@xemahq/contracts 0.82.0 → 0.84.0

package/dist/conformance/verify-store-package.vectors.json

@@ -0,0 +1,2081 @@
+{
+  "$comment": "Conformance vectors for the composed store-package verifier (`verifyStorePackage`). Re-run every vector against your implementation. HARNESS: `manifests[v.manifest]` is the parsed manifest; `bundleLock`, `sealedLockDigest`, `namedEntries` map to the input fields of the same name (`null` is `undefined`); `trust` is the declared trust, or the string \"official\" for the official signers; `nodePlatforms` null is `undefined`. The fake verifier convention: a sigstore bundle is `{ identity, oidcIssuer, payload(base64) }`, \"signed by\" the identity and issuer written in it, and verifies for a signer iff its payload equals the verified payload, its issuer equals `signer.oidcIssuer` and its identity matches the anchored escaped `signer.identity.exact`. `signatures.lock.signedBy` signs the canonical lock bytes (null: no lock signature layer); `signatures.images[key]` writes `images/<key>.payload.json` (a cosign payload naming `digest`, where \"sealed\" is the lock entry's indexDigest) and `images/<key>.sigstore.json` signed by `signedBy` (null: both layers absent). The expectation is the verdict code, componentKey and, on admission, the admitted signer (admitted null: nothing to seal).",
+  "manifests": {
+    "one": {
+      "name": "@acme/dispatcher-biome",
+      "version": "4.0.0",
+      "xema": {
+        "id": "dispatcher",
+        "displayName": "Dispatcher",
+        "scope": "platform",
+        "target": "server",
+        "components": [
+          {
+            "key": "api",
+            "kind": "service",
+            "artifact": {
+              "kind": "oci-image",
+              "path": "./service"
+            },
+            "entrypoint": {
+              "kind": "oci-default"
+            },
+            "protocol": {
+              "kind": "http",
+              "revision": "v1",
+              "serviceName": "language-neutral-api",
+              "openapi": "./service/openapi.json",
+              "authScopes": [
+                "org"
+              ]
+            },
+            "scheduler": "platform",
+            "executionModes": [
+              "isolated"
+            ],
+            "requirements": {
+              "tenancy": {
+                "allowed": [
+                  "org"
+                ],
+                "tenantContext": "verified"
+              },
+              "isolation": {
+                "minimum": "container"
+              },
+              "trust": {
+                "minimum": "verified"
+              },
+              "locality": {
+                "allowed": [
+                  "cloud",
+                  "customer-private"
+                ]
+              },
+              "state": {
+                "kind": "stateless"
+              },
+              "resources": {
+                "minimum": {
+                  "cpu": "100m",
+                  "memory": "128Mi",
+                  "ephemeralStorage": "64Mi"
+                }
+              },
+              "runtime": {
+                "kind": "none",
+                "architectures": [
+                  "amd64",
+                  "arm64"
+                ]
+              },
+              "io": {
+                "ingress": "http",
+                "egress": "platform",
+                "rawBody": false,
+                "devices": []
+              },
+              "scaling": {
+                "mode": "horizontal",
+                "concurrency": {
+                  "handling": "parallel",
+                  "maximumPerInstance": 100
+                },
+                "readiness": {
+                  "kind": "protocol",
+                  "initialDelaySeconds": 1
+                },
+                "drain": {
+                  "kind": "graceful",
+                  "maximumSeconds": 30
+                },
+                "hints": {
+                  "cpu": "latency",
+                  "memory": "steady",
+                  "startup": "fast"
+                }
+              }
+            }
+          }
+        ]
+      }
+    },
+    "two": {
+      "name": "@acme/dispatcher-biome",
+      "version": "4.0.0",
+      "xema": {
+        "id": "dispatcher",
+        "displayName": "Dispatcher",
+        "scope": "platform",
+        "target": "server",
+        "components": [
+          {
+            "key": "api",
+            "kind": "service",
+            "artifact": {
+              "kind": "oci-image",
+              "path": "./service"
+            },
+            "entrypoint": {
+              "kind": "oci-default"
+            },
+            "protocol": {
+              "kind": "http",
+              "revision": "v1",
+              "serviceName": "language-neutral-api",
+              "openapi": "./service/openapi.json",
+              "authScopes": [
+                "org"
+              ]
+            },
+            "scheduler": "platform",
+            "executionModes": [
+              "isolated"
+            ],
+            "requirements": {
+              "tenancy": {
+                "allowed": [
+                  "org"
+                ],
+                "tenantContext": "verified"
+              },
+              "isolation": {
+                "minimum": "container"
+              },
+              "trust": {
+                "minimum": "verified"
+              },
+              "locality": {
+                "allowed": [
+                  "cloud",
+                  "customer-private"
+                ]
+              },
+              "state": {
+                "kind": "stateless"
+              },
+              "resources": {
+                "minimum": {
+                  "cpu": "100m",
+                  "memory": "128Mi",
+                  "ephemeralStorage": "64Mi"
+                }
+              },
+              "runtime": {
+                "kind": "none",
+                "architectures": [
+                  "amd64",
+                  "arm64"
+                ]
+              },
+              "io": {
+                "ingress": "http",
+                "egress": "platform",
+                "rawBody": false,
+                "devices": []
+              },
+              "scaling": {
+                "mode": "horizontal",
+                "concurrency": {
+                  "handling": "parallel",
+                  "maximumPerInstance": 100
+                },
+                "readiness": {
+                  "kind": "protocol",
+                  "initialDelaySeconds": 1
+                },
+                "drain": {
+                  "kind": "graceful",
+                  "maximumSeconds": 30
+                },
+                "hints": {
+                  "cpu": "latency",
+                  "memory": "steady",
+                  "startup": "fast"
+                }
+              }
+            },
+            "dispatchesRuntimeComponents": [
+              {
+                "biomeId": "dispatcher",
+                "componentKey": "runner"
+              }
+            ]
+          },
+          {
+            "key": "runner",
+            "kind": "service",
+            "artifact": {
+              "kind": "oci-image",
+              "path": "./service"
+            },
+            "entrypoint": {
+              "kind": "oci-default"
+            },
+            "protocol": {
+              "kind": "http",
+              "revision": "v1",
+              "serviceName": "dispatcher-runner",
+              "openapi": "./service/openapi.json",
+              "authScopes": [
+                "org"
+              ]
+            },
+            "scheduler": "platform",
+            "executionModes": [
+              "isolated"
+            ],
+            "requirements": {
+              "tenancy": {
+                "allowed": [
+                  "org"
+                ],
+                "tenantContext": "verified"
+              },
+              "isolation": {
+                "minimum": "container"
+              },
+              "trust": {
+                "minimum": "verified"
+              },
+              "locality": {
+                "allowed": [
+                  "cloud",
+                  "customer-private"
+                ]
+              },
+              "state": {
+                "kind": "stateless"
+              },
+              "resources": {
+                "minimum": {
+                  "cpu": "100m",
+                  "memory": "128Mi",
+                  "ephemeralStorage": "64Mi"
+                }
+              },
+              "runtime": {
+                "kind": "none",
+                "architectures": [
+                  "amd64",
+                  "arm64"
+                ]
+              },
+              "io": {
+                "ingress": "http",
+                "egress": "platform",
+                "rawBody": false,
+                "devices": []
+              },
+              "scaling": {
+                "mode": "horizontal",
+                "concurrency": {
+                  "handling": "parallel",
+                  "maximumPerInstance": 100
+                },
+                "readiness": {
+                  "kind": "protocol",
+                  "initialDelaySeconds": 1
+                },
+                "drain": {
+                  "kind": "graceful",
+                  "maximumSeconds": 30
+                },
+                "hints": {
+                  "cpu": "latency",
+                  "memory": "steady",
+                  "startup": "fast"
+                }
+              }
+            }
+          }
+        ]
+      }
+    },
+    "none": {
+      "name": "@acme/content-biome",
+      "version": "4.0.0",
+      "xema": {
+        "id": "content-biome",
+        "displayName": "Content biome",
+        "scope": "platform",
+        "target": "server",
+        "components": [
+          {
+            "key": "content",
+            "kind": "content",
+            "artifact": {
+              "kind": "package-content",
+              "path": "."
+            },
+            "entrypoint": {
+              "kind": "materialize"
+            },
+            "protocol": {
+              "kind": "none"
+            },
+            "executionModes": [
+              "materialized"
+            ],
+            "requirements": {
+              "tenancy": {
+                "allowed": [
+                  "org"
+                ],
+                "tenantContext": "verified"
+              },
+              "isolation": {
+                "minimum": "none"
+              },
+              "trust": {
+                "minimum": "untrusted"
+              },
+              "locality": {
+                "allowed": [
+                  "cloud",
+                  "customer-private"
+                ]
+              },
+              "state": {
+                "kind": "stateless"
+              },
+              "resources": {
+                "minimum": {
+                  "cpu": "1m",
+                  "memory": "1Mi",
+                  "ephemeralStorage": "1Mi"
+                }
+              },
+              "runtime": {
+                "kind": "none"
+              },
+              "io": {
+                "ingress": "none",
+                "egress": "none",
+                "rawBody": false,
+                "devices": []
+              },
+              "scaling": {
+                "mode": "singleton",
+                "concurrency": {
+                  "handling": "serial",
+                  "maximumPerInstance": 1
+                },
+                "readiness": {
+                  "kind": "none"
+                },
+                "drain": {
+                  "kind": "none"
+                },
+                "hints": {
+                  "cpu": "batch",
+                  "memory": "steady",
+                  "startup": "fast"
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "vectors": [
+    {
+      "name": "one-signer-signed-lock-and-images-passes",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": true,
+        "admitted": {
+          "signer": {
+            "oidcIssuer": "https://token.actions.githubusercontent.com",
+            "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      }
+    },
+    {
+      "name": "trust-lists-a-and-b-and-b-signed-everything-admits-b",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        },
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": true,
+        "admitted": {
+          "signer": {
+            "oidcIssuer": "https://token.actions.githubusercontent.com",
+            "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      }
+    },
+    {
+      "name": "lock-by-a-and-image-by-b-both-trusted-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        },
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "image-signer-not-lock-signer"
+      }
+    },
+    {
+      "name": "unsigned-lock-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": null,
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "image-signer-untrusted"
+      }
+    },
+    {
+      "name": "unsigned-image-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": null,
+            "digest": null
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "image-signer-untrusted",
+        "componentKey": "api"
+      }
+    },
+    {
+      "name": "image-payload-naming-another-digest-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "image-signer-untrusted",
+        "componentKey": "api"
+      }
+    },
+    {
+      "name": "signer-the-deployment-does-not-trust-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "image-signer-untrusted"
+      }
+    },
+    {
+      "name": "official-trust-declares-no-store-packages-signer",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": "official",
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "store-signer-trust-empty"
+      }
+    },
+    {
+      "name": "public-key-store-packages-signer-is-refused-not-skipped",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        },
+        {
+          "kind": "public-key",
+          "scope": "store-packages",
+          "publicKey": {
+            "pem": "unparsed",
+            "sha256": "0000000000000000000000000000000000000000000000000000000000000000"
+          },
+          "transparencyLog": "required"
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "store-signer-trust-invalid"
+      }
+    },
+    {
+      "name": "regexp-store-packages-signer-is-refused-not-skipped",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        },
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "regexp": "^https://github.com/acme/.*$"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "store-signer-trust-invalid"
+      }
+    },
+    {
+      "name": "pull-request-ref-store-packages-signer-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        },
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/pull/7/merge"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "store-signer-trust-invalid"
+      }
+    },
+    {
+      "name": "absent-cluster-facts-are-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": null,
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "cluster-facts-missing"
+      }
+    },
+    {
+      "name": "platform-variant-gap-in-the-second-entry-names-its-component",
+      "manifest": "two",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "variant": "v8",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          },
+          {
+            "componentKey": "runner",
+            "kind": "runtime-component",
+            "indexDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:53d5e41fabd9f5c452a01c1341310a45d7e3f3a6a4ace5590ca4010cf53722ec",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64",
+          "variant": "v8"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          },
+          "runner": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "image-platform-missing",
+        "componentKey": "runner"
+      }
+    },
+    {
+      "name": "images-required-and-no-lock-is-refused",
+      "manifest": "one",
+      "bundleLock": null,
+      "sealedLockDigest": null,
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "package-image-lock-missing"
+      }
+    },
+    {
+      "name": "lock-for-a-manifest-with-no-image-component-is-unexpected",
+      "manifest": "none",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "package-image-lock-unexpected"
+      }
+    },
+    {
+      "name": "structurally-invalid-lock-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher"
+      },
+      "sealedLockDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "package-image-lock-invalid"
+      }
+    },
+    {
+      "name": "lock-not-matching-the-sealed-digest-is-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "package-image-lock-mismatch"
+      }
+    },
+    {
+      "name": "named-entries-differing-from-the-lock-are-refused",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": [
+        {
+          "componentKey": "api",
+          "kind": "service",
+          "indexDigest": "sha256:8888888888888888888888888888888888888888888888888888888888888888",
+          "platforms": [
+            {
+              "os": "linux",
+              "architecture": "amd64",
+              "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+            },
+            {
+              "os": "linux",
+              "architecture": "arm64",
+              "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+            }
+          ],
+          "source": {
+            "repo": "acme/dispatcher",
+            "path": "service",
+            "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+            "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+            "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+          }
+        }
+      ],
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "package-image-lock-mismatch"
+      }
+    },
+    {
+      "name": "lock-for-another-biome-or-version-is-a-mismatch",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "9.9.9",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:2e195624f2846586a6668bcf12a7e140818c081beab9d40ea3510b650463a69c",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "package-image-lock-mismatch"
+      }
+    },
+    {
+      "name": "lock-missing-a-required-component-is-incomplete",
+      "manifest": "two",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "package-image-lock-incomplete"
+      }
+    },
+    {
+      "name": "no-images-and-no-lock-admits-nothing",
+      "manifest": "none",
+      "bundleLock": null,
+      "sealedLockDigest": null,
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": true,
+        "admitted": null
+      }
+    },
+    {
+      "name": "platform-gap-and-untrusted-signer-refuses-platform-first",
+      "manifest": "one",
+      "bundleLock": {
+        "schemaVersion": 1,
+        "biomeId": "dispatcher",
+        "version": "4.0.0",
+        "sourceHashAlgorithm": "xema-image-input-sha256-v3",
+        "entries": [
+          {
+            "componentKey": "api",
+            "kind": "service",
+            "indexDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "platforms": [
+              {
+                "os": "linux",
+                "architecture": "amd64",
+                "childDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+              },
+              {
+                "os": "linux",
+                "architecture": "arm64",
+                "childDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+              }
+            ],
+            "source": {
+              "repo": "acme/dispatcher",
+              "path": "service",
+              "sourceCommit": "dddddddddddddddddddddddddddddddddddddddd",
+              "sourceManifestHash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+              "contentHash": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            }
+          }
+        ]
+      },
+      "sealedLockDigest": "sha256:26950b31fcc4f27f36f3052bc66603d8eb426ad7ee3a77b76bf6f9364fb7da85",
+      "namedEntries": null,
+      "trust": [
+        {
+          "kind": "oidc-certificate",
+          "scope": "store-packages",
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": {
+            "exact": "https://github.com/acme/dispatcher/.github/workflows/publish.yaml@refs/heads/main"
+          }
+        }
+      ],
+      "nodePlatforms": [
+        {
+          "os": "linux",
+          "architecture": "amd64"
+        },
+        {
+          "os": "linux",
+          "architecture": "arm64"
+        },
+        {
+          "os": "linux",
+          "architecture": "s390x"
+        }
+      ],
+      "signatures": {
+        "lock": {
+          "oidcIssuer": "https://token.actions.githubusercontent.com",
+          "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+        },
+        "images": {
+          "api": {
+            "signedBy": {
+              "oidcIssuer": "https://token.actions.githubusercontent.com",
+              "identity": "https://github.com/acme/dispatcher-b/.github/workflows/publish.yaml@refs/heads/main"
+            },
+            "digest": "sealed"
+          }
+        }
+      },
+      "expect": {
+        "ok": false,
+        "code": "image-platform-missing",
+        "componentKey": "api"
+      }
+    }
+  ]
+}