@xemahq/xema 0.29.1 → 0.31.0

package/edition/platform-service-ownership.mjs

@@ -0,0 +1,78 @@
+import { sourcePath } from './edition-workspace.mjs';
+import { readGitJsonAtCommit, serializeJson, sha256Hex } from './lib.mjs';
+import { sourceOwnedCapabilityDomains } from './platform-service-class.mjs';
+
+/** Why a platform service's capability-domain ownership was refused. */
+export const PlatformServiceOwnershipFault = Object.freeze({
+  /** The pinned source manifest could not be read. */
+  ManifestUnavailable: 'manifest-unavailable',
+  /** The manifest bytes do not hash to the index entry's `sourceManifestHash`. */
+  ManifestHashMismatch: 'manifest-hash-mismatch',
+  /** The index entry's `ownsCapabilityDomains` differs from the source manifest's. */
+  OwnershipMismatch: 'ownership-mismatch',
+});
+
+export class PlatformServiceOwnershipError extends Error {
+  constructor(fault, message) {
+    super(`[${fault}] ${message}`);
+    this.name = 'PlatformServiceOwnershipError';
+    this.fault = fault;
+  }
+}
+
+/**
+ * The source manifest of one index entry, at the commit the entry pins. The
+ * entry's `path` is workspace-relative (`<repo>/<manifestPath>`).
+ */
+export function readPinnedSourceManifest(entry) {
+  const manifestPath = entry.path.slice(`${entry.repo}/`.length);
+  try {
+    return readGitJsonAtCommit(sourcePath(entry.repo), manifestPath, entry.sourceCommit);
+  } catch (cause) {
+    throw new PlatformServiceOwnershipError(
+      PlatformServiceOwnershipFault.ManifestUnavailable,
+      `platform service "${entry.name}": cannot read ${entry.path} at ${entry.sourceCommit} ` +
+        `(${cause.message}); a resolve that reads the platform-service index needs the pinned sources`,
+    );
+  }
+}
+
+/**
+ * Re-derive each platform service's `ownsCapabilityDomains` from its pinned
+ * source manifest and refuse the index when an entry disagrees. The index is a
+ * hand-editable file; the SERVICE's own manifest is the authority for which
+ * service owns a domain, and so for where grants land.
+ *
+ * Returns the index rows with the RE-DERIVED value, never the index's.
+ *
+ * @param {{ services: object[] }} index
+ * @param {{ names?: Set<string>, readManifest?: (entry: object) => unknown }} [options]
+ *   `names` restricts the check to those services; `readManifest` is the test seam.
+ */
+export function verifiedPlatformServiceIndex(index, { names, readManifest = readPinnedSourceManifest } = {}) {
+  const services = index.services.map((entry) => {
+    if (names !== undefined && !names.has(entry.name)) {return entry;}
+    const manifest = readManifest(entry);
+    const actualHash = sha256Hex(serializeJson(manifest));
+    if (actualHash !== entry.sourceManifestHash) {
+      throw new PlatformServiceOwnershipError(
+        PlatformServiceOwnershipFault.ManifestHashMismatch,
+        `platform service "${entry.name}": ${entry.path} at ${entry.sourceCommit} hashes to ${actualHash}, ` +
+          `but the index pins sourceManifestHash ${entry.sourceManifestHash}`,
+      );
+    }
+    const derived = sourceOwnedCapabilityDomains(manifest, `${entry.path} at ${entry.sourceCommit}`);
+    const claimed = entry.ownsCapabilityDomains;
+    if (serializeJson(claimed ?? null) !== serializeJson(derived.ownsCapabilityDomains ?? null)) {
+      throw new PlatformServiceOwnershipError(
+        PlatformServiceOwnershipFault.OwnershipMismatch,
+        `platform service "${entry.name}": the index claims ownsCapabilityDomains ${JSON.stringify(claimed ?? [])}, ` +
+          `its source manifest declares ${JSON.stringify(derived.ownsCapabilityDomains ?? [])} ` +
+          `(sourceManifestHash ${entry.sourceManifestHash})`,
+      );
+    }
+    const { ownsCapabilityDomains: _claimed, ...rest } = entry;
+    return { ...rest, ...derived };
+  });
+  return { ...index, services };
+}

package/edition/produce-distribution-completeness-evidence.mjs

@@ -21,6 +21,7 @@ import {
   assertPinnedCosignVersion,
   buildDistributionImageEvidenceSet,
   buildDistributionImagesStatement,
+  evidenceChannelOfSigner,
   loadPinnedTrustPolicy,
   parseEvidenceCliFlags,
   resolveProducerEvidence,
@@ -59,6 +60,8 @@ export function githubWorkflowSigner({ repository, ref, path }) {
 
 /** The producer evidence and the completeness statement these inputs resolve to; deterministic. */
 async function deriveCompleteness(options, { outputRoot }) {
+  // The channel the signer signs for is the channel the lock is read on.
+  const channel = evidenceChannelOfSigner(options.signer, options.schemas);
   const resolution = {
     distributionId: options.distributionId,
     dataRoot: options.dataRoot,
@@ -66,6 +69,7 @@ async function deriveCompleteness(options, { outputRoot }) {
     schemas: options.schemas,
     expectedContractAuthority: options.expectedContractAuthority,
     registryClientFactory: options.registryClientFactory,
+    channel,
   };
   const staged = outputRoot === null
     ? await resolveProducerEvidence(resolution)
@@ -74,6 +78,7 @@ async function deriveCompleteness(options, { outputRoot }) {
     distributionLock: staged.distributionLock,
     imageLock: staged.imageLock,
     images: staged.images,
+    channel,
     releaseSequence: options.releaseSequence,
     releaseSourceCommit: options.releaseSourceCommit,
     runId: options.runId,

package/edition/produce-image-delivery-entitlement-evidence.mjs

@@ -18,6 +18,7 @@ import {
   acceptSignedEvidenceStatement,
   assertPinnedCosignVersion,
   buildImageDeliveryEntitlementStatement,
+  evidenceChannelOfSigner,
   loadPinnedTrustPolicy,
   parseEvidenceCliFlags,
   stageEvidenceStatement,
@@ -26,10 +27,11 @@ import {
   WorkspaceRoot,
   configureEditionWorkspaceFromArgv,
   dataRoot,
+  editionsRoot,
   isEntryModule,
 } from './edition-workspace.mjs';
 import { ENTITLEMENT_DESCRIPTOR_FILE, entitlementDescriptorDocument } from './image-delivery-entitlement-descriptor.mjs';
-import { canonicalJsonBytes, readCanonicalJsonFromRoot } from './image-evidence.mjs';
+import { canonicalJsonBytes, readCanonicalJsonFromRoot, readEditionDistributionLock } from './image-evidence.mjs';
 import { serializeJson } from './lib.mjs';
 import { githubWorkflowSigner } from './produce-distribution-completeness-evidence.mjs';
 import {
@@ -81,6 +83,12 @@ function deriveEntitlement(options) {
     schemas: options.schemas,
   });
   const statement = buildImageDeliveryEntitlementStatement({
+    distributionLock: readEditionDistributionLock(
+      options.editionsRoot,
+      options.distributionId,
+      options.schemas,
+      evidenceChannelOfSigner(options.signer, options.schemas),
+    ),
     distributionId: options.distributionId,
     completenessStatementDigest,
     customerId: options.customerId,
@@ -226,6 +234,7 @@ const SHARED_FLAGS = Object.freeze([
 async function main() {
   const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
     WorkspaceRoot.Data,
+    WorkspaceRoot.Editions,
     WorkspaceRoot.Kernel,
   ]);
   if (phase !== 'stage' && phase !== 'accept') {
@@ -240,6 +249,7 @@ async function main() {
   const options = {
     distributionId: flags.require('distribution'),
     evidenceRoot: resolve(flags.require('evidence-root')),
+    editionsRoot: editionsRoot(),
     stagingDirectory: resolve(flags.require('staging')),
     schemas,
     policy: loadPinnedTrustPolicy({ dataRoot: dataRoot(), schemas }),

package/edition/release-catalogue.mjs

@@ -5,14 +5,15 @@ import { readFileSync } from 'node:fs';
 import { biomeSourceTreeIds } from './biome-content.mjs';
 import { buildCatalogue } from './catalogue.mjs';
 import { EditionChannel } from './edition-constants.mjs';
-import { biomeIndexPath, platformServiceIndexPath, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { biomeIndexPath, kernelPackageDir, platformServiceIndexPath, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { kernelPackageOfAuthority } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { loadEditionManifest } from './resolve-distribution.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
 import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
 
 /** The catalogue of release offering `id`, from the committed locks (`locks` as `readCommittedEdition` returns them). */
-export async function releaseCatalogue(id, locks) {
+export async function releaseCatalogue(id, locks, { fetchKernelTarball } = {}) {
   const schemas = await loadKernelDistributionSchemas();
   const authority = createPinnedSourceAuthority({ pins: committedRepositoryPins() });
   // The WRITER of the catalogue's tree ids: the real `git rev-parse <commit>:<path>` of every biome.
@@ -23,6 +24,7 @@ export async function releaseCatalogue(id, locks) {
     locate: sourceTreeLocator(externalSourceTrees(locks.distributionLock)),
     vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
   });
+  const contractAuthority = schemas.parseRuntimeImageSourceIndex(JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8'))).contractAuthority;
   return buildCatalogue({
     sourceTreeIds,
     offeringId: id,
@@ -32,7 +34,12 @@ export async function releaseCatalogue(id, locks) {
     chartSetLock: locks.chartSetLock,
     biomeIndex: JSON.parse(readFileSync(biomeIndexPath(), 'utf8')),
     platformServiceIndex: schemas.parsePlatformServiceSourceIndex(JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8'))),
-    contractAuthority: schemas.parseRuntimeImageSourceIndex(JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8'))).contractAuthority,
+    contractAuthority,
+    kernel: await kernelPackageOfAuthority({
+      kernelPackageDir: kernelPackageDir(),
+      contractAuthority,
+      ...(fetchKernelTarball === undefined ? {} : { fetchTarball: fetchKernelTarball }),
+    }),
     leaf: loadEditionManifest(schemas.parseDistribution, id),
   });
 }

package/edition/remedy-command.mjs

@@ -10,7 +10,7 @@
 //   cannot run — and the reader of a dist-check failure is standing in a FLAT
 //   checkout of this repository, which is exactly where the pnpm spelling does
 //   not resolve. A remedy that cannot be run where it is printed is a dead end
-//   (`.claude/rules/writing-boundary-checks.md`, and closure-ledger A25).
+//   (`.claude/rules/writing-boundary-checks.md`).
 //
 //   Measured 2026-09-28 at `origin/develop`: 52 `pnpm dist:*` references in
 //   this repository, 19 such scripts declared in the aggregator, and ZERO
@@ -21,7 +21,7 @@
 //   That was the obvious fix and it is the wrong one: it would put 19 name→file
 //   mappings in two places, free to drift, and drift between them is invisible
 //   — a new script reachable from one side and not the other, with nothing able
-//   to say so short of a new gate. Closure-ledger A26 forbids buying a fix with
+//   to say so short of a new gate. The rule forbids buying a fix with
 //   a permanent check.
 //
 //   Deriving the command from the script's REAL PATH has one authority — the

package/edition/resolve-chart-set.mjs

@@ -82,7 +82,7 @@ import {
 } from './registry-credentials.mjs';
 
 if (isEntryModule(import.meta.url)) {
-  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Deploy, WorkspaceRoot.Kernel]);
+  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Kernel], { refuseOthers: true });
 }
 
 export const CHART_SET_LOCK_FILE = 'chart-set.lock.json';

package/edition/resolve-customer-edition.mjs

@@ -18,6 +18,7 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 
+import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
 import { AUTHORIZATION_LOCK_FILENAME, writeAuthorizationLock } from './authorization-base.mjs';
 import { CATALOGUE_FILE, CatalogueError } from './catalogue.mjs';
 import {
@@ -29,8 +30,8 @@ import {
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
 import { EditionLockFile } from './edition-constants.mjs';
 import { editionsRoot } from './edition-workspace.mjs';
-import { validateKernelContractAuthorityFromGit } from './kernel-contract-authority.mjs';
-import { compareStrings, loadKernelDistributionSchemas, serializeJson, validateImmutableImageLock } from './lib.mjs';
+import { adoptCatalogueKernel } from './kernel-package.mjs';
+import { compareStrings, serializeJson, validateImmutableImageLock } from './lib.mjs';
 import { pinnedSource, snapshotPinSource } from './pin-source.mjs';
 import { composeAuthorizationBase, composeManifest, resolveDistributionWithIndex, UnknownSelectionError } from './resolve-distribution.mjs';
 import { resolveImageRows } from './resolve-images.mjs';
@@ -63,11 +64,22 @@ function catalogueCeiling(catalogue, schemas) {
   return { trustPolicy: read('trustPolicy', schemas.DistributionTrustPolicySchema), trustCeiling: read('trustCeiling', schemas.ProcessTrustPolicySchema) };
 }
 
+/** A catalogue whose ceiling states no trust-domain assignments reserves no domain: the kernel's required ceiling argument is the empty policy. */
+const NO_CATALOGUE_TRUST_CEILING = Object.freeze({ assignments: [] });
+
+/** The kernel's `customerLockCeilingIssues` is the one check of a customer lock against the catalogue's ceiling. */
+function assertLockWithinCatalogueCeiling({ catalogue, definition, lock, schemas }) {
+  const issues = schemas.customerLockCeilingIssues(catalogueCeiling(catalogue, schemas).trustCeiling, lock.biomes);
+  if (issues.length > 0) {
+    throw new CatalogueCeilingError(`catalogue "${catalogue.offeringId}" (${catalogue.channel}): "${definition.id}" is outside the catalogue's trustCeiling: ${issues.join('; ')}`);
+  }
+}
+
 /**
  * The ceiling policy the customer's lock is written under: the catalogue's assignments, then
  * the definition's for what the catalogue leaves open. An assignment of the definition that
  * names a domain the catalogue assigns, or a biome the catalogue places, is not carried: the
- * catalogue's reading stands, and `assertWithinCatalogueCeiling` refuses the difference.
+ * catalogue's reading stands, and the kernel's `customerLockCeilingIssues` refuses the difference in the lock.
  */
 function ceilingUnderCatalogue(catalogueTrustCeiling, definitionTrustCeiling) {
   if (catalogueTrustCeiling === undefined) {return definitionTrustCeiling;}
@@ -80,25 +92,6 @@ function ceilingUnderCatalogue(catalogueTrustCeiling, definitionTrustCeiling) {
   return { assignments: [...catalogueTrustCeiling.assignments, ...open] };
 }
 
-/**
- * Every customer-source biome sits in the domain its definition names, and that is the domain
- * the catalogue's ceiling admits for it: the lock row carries the kernel's derivation
- * (`deriveTrustCeiling`) under `ceilingUnderCatalogue`, so a definition that reaches into a
- * domain the catalogue assigns, or moves a biome the catalogue places, differs from it here.
- */
-function assertWithinCatalogueCeiling({ catalogue, definition, lock, schemas }) {
-  const stated = new Map((definition.trustCeiling?.assignments ?? []).flatMap((assignment) => assignment.biomes.map((biome) => [biome, assignment.domain])));
-  for (const biome of lock.biomes.filter((candidate) => candidate.source !== undefined)) {
-    const admitted = biome.trustCeiling ?? schemas.defaultTrustDomain(biome.id, biome.origin);
-    if (stated.get(biome.id) !== admitted) {
-      throw new CatalogueCeilingError(
-        `catalogue "${catalogue.offeringId}" (${catalogue.channel}): "${definition.id}" assigns biome "${biome.id}" to trust domain ` +
-          `"${stated.get(biome.id)}", and the catalogue's trustCeiling admits "${admitted}" for it`,
-      );
-    }
-  }
-}
-
 /** `{name -> {imageRegistry, imageNamePrefix}}` from repeated `<source>=<registry>/<prefix>` values; the prefix is the text after the last "/". */
 export function parseSourceImages(values) {
   const byName = new Map();
@@ -247,8 +240,10 @@ export async function resolveCustomerImages({ id, catalogue, lock, composed, sch
   if (ownBiomes.length > 0) {
     const ownLock = { ...lock, biomes: ownBiomes, platformServices: [] };
     const runtimeImageSourceIndex = {
+      schemaVersion: 2,
       contractAuthority: catalogue.contractAuthority,
       repositoryPins: [],
+      producerWorkflowPins: [],
       platformServiceBindings: [],
       supplementalSubjects: [],
       crossRepoBuildInputs: [],
@@ -278,14 +273,9 @@ export async function resolveCustomerImages({ id, catalogue, lock, composed, sch
   return merged;
 }
 
-/** The kernel at --kernel must carry the contract the catalogue's offering was resolved under. */
-export async function assertKernelAtCatalogueAuthority(catalogue, schemas) {
-  await validateKernelContractAuthorityFromGit({ authority: catalogue.contractAuthority, schemas, requireHeadMatch: false });
-}
-
 /**
  * The distribution and authorization locks of the customer edition `rawDefinition`
- * against `catalogue`. `catalogueDigest` is the digest of `catalogue`, written into the lock. `verifyAuthority` and `materialize` are injectable for the test suites.
+ * against `catalogue`. `catalogueDigest` is the digest of `catalogue`, written into the lock. `adoptKernel` (the catalogue's kernel from npm, proved its contract authority; returns the kernel schemas) and `materialize` are injectable for the test suites.
  */
 export async function resolveCustomerDistribution({
   rawDefinition,
@@ -294,14 +284,18 @@ export async function resolveCustomerDistribution({
   sourceImages,
   pins,
   materialize,
-  verifyAuthority = assertKernelAtCatalogueAuthority,
+  adoptKernel = adoptCatalogueKernel,
+  fetchManifest = fetchRegistryManifest,
 }) {
   if (catalogueDigest === undefined) {throw new CatalogueError('a customer resolve names the digest of its catalogue');}
-  const schemas = await loadKernelDistributionSchemas();
+  const schemas = await adoptKernel(catalogue);
   const { definition, mirror } = parseCustomerDefinition(schemas, rawDefinition);
   const composed = composeCustomerEdition({ schemas, definition, mirror, catalogue, sourceImages, pins });
   const id = composed.leaf.id;
-  const inputs = { composed, biomeIndex: catalogue.biomes, platformServiceIndex: { schemaVersion: 1, services: catalogue.platformServices } };
+  // `sourcesAvailable: false`: a customer machine holds no vendor source checkouts, so the platform
+  // services' ownership cannot be re-derived here. It is verified where the catalogue is produced
+  // (`buildCatalogue`), and the catalogue is digest-pinned.
+  const inputs = { composed, biomeIndex: catalogue.biomes, platformServiceIndex: { schemaVersion: 1, services: catalogue.platformServices }, sourcesAvailable: false };
   let resolved;
   try {
     resolved = await resolveDistributionWithIndex(id, { inputs, ...(materialize === undefined ? {} : { materialize }) });
@@ -312,9 +306,14 @@ export async function resolveCustomerDistribution({
     throw error;
   }
   const { lock, index } = resolved;
-  assertTrustCeilingAssignsCustomerBiomes(schemas, definition, lock.biomes.filter((biome) => biome.source !== undefined).map((biome) => biome.id));
-  assertWithinCatalogueCeiling({ catalogue, definition, lock, schemas });
-  await verifyAuthority(catalogue, schemas);
+  assertTrustCeilingAssignsCustomerBiomes(
+    schemas,
+    definition,
+    lock.biomes.filter((biome) => biome.source !== undefined).map((biome) => biome.id),
+    catalogueCeiling(catalogue, schemas).trustCeiling ?? NO_CATALOGUE_TRUST_CEILING,
+  );
+  assertLockWithinCatalogueCeiling({ catalogue, definition, lock, schemas });
+  await assertAdapterBundlesMatchHost({ lock, hostRow: adapterHostRow(catalogue.biomes), fetchManifest });
   const authorizationLock = await composeAuthorizationBase(id, lock, index);
   // A customer lock names the catalogue it was resolved against; seal and verify refuse any other.
   return { id, schemas, composed, inputs, lock: { ...lock, catalogueDigest }, authorizationLock };

package/edition/resolve-distribution.mjs

@@ -63,6 +63,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
 import {
   adoptedFromLock,
   editionAuthorizationModuleInputs,
@@ -73,6 +74,7 @@ import {
   sealEditionAuthorizationBase,
   writeAuthorizationLock,
 } from './authorization-base.mjs';
+import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
 import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir, platformServiceIndexPath } from './edition-workspace.mjs';
@@ -91,7 +93,12 @@ import {
   validateImmutableDistributionLock,
   validateServiceDependencyOwnerParity,
 } from './lib.mjs';
+import {
+  assertOperationGrantsAdmitted,
+  assertOrganizationSweepsAdmitted,
+} from './operation-grant-admission.mjs';
 import { PUBLISHED_PIN_SOURCE, pinnedSource } from './pin-source.mjs';
+import { verifiedPlatformServiceIndex } from './platform-service-ownership.mjs';
 import { closureBiomeFacts } from './positive-closure.mjs';
 import { assertReleaseContent, assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { commandFor } from './remedy-command.mjs';
@@ -1744,6 +1751,13 @@ export function resolveDistributionFromInputs(
   // shipped provider. See `nexusBinder`.
   const nexusBindings = nexusBinder(id, [...selected.values()], schemas);
 
+  // (5d) Dispatched runtime components — every `runtime-image` edge of a
+  // shipped biome must resolve to a runtime component of a biome in the index.
+  // The target biome is not rostered (it enters no `biomes[]`, `requires` or
+  // install set); the image plane adds its image row. Resolved here so an
+  // unresolvable edge refuses the edition, not only its image lock.
+  resolveDispatchedRuntimeComponents(`distribution "${id}"`, [...selected.values()], index);
+
   // (6) Build the lock — sort by (tier order, id, target, repo).
   const biomes = [...selected.values()]
     .map((e) => ({
@@ -1821,7 +1835,7 @@ export function resolveDistributionFromInputs(
       // starts. Optional-in-the-new-schema and absent-from-the-old are different
       // facts, and only the second one governs a deployed image.
       //
-      // MEASURED 2026-09-17. Emitting it took presenca-dev's three
+      // MEASURED 2026-09-17. Emitting it took a customer environment's three
       // distribution-lock consumers — biome-host-api, capability-registry-api,
       // xema-capability-router — into CrashLoopBackOff on a sealed, signed,
       // platform-verified edition. The seal was green; the lock was unparseable
@@ -1839,7 +1853,7 @@ export function resolveDistributionFromInputs(
       // somebody raised the pin. Re-measured against the refs, not the comment:
       //   xema-base origin/main    `'@xemahq/contracts': ^0.15.0`
       //   xema-base origin/develop `'@xemahq/contracts': ^0.16.0`
-      //   xema-base 2ef54a1 (the `sourceCommit` presenca-dev's images.lock.json
+      //   xema-base 2ef54a1 (the `sourceCommit` a customer environment's images.lock.json
       //     names) resolves `@xemahq/contracts@0.15.0`, sole resolution.
       // and against the published tarballs, two-sided, `npm pack` + grep:
       //   0.9.2 -> 0 files name this key; 0.12.0 / 0.15.0 / 0.17.0 -> 2 each.
@@ -1847,7 +1861,7 @@ export function resolveDistributionFromInputs(
       // past the deletion condition this comment states below.
       //
       // WHAT ACTUALLY BLOCKS IT IS THE ROLLOUT, and a pin is not a rollout.
-      // Measured 2026-09-19 inside the running containers in `presenca-dev`:
+      // Measured 2026-09-19 inside the running containers in `a customer environment`:
       //   `cat /app/node_modules/@xemahq/contracts/package.json` -> "0.9.2",
       //   one resolution each (`ls -d /app/node_modules/.pnpm/@xemahq+contracts@*`),
       //   and `dist/distribution/lib/distribution-lock.js` carries `.strict()`
@@ -1856,7 +1870,7 @@ export function resolveDistributionFromInputs(
       //   POSITIVE CONTROL, same tree, same probe: `grep -rl distribution` -> 64.
       //   So the zero is an absence, not a broken probe.
       // And the three running digests are NOT the digests
-      // `deployments/presenca-dev/images.lock.json` designates — the cluster is
+      // `deployments/<customer>-dev/images.lock.json` designates — the cluster is
       // roughly one build behind its own lock, which is why a pin raised on the
       // branch has not reached the parser.
       //
@@ -1874,7 +1888,7 @@ export function resolveDistributionFromInputs(
       // answers this. For each of biome-host-api, capability-registry-api and
       // xema-capability-router:
       //
-      //   kubectl -n presenca-dev exec deploy/<svc> -- \
+      //   kubectl -n <customer>-dev exec deploy/<svc> -- \
       //     cat /app/node_modules/@xemahq/contracts/package.json
       //
       // must report >= 0.12.0 for ALL THREE. When it does, in ONE change:
@@ -1883,7 +1897,7 @@ export function resolveDistributionFromInputs(
       //      the withholding and will correctly go red;
       //   3. re-seal the affected locks;
       //   4. delete the `postgres.extensions` BRIDGE blocks from
-      //      `deployments/presenca-dev/secret-inputs.yaml` and
+      //      `deployments/<customer>-dev/secret-inputs.yaml` and
       //      `deployments/owl-xema-prod/secret-inputs.yaml` in xema-deploy —
       //      the deploy plane REFUSES that bridge by name the moment any biome
       //      in the lock carries this key, so 3 and 4 cannot be separated.
@@ -1999,6 +2013,20 @@ export function resolveDistributionFromInputs(
       // throws), so an entry without the key is one whose manifest declares
       // no such worker.
       workerImages: e.workerImages ?? {},
+      // The service-to-service operations each workload component requires,
+      // forwarded verbatim from the index (already sorted and non-empty). The
+      // seal admits them (`admitOperationGrants`). Omitted when none, so an
+      // edition declaring none is byte-identical.
+      ...(e.operationRequirements !== undefined &&
+      Object.keys(e.operationRequirements).length > 0
+        ? { operationRequirements: e.operationRequirements }
+        : {}),
+      // The organization sweeps each workload component may hold, forwarded
+      // verbatim; the seal admits them (`admitOrganizationSweeps`).
+      ...(e.organizationSweepRequirements !== undefined &&
+      Object.keys(e.organizationSweepRequirements).length > 0
+        ? { organizationSweepRequirements: e.organizationSweepRequirements }
+        : {}),
       // --- Catalog projection (consumed by biome-host's DistributionCatalogSource) ---
       // Forwarded verbatim from the index so the lock is the SELF-CONTAINED
       // single source of truth for the biome catalog: biome-host builds the
@@ -2068,7 +2096,15 @@ export function resolveDistributionFromInputs(
       // widening it. That refusal is the right posture and this is the right
       // side of it.
       const { installationClass: _installationClass, ...locked } = service;
-      return { ...locked, source };
+      return {
+        ...locked,
+        // Copied verbatim from the index entry (sorted, unique, non-empty by
+        // its schema); the grant admission reads it from the lock.
+        ...(source.ownsCapabilityDomains === undefined
+          ? {}
+          : { ownsCapabilityDomains: source.ownsCapabilityDomains }),
+        source,
+      };
     })
     .sort((a, b) => {
       const ta = TIER_WITH_EDGE.indexOf(a.tier);
@@ -2148,7 +2184,11 @@ export function resolveDistributionFromInputs(
   schemas.resolveFirstPartyCapabilityDomains(lock);
 
   // (8) Validate against the BUILT kernel schema — fail-fast.
-  schemas.parseUnsealedDistributionLock(lock);
+  const parsed = schemas.parseUnsealedDistributionLock(lock);
+  // (9) Admit every declared service-to-service operation requirement; a
+  //     refusal throws, so a lock with one is never returned to be written.
+  assertOperationGrantsAdmitted(schemas, parsed);
+  assertOrganizationSweepsAdmitted(schemas, parsed);
   return validateImmutableDistributionLock(lock);
 }
 
@@ -2175,22 +2215,33 @@ export async function resolveDistribution(id) {
  * `materialize` is the walk's one network seam, injectable for the contract
  * suite exactly as it is on `walkDeclaredSources`.
  */
-export async function resolveDistributionWithIndex(id, { materialize, inputs } = {}) {
+export async function resolveDistributionWithIndex(id, { materialize, inputs, readManifest } = {}) {
   const schemas = await loadKernelDistributionSchemas();
+  // The manifest is composed FIRST, because it is what declares the sources and
+  // what refuses a malformed definition before any other work. The walk then
+  // runs once per resolve and its entries are merged into a per-resolution
+  // index — never into `biome-index.json`, which is the platform's and is read
+  // by every edition.
+  const composed = inputs?.composed ?? composeEdition(schemas.parseDistribution, id);
   // THE RELEASE READS THESE FROM DISK; A DEVELOP SNAPSHOT INJECTS THEM
   // (`develop-snapshot-inputs.mjs`). Either way they pass through the one
   // validation below, so there is a single resolve path and two sources.
-  const platformServiceIndex =
+  const claimedPlatformServiceIndex =
     inputs?.platformServiceIndex ?? readPlatformServiceIndex(schemas.parsePlatformServiceSourceIndex);
+  // OWNERSHIP IS THE SERVICE'S OWN STATEMENT: each entry's capability domains
+  // are re-derived from its pinned source manifest (hash-verified), so a
+  // hand-edited index cannot move where grants land. Only the customer resolve
+  // sets `sourcesAvailable: false` -- it has no vendor checkouts and trusts the
+  // signed catalogue, which `buildCatalogue` verified where it was produced.
+  // Any other caller without the sources is refused, never skipped.
+  const platformServiceIndex =
+    inputs?.sourcesAvailable === false
+      ? claimedPlatformServiceIndex
+      : verifiedPlatformServiceIndex(claimedPlatformServiceIndex, { readManifest });
   const platformIndex = validateServiceDependencyOwnerParity(
     validateImmutableBiomeIndex(inputs?.biomeIndex ?? readBiomeIndex()),
     platformServiceIndex,
   );
-  // The manifest is composed FIRST, because it is what declares the sources. The
-  // walk then runs once per resolve and its entries are merged into a
-  // per-resolution index — never into `biome-index.json`, which is the
-  // platform's and is read by every edition.
-  const composed = inputs?.composed ?? composeEdition(schemas.parseDistribution, id);
   const { entries, sourceRecords } = await walkDeclaredSources({
     sources: composed.declaredSources,
     ...(materialize === undefined ? {} : { materialize }),
@@ -2212,8 +2263,9 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs } =
  * this exact writer so an in-process refresh cannot drift from the standalone
  * command's serialization or diagnostics.
  */
-export async function writeResolvedDistribution(id, { log = true, materialize } = {}) {
+export async function writeResolvedDistribution(id, { log = true, materialize, fetchManifest = fetchRegistryManifest } = {}) {
   const { lock, index } = await resolveDistributionWithIndex(id, { materialize });
+  await assertAdapterBundlesMatchHost({ lock, hostRow: adapterHostRow(index), fetchManifest });
   const outPath = join(editionsRoot(), id, 'distribution.lock.json');
   assertReleaseContent(lock, `the distribution lock for "${id}"`);
   assertReleaseEditionTree(join(editionsRoot(), id));
@@ -2285,12 +2337,14 @@ export async function composeAuthorizationBase(id, lock, index) {
   const kernel = await loadKernelAuthorizationComposer({ kernelPackageDir: kernelPackageDir() });
   // Refuses an edition that carries a module under a pin with no composer.
   const inputs = editionAuthorizationModuleInputs(lock.biomes, new Map(index.map((e) => [e.id, e])), kernel);
+  const { biomeOriginsOfLock } = await loadKernelDistributionSchemas();
   let sealed = null;
   if (kernel !== null) {
     sealed = sealEditionAuthorizationBase({
       distributionId: id,
       inputs,
       kernel,
+      biomeOrigins: biomeOriginsOfLock(lock),
       adopted: adoptedFromLock(readAuthorizationLock(editionDir)),
       runTests: fgaComposedModelTestRunner(resolveFgaCli()),
     });

package/edition/resolve-edition.mjs

@@ -50,14 +50,15 @@ import { withoutSealedDigests } from './seal-image-digests.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 
 // A customer resolve (`--definition`) has no vendor editions root: `--out` IS its
-// editions root, the directory its `<id>/` locks are written under.
+// editions root, the directory its `<id>/` locks are written under. It takes no kernel root:
+// the kernel is the catalogue's, downloaded from npm into the cache root.
 if (isEntryModule(import.meta.url)) {
   if (process.argv.includes(DEFINITION_FLAG)) {
     const at = process.argv.indexOf('--out');
     if (at < 0 || process.argv[at + 1] === undefined) {throw new Error(`--out <dir> is required with ${DEFINITION_FLAG}`);}
     mkdirSync(process.argv[at + 1], { recursive: true });
     process.argv.splice(at, 1, '--editions-root');
-    configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel, WorkspaceRoot.Cache], { refuseOthers: true });
+    configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Cache], { refuseOthers: true });
   } else {
     configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel, WorkspaceRoot.Cache]);
   }