@xemahq/edition-tooling 0.0.0-stage → 0.1.1

package/edition/assemble-third-party-input.mjs

@@ -0,0 +1,348 @@
+#!/usr/bin/env node
+// assemble-third-party-input — the producer input of ONE image of a THIRD-PARTY biome, assembled in the publisher's own
+// GitHub-hosted workflow (XEMA-1611 design section 5).
+//
+//   xema-edition evidence assemble-third-party-input \
+//     --bundle <oci repository>@sha256:<64-hex> \
+//     --contract-authority <file> \
+//     --image <image repository>@sha256:<64-hex> \
+//     --subject-id <component image name> \
+//     --provenance <absolute exported BuildKit SLSA v1 predicate> \
+//     --registry-credentials <file> \
+//     --output <path> \
+//     [--ttl-seconds <n>]
+//
+// It runs on PUBLIC inputs only: this CLI and the `@xemahq/contracts` it ships (both from public npm), the publisher's
+// own checkout at GITHUB_WORKSPACE, its own registry credential declaration and the GITHUB_* context of the run. It
+// takes no data root, no kernel checkout and nothing of the vendor's. The checks that need the vendor's trust policy
+// (the producer TTL ceiling, the signer rows, image ownership) run at the vendor's admission, by the trusted writer
+// (`index runtime-image-source --trusted-write --third-party`), never here.
+//
+// Emits the EXACT producer input `produce-image-source-evidence.mjs` accepts, through the first-party assembler's own
+// document builder and gates (`assemble-producer-input.mjs`). Field derivation:
+//   * contractAuthority   — the `--contract-authority` file (the kernel contract authority the vendor's evidence trust
+//                           pin names), proved to be the kernel this CLI ships before anything else is read.
+//   * subject kind and id — the bundle's `xema-biome.json` (`--bundle`, read BY DIGEST): the one service or worker
+//                           component with an `oci-image` artifact whose image name is `--subject-id` (a service by
+//                           `protocol.serviceName`, a worker by its key), kind `runtime-component` for a
+//                           `scheduler: runtime` component and `service` otherwise, as the index builder names it.
+//   * repo, repositoryUrl, sourceCommit, producerWorkflowSha, signer, builderId, runId, runAttempt
+//                         — GITHUB_REPOSITORY, GITHUB_SHA, GITHUB_WORKFLOW_REF, GITHUB_RUN_ID, GITHUB_RUN_ATTEMPT.
+//   * sourceManifestHash  — the kernel hash of the bundle's `xema-biome.json`.
+//   * path                — `<repo>/<biome dir>`: the directory of the ONE `xema-biome.json` of the checkout at
+//                           GITHUB_SHA whose hash is the bundle's (none, or more than one, is refused by name).
+//   * sourceTreeHash      — `hashImageBuildInputs` over the publisher's checkout at GITHUB_SHA, the same algorithm
+//                           first-party images are hashed with, with no cross-repo inputs. It is publisher-attested:
+//                           the vendor never recomputes it.
+//   * builder digests     — the exported BuildKit SLSA v1 predicate (`--provenance`), whose VCS revision must be
+//                           GITHUB_SHA.
+//   * manifest media type, platforms, sbomDigest, provenanceDigest
+//                         — the registry, read BY DIGEST at `--image` (no tag is read), with the publisher's credential.
+//   * issuedAt/expiresAt  — now, plus `--ttl-seconds` or DEFAULT_PRODUCER_TTL_SECONDS (72h). The ceiling is the vendor
+//                           trust policy's maxProducerTtlSeconds, enforced by the vendor's third-party pin writer
+//                           (`index runtime-image-source --trusted-write --third-party`) and `verify-evidence`; this CLI holds
+//                           no second one. A value that is not a positive integer, or whose expiresAt RFC 3339 cannot
+//                           name, is refused by name.
+//
+// It refuses to run unless RUNNER_ENVIRONMENT is the declared runner environment (`--runner-environment self-hosted`, else
+// `github-hosted`) and GITHUB_REF is `refs/heads/main`. Those variables are self-asserted by the run, so this is only a
+// fail-fast mirror: the authority is the vendor's admission, which holds the Fulcio certificate's Runner Environment to
+// the runner environment the vendor's pin declares for the source (github-hosted unless declared self-hosted) and its
+// Source Repository Ref to the release channel.
+
+import { isAbsolute, resolve } from 'node:path';
+
+import {
+  ProducerTtlCeilingSource,
+  assertAssembledProducerInput,
+  assertCanonicalSubjectId,
+  assertWorkflowContext,
+  deriveBuilder,
+  producerInputDocument,
+  producerTtlSecondsFlag,
+  readAssemblerFlags,
+  resolveImageArtifactEvidenceByDigest,
+  resolveProducerTtlSeconds,
+  writeProducerInputFile,
+} from './assemble-producer-input.mjs';
+import { configureEditionWorkspaceFromArgv, isEntryModule, kernelPackageDir, stateKernelPackageDir } from './edition-workspace.mjs';
+import { readPublicContractAuthority } from './evidence-input-mode.mjs';
+import { RunnerEnvironment, parseDeclaredRunnerEnvironment } from './fulcio-certificate-extensions.mjs';
+import { shippedKernelPackageDir } from './kernel-package.mjs';
+import {
+  assertGitCommitExists,
+  biomeImageComponents,
+  claimBiomeImageName,
+  hashImageBuildInputs,
+  isRuntimeImageComponent,
+  imageInputSourceHashAlgorithm,
+  readGitJsonAtCommit,
+} from './lib.mjs';
+import { OrasRegistry } from './oras.mjs';
+import { sandboxedGit } from './produce-image-source-evidence.mjs';
+import { loadRegistryCredentialDeclarationsFile, resolveRegistryCredential, splitImageRef } from './registry-credentials.mjs';
+import { subjectServicePath } from './resolve-images.mjs';
+import { fetchBundleManifest } from './third-party-bundle-registry.mjs';
+import { OCI_REPOSITORY_AT_DIGEST } from './third-party-source-flags.mjs';
+import { PUBLISHER_ATTESTED_LABEL } from './third-party-subjects.mjs';
+
+/** The runner a third-party producer input is assembled on when `--runner-environment` is not given. */
+export const THIRD_PARTY_RUNNER_ENVIRONMENT = RunnerEnvironment.GithubHosted;
+/** The only ref a third-party producer input is assembled from (the release channel). */
+export const THIRD_PARTY_PRODUCER_REF = 'refs/heads/main';
+
+const BIOME_MANIFEST_FILE = 'xema-biome.json';
+const OCI_IMAGE_ARTIFACT = 'oci-image';
+
+/** The flags of the verb; every one but `--ttl-seconds` is required. */
+export const THIRD_PARTY_INPUT_FLAGS = Object.freeze({
+  bundle: 'bundle',
+  contractAuthority: 'contract-authority',
+  image: 'image',
+  subjectId: 'subject-id',
+  provenance: 'provenance',
+  registryCredentials: 'registry-credentials',
+  output: 'output',
+  ttlSeconds: 'ttl-seconds',
+  runnerEnvironment: 'runner-environment',
+});
+
+export const THIRD_PARTY_INPUT_USAGE =
+  'usage: xema-edition evidence assemble-third-party-input --bundle <oci repository>@sha256:<64-hex> ' +
+  '--contract-authority <file> --image <image repository>@sha256:<64-hex> --subject-id <component image name> ' +
+  '--provenance <absolute exported SLSA v1 predicate> --registry-credentials <file> --output <path> [--ttl-seconds <n>] ' +
+  `[--runner-environment ${RunnerEnvironment.SelfHosted}, default ${RunnerEnvironment.GithubHosted}]`;
+
+/**
+ * Refuse a run that is not a `runnerEnvironment` run of refs/heads/main, before anything else is read.
+ * RUNNER_ENVIRONMENT and GITHUB_REF are self-asserted, so this is a fail-fast mirror only; the authority is the vendor
+ * admission's check of the Fulcio certificate's Runner Environment (against the pin's declaration) and Source
+ * Repository Ref extensions.
+ */
+export function assertThirdPartyRunner(env, runnerEnvironment = THIRD_PARTY_RUNNER_ENVIRONMENT) {
+  if (env.RUNNER_ENVIRONMENT !== runnerEnvironment) {
+    throw new Error(
+      `a third-party producer input is assembled only on a ${runnerEnvironment} runner ` +
+        `(RUNNER_ENVIRONMENT is ${JSON.stringify(env.RUNNER_ENVIRONMENT ?? null)}): the vendor admits only certificates whose ` +
+        `Fulcio Runner Environment extension is the one its pin declares (${RunnerEnvironment.GithubHosted} unless declared ` +
+        `${RunnerEnvironment.SelfHosted}); pass --${THIRD_PARTY_INPUT_FLAGS.runnerEnvironment} ${RunnerEnvironment.SelfHosted} only when it does`,
+    );
+  }
+  if (env.GITHUB_REF !== THIRD_PARTY_PRODUCER_REF) {
+    throw new Error(
+      `a third-party producer input is assembled only from ${THIRD_PARTY_PRODUCER_REF} ` +
+        `(GITHUB_REF is ${JSON.stringify(env.GITHUB_REF ?? null)}): the vendor admits only certificates whose Fulcio ` +
+        `Source Repository Ref extension is ${THIRD_PARTY_PRODUCER_REF}, the release channel`,
+    );
+  }
+}
+
+function ociReference(flag, value) {
+  if (!OCI_REPOSITORY_AT_DIGEST.test(value ?? '')) {
+    throw new Error(`--${flag} must be <repository>@sha256:<64-hex>; got ${JSON.stringify(value)}`);
+  }
+  const at = value.indexOf('@');
+  return { repository: value.slice(0, at), digest: value.slice(at + 1) };
+}
+
+/**
+ * The bundle component `subjectId` names, and its runtime image subject kind, by the index builder's own rule
+ * (`biomeImageComponents`, `claimBiomeImageName`, `isRuntimeImageComponent` in lib.mjs): every image component is
+ * named, so a component with no image name, a web biome with an image and a duplicate image name are refused as the
+ * index builder refuses them; the subject is the one with its own `oci-image` artifact named `subjectId`.
+ */
+export function bundleImageSubject({ manifest, subjectId, enums, bundleRef }) {
+  const xema = manifest?.xema;
+  const components = Array.isArray(xema?.components) ? xema.components : [];
+  const rel = `bundle ${bundleRef} ${BIOME_MANIFEST_FILE}`;
+  const taken = new Set();
+  const images = biomeImageComponents(components)
+    .map((component) => ({ component, name: claimBiomeImageName(component, { rel, id: xema?.id, target: xema?.target, taken }) }))
+    .filter(({ component }) => component.artifact?.kind === OCI_IMAGE_ARTIFACT);
+  const match = images.find(({ name }) => name === subjectId);
+  if (match === undefined) {
+    throw new Error(
+      `bundle ${bundleRef} has no ${OCI_IMAGE_ARTIFACT} service or worker component named ${JSON.stringify(subjectId)} ` +
+        `(its images: ${images.map(({ name }) => name).join(', ') || 'none'}); --subject-id names exactly one`,
+    );
+  }
+  const kind = isRuntimeImageComponent(match.component)
+    ? enums.RuntimeImageSubjectKind.RuntimeComponent
+    : enums.RuntimeImageSubjectKind.Service;
+  return { kind, id: subjectId };
+}
+
+/**
+ * The biome directory of the publisher's checkout at `commit`: the directory of the ONE `xema-biome.json` whose kernel
+ * source manifest hash is `sourceManifestHash` (`''` for the repository root). None, or more than one, is refused.
+ */
+export async function biomeDirectoryAtCommit({ checkout, commit, sourceManifestHash, schemas, bundleRef }) {
+  const paths = sandboxedGit(checkout, ['ls-tree', '-r', '-z', '--name-only', commit])
+    .split('\0')
+    .filter((path) => path === BIOME_MANIFEST_FILE || path.endsWith(`/${BIOME_MANIFEST_FILE}`));
+  const matching = [];
+  for (const path of paths) {
+    const hash = await schemas.computeBiomeSourceManifestHash(readGitJsonAtCommit(checkout, path, commit));
+    if (hash === sourceManifestHash) {matching.push(path);}
+  }
+  if (matching.length !== 1) {
+    throw new Error(
+      `the checkout at ${commit} has ${matching.length} ${BIOME_MANIFEST_FILE} files whose source manifest hash is ` +
+        `${sourceManifestHash}, the hash of bundle ${bundleRef} ` +
+        `(${matching.length === 0 ? `its ${BIOME_MANIFEST_FILE} files: ${paths.join(', ') || 'none'}` : matching.join(', ')}); exactly one is required: ` +
+        'the bundle must be published from this commit',
+    );
+  }
+  const [path] = matching;
+  return path === BIOME_MANIFEST_FILE ? '' : path.slice(0, -`/${BIOME_MANIFEST_FILE}`.length);
+}
+
+/**
+ * Assemble the producer input of one third-party image and prove it satisfies the producer's exact contract.
+ *
+ * @param {object} request
+ * @param {string} request.bundle `<oci repository>@sha256:<hex>` of the published biome bundle
+ * @param {string} request.contractAuthorityPath the `--contract-authority` file
+ * @param {string} request.image `<image repository>@sha256:<hex>` of the published image
+ * @param {string} request.subjectId the bundle component's image name
+ * @param {string} request.provenancePath the exported BuildKit SLSA v1 predicate (absolute)
+ * @param {string} request.registryCredentialsPath the publisher's registry credential declaration file
+ * @param {number} [request.ttlSeconds]
+ * @param {'self-hosted'} [request.runnerEnvironment] the declared runner environment (`parseDeclaredRunnerEnvironment`; absent: github-hosted)
+ * @param {string} [request.kernelDir] the kernel package (default: the configured Kernel root)
+ * @param {object} [request.env]
+ * @param {Function} [request.registryFor] `({authority, credential}) => client`, for tests
+ * @param {number} [request.now]
+ */
+export async function assembleThirdPartyInput({
+  bundle,
+  contractAuthorityPath,
+  image,
+  subjectId,
+  provenancePath,
+  registryCredentialsPath,
+  ttlSeconds,
+  runnerEnvironment,
+  kernelDir = kernelPackageDir(),
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+  registryFor = null,
+  now = Date.now(),
+}) {
+  assertThirdPartyRunner(
+    env,
+    parseDeclaredRunnerEnvironment(runnerEnvironment, `--${THIRD_PARTY_INPUT_FLAGS.runnerEnvironment}`) ?? THIRD_PARTY_RUNNER_ENVIRONMENT,
+  );
+  const context = assertWorkflowContext(env);
+  ociReference(THIRD_PARTY_INPUT_FLAGS.bundle, bundle);
+  const imageRef = ociReference(THIRD_PARTY_INPUT_FLAGS.image, image);
+  assertCanonicalSubjectId(subjectId);
+  const effectiveTtlSeconds = resolveProducerTtlSeconds({ ttlSeconds, now, ceiling: { source: ProducerTtlCeilingSource.VendorAdmission } });
+  const checkout = env.GITHUB_WORKSPACE;
+  if (typeof checkout !== 'string' || !isAbsolute(checkout)) {
+    throw new Error(
+      `GITHUB_WORKSPACE (${JSON.stringify(checkout ?? null)}) is not an absolute path: the publisher's checkout at GITHUB_SHA is hashed there`,
+    );
+  }
+  try {
+    assertGitCommitExists(checkout, context.sha);
+  } catch (error) {
+    throw new Error(`the publisher's checkout at GITHUB_WORKSPACE ${checkout} does not hold GITHUB_SHA ${context.sha}: ${error.message}`);
+  }
+  const { contractAuthority, schemas } = await readPublicContractAuthority({ path: contractAuthorityPath, kernelDir });
+  const builder = deriveBuilder({ provenancePath, sourceCommit: context.sha });
+
+  const declarations = loadRegistryCredentialDeclarationsFile(registryCredentialsPath);
+  const clients = new Map();
+  const clientFor = (authority) => {
+    if (!clients.has(authority)) {
+      const credential = resolveRegistryCredential({ authority, declarations, env });
+      // No vendor data root: the publisher's oras is held to its version, not to a vendor pin. Every byte read is
+      // content-addressed here and re-verified by the vendor's admission.
+      clients.set(authority, registryFor ? registryFor({ authority, credential }) : new OrasRegistry({ credential, trust: () => null, fetchImpl }));
+    }
+    return clients.get(authority);
+  };
+
+  const { manifest } = await fetchBundleManifest({ clientFor, ociRef: bundle });
+  const sourceManifestHash = await schemas.computeBiomeSourceManifestHash(manifest);
+  const subject = bundleImageSubject({ manifest, subjectId, enums: schemas, bundleRef: bundle });
+  const biomeDirectory = await biomeDirectoryAtCommit({ checkout, commit: context.sha, sourceManifestHash, schemas, bundleRef: bundle });
+  const servicePath = subjectServicePath(
+    { kind: subject.kind, id: subject.id, repo: context.repository, path: biomeDirectory === '' ? '.' : biomeDirectory },
+    context.sha,
+    () => ({ dir: checkout, base: checkout }),
+  );
+  const sourceTreeHash = hashImageBuildInputs(
+    { repoDir: checkout, service: subject.id, servicePath, commit: context.sha, crossRepoInputs: [], buildStepDirectories: [] },
+    imageInputSourceHashAlgorithm(),
+  );
+  const artifact = await resolveImageArtifactEvidenceByDigest({
+    client: clientFor(splitImageRef(imageRef.repository).authority),
+    imageRepository: imageRef.repository,
+    manifestDigest: imageRef.digest,
+    referenceProvenance: builder.predicate,
+  });
+  const input = producerInputDocument({
+    contractAuthority,
+    context,
+    builder,
+    now,
+    ttlSeconds: effectiveTtlSeconds,
+    subject: {
+      kind: subject.kind,
+      id: subject.id,
+      repositoryUrl: `https://github.com/${context.repository}`,
+      repo: context.repository,
+      path: biomeDirectory === '' ? context.repository : `${context.repository}/${biomeDirectory}`,
+      sourceCommit: context.sha,
+      sourceManifestHash,
+      sourceTreeHash,
+      imageRepository: imageRef.repository,
+      ...artifact,
+    },
+  });
+  assertAssembledProducerInput({ input, schemas, contractAuthority, context });
+  return input;
+}
+
+function requireFlag(flags, name) {
+  const value = flags.get(name);
+  if (value === undefined) {
+    throw new Error(`--${name} is required\n${THIRD_PARTY_INPUT_USAGE}`);
+  }
+  return value;
+}
+
+async function main() {
+  // No workspace root: the verb runs on public inputs, with the kernel this CLI ships.
+  const args = configureEditionWorkspaceFromArgv(process.argv.slice(2), [], { refuseOthers: true });
+  stateKernelPackageDir(shippedKernelPackageDir());
+  const flags = readAssemblerFlags(args, new Set(Object.values(THIRD_PARTY_INPUT_FLAGS)));
+  const output = resolve(requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.output));
+  const ttl = flags.get(THIRD_PARTY_INPUT_FLAGS.ttlSeconds);
+  const input = await assembleThirdPartyInput({
+    bundle: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.bundle),
+    contractAuthorityPath: resolve(requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.contractAuthority)),
+    image: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.image),
+    subjectId: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.subjectId),
+    provenancePath: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.provenance),
+    registryCredentialsPath: resolve(requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.registryCredentials)),
+    ttlSeconds: producerTtlSecondsFlag(ttl),
+    runnerEnvironment: flags.get(THIRD_PARTY_INPUT_FLAGS.runnerEnvironment),
+  });
+  writeProducerInputFile(output, input);
+  const [subject] = input.subjects;
+  console.log(
+    `[assemble-third-party-input] wrote ${output} for subject ${subject.kind}:${subject.id} ` +
+      `(${subject.imageRepository}@${subject.manifestDigest}, ${subject.repo}@${subject.sourceCommit}, ` +
+      `sourceTreeHash (${PUBLISHER_ATTESTED_LABEL}) ${subject.sourceTreeHash})`,
+  );
+}
+
+if (isEntryModule(import.meta.url)) {
+  main().catch((error) => {
+    console.error(`[assemble-third-party-input] ${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/edition/authored-source-check.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// authored-source-check — `xema-edition check-authored`: grades the AUTHORED
+// distribution source, the develop lifecycle's gate. It is its own mode, not
+// the release check with assertions turned off: `xema-edition check`
+// (dist-check.mjs) stays the full release-path grade, and nothing here can
+// make it skip anything.
+//
+// Authored and release state are separate lifecycles. What is authored is
+// graded here, offline; what only a release carries is not read: no lock
+// content (the committed distribution / images / authorization / chart-set
+// locks; the trust-arming rule counts lock files by presence), and nothing that
+// needs a source checkout at a committed `repositoryPins` commit. No edition is
+// resolved here: the plane invariants over a resolved edition (the
+// capability-domain reservation table and biome confinement) are asserted on
+// develop by the develop resolve against the graph it froze
+// (develop-edition-invariants.mjs), and on the release path by
+// `xema-edition check` over the committed locks. One place per assertion.
+//
+// KEPT (each refuses):
+//   - the kernel speaks a supported edition protocol;
+//   - biome-index.json: immutable entries, deterministic order, no duplicate
+//     source identity, a serviceDependencies projection on every entry;
+//   - platform-service-index.json: parses, matches the declared
+//     platformServiceSources offline, service-dependency owner parity;
+//   - runtime-image-source-index.json: the offline `--check`;
+//   - the evidence trust policy, its data-root pin and its arming assessment
+//     (`--channel <develop|release>`, default release: release holds the built
+//     evidence verifier to the pin's digests, develop states a differing digest
+//     and checks everything else; an unknown channel is refused);
+//   - the data-root readers (store source repositories, publisher trust);
+//   - the fleet chart-set pin is a rostered chart-set lock;
+//   - the pinned kernel's authorization composer loads;
+//   - the ownership self-tests: the kernel's capability-domain reader refuses
+//     two owners of one domain and an invalid domain, and counts no unlisted
+//     domain as first-party (synthetic tables, no lock);
+//   - every edition definition is structurally valid: the kernel parses it
+//     (its `sourcePins` included) and it composes.
+//
+// NOT HERE:
+//   - lock currency, sealed hashes, the authorization lock, each edition's
+//     chart-set.lock.json copy, platform-service ownership at pinned commits,
+//     `--check-sources` (refused): release state, `xema-edition check`;
+//   - the definition resolve, reservations, confinement: the develop resolve.
+
+import {
+  checkChannelFromArgv,
+  checkDataRootPlane,
+  discoverDistributionIds,
+  loadPlaneAuthorizationKernel,
+  ownershipSelfTestFailures,
+  readFleetChartSetPin,
+} from './dist-check.mjs';
+import { EditionChannel } from './edition-channel.mjs';
+import { describeEditionHolds } from './edition-source-pins.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule } from './edition-workspace.mjs';
+import { loadKernelDistributionSchemas } from './lib.mjs';
+import { composeEdition } from './resolve-distribution.mjs';
+
+/** The release-path flag this mode refuses rather than ignores. */
+const CHECK_SOURCES_FLAG = '--check-sources';
+
+/**
+ * Whether edition `id`'s definition is structurally valid: the kernel parses it
+ * and it composes. Nothing is resolved and no index or source is read.
+ *
+ * @returns {Promise<string | null>} the refusal, or null when valid
+ */
+export async function definitionRefusal(id) {
+  try {
+    const schemas = await loadKernelDistributionSchemas();
+    composeEdition(schemas.parseDistribution, id);
+    return null;
+  } catch (err) {
+    return err.message;
+  }
+}
+
+/**
+ * The ownership self-tests (dist-check.mjs): the kernel's capability-domain
+ * reader, against synthetic tables. Lock-free. Returns true when green.
+ */
+async function checkOwnershipSelfTests(resolveFirstPartyCapabilityDomains) {
+  let failures;
+  try {
+    failures = ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains);
+  } catch (err) {
+    failures = [`the kernel's capability-domain reader threw on a valid table: ${err.message}`];
+  }
+  for (const failure of failures) {console.error(`[dist:check-authored] ownership self-test FAILED: ${failure}`);}
+  if (failures.length === 0) {console.log('[dist:check-authored] ownership self-tests: green.');}
+  return failures.length === 0;
+}
+
+/**
+ * The authored check over the configured roots. Returns true when green.
+ * `resolveFirstPartyCapabilityDomains` is the kernel's reader unless a test
+ * stands in for it. `channel` (`--channel <develop|release>`, default release) is
+ * the lane checked; `locateVerifier` is a test seam for the built verifier.
+ */
+export async function checkAuthoredSource({ resolveFirstPartyCapabilityDomains, channel = EditionChannel.Release, locateVerifier } = {}) {
+  let green = await checkDataRootPlane({ checkSources: false, channel, locateVerifier });
+  const reader = resolveFirstPartyCapabilityDomains ?? (await loadKernelDistributionSchemas()).resolveFirstPartyCapabilityDomains;
+  if (!(await checkOwnershipSelfTests(reader))) {green = false;}
+
+  const distributionIds = discoverDistributionIds();
+  for (const line of describeEditionHolds(distributionIds)) {console.log(line);}
+  for (const id of distributionIds) {
+    const refusal = await definitionRefusal(id);
+    if (refusal === null) {
+      console.log(`[dist:check-authored] ${id}: the definition is valid.`);
+    } else {
+      console.error(`[dist:check-authored] ${id}: the definition is invalid — ${refusal}`);
+      green = false;
+    }
+  }
+
+  const { green: authorizationKernelGreen } = await loadPlaneAuthorizationKernel();
+  if (!authorizationKernelGreen) {green = false;}
+  if (readFleetChartSetPin() === null) {green = false;}
+
+  return green;
+}
+
+async function main() {
+  if (process.argv.includes(CHECK_SOURCES_FLAG)) {
+    throw new Error(
+      `${CHECK_SOURCES_FLAG} audits the indexes against source checkouts, which is release state: ` +
+        `run \`xema-edition check ${CHECK_SOURCES_FLAG}\`.`,
+    );
+  }
+  if (!(await checkAuthoredSource({ channel: checkChannelFromArgv(process.argv.slice(2)) }))) {process.exit(1);}
+  console.log('[dist:check-authored] the authored distribution source is green.');
+}
+
+if (isEntryModule(import.meta.url)) {
+  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
+  main().catch((err) => {
+    console.error(`[dist:check-authored] ${err.message}`);
+    process.exit(1);
+  });
+}

package/edition/authority-binding.mjs

@@ -0,0 +1,23 @@
+// authority-binding — whether evidence must be stated under the current kernel contract authority. One predicate, used
+// by every site that compares a statement's `contractAuthority` with the expected one.
+
+import { EditionChannel } from './edition-channel.mjs';
+
+/** Who owns the subject whose evidence is checked: a first-party subject is built from this platform's source. */
+export const EvidenceSubjectKind = Object.freeze({ FirstParty: 'first-party', ThirdParty: 'third-party' });
+
+/**
+ * Whether evidence of a `subjectKind` subject on `channel` is held to the current kernel contract authority. False only
+ * for a third-party subject on the develop channel: re-signing every third-party subject whenever the kernel moves is
+ * provenance machinery that a deployment we manage does not carry. Only the authority comparison is skipped; the
+ * signature, subject digest, policy row and sole image signer row are checked on every channel.
+ */
+export function isAuthorityBound(channel, subjectKind) {
+  if (!Object.values(EditionChannel).includes(channel)) {
+    throw new Error(`unknown edition channel ${JSON.stringify(channel)}`);
+  }
+  if (!Object.values(EvidenceSubjectKind).includes(subjectKind)) {
+    throw new Error(`unknown evidence subject kind ${JSON.stringify(subjectKind)}`);
+  }
+  return !(channel === EditionChannel.Develop && subjectKind === EvidenceSubjectKind.ThirdParty);
+}