@xemahq/xema 0.26.0 → 0.27.0

package/edition/assemble-producer-input.mjs

@@ -0,0 +1,1251 @@
+#!/usr/bin/env node
+// assemble-producer-input — producer-input assembly for detached image-source
+// evidence (plan phase E1).
+//
+//   xema edition evidence assemble-input \
+//     --output <absolute-path> \
+//     --image-repository <registry>/<namespace>/<service> \
+//     --manifest-digest sha256:<64-hex> \
+//     --subject-kind service --subject-id <service> \
+//     --source-repo repos/<repo> \
+//     --source-path repos/<repo>/<biome-or-package-path> \
+//     --source-commit <40-hex> \
+//     --provenance <absolute-predicate-json> \
+//     [--ttl-seconds <1..policy-max>] \
+//     [--source-manifest-hash <64-hex>] [--source-tree-hash <64-hex>]
+//
+// Emits the EXACT producer input manifest `produce-image-source-evidence.mjs`
+// accepts. The assembled manifest is validated with the producer's own gates —
+// `assertProducerInput`, the full kernel statement schema, and (from the
+// GITHUB_* environment) `assertGitHubProducerContext` — BEFORE it is written:
+// the assembler never emits a manifest the producer would reject.
+//
+// Field derivation:
+//   * contractAuthority   — the verifier-embedded kernel contract authority
+//                           (single source of truth; the offline verifier only
+//                           ever accepts that exact object).
+//   * sourceHashAlgorithm — read from `@xemahq/distribution-source-hash` via
+//                           lib.mjs `imageInputSourceHashAlgorithm()` — the one
+//                           algorithm an image lock may name.
+//   * producerWorkflowSha — GITHUB_SHA of the running producer workflow.
+//   * signer              — derived from the running workflow's context:
+//                           certificateIdentity is exactly
+//                           https://github.com/<repo>/<workflow-path>@<ref>.
+//   * builder             — builderId is the building workflow; buildType and
+//                           the definition/parameters digests are read off the
+//                           BuildKit SLSA v1 predicate the build exported
+//                           (`--provenance`) — the same bytes the workflow
+//                           cosign-attests, so the evidence cannot describe a
+//                           different build than the one that ran.
+//   * sourceManifestHash  — the kernel computeBiomeSourceManifestHash of the git-blob-at-commit,
+//                           the exact runtime-image-source-index algorithm
+//                           (lib.mjs `readGitJsonAtCommit` + `serializeJson`).
+//   * sourceTreeHash      — computed here with lib.mjs `hashImageBuildInputs`
+//                           under `imageInputSourceHashAlgorithm()` — the SAME
+//                           functions and package the lock resolver and every
+//                           producer's `compute-image-tag.mjs` use. The request
+//                           is reconstructed exactly as the producing build saw
+//                           it: the service directory comes from the subject's
+//                           own manifest at the build commit
+//                           (resolve-images `subjectServicePath`), and the
+//                           vendored cross-repo inputs + build-step directories
+//                           come from the producing checkout's committed
+//                           `tooling/release/cross-repo-build-inputs.json` AT
+//                           THAT COMMIT — never the live distribution index,
+//                           which may already pin newer source revisions.
+//   * manifestDigest cross-check, manifestMediaType, platforms — read from the
+//     registry with the fail-closed OCI client at the canonical
+//     `<imageRepository>:<sourceTreeHash>` coordinate: the digest served there
+//     must be exactly the caller's `--manifest-digest`, and platforms are
+//     proven by their hash-verified image configs (verify-image-platforms
+//     `resolvePublishedPlatforms`).
+//   * sbomDigest, provenanceDigest — the cosign attestation artifacts the
+//     producing workflow attached to the delivered manifest digest: the
+//     `sha256-<digest>.att` manifest's DSSE envelope layers, classified by
+//     their `predicateType` annotation and bound to the delivered digest
+//     through their decoded in-toto statement subject. A missing attestation
+//     fails fast naming the cosign `--type` flag that emits it.
+//     MULTIPLICITY IS EXPECTED: a multi-arch index is the product of one
+//     build per platform, and lanes attest accordingly — one SLSA + one SBOM
+//     attestation per architecture, all bound to the index digest (plus
+//     further copies whenever a lane re-runs, because cosign attest APPENDS).
+//     The assembler therefore selects ONE deterministic witness per type:
+//     the provenance layer whose statement names the PRIMARY build's own
+//     builder id + invocation id (the identity of the caller's `--provenance`
+//     predicate, so the statement's artifact section and build section
+//     describe the SAME build), and — no caller-side SBOM reference exists —
+//     the smallest SBOM layer digest. A subject with no layer describing the
+//     primary build fails fast.
+//
+// The runtime image source index, the registry credential declaration and the
+// declared trust policy are read from the data root (`--data-root`), and the
+// subject's source objects from the source checkouts under `--sources-root`
+// at their aggregator-relative paths.
+//
+// Registry credentials come from image-registry-credentials.json (the file
+// names environment variables, never secrets).
+
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import {
+  WorkspaceRoot,
+  configureEditionWorkspaceFromArgv,
+  dataRoot,
+  isEntryModule,
+  sourcePath as sourceCheckoutPath,
+} from './edition-workspace.mjs';
+import { COMMIT_PATTERN, GITHUB_REF_PATTERN, GITHUB_REPOSITORY_PATTERN, SHA256_DIGEST_PATTERN, SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
+import { firstPartySourceId } from './first-party-source-ids.mjs';
+import { canonicalJson } from './image-evidence.mjs';
+import {
+  assertGitCommitExists,
+  compareStrings,
+  hashImageBuildInputs,
+  imageInputSourceHashAlgorithm,
+  loadKernelDistributionSchemas,
+  readGitJsonAtCommit,
+  serializeJson,
+  sha256Hex,
+} from './lib.mjs';
+import { OrasRegistry } from './oras.mjs';
+import { assertGitHubProducerContext, assertProducerInput, buildImageSourceStatements, readPinnedContractAuthority, sandboxedGit } from './produce-image-source-evidence.mjs';
+import {
+  loadRegistryCredentialDeclarations,
+  resolveRegistryCredential,
+  splitImageRef,
+} from './registry-credentials.mjs';
+import {
+  COMPOSED_PROCESS_DECLARATION_FILE,
+  COMPOSED_PROCESS_IMAGE_PATH,
+  composedProcessSubjectId,
+  subjectServicePath,
+} from './resolve-images.mjs';
+import {
+  platformIdentity,
+  resolvePublishedPlatforms,
+} from './verify-image-platforms.mjs';
+
+const SOURCE_REPO_PATTERN = /^(?:repos|submodules)\/[a-zA-Z0-9_.-]+$/;
+// The kernel's `CanonicalIdentifierSchema` shape (runId / subject id).
+const CANONICAL_IDENTIFIER_PATTERN =
+  /^[a-zA-Z0-9](?:[a-zA-Z0-9._:/@+-]{0,254}[a-zA-Z0-9])?$/;
+// cosign v2 attaches every attestation of a subject as one layer of the
+// single `sha256-<subject-digest>.att` manifest; each layer is a DSSE
+// envelope whose `predicateType` annotation names the attestation.
+const ATTESTATION_TAG_SUFFIX = '.att';
+const DSSE_ENVELOPE_LAYER_MEDIA_TYPE = 'application/vnd.dsse.envelope.v1+json';
+const IN_TOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json';
+const PREDICATE_TYPE_ANNOTATION = 'predicateType';
+const SBOM_PREDICATE_TYPE = 'https://spdx.dev/Document';
+const PROVENANCE_PREDICATE_TYPE = 'https://slsa.dev/provenance/v1';
+// The third mandatory deploy predicate (see the producing workflows). It
+// legitimately shares the `.att` manifest but occupies no producer-input slot.
+const DEPLOY_SOURCE_PREDICATE_TYPE =
+  'https://xema.dev/attestations/deploy-source/v1';
+const MAX_ATTESTATION_LAYER_BYTES = 64 * 1024 * 1024;
+// The vendoring record the producing workflow consumed — committed in the
+// producing repository, read AT THE BUILD COMMIT (see header).
+const CROSS_REPO_RECORD_PATH = 'tooling/release/cross-repo-build-inputs.json';
+
+function canonicalRelativePath(value, label) {
+  if (
+    typeof value !== 'string' ||
+    value.length === 0 ||
+    value !== value.normalize('NFC') ||
+    value.startsWith('/') ||
+    value.endsWith('/') ||
+    value
+      .split('/')
+      .some((segment) => segment === '' || segment === '.' || segment === '..')
+  ) {
+    throw new Error(
+      `${label} must be an NFC-normalized repository-relative path without traversal`,
+    );
+  }
+  return value;
+}
+
+export function assertWorkflowContext(env) {
+  const repository = env.GITHUB_REPOSITORY;
+  const ref = env.GITHUB_REF;
+  const sha = env.GITHUB_SHA;
+  const workflowRef = env.GITHUB_WORKFLOW_REF;
+  if (!GITHUB_REPOSITORY_PATTERN.test(repository ?? '')) {
+    throw new Error('GITHUB_REPOSITORY is not an exact owner/repo slug');
+  }
+  if (!GITHUB_REF_PATTERN.test(ref ?? '')) {
+    throw new Error('GITHUB_REF is not an exact branch or tag ref');
+  }
+  if (!COMMIT_PATTERN.test(sha ?? '')) {
+    throw new Error('GITHUB_SHA is not an exact 40-hex commit');
+  }
+  const prefix = `${repository}/`;
+  const suffix = `@${ref}`;
+  if (
+    typeof workflowRef !== 'string' ||
+    !workflowRef.startsWith(prefix) ||
+    !workflowRef.endsWith(suffix) ||
+    workflowRef.length <= prefix.length + suffix.length
+  ) {
+    throw new Error(
+      `GITHUB_WORKFLOW_REF "${workflowRef}" is not exactly <repository>/<workflow-path>@<ref> for this run`,
+    );
+  }
+  const path = workflowRef.slice(
+    prefix.length,
+    workflowRef.length - suffix.length,
+  );
+  if (
+    !path.startsWith('.github/workflows/') ||
+    path.split('/').some((segment) => !segment || segment === '..')
+  ) {
+    throw new Error(
+      `GITHUB_WORKFLOW_REF names "${path}", which is not an exact workflow file under .github/workflows/`,
+    );
+  }
+  const runId = env.GITHUB_RUN_ID;
+  if (!CANONICAL_IDENTIFIER_PATTERN.test(runId ?? '')) {
+    throw new Error('GITHUB_RUN_ID is not a usable run identifier');
+  }
+  const runAttempt = Number(env.GITHUB_RUN_ATTEMPT);
+  if (
+    !Number.isSafeInteger(runAttempt) ||
+    runAttempt < 1 ||
+    String(runAttempt) !== env.GITHUB_RUN_ATTEMPT
+  ) {
+    throw new Error('GITHUB_RUN_ATTEMPT is not a positive integer');
+  }
+  return { repository, ref, sha, path, workflowRef, runId, runAttempt };
+}
+
+/**
+ * The build identity section of the producer input. `buildType` and the two
+ * digests are read off the BuildKit SLSA v1 predicate the producing workflow
+ * exported from the image it just pushed — the same bytes it cosign-attests
+ * and the deploy plane re-verifies — so the evidence can never describe a
+ * different build than the one that ran.
+ */
+export function deriveBuilder({ provenancePath, sourceCommit }) {
+  if (!isAbsolute(provenancePath)) {
+    throw new Error('--provenance must be an absolute path');
+  }
+  let predicate;
+  try {
+    predicate = JSON.parse(readFileSync(provenancePath, 'utf8'));
+  } catch (error) {
+    throw new Error(
+      `cannot read the exported BuildKit provenance predicate at ${provenancePath}: ${error.message}`,
+    );
+  }
+  const label = 'exported BuildKit SLSA v1 provenance predicate';
+  if (
+    typeof predicate !== 'object' ||
+    predicate === null ||
+    Array.isArray(predicate)
+  ) {
+    throw new Error(`${label} is not a JSON object`);
+  }
+  const buildDefinition = predicate.buildDefinition;
+  if (
+    typeof buildDefinition !== 'object' ||
+    buildDefinition === null ||
+    Array.isArray(buildDefinition)
+  ) {
+    throw new Error(
+      `${label} has no buildDefinition object — SLSA v1 (BuildKit >= v0.28) is required; ` +
+        'pin the BuildKit image and pass provenance: mode=max,version=v1 to docker/build-push-action',
+    );
+  }
+  // SLSA v1 names the build type INSIDE buildDefinition; a top-level buildType
+  // is the retired v0.2 shape.
+  const buildType = buildDefinition.buildType;
+  if (typeof buildType !== 'string' || buildType.length === 0) {
+    throw new Error(
+      `${label} names no buildDefinition.buildType — is this SLSA v1 output?`,
+    );
+  }
+  const revision =
+    predicate.runDetails?.metadata?.buildkit_metadata?.vcs?.revision;
+  if (revision !== sourceCommit) {
+    throw new Error(
+      `${label} records VCS revision "${String(revision)}", not source commit ${sourceCommit} — ` +
+        'the exported predicate must describe exactly the build this evidence names',
+    );
+  }
+  const parameters = {};
+  if ('externalParameters' in buildDefinition) {
+    parameters.externalParameters = buildDefinition.externalParameters;
+  }
+  if ('internalParameters' in buildDefinition) {
+    parameters.internalParameters = buildDefinition.internalParameters;
+  }
+  if (Object.keys(parameters).length === 0) {
+    throw new Error(
+      `${label} carries neither externalParameters nor internalParameters — nothing binds the build's inputs`,
+    );
+  }
+  return {
+    buildType,
+    buildDefinitionDigest: `sha256:${sha256Hex(canonicalJson(buildDefinition))}`,
+    parametersDigest: `sha256:${sha256Hex(canonicalJson(parameters))}`,
+    // The parsed predicate itself: the registry scan below binds the
+    // statement's provenance witness to this exact build's identity.
+    predicate,
+  };
+}
+
+/**
+ * The identity the PRIMARY build's SLSA attestation must carry: builder id +
+ * invocation id, read off a decoded SLSA v1 predicate. Both spellings of the
+ * invocation key occur in the wild — BuildKit's own rendering writes
+ * `invocationId`, lanes whose predicates passed through other renderings
+ * carry `invocationID` — so both are read, never rewritten.
+ */
+function slsaBuildIdentity(predicate, label) {
+  const builderId = predicate?.runDetails?.builder?.id;
+  if (typeof builderId !== 'string' || builderId.length === 0) {
+    throw new Error(`${label} records no runDetails.builder.id — the builder identity is what binds an attestation to one build`);
+  }
+  const metadata = predicate?.runDetails?.metadata;
+  const invocationId =
+    typeof metadata?.invocationId === 'string'
+      ? metadata.invocationId
+      : typeof metadata?.invocationID === 'string'
+        ? metadata.invocationID
+        : undefined;
+  if (invocationId === undefined || invocationId.length === 0) {
+    throw new Error(
+      `${label} records no runDetails.metadata.invocationId/invocationID — without an invocation id one build's attestation cannot be told from another's`,
+    );
+  }
+  return { builderId, invocationId };
+}
+
+/**
+ * The vendoring record the producing checkout committed — read at the BUILD
+ * commit, because it pins the cross-repo bytes the build actually consumed.
+ * Absent record (a repository with no cross-repo inputs) returns null.
+ *
+ * EVERY field this function returns is validated HERE, before any consumer
+ * filters it. An entry that drops out of the source-hash closure does not fail
+ * — it produces a DIFFERENT `sourceTreeHash`, and the only symptom is the
+ * registry cross-check reporting "the image was not published from this source
+ * identity" hundreds of lines later, naming neither the record nor the entry.
+ * A malformed vendoring record is unusable, full stop; it must say so here.
+ */
+export function readCrossRepoRecord(repoDir, commit, repo) {
+  const label = `${repo}@${commit}:${CROSS_REPO_RECORD_PATH}`;
+  let present = true;
+  try {
+    sandboxedGit(repoDir, [
+      'cat-file',
+      '-e',
+      `${commit}:${CROSS_REPO_RECORD_PATH}`,
+    ]);
+  } catch {
+    present = false;
+  }
+  if (!present) {return null;}
+  let record;
+  try {
+    record = readGitJsonAtCommit(repoDir, CROSS_REPO_RECORD_PATH, commit);
+  } catch (error) {
+    throw new Error(`${label} is not readable JSON: ${error.message}`);
+  }
+  if (record?.schemaVersion !== 1 || !Array.isArray(record.inputs)) {
+    throw new Error(`${label} is not a schemaVersion 1 cross-repo record`);
+  }
+  // Build-step context directories ride straight into `hashImageBuildInputs`.
+  // They were consumed with `?? []` and NO validation at all, so a record
+  // carrying a non-array (or a traversing path) silently hashed a different
+  // closure than the build consumed.
+  const buildStepContextDirectories = record.buildStepContextDirectories ?? [];
+  if (!Array.isArray(buildStepContextDirectories)) {
+    throw new Error(
+      `${label} buildStepContextDirectories must be an array of repository-relative directories`,
+    );
+  }
+  for (const directory of buildStepContextDirectories) {
+    canonicalRelativePath(
+      directory,
+      `${label} buildStepContextDirectories entry`,
+    );
+  }
+  // Shape FIRST, selection second. The `consumerService` filter used to run
+  // BEFORE this validation, so an entry MISSING `consumerService` compared
+  // `undefined !== null && undefined !== id` — true — and was silently skipped
+  // by the very check that exists to reject it.
+  for (const input of record.inputs) {
+    if (
+      input === null ||
+      typeof input !== 'object' ||
+      Array.isArray(input) ||
+      (input.consumerService !== null &&
+        typeof input.consumerService !== 'string') ||
+      (typeof input.consumerService === 'string' &&
+        input.consumerService.length === 0) ||
+      typeof input.sourceRepo !== 'string' ||
+      !SOURCE_REPO_PATTERN.test(input.sourceRepo) ||
+      !COMMIT_PATTERN.test(input.sourceCommit ?? '') ||
+      typeof input.sourcePath !== 'string' ||
+      typeof input.destinationPath !== 'string'
+    ) {
+      throw new Error(`${label} carries a malformed input ${serializeJson(input ?? null)}`);
+    }
+    canonicalRelativePath(input.sourcePath, `${label} input sourcePath`);
+    canonicalRelativePath(
+      input.destinationPath,
+      `${label} input destinationPath`,
+    );
+  }
+  return { inputs: record.inputs, buildStepContextDirectories };
+}
+
+/**
+ * The subject's source identity, computed with the exact lock algorithms:
+ * sourceManifestHash (the runtime-image-source-index algorithm),
+ * sourceTreeHash (the ImageInputV2 build-input closure), and the
+ * repositoryUrl the verifier binds (the runtime-image-source-index pin).
+ */
+/**
+ * The `platform-service-index.json` entry a `platform`-kind subject is built
+ * from.
+ *
+ * `platform` subjects are the fleet's only repository-ROOT subjects: their lock
+ * entry is synthesized in `resolve-images.mjs` from
+ * `distributionLock.platformServices[].source`, with `path === repo` and
+ * `sourceManifestPath === '<repo>/package.json'` — they are whole repositories
+ * (the five generic submodules), not biome directories.
+ *
+ * `deriveSubjectSourceIdentity` recognized only two shapes: a supplemental
+ * subject declared in the runtime index, or a biome subject whose path names a
+ * directory inside the repository. A `platform` subject is neither, so EVERY one
+ * of them failed deterministically — before any registry hop — on "is not a
+ * supplemental subject, so its source path must name a biome directory". All
+ * five generic submodules were therefore unable to produce image-source evidence
+ * at all.
+ *
+ * The index is the SAME authority `resolve-images.mjs` resolved the lock's
+ * platform subjects from, so resolving through it here is what makes the
+ * assembler's `sourceTreeHash` equal the lock's `contentHash` — the equality the
+ * whole producer contract rests on. `imageKey` (not `name`) is the subject id,
+ * because that is the field `resolve-images.mjs` uses for `subjectId`.
+ */
+function findPlatformServiceSource({ readPlatformServiceIndex, kind, id, repo }) {
+  if (typeof readPlatformServiceIndex !== 'function') {
+    throw new Error(
+      `subject ${kind}:${id} is a platform subject, which is resolved from ` +
+        'platform-service-index.json, but no reader for that index was provided',
+    );
+  }
+  const matches = readPlatformServiceIndex().services.filter(
+    (candidate) => candidate.imageKey === id && candidate.repo === repo,
+  );
+  if (matches.length !== 1) {
+    throw new Error(
+      `subject ${kind}:${id} matches ${matches.length} entries of ` +
+        `platform-service-index.json for repository "${repo}"; exactly one is ` +
+        'required — a platform subject is resolved from that index, which is the ' +
+        'same authority resolve-images.mjs built the lock from',
+    );
+  }
+  return matches[0];
+}
+
+export async function deriveSubjectSourceIdentity({
+  runtimeIndex,
+  // Lazy on purpose: platform-service-index.json is needed ONLY to resolve a
+  // `platform` subject, and requiring it for every subject made the file an
+  // unconditional input of a derivation that mostly does not read it.
+  readPlatformServiceIndex,
+  // The kernel enum member, passed in rather than written as a literal: the
+  // subject kind is a closed set the kernel owns, and a local copy is a second
+  // source of truth waiting to drift.
+  platformSubjectKind,
+  // The kernel's `RuntimeImageSubjectKind.ComposedProcess`, passed in for the
+  // reason `platformSubjectKind` is. Undefined: no subject is a composed one.
+  composedProcessSubjectKind = undefined,
+  declaration,
+}) {
+  const { kind, id, repo, path, sourceCommit } = declaration;
+  if (typeof platformSubjectKind !== 'string' || !platformSubjectKind) {
+    throw new Error(
+      'the kernel platform subject kind is required to resolve a source identity',
+    );
+  }
+  const pin = runtimeIndex.repositoryPins.find(
+    (candidate) => candidate.repo === repo,
+  );
+  if (!pin) {
+    throw new Error(
+      `subject ${kind}:${id} names source repository "${repo}", which has no ` +
+        'repository pin in runtime-image-source-index.json — it is not an image source repository',
+    );
+  }
+  const repoDir = sourceCheckoutPath(repo);
+  assertGitCommitExists(repoDir, sourceCommit);
+  // Supplemental subjects (host shell, independently sourced platform images)
+  // declare their source manifest in the runtime index; biome subjects carry
+  // `<biome>/xema-biome.json`.
+  const supplemental = runtimeIndex.supplementalSubjects.find(
+    (candidate) => candidate.kind === kind && candidate.id === id,
+  );
+  let manifestRepoRelativePath;
+  let subjectForServicePath = { kind, id, repo, path };
+  if (supplemental) {
+    if (supplemental.repo !== repo || supplemental.path !== path) {
+      throw new Error(
+        `subject ${kind}:${id} is a supplemental subject of ${supplemental.repo}:${supplemental.path} ` +
+          `in runtime-image-source-index.json, not of ${repo}:${path}`,
+      );
+    }
+    if (!supplemental.sourceManifestPath.startsWith(`${repo}/`)) {
+      throw new Error(
+        `subject ${kind}:${id} sourceManifestPath "${supplemental.sourceManifestPath}" ` +
+          `escapes its repository "${repo}"`,
+      );
+    }
+    manifestRepoRelativePath = supplemental.sourceManifestPath.slice(
+      repo.length + 1,
+    );
+    subjectForServicePath = {
+      ...subjectForServicePath,
+      sourceManifestPath: manifestRepoRelativePath,
+    };
+  } else if (composedProcessSubjectKind !== undefined && kind === composedProcessSubjectKind) {
+    // The composed-process image of one build: a Dockerfile-only image at the
+    // repository's `infra/composed-process/`, whose declaration is its
+    // `image-build-inputs.json` — exactly the shape resolve-images.mjs names
+    // in the lock (`readComposedProcessDeclarations`).
+    if (path !== `${repo}/${COMPOSED_PROCESS_IMAGE_PATH}`) {
+      throw new Error(
+        `subject ${kind}:${id} declares source path "${path}", but a composed-process ` +
+          `image is built from "${repo}/${COMPOSED_PROCESS_IMAGE_PATH}"`,
+      );
+    }
+    const expectedId = composedProcessSubjectId(firstPartySourceId(repo));
+    if (id !== expectedId) {
+      throw new Error(
+        `subject ${kind}:${id} is not the composed-process subject of "${repo}" ("${expectedId}")`,
+      );
+    }
+    manifestRepoRelativePath = `${COMPOSED_PROCESS_IMAGE_PATH}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
+    subjectForServicePath = {
+      ...subjectForServicePath,
+      sourceManifestPath: manifestRepoRelativePath,
+    };
+  } else if (kind === platformSubjectKind) {
+    // The third shape: a whole-repository platform service. See
+    // `findPlatformServiceSource`.
+    const service = findPlatformServiceSource({
+      readPlatformServiceIndex,
+      kind,
+      id,
+      repo,
+    });
+    if (path !== repo) {
+      throw new Error(
+        `subject ${kind}:${id} declares source path "${path}", but a platform ` +
+          `subject is the whole repository "${repo}" — resolve-images.mjs sets ` +
+          'path === repo for it, and any other path hashes a closure the lock never named',
+      );
+    }
+    if (!service.path.startsWith(`${repo}/`)) {
+      throw new Error(
+        `subject ${kind}:${id} platform-service-index path "${service.path}" ` +
+          `escapes its repository "${repo}"`,
+      );
+    }
+    manifestRepoRelativePath = service.path.slice(repo.length + 1);
+    // Setting `sourceManifestPath` is what makes `subjectServicePath` return the
+    // repository ROOT instead of reading a `xema-biome.json` that does not
+    // exist — exactly the path whose build-input closure produced the lock's
+    // contentHash.
+    subjectForServicePath = {
+      ...subjectForServicePath,
+      sourceManifestPath: manifestRepoRelativePath,
+    };
+  } else {
+    if (path === repo) {
+      throw new Error(
+        `subject ${kind}:${id} is not a supplemental subject, so its source path ` +
+          'must name a biome directory inside the repository, not the repository root',
+      );
+    }
+    manifestRepoRelativePath = `${path.slice(repo.length + 1)}/xema-biome.json`;
+  }
+  const { computeBiomeSourceManifestHash } = await loadKernelDistributionSchemas();
+  const sourceManifestHash = await computeBiomeSourceManifestHash(
+    readGitJsonAtCommit(repoDir, manifestRepoRelativePath, sourceCommit),
+  );
+  const servicePath = subjectServicePath(subjectForServicePath, sourceCommit);
+  // Vendored cross-repo inputs EXACTLY as the build consumed them: the record
+  // committed in the producing checkout at the build commit. A `null`
+  // consumerService vendors for EVERY service of the consumer repository.
+  // `readCrossRepoRecord` has already proven EVERY entry well-formed, so the
+  // filter below can only ever narrow a valid set — it can no longer be the
+  // thing that hides an invalid one.
+  const record = readCrossRepoRecord(repoDir, sourceCommit, repo);
+  const crossRepoInputs = [];
+  for (const input of record?.inputs ?? []) {
+    // A composed image carries EVERY service of its build, so it vendors every
+    // input the record declares — the same set resolve-images.mjs hashes.
+    const composed =
+      composedProcessSubjectKind !== undefined && kind === composedProcessSubjectKind;
+    if (!composed && input.consumerService !== null && input.consumerService !== id) {
+      continue;
+    }
+    const sourceRepoDir = sourceCheckoutPath(input.sourceRepo);
+    assertGitCommitExists(sourceRepoDir, input.sourceCommit);
+    crossRepoInputs.push({
+      destinationPath: input.destinationPath,
+      sourceRepoDir,
+      sourcePath: input.sourcePath,
+      sourceCommit: input.sourceCommit,
+    });
+  }
+  const sourceTreeHash = hashImageBuildInputs(
+    {
+      repoDir,
+      service: id,
+      servicePath,
+      commit: sourceCommit,
+      crossRepoInputs,
+      buildStepDirectories: [...(record?.buildStepContextDirectories ?? [])],
+    },
+    imageInputSourceHashAlgorithm(),
+  );
+  return {
+    repositoryUrl: pin.repositoryUrl,
+    sourceManifestHash,
+    sourceTreeHash,
+  };
+}
+
+/**
+ * The SBOM + provenance digests carried by the subject's cosign attestation
+ * manifest (`sha256-<digest>.att`): the DSSE envelope layer digests, bound to
+ * the delivered digest through their decoded statement subject. Fail-closed on
+ * every gap, naming the pipeline step that must emit the missing artifact.
+ *
+ * A merged multi-arch index legitimately carries SEVERAL attestations of each
+ * type — one per platform build, plus one more per lane re-run, because
+ * `cosign attest` appends. Every candidate is validated (envelope shape,
+ * predicate type, subject binding) and then ONE witness per type is selected
+ * deterministically:
+ *
+ *   * SLSA provenance — the candidate whose statement names the SAME build as
+ *     the caller's exported `--provenance` predicate (equal builder id AND
+ *     invocation id), so the statement's artifact and build sections describe
+ *     one and the same build. Ties (identical re-attestations of that build)
+ *     resolve to the smallest layer digest; no match fails loudly.
+ *   * SBOM — no caller-side reference exists, so the smallest layer digest
+ *     among the validated candidates. Content-addressed, stable, and every
+ *     candidate already proved it is an SBOM attestation bound to the
+ *     delivered digest.
+ */
+async function resolveCosignAttestationDigests({
+  client,
+  repository,
+  imageRepository,
+  manifestDigest,
+  label,
+  referenceProvenance,
+}) {
+  const attestationTag = `sha256-${manifestDigest.slice('sha256:'.length)}${ATTESTATION_TAG_SUFFIX}`;
+  let attestation;
+  try {
+    attestation = await client.getManifestByTag(repository, attestationTag);
+  } catch (error) {
+    throw new Error(
+      `${label} has no cosign attestation manifest at tag ${attestationTag}: ${error.message}. ` +
+        'The producing workflow must `cosign attest` the SBOM (--type spdxjson) and the SLSA ' +
+        `provenance (--type slsaprovenance1) against the exact delivered digest ${manifestDigest}. ` +
+        'If this digest is a multi-arch index merged AFTER the build attested the pre-merge image ' +
+        '(a separate multi-arch merge workflow), the merge step must re-run those attest calls on the merged ' +
+        'index.',
+    );
+  }
+  if (attestation.isIndex) {
+    throw new Error(
+      `${label} attestation tag ${attestationTag} resolved to an index; the assembler expects the ` +
+        'single-manifest / multi-layer shape cosign v2.6.3 writes',
+    );
+  }
+  const layers = Array.isArray(attestation.document.layers)
+    ? attestation.document.layers
+    : [];
+  if (layers.length === 0) {
+    throw new Error(
+      `${label} attestation manifest ${attestation.digest} carries no layers`,
+    );
+  }
+  const deliveredHex = manifestDigest.slice('sha256:'.length);
+  const sbomCandidates = [];
+  const provenanceCandidates = [];
+  for (const layer of layers) {
+    if (layer?.mediaType !== DSSE_ENVELOPE_LAYER_MEDIA_TYPE) {
+      throw new Error(
+        `${label} attestation manifest ${attestation.digest} carries a ` +
+          `"${String(layer?.mediaType)}" layer; only ${DSSE_ENVELOPE_LAYER_MEDIA_TYPE} ` +
+          'layers are admissible',
+      );
+    }
+    const predicateType = layer.annotations?.[PREDICATE_TYPE_ANNOTATION];
+    if (typeof predicateType !== 'string' || predicateType.length === 0) {
+      throw new Error(
+        `${label} attestation layer ${layer.digest} has no "${PREDICATE_TYPE_ANNOTATION}" annotation`,
+      );
+    }
+    if (predicateType === DEPLOY_SOURCE_PREDICATE_TYPE) {continue;}
+    if (
+      predicateType !== SBOM_PREDICATE_TYPE &&
+      predicateType !== PROVENANCE_PREDICATE_TYPE
+    ) {
+      throw new Error(
+        `${label} attestation layer ${layer.digest} has unrecognized predicate type ` +
+          `"${predicateType}" — only ${SBOM_PREDICATE_TYPE}, ${PROVENANCE_PREDICATE_TYPE} and ` +
+          `${DEPLOY_SOURCE_PREDICATE_TYPE} may hang off a producer subject`,
+      );
+    }
+    // Fetching the envelope proves it is stored and content-addressed, and the
+    // decoded statement must bind EXACTLY the delivered digest: an attestation
+    // that names any other subject describes a different image.
+    const bytes = await client.getBlob(
+      repository,
+      layer.digest,
+      MAX_ATTESTATION_LAYER_BYTES,
+    );
+    let envelope;
+    try {
+      envelope = JSON.parse(bytes.toString('utf8'));
+    } catch {
+      throw new Error(
+        `${label} attestation layer ${layer.digest} is not valid JSON`,
+      );
+    }
+    if (envelope?.payloadType !== IN_TOTO_PAYLOAD_TYPE) {
+      throw new Error(
+        `${label} attestation layer ${layer.digest} is not an ${IN_TOTO_PAYLOAD_TYPE} DSSE envelope`,
+      );
+    }
+    let statement;
+    try {
+      statement = JSON.parse(
+        Buffer.from(String(envelope.payload), 'base64').toString('utf8'),
+      );
+    } catch {
+      throw new Error(
+        `${label} attestation layer ${layer.digest} carries no decodable in-toto statement`,
+      );
+    }
+    if (statement?.predicateType !== predicateType) {
+      throw new Error(
+        `${label} attestation layer ${layer.digest} annotates "${predicateType}" ` +
+          `but its statement declares "${String(statement?.predicateType)}"`,
+      );
+    }
+    const expectedSubject = {
+      name: imageRepository,
+      digest: { sha256: deliveredHex },
+    };
+    if (
+      !Array.isArray(statement.subject) ||
+      statement.subject.length !== 1 ||
+      JSON.stringify(statement.subject[0]) !== JSON.stringify(expectedSubject)
+    ) {
+      throw new Error(
+        `${label} attestation layer ${layer.digest} binds ` +
+          `${serializeJson(statement.subject ?? null)}, not the delivered subject ` +
+          `${serializeJson(expectedSubject)} — the producing workflow must attest the exact ` +
+          'digest the canonical coordinate serves',
+      );
+    }
+    if (predicateType === SBOM_PREDICATE_TYPE) {
+      sbomCandidates.push({ digest: layer.digest, statement });
+    } else {
+      provenanceCandidates.push({ digest: layer.digest, statement });
+    }
+  }
+  if (sbomCandidates.length === 0) {
+    throw new Error(
+      `${label} carries no SBOM attestation (${SBOM_PREDICATE_TYPE}) — the producing workflow must run ` +
+        `cosign attest --yes --type spdxjson --predicate <spdx.json> ${imageRepository}@${manifestDigest}`,
+    );
+  }
+  if (provenanceCandidates.length === 0) {
+    throw new Error(
+      `${label} carries no SLSA provenance attestation (${PROVENANCE_PREDICATE_TYPE}) — the producing ` +
+        `workflow must run cosign attest --yes --type slsaprovenance1 --predicate <slsa-provenance.json> ` +
+        `${imageRepository}@${manifestDigest}`,
+    );
+  }
+  // The provenance witness must describe the SAME build the statement's build
+  // section describes — the caller's exported predicate. A multi-platform
+  // index carries one attestation per platform build; picking any other
+  // build's would attest the index with a different source's provenance.
+  const referenceIdentity = slsaBuildIdentity(
+    referenceProvenance,
+    'the exported --provenance predicate',
+  );
+  const matches = provenanceCandidates.filter((candidate) => {
+    try {
+      const identity = slsaBuildIdentity(
+        candidate.statement.predicate,
+        `attestation layer ${candidate.digest}`,
+      );
+      return (
+        identity.builderId === referenceIdentity.builderId &&
+        identity.invocationId === referenceIdentity.invocationId
+      );
+    } catch {
+      // A candidate whose predicate names no build identity can never be the
+      // primary build's witness; it stays admissible for nothing.
+      return false;
+    }
+  });
+  if (matches.length === 0) {
+    throw new Error(
+      `${label} carries ${provenanceCandidates.length} SLSA provenance attestation(s) but none ` +
+        `describes the primary build (builder "${referenceIdentity.builderId}", invocation ` +
+        `"${referenceIdentity.invocationId}") — the lane must re-attest the merged index with ` +
+        'that build\'s own predicate (mirror release-arm64-host-web.yaml\'s attest step)',
+    );
+  }
+  matches.sort((left, right) => compareStrings(left.digest, right.digest));
+  const provenanceDigest = matches[0].digest;
+  const sbomsByDigest = [...sbomCandidates].sort((left, right) =>
+    compareStrings(left.digest, right.digest),
+  );
+  const sbomDigest = sbomsByDigest[0].digest;
+  return { sbomDigest, provenanceDigest };
+}
+
+/**
+ * Registry side of one subject, resolved at the canonical
+ * `<imageRepository>:<sourceTreeHash>` coordinate: the served manifest digest
+ * (which must be exactly the caller's), its media type, the hash-proven
+ * platform set, and the SBOM/provenance attestation digests.
+ * `referenceProvenance` is the caller's parsed exported BuildKit predicate —
+ * the identity anchor the provenance-witness selection binds to.
+ */
+export async function resolveImageArtifactEvidence({
+  imageRepository,
+  manifestDigest,
+  sourceTreeHash,
+  referenceProvenance,
+  distributionsRoot = dataRoot(),
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+  registryFor = null,
+}) {
+  if (!SHA256_DIGEST_PATTERN.test(manifestDigest ?? '')) {
+    throw new Error('--manifest-digest must be an exact sha256:<64-hex> digest');
+  }
+  if (!SHA256_HEX_PATTERN.test(sourceTreeHash ?? '')) {
+    throw new Error('sourceTreeHash must be 64 lowercase sha256 hex characters');
+  }
+  if (
+    typeof referenceProvenance !== 'object' ||
+    referenceProvenance === null ||
+    Array.isArray(referenceProvenance)
+  ) {
+    throw new Error(
+      'referenceProvenance (the parsed exported BuildKit SLSA v1 predicate) is required — ' +
+        'it is what binds the selected provenance attestation to the primary build',
+    );
+  }
+  const { authority, repository } = splitImageRef(imageRepository);
+  const declarations = loadRegistryCredentialDeclarations(distributionsRoot);
+  const credential = resolveRegistryCredential({ authority, declarations, env });
+  const client = registryFor
+    ? registryFor({ authority, credential })
+    : new OrasRegistry({ credential, fetchImpl });
+  const coordinate = `${imageRepository}:${sourceTreeHash}`;
+  const top = await client.getManifestByTag(repository, sourceTreeHash);
+  if (top.digest !== manifestDigest) {
+    throw new Error(
+      `${coordinate} serves ${top.digest}, not the caller-declared ${manifestDigest} — ` +
+        'the image was not published from this source identity (wrong build commit, ' +
+        'or the cross-repo record at the build commit differs from the one this source carries)',
+    );
+  }
+  // Proves EVERY platform by its own hash-verified image config and refuses
+  // attestation children as platforms — exactly the evidence the producer
+  // input carries.
+  const published = await resolvePublishedPlatforms({
+    client,
+    repository,
+    tag: sourceTreeHash,
+    coordinate,
+  });
+  if (published.indexDigest !== top.digest) {
+    throw new Error(
+      `${coordinate} did not resolve to the exact published manifest this evidence names`,
+    );
+  }
+  const label = `${imageRepository}@${top.digest}`;
+  const { sbomDigest, provenanceDigest } =
+    await resolveCosignAttestationDigests({
+      client,
+      repository,
+      imageRepository,
+      manifestDigest: top.digest,
+      label,
+      referenceProvenance,
+    });
+  const platforms = published.platforms
+    .map((entry) => ({
+      ...entry.platform,
+      manifestDigest: entry.manifestDigest,
+    }))
+    // The kernel's canonical platform order: os/architecture/variant,
+    // code-point comparison (assertPlatforms re-checks this on verification).
+    .sort((left, right) =>
+      compareStrings(platformIdentity(left), platformIdentity(right)),
+    );
+  return {
+    manifestDigest: top.digest,
+    manifestMediaType: top.mediaType,
+    platforms,
+    sbomDigest,
+    provenanceDigest,
+  };
+}
+
+/**
+ * The producer's DECLARED evidence lifetime, in seconds.
+ *
+ * This used to default to the trust policy's `maxProducerTtlSeconds` (the
+ * CEILING), which is wrong in two independent ways:
+ *
+ *  1. It collapses two numbers that must move independently. The ceiling is the
+ *     VERIFIER's tolerance; this is the PRODUCER's intent. With them equal,
+ *     `assertTimeWindow`'s `expires - issued > maxTtlSeconds` sits exactly on
+ *     the boundary, so lowering the policy ceiling by one second retroactively
+ *     invalidates every bundle ever signed — the ceiling could never be
+ *     tightened without re-producing the entire fleet's evidence.
+ *  2. "As long as permitted" is not a decision. The offline verifier has NO
+ *     revocation channel, so this TTL *is* the revocation window for a
+ *     mis-issued or leaked bundle. Taking the maximum by default makes that
+ *     window as wide as the policy allows, by omission rather than by choice.
+ *
+ * 72h is the shortest value that still spans a weekend: a bundle produced late
+ * Friday is still valid Monday morning, so a release or delivery that slips
+ * over a weekend never needs an out-of-band refresh. Everything shorter buys
+ * marginal revocation latency and pays for it in operational surprise.
+ *
+ * A producer that genuinely needs a different lifetime passes `--ttl-seconds`;
+ * the ceiling still bounds it, and the value is asserted against the ceiling
+ * below so this constant can never quietly exceed the policy.
+ */
+export const DEFAULT_PRODUCER_TTL_SECONDS = 3 * 24 * 60 * 60;
+
+function readProducerTtlSeconds(distributionsRoot) {
+  const declared = editionWorkspaceConfig().evidenceTrustPolicy.policy;
+  if (declared === null) {
+    throw new Error(
+      `${distributionsRoot} declares no evidenceTrustPolicy in edition-workspace.json; the producer TTL ceiling comes from it`,
+    );
+  }
+  const policyPath = join(distributionsRoot, declared);
+  let policy;
+  try {
+    policy = JSON.parse(readFileSync(policyPath, 'utf8'));
+  } catch (error) {
+    throw new Error(
+      `cannot read the committed trust policy at ${policyPath}: ${error.message}`,
+    );
+  }
+  if (
+    policy?.schemaVersion !== 1 ||
+    !Number.isSafeInteger(policy.maxProducerTtlSeconds) ||
+    policy.maxProducerTtlSeconds < 1
+  ) {
+    throw new Error(
+      `${policyPath} does not declare a positive integer maxProducerTtlSeconds`,
+    );
+  }
+  return policy.maxProducerTtlSeconds;
+}
+
+function rfc3339(timestamp) {
+  return new Date(timestamp).toISOString().replace(/\.\d{3}Z$/, 'Z');
+}
+
+/**
+ * Assemble the complete producer input manifest for ONE image subject and
+ * prove — before anything is written — that it satisfies the producer's exact
+ * field contract, the kernel statement schema, and the running GitHub context
+ * the producer action will compare it against.
+ */
+export async function assembleProducerInput({
+  imageRepository,
+  manifestDigest,
+  subjectKind,
+  subjectId,
+  sourceRepo,
+  sourcePath,
+  sourceCommit,
+  provenancePath,
+  sourceManifestHash: declaredSourceManifestHash,
+  sourceTreeHash: declaredSourceTreeHash,
+  ttlSeconds,
+  distributionsRoot = dataRoot(),
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+  registryFor = null,
+  now = Date.now(),
+}) {
+  const schemas = await loadKernelDistributionSchemas();
+  const contractAuthority = readPinnedContractAuthority({
+    dataRoot: distributionsRoot,
+    schemas,
+  });
+  const subjectKinds = Object.values(schemas.RuntimeImageSubjectKind);
+  if (!subjectKinds.includes(subjectKind)) {
+    throw new Error(
+      `--subject-kind "${String(subjectKind)}" must be one of ${subjectKinds.join(', ')}`,
+    );
+  }
+  if (!CANONICAL_IDENTIFIER_PATTERN.test(subjectId ?? '')) {
+    throw new Error('--subject-id is not a canonical identifier');
+  }
+  if (!SOURCE_REPO_PATTERN.test(sourceRepo ?? '')) {
+    throw new Error(
+      `--source-repo "${String(sourceRepo)}" must be an aggregator-plane repository (repos/<name> or submodules/<name>)`,
+    );
+  }
+  canonicalRelativePath(sourcePath, '--source-path');
+  if (sourcePath !== sourceRepo && !sourcePath.startsWith(`${sourceRepo}/`)) {
+    throw new Error(`--source-path must stay inside ${sourceRepo}`);
+  }
+  if (!COMMIT_PATTERN.test(sourceCommit ?? '')) {
+    throw new Error('--source-commit must be an exact 40-hex commit');
+  }
+  const context = assertWorkflowContext(env);
+  const runtimeIndex = schemas.parseRuntimeImageSourceIndex(
+    JSON.parse(
+      readFileSync(
+        join(distributionsRoot, 'runtime-image-source-index.json'),
+        'utf8',
+      ),
+    ),
+  );
+  const source = await deriveSubjectSourceIdentity({
+    runtimeIndex,
+    // Parsed through the kernel schema, not read raw: a `platform` subject's
+    // whole source identity is resolved from this index, so a malformed index
+    // must fail rather than produce a subtly wrong closure.
+    readPlatformServiceIndex: () =>
+      schemas.parsePlatformServiceSourceIndex(
+        JSON.parse(
+          readFileSync(
+            join(distributionsRoot, 'platform-service-index.json'),
+            'utf8',
+          ),
+        ),
+      ),
+    platformSubjectKind: schemas.RuntimeImageSubjectKind.Platform,
+    composedProcessSubjectKind: schemas.RuntimeImageSubjectKind.ComposedProcess,
+    declaration: {
+      kind: subjectKind,
+      id: subjectId,
+      repo: sourceRepo,
+      path: sourcePath,
+      sourceCommit,
+    },
+  });
+  if (
+    declaredSourceManifestHash !== undefined &&
+    declaredSourceManifestHash !== source.sourceManifestHash
+  ) {
+    throw new Error(
+      `--source-manifest-hash "${String(declaredSourceManifestHash)}" does not match the ` +
+        `${source.sourceManifestHash} computed from ${sourceRepo}@${sourceCommit} — ` +
+        'the declared source identity is not the one this manifest hashes',
+    );
+  }
+  if (
+    declaredSourceTreeHash !== undefined &&
+    declaredSourceTreeHash !== source.sourceTreeHash
+  ) {
+    throw new Error(
+      `--source-tree-hash "${String(declaredSourceTreeHash)}" does not match the ` +
+        `${source.sourceTreeHash} computed from the build-input closure of ` +
+        `${sourceRepo}@${sourceCommit} — the declared coordinate is not the one this source builds`,
+    );
+  }
+  const builder = deriveBuilder({ provenancePath, sourceCommit });
+  const artifact = await resolveImageArtifactEvidence({
+    imageRepository,
+    manifestDigest,
+    sourceTreeHash: source.sourceTreeHash,
+    referenceProvenance: builder.predicate,
+    distributionsRoot,
+    env,
+    fetchImpl,
+    registryFor,
+  });
+  const maxTtlSeconds = readProducerTtlSeconds(distributionsRoot);
+  // The DEFAULT bows to the policy ceiling; an EXPLICIT `--ttl-seconds` above
+  // it still fails below. Tightening `maxProducerTtlSeconds` is a legitimate
+  // operator decision, and it must not break every producer until someone
+  // edits a constant in this file — but a caller who NAMES a lifetime the
+  // verifier will reject has made a mistake, and gets told so.
+  const effectiveTtlSeconds =
+    ttlSeconds ?? Math.min(DEFAULT_PRODUCER_TTL_SECONDS, maxTtlSeconds);
+  if (
+    !Number.isSafeInteger(effectiveTtlSeconds) ||
+    effectiveTtlSeconds < 1 ||
+    effectiveTtlSeconds > maxTtlSeconds
+  ) {
+    throw new Error(
+      `--ttl-seconds must be an integer between 1 and the trust policy's maxProducerTtlSeconds (${maxTtlSeconds})`,
+    );
+  }
+  const input = {
+    schemaVersion: 1,
+    contractAuthority: { ...contractAuthority },
+    sourceHashAlgorithm: imageInputSourceHashAlgorithm(),
+    producerWorkflowSha: context.sha,
+    signer: {
+      certificateIdentity: `https://github.com/${context.repository}/${context.path}@${context.ref}`,
+      oidcIssuer: 'https://token.actions.githubusercontent.com',
+      githubWorkflow: {
+        repository: context.repository,
+        ref: context.ref,
+        path: context.path,
+      },
+    },
+    builder: {
+      builderId: `https://github.com/${context.repository}/${context.path}`,
+      buildType: builder.buildType,
+      buildDefinitionDigest: builder.buildDefinitionDigest,
+      parametersDigest: builder.parametersDigest,
+    },
+    runId: context.runId,
+    runAttempt: context.runAttempt,
+    issuedAt: rfc3339(now),
+    expiresAt: rfc3339(now + effectiveTtlSeconds * 1000),
+    expectedSubjects: [`${subjectKind}:${subjectId}`],
+    subjects: [
+      {
+        kind: subjectKind,
+        id: subjectId,
+        repositoryUrl: source.repositoryUrl,
+        repo: sourceRepo,
+        path: sourcePath,
+        sourceCommit,
+        sourceManifestHash: source.sourceManifestHash,
+        sourceTreeHash: source.sourceTreeHash,
+        imageRepository,
+        manifestDigest: artifact.manifestDigest,
+        manifestMediaType: artifact.manifestMediaType,
+        platforms: artifact.platforms,
+        sbomDigest: artifact.sbomDigest,
+        provenanceDigest: artifact.provenanceDigest,
+      },
+    ],
+  };
+  // Prove the output satisfies the producer BEFORE anything reads it: the
+  // exact field contract, then the kernel statement schema the producer builds
+  // (the same parse produce-image-source-evidence.mjs runs before signing),
+  // then the GitHub context the producer action compares against.
+  assertProducerInput(input, contractAuthority);
+  buildImageSourceStatements(input, schemas, contractAuthority);
+  assertGitHubProducerContext(input, {
+    repository: context.repository,
+    ref: context.ref,
+    sha: context.sha,
+    workflowRef: context.workflowRef,
+  });
+  return input;
+}
+
+function requireValue(flags, name) {
+  const value = flags.get(name);
+  if (value === undefined) {
+    throw new Error(`--${name} is required`);
+  }
+  return value;
+}
+
+async function main() {
+  const args = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
+    WorkspaceRoot.Data,
+    WorkspaceRoot.Sources,
+    WorkspaceRoot.Kernel,
+  ]);
+  const flags = new Map();
+  for (let index = 0; index < args.length; index += 2) {
+    const flag = args[index];
+    if (!flag.startsWith('--')) {
+      throw new Error(`unexpected argument "${flag}"`);
+    }
+    const name = flag.slice(2);
+    const value = args[index + 1];
+    if (value === undefined || value.startsWith('--')) {
+      throw new Error(`--${name} requires a value`);
+    }
+    if (flags.has(name)) {
+      throw new Error(`--${name} was given twice`);
+    }
+    flags.set(name, value);
+  }
+  const known = new Set([
+    'output',
+    'image-repository',
+    'manifest-digest',
+    'subject-kind',
+    'subject-id',
+    'source-repo',
+    'source-path',
+    'source-commit',
+    'source-manifest-hash',
+    'source-tree-hash',
+    'provenance',
+    'ttl-seconds',
+  ]);
+  for (const name of flags.keys()) {
+    if (!known.has(name)) {
+      throw new Error(`unknown option "--${name}"`);
+    }
+  }
+  const output = resolve(requireValue(flags, 'output'));
+  const input = await assembleProducerInput({
+    imageRepository: requireValue(flags, 'image-repository'),
+    manifestDigest: requireValue(flags, 'manifest-digest'),
+    subjectKind: requireValue(flags, 'subject-kind'),
+    subjectId: requireValue(flags, 'subject-id'),
+    sourceRepo: requireValue(flags, 'source-repo'),
+    sourcePath: requireValue(flags, 'source-path'),
+    sourceCommit: requireValue(flags, 'source-commit'),
+    provenancePath: resolve(requireValue(flags, 'provenance')),
+    sourceManifestHash: flags.get('source-manifest-hash'),
+    sourceTreeHash: flags.get('source-tree-hash'),
+    ttlSeconds: flags.has('ttl-seconds')
+      ? Number(flags.get('ttl-seconds'))
+      : undefined,
+  });
+  // The output directory is caller scratch space — create it deterministically
+  // (the producer action's input-manifest must be repository-relative, so the
+  // caller cannot sidestep this by pointing at RUNNER_TEMP). `wx` below still
+  // refuses to overwrite an existing manifest.
+  mkdirSync(dirname(output), { recursive: true });
+  writeFileSync(output, serializeJson(input), { flag: 'wx', mode: 0o600 });
+  console.log(
+    `[assemble-producer-input] wrote ${output} for subject ` +
+      `${input.subjects[0].kind}:${input.subjects[0].id} ` +
+      `(${input.subjects[0].imageRepository}@${input.subjects[0].manifestDigest})`,
+  );
+}
+
+if (isEntryModule(import.meta.url)) {
+  main().catch((error) => {
+    console.error(`[assemble-producer-input] ${error.message}`);
+    process.exitCode = 1;
+  });
+}