
+App credential in the consumer.
 
-Writer App pushes can start ordinary candidate workflows. Those automatic candidate runs are
-non-authoritative and never satisfy the required check. The writer must explicitly send the
-`governance-upgrade-candidate-validation` repository dispatch. That event reloads
-`governance-anchor.yml` from protected default, executes candidate verification without credentials,
-and lets only the separate check-only Governance Check App publish the required
-`Immutable consumer snapshot` verdict. Review and protected rules decide whether the PR can merge.
+Protected `main` requires the single `Verify consumer` context from `audit.yml`. That workflow performs
+one locked install followed by typecheck, import lint, and build. The normal PR review and protected
+branch rules decide whether the mirror proposal can merge. Preview, visual, accessibility, canary, and
+external readback evidence are optional hardening lanes unless a repository explicitly opts into them;
+they are not hidden prerequisites for the standard release path.
 
 ## Verification boundary
 

package/ds-canonical/fork/consumer/managed-files/bc44cabad181f766611dab6a8f52d81100afadd50ac59799015e8ba7bf46d9eb.blob

@@ -103,7 +103,7 @@ function sameFileIdentity(left, right) {
     && left.ctimeNs === right.ctimeNs
 }
 
-function stableRegularBytes(path, label, maxBytes = MAX_SETUP_AUTHORITY_FILE_BYTES) {
+function stableRegularFile(path, label, maxBytes = MAX_SETUP_AUTHORITY_FILE_BYTES) {
   let descriptor
   try {
     const beforePath = lstatSync(path, { bigint: true })
@@ -132,12 +132,19 @@ function stableRegularBytes(path, label, maxBytes = MAX_SETUP_AUTHORITY_FILE_BYT
         && BigInt(bytes.length) === before.size,
       `${label} changed while it was captured`,
     )
-    return bytes
+    return {
+      bytes,
+      mode: Number(before.mode & 0o777n),
+    }
   } finally {
     if (descriptor !== undefined) closeSync(descriptor)
   }
 }
 
+function stableRegularBytes(path, label, maxBytes = MAX_SETUP_AUTHORITY_FILE_BYTES) {
+  return stableRegularFile(path, label, maxBytes).bytes
+}
+
 function canonicalForkPath(value) {
   return typeof value === 'string'
     && value.length > 0
@@ -155,8 +162,9 @@ function regularForkInventory(root) {
     invariant(
       directoryInfo.isDirectory()
         && !directoryInfo.isSymbolicLink()
+        && (directoryInfo.mode & 0o777) === 0o755
         && realpathSync(directory) === directory,
-      `installed governance corpus directory is unsafe:${prefix || '.'}`,
+      `installed governance corpus directory is unsafe or has a non-canonical mode:${prefix || '.'}`,
     )
     for (const name of readdirSync(directory).sort()) {
       invariant(name === name.normalize('NFC') && name !== '.' && name !== '..', `installed governance corpus name is not canonical:${name}`)
@@ -174,17 +182,27 @@ function regularForkInventory(root) {
   return rows
 }
 
-function writeExclusiveSnapshotFile(path, bytes) {
+function frozenSnapshotFileMode(sourceMode, label) {
+  invariant([0o644, 0o755].includes(sourceMode), `${label} has a non-canonical source mode`)
+  return sourceMode === 0o755 ? 0o500 : 0o400
+}
+
+function writeExclusiveSnapshotFile(path, record, label) {
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+  const frozenMode = frozenSnapshotFileMode(record.mode, label)
   let descriptor
   try {
-    descriptor = openSync(path, 'wx', 0o400)
-    writeFileSync(descriptor, bytes)
+    descriptor = openSync(path, 'wx', frozenMode)
+    writeFileSync(descriptor, record.bytes)
     fsyncSync(descriptor)
   } finally {
     if (descriptor !== undefined) closeSync(descriptor)
   }
-  invariant(sha256(stableRegularBytes(path, `private checker snapshot ${path}`)) === sha256(bytes), 'private checker snapshot write did not preserve authenticated bytes')
+  const written = stableRegularFile(path, `private checker snapshot ${path}`)
+  invariant(
+    written.mode === frozenMode && sha256(written.bytes) === sha256(record.bytes),
+    'private checker snapshot write did not preserve authenticated bytes and frozen source-mode identity',
+  )
 }
 
 function freezeSnapshotDirectories(root) {
@@ -223,7 +241,8 @@ function materializeInstalledCheckerClosure(root) {
       && realpathSync(installedFork) === installedFork,
     'installed governance corpus root is missing or has symlink ancestry',
   )
-  const corpusLockBytes = stableRegularBytes(join(installedFork, 'governance.lock'), 'installed governance corpus lock')
+  const corpusLockRecord = stableRegularFile(join(installedFork, 'governance.lock'), 'installed governance corpus lock')
+  const corpusLockBytes = corpusLockRecord.bytes
   let corpusLock
   let committedBom
   try {
@@ -243,10 +262,12 @@ function materializeInstalledCheckerClosure(root) {
     committedBom?.payload?.forkCorpusLockSha256 === sha256(corpusLockBytes),
     'committed governance lock does not authenticate the installed corpus lock',
   )
-  const shippedBom = stableRegularBytes(join(installedFork, 'consumer/lock.json'), 'installed governance release lock')
+  const shippedBomRecord = stableRegularFile(join(installedFork, 'consumer/lock.json'), 'installed governance release lock')
+  const shippedBom = shippedBomRecord.bytes
   const committedBomBytes = stableRegularBytes(join(root, 'governance/lock.json'), 'committed governance lock')
   invariant(shippedBom.equals(committedBomBytes), 'installed governance release lock differs from the committed lock')
-  const shippedSchema = stableRegularBytes(join(installedFork, 'consumer/lock.schema.json'), 'installed governance lock schema')
+  const shippedSchemaRecord = stableRegularFile(join(installedFork, 'consumer/lock.schema.json'), 'installed governance lock schema')
+  const shippedSchema = shippedSchemaRecord.bytes
   const committedSchema = stableRegularBytes(join(root, 'governance/lock.schema.json'), 'committed governance lock schema')
   invariant(shippedSchema.equals(committedSchema), 'installed governance lock schema differs from the committed schema')
 
@@ -262,16 +283,17 @@ function materializeInstalledCheckerClosure(root) {
         && !entries.has(entry.file),
       `installed governance corpus lock entry is invalid or duplicated:${index}`,
     )
-    const bytes = stableRegularBytes(join(installedFork, ...entry.file.split('/')), `installed governance corpus ${entry.file}`)
-    invariant(sha256(bytes) === entry.sha256, `installed governance corpus digest mismatch:${entry.file}`)
-    totalBytes += bytes.length
+    const record = stableRegularFile(join(installedFork, ...entry.file.split('/')), `installed governance corpus ${entry.file}`)
+    frozenSnapshotFileMode(record.mode, `installed governance corpus ${entry.file}`)
+    invariant(sha256(record.bytes) === entry.sha256, `installed governance corpus digest mismatch:${entry.file}`)
+    totalBytes += record.bytes.length
     invariant(totalBytes <= MAX_SETUP_AUTHORITY_TOTAL_BYTES, 'installed governance corpus exceeds the closed snapshot budget')
-    entries.set(entry.file, bytes)
+    entries.set(entry.file, record)
   }
   const checkerRelative = 'consumer/governance-check.mjs'
   invariant(
     entries.has(checkerRelative)
-      && committedBom?.payload?.governanceCheckSha256 === sha256(entries.get(checkerRelative)),
+      && committedBom?.payload?.governanceCheckSha256 === sha256(entries.get(checkerRelative).bytes),
     'committed governance lock does not authenticate the installed checker',
   )
   const expectedInventory = [...entries.keys(), 'consumer/lock.json', 'consumer/lock.schema.json', 'governance.lock'].sort()
@@ -281,9 +303,9 @@ function materializeInstalledCheckerClosure(root) {
   )
   const sourceClosure = new Map([
     ...entries,
-    ['governance.lock', corpusLockBytes],
-    ['consumer/lock.json', shippedBom],
-    ['consumer/lock.schema.json', shippedSchema],
+    ['governance.lock', corpusLockRecord],
+    ['consumer/lock.json', shippedBomRecord],
+    ['consumer/lock.schema.json', shippedSchemaRecord],
   ])
 
   const privateBase = resolveClosedPrivateRuntimeBase(process.platform)
@@ -292,12 +314,12 @@ function materializeInstalledCheckerClosure(root) {
   const snapshotFork = join(snapshotRoot, 'fork')
   mkdirSync(snapshotFork, { mode: 0o700 })
   try {
-    for (const [path, bytes] of entries) {
-      writeExclusiveSnapshotFile(join(snapshotFork, ...path.split('/')), bytes)
+    for (const [path, record] of entries) {
+      writeExclusiveSnapshotFile(join(snapshotFork, ...path.split('/')), record, `installed governance corpus ${path}`)
     }
-    writeExclusiveSnapshotFile(join(snapshotFork, 'governance.lock'), corpusLockBytes)
-    writeExclusiveSnapshotFile(join(snapshotFork, 'consumer/lock.json'), shippedBom)
-    writeExclusiveSnapshotFile(join(snapshotFork, 'consumer/lock.schema.json'), shippedSchema)
+    writeExclusiveSnapshotFile(join(snapshotFork, 'governance.lock'), corpusLockRecord, 'installed governance corpus lock')
+    writeExclusiveSnapshotFile(join(snapshotFork, 'consumer/lock.json'), shippedBomRecord, 'installed governance release lock')
+    writeExclusiveSnapshotFile(join(snapshotFork, 'consumer/lock.schema.json'), shippedSchemaRecord, 'installed governance lock schema')
     freezeSnapshotDirectories(snapshotRoot)
     return {
       checker: join(snapshotFork, checkerRelative),
@@ -310,11 +332,12 @@ function materializeInstalledCheckerClosure(root) {
           'installed governance corpus inventory changed after checker snapshot',
         )
         for (const [path, expected] of sourceClosure) {
+          const current = stableRegularFile(
+            join(installedFork, ...path.split('/')),
+            `installed checker closure CAS ${path}`,
+          )
           invariant(
-            stableRegularBytes(
-              join(installedFork, ...path.split('/')),
-              `installed checker closure CAS ${path}`,
-            ).equals(expected),
+            current.mode === expected.mode && current.bytes.equals(expected.bytes),
             `installed checker closure changed after authenticated snapshot:${path}`,
           )
         }