@xemahq/xema 0.29.1 → 0.31.0

package/edition/adapter-host-versions.mjs

@@ -0,0 +1,41 @@
+// adapter-host-versions — what the edition knows of the adapter host's own copies of the packages an adapter
+// bundles: the packages compared, the host's caret rule (copied exactly from xema-base
+// biomes/biome-adapter-host/api/biome-adapter-host/src/loader/caret-compatibility.ts), and the lockfile read that
+// yields the host's versions when the biome index is built. No kernel load, so the index build can import it.
+
+/** The id of the biome that ships the adapter host (the service of BiomeComponentHostAbi.AdapterHost). */
+export const ADAPTER_HOST_BIOME_ID = 'biome-adapter-host';
+
+/** Exactly the packages xema-connectors tooling/bundle REQUIRED_BUNDLED_PACKAGES names. */
+export const BUNDLED_PACKAGES = Object.freeze(['@xemahq/contracts', '@xemahq/biome-sdk']);
+
+const VERSION_PATTERN = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/;
+
+/** The host's rule, copied: same major; when major is 0, same minor too; unparsable is incompatible. */
+export function isCaretCompatible(bundled, host) {
+  const left = typeof bundled === 'string' ? VERSION_PATTERN.exec(bundled) : null;
+  const right = typeof host === 'string' ? VERSION_PATTERN.exec(host) : null;
+  if (left === null || right === null) {return false;}
+  if (left[1] !== right[1]) {return false;}
+  return left[1] !== '0' || left[2] === right[2];
+}
+
+/** The host component's resolved versions, read from the repository's pnpm-lock.yaml importer. */
+export function readHostPackageVersions({ lockfileText, importer, lockfilePath, parseYaml }) {
+  if (lockfileText === null) {
+    throw new Error(`host package versions: ${lockfilePath} does not exist`);
+  }
+  const dependencies = parseYaml(lockfileText)?.importers?.[importer]?.dependencies;
+  if (dependencies === undefined) {
+    throw new Error(`host package versions: ${lockfilePath} has no importer "${importer}" with dependencies`);
+  }
+  const versions = {};
+  for (const name of BUNDLED_PACKAGES) {
+    const raw = dependencies[name]?.version;
+    if (typeof raw !== 'string') {
+      throw new Error(`host package versions: ${lockfilePath} importer "${importer}" has no ${name} entry`);
+    }
+    versions[name] = raw.split('(')[0];
+  }
+  return versions;
+}

package/edition/assemble-producer-input.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // assemble-producer-input — producer-input assembly for detached image-source
-// evidence (plan phase E1).
+// evidence.
 //
 //   xema edition evidence assemble-input \
 //     --output <absolute-path> \

package/edition/authorization-base.mjs

@@ -38,7 +38,6 @@ import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 export const AUTHORIZATION_MODULE_DIRECTORY = 'authorization';
 export const AUTHORIZATION_ENVELOPE_FILENAME = 'envelope.json';
 export const AUTHORIZATION_LOCK_FILENAME = 'authorization.lock.json';
-export const AUTHORIZATION_LOCK_SCHEMA_VERSION = 1;
 
 /**
  * The OpenFGA CLI the sealer tests with, EXACTLY. 0.8.1 embeds
@@ -142,10 +141,12 @@ export async function loadKernelAuthorizationComposer({ kernelPackageDir }) {
   let server;
   let contribution;
   let generation;
+  let distribution;
   try {
     server = await import(`file://${serverDist}`);
     contribution = await import(`file://${join(kernelPackageDir, 'dist', 'authorization-module', 'index.js')}`);
     generation = await import(`file://${join(kernelPackageDir, 'dist', 'platform-generation', 'index.js')}`);
+    distribution = await import(`file://${join(kernelPackageDir, 'dist', 'distribution', 'index.js')}`);
   } catch (err) {
     throw new Error(`Cannot load the pinned kernel's authorization composer from ${serverDist}: ${err.message}`);
   }
@@ -153,6 +154,7 @@ export async function loadKernelAuthorizationComposer({ kernelPackageDir }) {
     [server, 'composeAuthorizationBase'],
     [server, 'authorizationModuleInputFromContribution'],
     [contribution, 'stampAuthorizationModuleContribution'],
+    [distribution, 'parseAuthorizationLockReadView'],
   ]) {
     if (typeof mod[name] !== 'function') {
       throw new Error(`the pinned kernel's authorization-module subpaths do not export ${name}.`);
@@ -169,6 +171,8 @@ export async function loadKernelAuthorizationComposer({ kernelPackageDir }) {
     composeAuthorizationBase: server.composeAuthorizationBase,
     authorizationModuleInputFromContribution: server.authorizationModuleInputFromContribution,
     stampAuthorizationModuleContribution: contribution.stampAuthorizationModuleContribution,
+    parseAuthorizationLockReadView: distribution.parseAuthorizationLockReadView,
+    authorizationLockSchemaVersion: distribution.AUTHORIZATION_LOCK_SCHEMA_VERSION,
     currentPlatformGeneration: parsed.data,
     kernelPackageDir,
   };
@@ -186,10 +190,11 @@ export function adoptedFromLock(lock) {
 }
 
 /** Compose an edition's base; a refusal names the edition and every violation. */
-export function composeEditionAuthorizationBase({ distributionId, inputs, kernel, adopted }) {
+export function composeEditionAuthorizationBase({ distributionId, inputs, kernel, adopted, biomeOrigins }) {
   try {
     return kernel.composeAuthorizationBase({
       modules: inputs,
+      biomeOrigins,
       currentPlatformGeneration: kernel.currentPlatformGeneration,
       ...(adopted ? { adopted } : {}),
     });
@@ -201,10 +206,10 @@ export function composeEditionAuthorizationBase({ distributionId, inputs, kernel
   }
 }
 
-/** The lock body for a composed base. Deterministic: no timestamp. */
+/** The lock body for a composed base. Deterministic: no timestamp. It is read through the kernel's `parseAuthorizationLockReadView` before it is returned. */
 export function authorizationLockOf(distributionId, kernel, composed) {
-  return {
-    schemaVersion: AUTHORIZATION_LOCK_SCHEMA_VERSION,
+  const lock = {
+    schemaVersion: kernel.authorizationLockSchemaVersion,
     distributionId,
     platformGeneration: kernel.currentPlatformGeneration,
     modelHash: composed.modelHash,
@@ -219,6 +224,8 @@ export function authorizationLockOf(distributionId, kernel, composed) {
     parentImplementers: [...composed.parentImplementers],
     model: composed.model,
   };
+  kernel.parseAuthorizationLockReadView(lock);
+  return lock;
 }
 
 /** Resolve and verify the pinned `fga` CLI. */
@@ -272,8 +279,8 @@ export function fgaComposedModelTestRunner(bin) {
 }
 
 /** Compose, test, describe. `runTests` is the `fga model test` runner. */
-export function sealEditionAuthorizationBase({ distributionId, inputs, kernel, adopted, runTests }) {
-  const composed = composeEditionAuthorizationBase({ distributionId, inputs, kernel, adopted });
+export function sealEditionAuthorizationBase({ distributionId, inputs, kernel, adopted, biomeOrigins, runTests }) {
+  const composed = composeEditionAuthorizationBase({ distributionId, inputs, kernel, adopted, biomeOrigins });
   runTests(composed);
   return authorizationLockOf(distributionId, kernel, composed);
 }
@@ -293,7 +300,7 @@ export const AuthorizationLockCheck = Object.freeze({
  * exactly as the sealer would refuse it) and compares the whole lock. The
  * tests are not re-run: an equal `modelHash` is the model the sealer tested.
  */
-export function checkAuthorizationLockCurrent({ distributionId, committed, inputs, kernel, serialize }) {
+export function checkAuthorizationLockCurrent({ distributionId, committed, inputs, kernel, biomeOrigins, serialize }) {
   if (kernel === null) {
     return committed === null ? AuthorizationLockCheck.GREEN : AuthorizationLockCheck.NOT_SEALABLE;
   }
@@ -302,6 +309,7 @@ export function checkAuthorizationLockCurrent({ distributionId, committed, input
     distributionId,
     inputs,
     kernel,
+    biomeOrigins,
     adopted: adoptedFromLock(committed),
   });
   return serialize(authorizationLockOf(distributionId, kernel, composed)) === serialize(committed)
@@ -316,7 +324,7 @@ export function checkAuthorizationLockCurrent({ distributionId, committed, input
  * entries plus the edition's source-walked ones). Returns an
  * `AuthorizationLockCheck` member; throws on a refusal.
  */
-export function checkEditionAuthorizationLock({ distributionId, editionDir, lockBiomes, index, kernel, serialize }) {
+export function checkEditionAuthorizationLock({ distributionId, editionDir, lockBiomes, biomeOrigins, index, kernel, serialize }) {
   if (!Array.isArray(index)) {
     throw new Error(`${distributionId}: the authorization check needs the index the lock was resolved from.`);
   }
@@ -325,6 +333,7 @@ export function checkEditionAuthorizationLock({ distributionId, editionDir, lock
     committed: readAuthorizationLock(editionDir),
     inputs: editionAuthorizationModuleInputs(lockBiomes, new Map(index.map((e) => [e.id, e])), kernel),
     kernel,
+    biomeOrigins,
     serialize,
   });
 }

package/edition/biome-content.mjs

@@ -20,6 +20,10 @@ import { execFileSync } from 'node:child_process';
 import { relative, sep } from 'node:path';
 
 import { readGitJsonAtCommit } from './lib.mjs';
+import {
+  assertOperationGrantsAdmitted,
+  assertOrganizationSweepsAdmitted,
+} from './operation-grant-admission.mjs';
 
 /** A biome whose recomputed content hash is not the lock's, or whose inputs cannot be recomputed. */
 export class BiomeContentHashError extends Error {
@@ -246,6 +250,8 @@ export async function biomeSourceTreeIds({ schemas, lock, imageLock, locate, ven
 /** Seal: the unsealed lock + the recomputed hashes -> the kernel's `sealDistributionLock`. */
 export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest }) {
   const hashes = await computeBiomeContentHashes({ schemas, lock: unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest });
+  assertOperationGrantsAdmitted(schemas, unsealed);
+  assertOrganizationSweepsAdmitted(schemas, unsealed);
   return schemas.sealDistributionLock(unsealed, hashes);
 }
 

package/edition/build-platform-service-index.mjs

@@ -14,6 +14,7 @@ import {
 import {
   comparablePlatformService,
   declaredInstallationClass,
+  sourceOwnedCapabilityDomains,
 } from './platform-service-class.mjs';
 import {
   platformServiceSourceDeclaration,
@@ -142,6 +143,7 @@ function buildTrustedIndex(sourceAuthority) {
       name: declaration.name,
       tier: declaration.tier,
       ...declaredInstallationClass(declaration),
+      ...sourceOwnedCapabilityDomains(sourceManifest, `${binding.path} at ${before}`),
       repositoryUrl,
       repo: binding.repo,
       path: binding.path,

package/edition/build-runtime-image-source-index.mjs

@@ -204,6 +204,10 @@ function assertVendoredSourcesResolve(crossRepoBuildInputs, resolveIdentity) {
   }
 }
 
+const LEGACY_INDEX_SCHEMA_VERSION = 1;
+const CURRENT_INDEX_SCHEMA_VERSION = 2;
+const KNOWN_INDEX_SCHEMA_VERSIONS = Object.freeze([LEGACY_INDEX_SCHEMA_VERSION, CURRENT_INDEX_SCHEMA_VERSION]);
+
 /**
  * The kernel-contract authority for a pin regeneration.
  *
@@ -250,13 +254,24 @@ function assertVendoredSourcesResolve(crossRepoBuildInputs, resolveIdentity) {
  * rule — the caller states the commit (`--kernel-commit`) and the checkout's
  * HEAD must equal it. Stating a commit when a committed authority exists is
  * refused: it would be read by nobody.
+ *
+ * A committed index of schemaVersion 1 carries an authority a current kernel
+ * cannot validate, so it counts as having NO committed authority: it is
+ * migrated by bootstrap, which writes a schemaVersion 2 index. Any other
+ * schemaVersion is refused by name, never read as one of these.
  */
 async function resolveContractAuthority(schemas, kernelRoot, kernelCommit) {
   const repositoryDirectory = kernelRoot ?? undefined;
   const committed = existsSync(runtimeImageSourceIndexPath())
     ? readJson(runtimeImageSourceIndexPath())
     : undefined;
-  if (!committed?.contractAuthority) {
+  if (committed !== undefined && !KNOWN_INDEX_SCHEMA_VERSIONS.includes(committed.schemaVersion)) {
+    throw new Error(
+      `${runtimeImageSourceIndexPath()} has schemaVersion ${JSON.stringify(committed.schemaVersion)}; ` +
+        `this command reads ${KNOWN_INDEX_SCHEMA_VERSIONS.join(' or ')}`,
+    );
+  }
+  if (committed === undefined || committed.schemaVersion === LEGACY_INDEX_SCHEMA_VERSION || !committed.contractAuthority) {
     return buildTrustedKernelContractAuthority({
       ...(repositoryDirectory === undefined ? {} : { repositoryDirectory }),
       schemas,
@@ -360,6 +375,72 @@ function committedRepositoryPinsToPreserve(repoScope) {
   );
 }
 
+/**
+ * `producerWorkflowPins` are operator-stated TRUST DATA: which commit of a
+ * producer repository's workflow the verifier believes. Nothing is derived (not
+ * from `repositoryPins`, not from a policy row); the committed pins are kept
+ * exactly, and `--producer-workflow-pin <owner/repo>=<40-hex>` sets or updates
+ * one. A bootstrap index with none committed writes `[]`, which the kernel allows.
+ */
+export function mergeProducerWorkflowPins(committedPins, statedPins) {
+  const merged = new Map(
+    (Array.isArray(committedPins) ? committedPins : []).map((pin) => [
+      pin.repository,
+      { repository: pin.repository, workflowCommit: pin.workflowCommit },
+    ]),
+  );
+  for (const pin of statedPins) {
+    merged.set(pin.repository, { repository: pin.repository, workflowCommit: pin.workflowCommit });
+  }
+  return [...merged.values()].sort((left, right) => compareStrings(left.repository, right.repository));
+}
+
+const PRODUCER_WORKFLOW_PIN_FLAG = '--producer-workflow-pin';
+
+/**
+ * Every `--producer-workflow-pin <owner/repo>=<40-hex>` of the argv. A malformed
+ * value, or a repository stated twice, is refused here; the repository and
+ * commit grammar is the kernel's, applied by the index parse.
+ */
+export function parseProducerWorkflowPinFlags(argv) {
+  const pins = [];
+  const remaining = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] !== PRODUCER_WORKFLOW_PIN_FLAG) {
+      remaining.push(argv[index]);
+      continue;
+    }
+    const value = argv[index + 1];
+    const separator = value?.indexOf('=') ?? -1;
+    if (separator < 1 || value.startsWith('--')) {
+      throw new Error(`${PRODUCER_WORKFLOW_PIN_FLAG} requires <owner/repo>=<40-hex-commit>`);
+    }
+    const repository = value.slice(0, separator);
+    const workflowCommit = value.slice(separator + 1);
+    if (pins.some((pin) => pin.repository === repository)) {
+      throw new Error(`${PRODUCER_WORKFLOW_PIN_FLAG} names ${repository} more than once`);
+    }
+    if (!COMMIT_PATTERN.test(workflowCommit)) {
+      throw new Error(`${PRODUCER_WORKFLOW_PIN_FLAG} ${repository}: the commit must be a full 40-hex sha`);
+    }
+    pins.push({ repository, workflowCommit });
+    index += 1;
+  }
+  return { producerWorkflowPins: pins, remaining };
+}
+
+/**
+ * A `--producer-workflow-pin` is trust data for the index `--trusted-write`
+ * writes, and only there. Every other mode writes nothing, so a pin stated to
+ * one would be silently ignored; `--check-sources` included: it grades the
+ * committed index against the sources, and a pin is not a source.
+ */
+export function assertProducerWorkflowPinsWritten(producerWorkflowPins, flag, usage) {
+  if (producerWorkflowPins.length > 0 && flag !== '--trusted-write') {
+    throw new Error(`${PRODUCER_WORKFLOW_PIN_FLAG} states trust data for a written index: ${flag} writes none\n${usage}`);
+  }
+}
+
 /**
  * `biomeIndex` and `platformServiceIndex` are the indexes this one is built
  * over, INJECTED: the release CLI passes the committed ones read from disk
@@ -371,7 +452,7 @@ export async function buildTrustedIndex(
   sourceAuthority,
   kernelRoot,
   repoScope,
-  { biomeIndex, platformServiceIndex, kernelCommit },
+  { biomeIndex, platformServiceIndex, kernelCommit, producerWorkflowPins = [] },
 ) {
   const contractAuthority = await resolveContractAuthority(schemas, kernelRoot, kernelCommit);
   const repositoryIdentities = new Map();
@@ -421,7 +502,7 @@ export async function buildTrustedIndex(
   const repositoryPins = [...sourceRepos]
     .sort(compareStrings)
     .map(getRepositoryIdentity);
-  const crossRepoBuildInputs = [...crossRepoBuildInputs()].sort(
+  const sortedCrossRepoBuildInputs = [...crossRepoBuildInputs()].sort(
     (left, right) =>
       compareStrings(
         [left.consumerRepo, left.consumerService, left.destinationPath].join(
@@ -432,7 +513,7 @@ export async function buildTrustedIndex(
         ),
       ),
   );
-  assertVendoredSourcesResolve(crossRepoBuildInputs, getRepositoryIdentity);
+  assertVendoredSourcesResolve(sortedCrossRepoBuildInputs, getRepositoryIdentity);
   const buildStepContextDirectories = [...buildStepContextDirectoriesDeclared()].sort(
     (left, right) =>
       compareStrings(
@@ -448,7 +529,7 @@ export async function buildTrustedIndex(
       );
     }
   }
-  for (const input of crossRepoBuildInputs) {
+  for (const input of sortedCrossRepoBuildInputs) {
     for (const repo of [input.consumerRepo, input.sourceRepo]) {
       if (!sourceRepos.has(repo)) {
         throw new Error(
@@ -459,12 +540,16 @@ export async function buildTrustedIndex(
     }
   }
   return {
-    schemaVersion: 1,
+    schemaVersion: CURRENT_INDEX_SCHEMA_VERSION,
     contractAuthority,
     supplementalSubjects,
-    crossRepoBuildInputs,
+    crossRepoBuildInputs: sortedCrossRepoBuildInputs,
     buildStepContextDirectories,
     repositoryPins,
+    producerWorkflowPins: mergeProducerWorkflowPins(
+      existsSync(runtimeImageSourceIndexPath()) ? readJson(runtimeImageSourceIndexPath()).producerWorkflowPins : [],
+      producerWorkflowPins,
+    ),
     platformServiceBindings: [...platformServiceRuntimeBindings()].sort(
       (left, right) =>
         compareStrings(left.platformService, right.platformService),
@@ -749,7 +834,7 @@ const USAGE =
   'usage: build-runtime-image-source-index.mjs (--check | --check-sources | --trusted-write | ' +
   '--repin-contract-authority --kernel-commit <40-hex-commit>) ' +
   '[--source published|workspace] [--kernel-root <absolute-checkout>] ' +
-  '[--repo <repository> [--at <40-hex-commit>]] ' +
+  '[--repo <repository> [--at <40-hex-commit>]] [--producer-workflow-pin <owner/repo>=<40-hex-commit> ...] ' +
   '(--trusted-write on a data root with no committed contract authority also requires --kernel-commit)';
 
 async function main() {
@@ -757,7 +842,8 @@ async function main() {
     process.argv.slice(2),
   );
   const { kernelCommit, remaining: afterKernelRoot } = parseKernelCommit(afterKernelRootFlag);
-  const { repoScope, remaining: afterRepoScope } = parseRepoScope(afterKernelRoot);
+  const { producerWorkflowPins, remaining: afterWorkflowPins } = parseProducerWorkflowPinFlags(afterKernelRoot);
+  const { repoScope, remaining: afterRepoScope } = parseRepoScope(afterWorkflowPins);
   const { exactCommit, remaining: argv } = parseExactCommit(afterRepoScope);
   const { mode, remaining } = parseSourceModeArgs(argv);
   if (exactCommit !== undefined && repoScope === undefined) {
@@ -773,6 +859,7 @@ async function main() {
   if (kernelCommit !== undefined && ![REPIN_FLAG, '--trusted-write'].includes(flag)) {
     throw new Error(`${KERNEL_COMMIT_FLAG} states the commit of a new contract authority: ${flag} chooses none\n${USAGE}`);
   }
+  assertProducerWorkflowPinsWritten(producerWorkflowPins, flag, USAGE);
   const schemas = await loadKernelDistributionSchemas();
   if (flag === REPIN_FLAG) {
     if (repoScope !== undefined || exactCommit !== undefined) {
@@ -828,6 +915,7 @@ async function main() {
         biomeIndex: readJson(biomeIndexPath()),
         platformServiceIndex: readJson(join(dataRoot(), 'platform-service-index.json')),
         kernelCommit,
+        producerWorkflowPins,
       },
     ),
   );

package/edition/catalogue.mjs

@@ -14,13 +14,18 @@ import { join } from 'node:path';
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
 import { EDITION_OFFERING_LAYERS, EditionChannel } from './edition-constants.mjs';
 import { serializeJson } from './lib.mjs';
+import { verifiedPlatformServiceIndex } from './platform-service-ownership.mjs';
 
 export const CATALOGUE_FILE = EDITION_OFFERING_LAYERS.catalogue;
 export const CATALOGUE_SCHEMA = 'xema.edition-catalogue/v1';
 
-const TOP_KEYS = ['schema', 'offeringId', 'channel', 'biomes', 'sourceTreeIds', 'platformServices', 'images', 'chartSet', 'contractAuthority', 'ceiling'];
+const TOP_KEYS = ['schema', 'offeringId', 'channel', 'biomes', 'sourceTreeIds', 'platformServices', 'images', 'chartSet', 'contractAuthority', 'kernel', 'ceiling'];
 const IMAGES_KEYS = ['sourceHashAlgorithm', 'subjects', 'platformServiceBindings', 'webBiomes'];
 const CEILING_KEYS = ['trustPolicy', 'trustCeiling'];
+const KERNEL_KEYS = ['name', 'version', 'integrity'];
+const KERNEL_PACKAGE = '@xemahq/contracts';
+const EXACT_SEMVER = /^\d+\.\d+\.\d+$/;
+const NPM_INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
 const DIGEST = /^sha256:[a-f0-9]{64}$/;
 const GIT_TREE_ID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
 
@@ -76,6 +81,14 @@ export function parseCatalogue(value) {
   }
   if (!isObject(value.chartSet)) {throw new CatalogueError(`${CATALOGUE_FILE}: chartSet must be the offering's chart-set lock`);}
   if (!isObject(value.contractAuthority)) {throw new CatalogueError(`${CATALOGUE_FILE}: contractAuthority must be the runtime image source index's authority`);}
+  exactKeys(value.kernel, KERNEL_KEYS, `${CATALOGUE_FILE} kernel`);
+  if (value.kernel.name !== KERNEL_PACKAGE) {throw new CatalogueError(`${CATALOGUE_FILE}: kernel.name must be ${KERNEL_PACKAGE}, not ${JSON.stringify(value.kernel.name)}`);}
+  if (typeof value.kernel.version !== 'string' || !EXACT_SEMVER.test(value.kernel.version)) {
+    throw new CatalogueError(`${CATALOGUE_FILE}: kernel.version must be an exact x.y.z version, not ${JSON.stringify(value.kernel.version)}`);
+  }
+  if (typeof value.kernel.integrity !== 'string' || !NPM_INTEGRITY.test(value.kernel.integrity)) {
+    throw new CatalogueError(`${CATALOGUE_FILE}: kernel.integrity must be an npm sha512 integrity (sha512-<base64>)`);
+  }
   exactKeys(value.ceiling, CEILING_KEYS, `${CATALOGUE_FILE} ceiling`);
   return value;
 }
@@ -94,8 +107,10 @@ export function buildCatalogue({
   biomeIndex,
   platformServiceIndex,
   contractAuthority,
+  kernel,
   leaf,
   sourceTreeIds,
+  readManifest,
 }) {
   const sourced = distributionLock.biomes.filter((biome) => biome.source !== undefined);
   if (sourced.length > 0) {
@@ -106,7 +121,9 @@ export function buildCatalogue({
   const biomes = biomeIndex.filter((row) => shippedBiomes.has(row.id));
   const missing = [...shippedBiomes].filter((id) => !biomes.some((row) => row.id === id));
   if (missing.length > 0) {throw new CatalogueError(`offering "${offeringId}": the biome index has no row for ${missing.join(', ')}`);}
-  const platformServices = platformServiceIndex.services.filter((row) => shippedServices.has(row.name));
+  // The customer trusts this catalogue's ownership rows without sources, so they are
+  // re-derived from the pinned manifests here, before the catalogue seals.
+  const platformServices = verifiedPlatformServiceIndex(platformServiceIndex, { names: shippedServices, readManifest }).services.filter((row) => shippedServices.has(row.name));
   return parseCatalogue({
     schema: CATALOGUE_SCHEMA,
     offeringId,
@@ -122,6 +139,7 @@ export function buildCatalogue({
     },
     chartSet: chartSetLock,
     contractAuthority,
+    kernel,
     ceiling: { trustPolicy: leaf?.trustPolicy ?? null, trustCeiling: leaf?.trustCeiling ?? null },
   });
 }
@@ -133,14 +151,3 @@ export function writeCatalogue(outDir, catalogue) {
   writeFileSync(path, serializeJson(catalogue));
   return path;
 }
-
-const KERNEL_COMMIT = /^[0-9a-f]{40}$/;
-
-/** The commit the catalogue's contract authority was taken at (40 hex); read without the kernel schemas, which are not checked out yet where this is used. */
-export function contractAuthoritySourceCommit(catalogue) {
-  const commit = catalogue.contractAuthority.sourceCommit;
-  if (typeof commit !== 'string' || !KERNEL_COMMIT.test(commit)) {
-    throw new CatalogueError(`${CATALOGUE_FILE}: contractAuthority.sourceCommit is not a 40-hex commit: ${JSON.stringify(commit)}`);
-  }
-  return commit;
-}

package/edition/checkout-indexed-source-repositories.mjs

@@ -5,7 +5,7 @@ import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 
 import { editionWorkspaceConfig } from './edition-config.mjs';
-import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, runtimeImageSourceIndexPath, sourcesRoot } from './edition-workspace.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, platformServiceIndexPath, runtimeImageSourceIndexPath, sourcesRoot } from './edition-workspace.mjs';
 import { holdSource, withSourceGitEnv } from './git-source-auth.mjs';
 import { applyPinSource, snapshotPinSource } from './pin-source.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
@@ -45,10 +45,40 @@ function git(args, env) {
   execFileSync('git', args, { env, stdio: 'inherit' });
 }
 
-export function checkoutIndexedSources({ workspaceRoot, index, env = process.env }) {
+/**
+ * The extra commits each checkout must also hold: resolve reads every platform
+ * service's manifest at the `sourceCommit` platform-service-index.json pins, and
+ * that commit may differ from the repository's own pin. Maps repo to the
+ * distinct such commits (excluding the pinned one). A platform service whose
+ * repository has no pin is refused: there is no checkout to fetch into.
+ */
+export function platformServiceExtraCommits(plan, platformServiceIndex) {
+  if (!Array.isArray(platformServiceIndex?.services)) {
+    throw new Error('platform-service-index.json declares no services array');
+  }
+  const pinned = new Map(plan.map((entry) => [entry.repo, entry.sourceCommit]));
+  const extra = new Map();
+  for (const service of platformServiceIndex.services) {
+    if (!pinned.has(service?.repo)) {
+      throw new Error(
+        `platform service "${service?.name}" names repository ${JSON.stringify(service?.repo)}, which has no repository pin in the runtime image source index`,
+      );
+    }
+    if (!SHA.test(String(service.sourceCommit ?? ''))) {
+      throw new Error(`platform service "${service.name}" sourceCommit is not exact lowercase 40-hex`);
+    }
+    if (service.sourceCommit === pinned.get(service.repo)) {continue;}
+    if (!extra.has(service.repo)) {extra.set(service.repo, new Set());}
+    extra.get(service.repo).add(service.sourceCommit);
+  }
+  return new Map([...extra].map(([repo, commits]) => [repo, [...commits]]));
+}
+
+export function checkoutIndexedSources({ workspaceRoot, index, platformServiceIndex, env = process.env, runGit = git }) {
   if (!workspaceRoot) {throw new Error('workspaceRoot is required');}
   const workspace = editionWorkspaceConfig();
   const plan = sourceCheckoutPlan(index, workspace);
+  const extraCommits = platformServiceExtraCommits(plan, platformServiceIndex);
   for (const entry of plan) {holdSource({ name: entry.repo, url: entry.repositoryUrl }, workspace, env);}
   for (const entry of plan) {
     const target = resolve(workspaceRoot, entry.repo);
@@ -57,10 +87,10 @@ export function checkoutIndexedSources({ workspaceRoot, index, env = process.env
     }
     withSourceGitEnv({ name: entry.repo, url: entry.repositoryUrl }, { workspace, env }, (gitEnv) => {
       mkdirSync(dirname(target), { recursive: true });
-      git(['init', '--quiet', target], gitEnv);
-      git(['-C', target, 'remote', 'add', 'origin', entry.repositoryUrl], gitEnv);
-      git(['-C', target, 'fetch', '--quiet', '--depth=1', 'origin', entry.sourceCommit], gitEnv);
-      git(['-C', target, 'checkout', '--quiet', '--detach', entry.sourceCommit], gitEnv);
+      runGit(['init', '--quiet', target], gitEnv);
+      runGit(['-C', target, 'remote', 'add', 'origin', entry.repositoryUrl], gitEnv);
+      runGit(['-C', target, 'fetch', '--quiet', '--depth=1', 'origin', entry.sourceCommit], gitEnv);
+      runGit(['-C', target, 'checkout', '--quiet', '--detach', entry.sourceCommit], gitEnv);
       const actual = execFileSync('git', ['-C', target, 'rev-parse', 'HEAD'], {
         env: gitEnv,
         encoding: 'utf8',
@@ -68,6 +98,10 @@ export function checkoutIndexedSources({ workspaceRoot, index, env = process.env
       if (actual !== entry.sourceCommit) {
         throw new Error(`${entry.repo} resolved ${actual}, expected ${entry.sourceCommit}`);
       }
+      for (const commit of extraCommits.get(entry.repo) ?? []) {
+        runGit(['-C', target, 'fetch', '--quiet', '--depth=1', 'origin', commit], gitEnv);
+        console.log(`[source-checkout] ${entry.repo} also holds platform-service commit ${commit}`);
+      }
     });
     console.log(`[source-checkout] ${entry.repo} @ ${entry.sourceCommit}`);
   }
@@ -96,6 +130,7 @@ if (isEntryModule(import.meta.url)) {
     const count = checkoutIndexedSources({
       workspaceRoot: sourcesRoot(),
       index,
+      platformServiceIndex: JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8')),
     });
     console.log(`[source-checkout] materialized ${count} indexed repositories at exact commits`);
   } catch (error) {

package/edition/customer-definition.mjs

@@ -57,32 +57,15 @@ export function parseCustomerDefinition(schemas, raw) {
   } catch (error) {
     throw new CustomerDefinitionError(error.message, { cause: error });
   }
-  assertNoVendorReservedDomain(schemas, definition);
   return { definition, mirror };
 }
 
-/** The trust domains only the vendor places a biome in: the kernel's first-party domain. */
-export const vendorReservedTrustDomains = (schemas) => [schemas.FIRST_PARTY_TRUST_DOMAIN];
-
-/** A customer's `trustCeiling` assigns its own biomes and never into a vendor-reserved domain. */
-function assertNoVendorReservedDomain(schemas, definition) {
-  const reserved = new Set(vendorReservedTrustDomains(schemas));
-  for (const assignment of definition.trustCeiling?.assignments ?? []) {
-    if (reserved.has(assignment.domain)) {
-      throw new CustomerDefinitionError(
-        `customer definition "${definition.id}": \`trustCeiling\` assigns ${assignment.biomes.map((biome) => `biome "${biome}"`).join(', ')} ` +
-          `to trust domain "${assignment.domain}", which is reserved to the vendor; a customer's biomes are assigned a domain of the customer's own`,
-      );
-    }
-  }
-}
-
 /**
  * The trustCeiling must assign every customer-source biome (a biome the resolved lock draws
- * from the definition's own `sources[]`) and no other: the kernel's `customerTrustCeilingIssues`.
+ * from the definition's own `sources[]`) and no other, and none in a domain the catalogue's ceiling reserves: the kernel's `customerTrustCeilingIssues`.
  */
-export function assertTrustCeilingAssignsCustomerBiomes(schemas, definition, customerBiomeIds) {
-  const issues = schemas.customerTrustCeilingIssues(definition, customerBiomeIds);
+export function assertTrustCeilingAssignsCustomerBiomes(schemas, definition, customerBiomeIds, catalogueTrustCeiling) {
+  const issues = schemas.customerTrustCeilingIssues(definition, customerBiomeIds, catalogueTrustCeiling);
   if (issues.length > 0) {
     throw new CustomerDefinitionError(`customer definition "${definition.id}": ${issues.join('; ')}`);
   }

package/edition/develop-customer-edition.mjs

@@ -72,7 +72,7 @@ export function declaredSourceNamesOf(rawDefinition) {
 }
 
 /** Resolve and seal the develop customer edition; returns the four locks and the frozen provenance pins. */
-export async function resolveCustomerDevelopEdition({ rawDefinition, catalogue, catalogueDigest, pins, sourceImages, env = process.env, sealOptions = {}, verifyAuthority, materialize }) {
+export async function resolveCustomerDevelopEdition({ rawDefinition, catalogue, catalogueDigest, pins, sourceImages, env = process.env, sealOptions = {}, adoptKernel, materialize }) {
   const frozen = customerDevelopPins({ pins, declaredSourceNames: declaredSourceNamesOf(rawDefinition), catalogueDigest });
   const resolved = await resolveCustomerEdition({
     rawDefinition,
@@ -81,7 +81,7 @@ export async function resolveCustomerDevelopEdition({ rawDefinition, catalogue,
     sourceImages,
     pins: frozen,
     catalogueDigest,
-    ...(verifyAuthority === undefined ? {} : { verifyAuthority }),
+    ...(adoptKernel === undefined ? {} : { adoptKernel }),
     ...(materialize === undefined ? {} : { materialize }),
     sealOwn: ({ distributionId, subjects }) => sealDevelopImageSubjects({ distributionId, subjects, env, ...sealOptions }),
   });