@thomasminh1995/depverdict 0.6.0-alpha.1

package/src/governance-metadata.js

@@ -0,0 +1,346 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import path from 'node:path';
+
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+
+import { canonicalJsonBytes } from './canonical-json.js';
+import {
+  CAPABILITY_PROFILE_FILENAME,
+  DEPLOYMENT_PROFILE_FILENAME,
+  QUALIFICATION_RECORD_FILENAME
+} from './constants.js';
+import { compareText } from './portable.js';
+
+export const GOVERNANCE_SCHEMA_VERSION = '1.0.0';
+export const OFFLINE_CONFORMANCE_ENDPOINT = 'https://offline-conformance.invalid/v1/chat/completions';
+
+const [capabilitySchema, deploymentSchema, qualificationSchema] = await Promise.all([
+  readSchema('../schemas/capability-profile.schema.json'),
+  readSchema('../schemas/deployment-profile.schema.json'),
+  readSchema('../schemas/qualification-record.schema.json')
+]);
+const ajv = new Ajv2020({ allErrors: true, strict: true, strictRequired: false });
+addFormats(ajv);
+const validateCapabilitySchema = ajv.compile(capabilitySchema);
+const validateDeploymentSchema = ajv.compile(deploymentSchema);
+const validateQualificationSchema = ajv.compile(qualificationSchema);
+
+async function readSchema(relativeUrl) {
+  return JSON.parse(await readFile(new URL(relativeUrl, import.meta.url), 'utf8'));
+}
+
+const FORBIDDEN_KEY = /(?:authorization|api[_-]?key|secret|token|password|credential|private[_-]?key|prompt|evidence|repository(?:data)?)/i;
+const FORBIDDEN_VALUE = /(?:\bBearer\s+\S+|\bsk-[A-Za-z0-9_-]{8,}|-----BEGIN [A-Z ]+PRIVATE KEY-----)/i;
+
+export function assertNoGovernanceSecrets(value, currentPath = '$') {
+  if (typeof value === 'string') {
+    if (FORBIDDEN_VALUE.test(value)) {
+      throw new Error(`Governance metadata validation error: secret-like value at ${currentPath}.`);
+    }
+    return;
+  }
+  if (value === null || typeof value !== 'object') return;
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertNoGovernanceSecrets(item, `${currentPath}[${index}]`));
+    return;
+  }
+  for (const [key, item] of Object.entries(value)) {
+    if (FORBIDDEN_KEY.test(key)) {
+      throw new Error(`Governance metadata validation error: forbidden field ${currentPath}.${key}.`);
+    }
+    assertNoGovernanceSecrets(item, `${currentPath}.${key}`);
+  }
+}
+
+function schemaError(kind, validate) {
+  return new Error(`${kind} validation error: schema validation failed: ${ajv.errorsText(validate.errors, { separator: '; ' })}`);
+}
+
+function validateVersion(value, kind) {
+  if (value?.schemaVersion !== GOVERNANCE_SCHEMA_VERSION) {
+    throw new Error(`${kind} validation error: unsupported schema version; expected ${GOVERNANCE_SCHEMA_VERSION}.`);
+  }
+}
+
+function sortedUnique(values) {
+  return [...new Set(values)].sort(compareText);
+}
+
+function isSorted(values) {
+  return values.every((value, index) => index === 0 || compareText(values[index - 1], value) <= 0);
+}
+
+export function buildCapabilityProfile({
+  capabilityId,
+  protocol,
+  structuredOutput,
+  jsonMode,
+  streaming,
+  toolCalling,
+  responsesApi,
+  usageMetadata,
+  identityVerification,
+  timeoutSupported
+}) {
+  return validateCapabilityProfile({
+    schemaVersion: GOVERNANCE_SCHEMA_VERSION,
+    capabilityId,
+    protocol,
+    structuredOutput,
+    jsonMode,
+    streaming,
+    toolCalling,
+    responsesApi,
+    usageMetadata,
+    identityVerification,
+    timeoutSupported
+  });
+}
+
+export function validateCapabilityProfile(profile) {
+  assertNoGovernanceSecrets(profile);
+  validateCapabilityProfileSchema(profile);
+  if (profile.structuredOutput === 'jsonMode' && !profile.jsonMode) {
+    throw new Error('Capability Profile validation error: jsonMode must be true when it is the structured output mode.');
+  }
+  return profile;
+}
+
+export function validateCapabilityProfileSchema(profile) {
+  validateVersion(profile, 'Capability Profile');
+  if (!validateCapabilitySchema(profile)) throw schemaError('Capability Profile', validateCapabilitySchema);
+  return profile;
+}
+
+export function buildDeploymentProfile({
+  deploymentId,
+  provider,
+  endpoint,
+  model,
+  capabilityProfile,
+  capabilityProfileDigest,
+  modelRevision,
+  timeoutSeconds,
+  maxResponseBytes
+}) {
+  return validateDeploymentProfile({
+    schemaVersion: GOVERNANCE_SCHEMA_VERSION,
+    deploymentId,
+    provider,
+    endpoint,
+    model,
+    capabilityProfile,
+    capabilityProfileDigest,
+    ...(modelRevision === undefined ? {} : { modelRevision }),
+    timeoutSeconds,
+    maxResponseBytes
+  });
+}
+
+export function validateDeploymentProfile(profile) {
+  assertNoGovernanceSecrets(profile);
+  validateDeploymentProfileSchema(profile);
+  const endpoint = new URL(profile.endpoint);
+  if (!['http:', 'https:'].includes(endpoint.protocol)) {
+    throw new Error('Deployment Profile validation error: endpoint must use HTTP or HTTPS.');
+  }
+  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+    throw new Error('Deployment Profile validation error: endpoint must not contain credentials, query parameters, or fragments.');
+  }
+  return profile;
+}
+
+export function validateDeploymentProfileSchema(profile) {
+  validateVersion(profile, 'Deployment Profile');
+  if (!validateDeploymentSchema(profile)) throw schemaError('Deployment Profile', validateDeploymentSchema);
+  return profile;
+}
+
+export function buildQualificationRecord({
+  qualificationId,
+  deploymentProfileDigest,
+  capabilityProfileDigest,
+  conformanceReportDigest = null,
+  status,
+  qualifiedFor
+}) {
+  return validateQualificationRecord({
+    schemaVersion: GOVERNANCE_SCHEMA_VERSION,
+    qualificationId,
+    deploymentProfileDigest,
+    capabilityProfileDigest,
+    conformanceReportDigest,
+    status,
+    qualifiedFor: sortedUnique(qualifiedFor)
+  });
+}
+
+export function validateQualificationRecord(record) {
+  assertNoGovernanceSecrets(record);
+  validateQualificationRecordSchema(record);
+  if (!isSorted(record.qualifiedFor)) {
+    throw new Error('Qualification Record validation error: qualifiedFor must use stable lexical ordering.');
+  }
+  if (['SUPPORTED', 'CERTIFIED'].includes(record.status) && record.conformanceReportDigest === null) {
+    throw new Error(`Qualification Record validation error: ${record.status} requires a conformanceReportDigest.`);
+  }
+  return record;
+}
+
+export function validateQualificationRecordSchema(record) {
+  validateVersion(record, 'Qualification Record');
+  if (!validateQualificationSchema(record)) throw schemaError('Qualification Record', validateQualificationSchema);
+  return record;
+}
+
+function metadataDigest(value, validate) {
+  validate(value);
+  return `sha256:${createHash('sha256').update(canonicalJsonBytes(value)).digest('hex')}`;
+}
+
+export function capabilityProfileDigest(profile) {
+  return metadataDigest(profile, validateCapabilityProfile);
+}
+
+export function deploymentProfileDigest(profile) {
+  return metadataDigest(profile, validateDeploymentProfile);
+}
+
+export function qualificationRecordDigest(record) {
+  return metadataDigest(record, validateQualificationRecord);
+}
+
+function serialize(value, validate) {
+  validate(value);
+  return `${JSON.stringify(value, null, 2)}\n`;
+}
+
+export function serializeCapabilityProfile(profile) {
+  return serialize(profile, validateCapabilityProfile);
+}
+
+export function serializeDeploymentProfile(profile) {
+  return serialize(profile, validateDeploymentProfile);
+}
+
+export function serializeQualificationRecord(record) {
+  return serialize(record, validateQualificationRecord);
+}
+
+async function writePrivateJson(outputPath, value, serializer) {
+  const target = path.resolve(outputPath);
+  const temporary = `${target}.${process.pid}.tmp`;
+  await mkdir(path.dirname(target), { recursive: true });
+  let handle;
+  try {
+    handle = await open(temporary, 'w', 0o600);
+    await handle.writeFile(serializer(value), 'utf8');
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await rename(temporary, target);
+  } catch (error) {
+    await handle?.close().catch(() => {});
+    await rm(temporary, { force: true }).catch(() => {});
+    throw error;
+  }
+  return target;
+}
+
+export function writeCapabilityProfile(outputPath, profile) {
+  return writePrivateJson(outputPath, profile, serializeCapabilityProfile);
+}
+
+export function writeDeploymentProfile(outputPath, profile) {
+  return writePrivateJson(outputPath, profile, serializeDeploymentProfile);
+}
+
+export function writeQualificationRecord(outputPath, record) {
+  return writePrivateJson(outputPath, record, serializeQualificationRecord);
+}
+
+function portableId(value, fallback) {
+  const normalized = String(value ?? '')
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, '')
+    .slice(0, 96);
+  return normalized || fallback;
+}
+
+export function createDefaultGovernanceArtifacts({
+  provider = 'openai-compatible',
+  endpoint = OFFLINE_CONFORMANCE_ENDPOINT,
+  model = 'offline-fixture',
+  timeoutSeconds = 180,
+  maxResponseBytes = 1_048_576,
+  qualifiedFor = ['MVP-03']
+} = {}) {
+  const providerId = portableId(provider, 'runtime');
+  const modelId = portableId(model, 'model');
+  const capabilityProfile = buildCapabilityProfile({
+    capabilityId: `${providerId}-v1`,
+    protocol: 'chat-completions',
+    structuredOutput: 'jsonSchema',
+    jsonMode: false,
+    streaming: false,
+    toolCalling: false,
+    responsesApi: false,
+    usageMetadata: true,
+    identityVerification: true,
+    timeoutSupported: true
+  });
+  const deploymentId = portableId(`${providerId}-${modelId}`, 'offline-deployment');
+  const deploymentProfile = buildDeploymentProfile({
+    deploymentId,
+    provider,
+    endpoint,
+    model,
+    capabilityProfile: capabilityProfile.capabilityId,
+    capabilityProfileDigest: capabilityProfileDigest(capabilityProfile),
+    timeoutSeconds,
+    maxResponseBytes
+  });
+  const qualificationRecord = buildQualificationRecord({
+    qualificationId: portableId(`${deploymentProfile.deploymentId}-mvp-03`, 'runtime-mvp-03'),
+    deploymentProfileDigest: deploymentProfileDigest(deploymentProfile),
+    capabilityProfileDigest: capabilityProfileDigest(capabilityProfile),
+    conformanceReportDigest: null,
+    status: 'EXPERIMENTAL',
+    qualifiedFor
+  });
+  return { capabilityProfile, deploymentProfile, qualificationRecord };
+}
+
+export function serializeGovernanceArtifacts(artifacts) {
+  validateCapabilityProfile(artifacts?.capabilityProfile);
+  validateDeploymentProfile(artifacts?.deploymentProfile);
+  validateQualificationRecord(artifacts?.qualificationRecord);
+  return `${JSON.stringify({
+    capabilityProfile: artifacts.capabilityProfile,
+    deploymentProfile: artifacts.deploymentProfile,
+    qualificationRecord: artifacts.qualificationRecord
+  }, null, 2)}\n`;
+}
+
+export async function writeGovernanceArtifacts(outputDirectory, artifacts) {
+  validateCapabilityProfile(artifacts?.capabilityProfile);
+  validateDeploymentProfile(artifacts?.deploymentProfile);
+  validateQualificationRecord(artifacts?.qualificationRecord);
+  const directory = path.resolve(outputDirectory);
+  const capabilityProfile = await writeCapabilityProfile(
+    path.join(directory, CAPABILITY_PROFILE_FILENAME),
+    artifacts.capabilityProfile
+  );
+  const deploymentProfile = await writeDeploymentProfile(
+    path.join(directory, DEPLOYMENT_PROFILE_FILENAME),
+    artifacts.deploymentProfile
+  );
+  const qualificationRecord = await writeQualificationRecord(
+    path.join(directory, QUALIFICATION_RECORD_FILENAME),
+    artifacts.qualificationRecord
+  );
+  return { capabilityProfile, deploymentProfile, qualificationRecord };
+}

package/src/governance-validator.js

@@ -0,0 +1,360 @@
+import { createHash } from 'node:crypto';
+
+import { canonicalJsonBytes } from './canonical-json.js';
+import { validateConformanceReport } from './conformance-report.js';
+import {
+  assertNoGovernanceSecrets,
+  validateCapabilityProfileSchema,
+  validateDeploymentProfileSchema,
+  validateQualificationRecordSchema
+} from './governance-metadata.js';
+import {
+  GOVERNANCE_VALIDATION_STAGES,
+  createGovernanceDiagnostic,
+  sortGovernanceDiagnostics
+} from './governance-diagnostics.js';
+import { compareText } from './portable.js';
+
+const ARTIFACTS = Object.freeze([
+  {
+    key: 'capabilityProfile',
+    unknownCode: 'UNKNOWN_CAPABILITY',
+    validateSchema: validateCapabilityProfileSchema
+  },
+  {
+    key: 'deploymentProfile',
+    unknownCode: 'UNKNOWN_DEPLOYMENT',
+    validateSchema: validateDeploymentProfileSchema
+  },
+  {
+    key: 'conformanceReport',
+    unknownCode: 'UNKNOWN_CONFORMANCE',
+    validateSchema: validateConformanceReport
+  },
+  {
+    key: 'qualificationRecord',
+    unknownCode: 'UNKNOWN_QUALIFICATION',
+    validateSchema: validateQualificationRecordSchema
+  }
+]);
+
+function digest(value) {
+  return `sha256:${createHash('sha256').update(canonicalJsonBytes(value)).digest('hex')}`;
+}
+
+function addDiagnostic(diagnostics, diagnostic) {
+  diagnostics.push(createGovernanceDiagnostic(diagnostic));
+}
+
+function hasInitialDiagnostic(initialDiagnostics, artifact) {
+  return initialDiagnostics.some((diagnostic) => diagnostic.artifact === artifact);
+}
+
+function validateSchemas(artifacts, initialDiagnostics, diagnostics) {
+  const valid = {};
+  for (const definition of ARTIFACTS) {
+    const value = artifacts?.[definition.key];
+    if (value === undefined) {
+      if (!hasInitialDiagnostic(initialDiagnostics, definition.key)) {
+        addDiagnostic(diagnostics, {
+          stage: GOVERNANCE_VALIDATION_STAGES.LOAD_JSON,
+          code: definition.unknownCode,
+          artifact: definition.key,
+          message: 'Required governance artifact is unavailable.'
+        });
+      }
+      valid[definition.key] = false;
+      continue;
+    }
+    try {
+      definition.validateSchema(value);
+      valid[definition.key] = true;
+    } catch {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.SCHEMA_VALIDATION,
+        code: 'INVALID_SCHEMA',
+        artifact: definition.key,
+        message: 'Governance artifact failed schema or intrinsic invariant validation.'
+      });
+      valid[definition.key] = false;
+    }
+  }
+  return valid;
+}
+
+function calculateDigests(artifacts, valid, diagnostics) {
+  const digests = {};
+  for (const definition of ARTIFACTS) {
+    if (!valid[definition.key]) continue;
+    try {
+      digests[definition.key] = digest(artifacts[definition.key]);
+    } catch {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.DIGEST_VERIFICATION,
+        code: 'DIGEST_MISMATCH',
+        artifact: definition.key,
+        message: 'Canonical SHA-256 digest could not be calculated.'
+      });
+      valid[definition.key] = false;
+    }
+  }
+  return digests;
+}
+
+function compareDigest(diagnostics, artifact, path, actual, referenced) {
+  if (actual === referenced) return;
+  addDiagnostic(diagnostics, {
+    stage: GOVERNANCE_VALIDATION_STAGES.CROSS_ARTIFACT_VALIDATION,
+    code: 'DIGEST_MISMATCH',
+    artifact,
+    path,
+    message: 'Referenced digest does not match the canonical upstream artifact digest.'
+  });
+}
+
+function validateCrossArtifactLinks(artifacts, valid, digests, diagnostics) {
+  const capability = artifacts.capabilityProfile;
+  const deployment = artifacts.deploymentProfile;
+  const conformance = artifacts.conformanceReport;
+  const qualification = artifacts.qualificationRecord;
+
+  if (valid.capabilityProfile && valid.deploymentProfile) {
+    if (deployment.capabilityProfile !== capability.capabilityId) {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.CROSS_ARTIFACT_VALIDATION,
+        code: 'UNKNOWN_CAPABILITY',
+        artifact: 'deploymentProfile',
+        path: '$.capabilityProfile',
+        message: 'Deployment Profile references a different Capability Profile ID.'
+      });
+    }
+    compareDigest(
+      diagnostics,
+      'deploymentProfile',
+      '$.capabilityProfileDigest',
+      digests.capabilityProfile,
+      deployment.capabilityProfileDigest
+    );
+  }
+
+  if (valid.capabilityProfile && valid.conformanceReport) {
+    compareDigest(
+      diagnostics,
+      'conformanceReport',
+      '$.capabilityProfileDigest',
+      digests.capabilityProfile,
+      conformance.capabilityProfileDigest
+    );
+  }
+  if (valid.capabilityProfile && valid.qualificationRecord) {
+    compareDigest(
+      diagnostics,
+      'qualificationRecord',
+      '$.capabilityProfileDigest',
+      digests.capabilityProfile,
+      qualification.capabilityProfileDigest
+    );
+  }
+
+  if (valid.deploymentProfile && valid.conformanceReport) {
+    compareDigest(
+      diagnostics,
+      'conformanceReport',
+      '$.deploymentProfileDigest',
+      digests.deploymentProfile,
+      conformance.deploymentProfileDigest
+    );
+    if (conformance.runtime.provider !== deployment.provider
+      || conformance.runtime.model !== deployment.model) {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.CROSS_ARTIFACT_VALIDATION,
+        code: 'UNKNOWN_DEPLOYMENT',
+        artifact: 'conformanceReport',
+        path: '$.runtime',
+        message: 'Conformance runtime identity does not match the Deployment Profile.'
+      });
+    }
+  }
+  if (valid.deploymentProfile && valid.qualificationRecord) {
+    compareDigest(
+      diagnostics,
+      'qualificationRecord',
+      '$.deploymentProfileDigest',
+      digests.deploymentProfile,
+      qualification.deploymentProfileDigest
+    );
+  }
+
+  if (valid.conformanceReport && valid.qualificationRecord) {
+    if (qualification.conformanceReportDigest === null) {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.CROSS_ARTIFACT_VALIDATION,
+        code: 'UNKNOWN_CONFORMANCE',
+        artifact: 'qualificationRecord',
+        path: '$.conformanceReportDigest',
+        message: 'Qualification Record does not reference the loaded Conformance Report.'
+      });
+    } else {
+      compareDigest(
+        diagnostics,
+        'qualificationRecord',
+        '$.conformanceReportDigest',
+        digests.conformanceReport,
+        qualification.conformanceReportDigest
+      );
+    }
+  }
+}
+
+function mutableModelAlias(model) {
+  return /(?:^|[:/@._-])(?:latest|main|master|stable|current)(?:$|[:/@._-])/i.test(model);
+}
+
+function validatePolicy(artifacts, valid, diagnostics) {
+  for (const definition of ARTIFACTS.filter((entry) => entry.key !== 'conformanceReport')) {
+    if (!valid[definition.key]) continue;
+    try {
+      assertNoGovernanceSecrets(artifacts[definition.key]);
+    } catch {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.GOVERNANCE_POLICY_VALIDATION,
+        code: 'GOVERNANCE_POLICY_VIOLATION',
+        artifact: definition.key,
+        message: 'Governance artifact contains a forbidden field or secret-like value.'
+      });
+    }
+  }
+
+  const capability = artifacts.capabilityProfile;
+  if (valid.capabilityProfile && capability.structuredOutput === 'jsonMode' && !capability.jsonMode) {
+    addDiagnostic(diagnostics, {
+      stage: GOVERNANCE_VALIDATION_STAGES.GOVERNANCE_POLICY_VALIDATION,
+      code: 'GOVERNANCE_POLICY_VIOLATION',
+      artifact: 'capabilityProfile',
+      path: '$.jsonMode',
+      message: 'jsonMode must be true when it is the declared structured output mode.'
+    });
+  }
+
+  const deployment = artifacts.deploymentProfile;
+  if (valid.deploymentProfile) {
+    const endpoint = new URL(deployment.endpoint);
+    if (!['http:', 'https:'].includes(endpoint.protocol)
+      || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.GOVERNANCE_POLICY_VALIDATION,
+        code: 'GOVERNANCE_POLICY_VIOLATION',
+        artifact: 'deploymentProfile',
+        path: '$.endpoint',
+        message: 'Deployment endpoint violates portable credential-free URL policy.'
+      });
+    }
+  }
+
+  const qualification = artifacts.qualificationRecord;
+  const conformance = artifacts.conformanceReport;
+  if (valid.qualificationRecord) {
+    if (!qualification.qualifiedFor.every((task, index, tasks) => (
+      index === 0 || compareText(tasks[index - 1], task) < 0
+    ))) {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.GOVERNANCE_POLICY_VALIDATION,
+        code: 'GOVERNANCE_POLICY_VIOLATION',
+        artifact: 'qualificationRecord',
+        path: '$.qualifiedFor',
+        message: 'Qualification task scope must be unique and lexically ordered.'
+      });
+    }
+    if (['SUPPORTED', 'CERTIFIED'].includes(qualification.status)
+      && qualification.conformanceReportDigest === null) {
+      addDiagnostic(diagnostics, {
+        stage: GOVERNANCE_VALIDATION_STAGES.GOVERNANCE_POLICY_VALIDATION,
+        code: 'INVALID_CERTIFICATION_STATE',
+        artifact: 'qualificationRecord',
+        path: '$.status',
+        message: 'SUPPORTED and CERTIFIED require a Conformance Report digest.'
+      });
+    }
+  }
+
+  if (valid.qualificationRecord && valid.conformanceReport
+    && ['SUPPORTED', 'CERTIFIED'].includes(qualification.status)
+    && conformance.recommendation !== 'CONFORMANT') {
+    addDiagnostic(diagnostics, {
+      stage: GOVERNANCE_VALIDATION_STAGES.GOVERNANCE_POLICY_VALIDATION,
+      code: 'INVALID_CERTIFICATION_STATE',
+      artifact: 'qualificationRecord',
+      path: '$.status',
+      message: 'SUPPORTED and CERTIFIED require a CONFORMANT Conformance Report.'
+    });
+  }
+
+  if (valid.qualificationRecord && valid.deploymentProfile
+    && qualification.status === 'CERTIFIED'
+    && mutableModelAlias(deployment.model)
+    && (typeof deployment.modelRevision !== 'string'
+      || mutableModelAlias(deployment.modelRevision))) {
+    addDiagnostic(diagnostics, {
+      stage: GOVERNANCE_VALIDATION_STAGES.GOVERNANCE_POLICY_VALIDATION,
+      code: 'INVALID_CERTIFICATION_STATE',
+      artifact: 'qualificationRecord',
+      path: '$.status',
+      message: 'CERTIFIED is not allowed for a mutable model alias without modelRevision pinning.'
+    });
+  }
+}
+
+function requestedTasks(options) {
+  const tasks = [
+    ...(typeof options.task === 'string' ? [options.task] : []),
+    ...(Array.isArray(options.tasks) ? options.tasks : [])
+  ];
+  return [...new Set(tasks.filter((task) => typeof task === 'string' && task.length > 0))].sort(compareText);
+}
+
+function validateTaskScope(artifacts, valid, options, diagnostics) {
+  if (!valid.qualificationRecord) return;
+  const qualified = new Set(artifacts.qualificationRecord.qualifiedFor);
+  for (const [index, task] of requestedTasks(options).entries()) {
+    if (qualified.has(task)) continue;
+    addDiagnostic(diagnostics, {
+      stage: GOVERNANCE_VALIDATION_STAGES.TASK_SCOPE_VALIDATION,
+      code: 'TASK_SCOPE_MISMATCH',
+      artifact: 'qualificationRecord',
+      path: `$.requestedTasks[${index}]`,
+      message: 'Qualification Record does not explicitly cover the requested task.'
+    });
+  }
+}
+
+export function validateGovernanceArtifacts(artifacts, options = {}) {
+  const initialDiagnostics = Array.isArray(options.initialDiagnostics)
+    ? options.initialDiagnostics
+    : [];
+  const diagnostics = [...initialDiagnostics];
+  const validArtifacts = validateSchemas(artifacts, initialDiagnostics, diagnostics);
+  const digests = calculateDigests(artifacts, validArtifacts, diagnostics);
+  validateCrossArtifactLinks(artifacts, validArtifacts, digests, diagnostics);
+  validatePolicy(artifacts, validArtifacts, diagnostics);
+  validateTaskScope(artifacts, validArtifacts, options, diagnostics);
+  const sortedDiagnostics = sortGovernanceDiagnostics(diagnostics);
+  const valid = sortedDiagnostics.length === 0;
+  return {
+    valid,
+    diagnostics: sortedDiagnostics,
+    bundle: valid
+      ? {
+          capabilityProfile: artifacts.capabilityProfile,
+          deploymentProfile: artifacts.deploymentProfile,
+          conformanceReport: artifacts.conformanceReport,
+          qualificationRecord: artifacts.qualificationRecord,
+          digests: {
+            capabilityProfile: digests.capabilityProfile,
+            deploymentProfile: digests.deploymentProfile,
+            conformanceReport: digests.conformanceReport,
+            qualificationRecord: digests.qualificationRecord
+          }
+        }
+      : null
+  };
+}