@xemahq/xema 0.33.6 → 0.34.1

package/edition/README.md

@@ -95,7 +95,7 @@ The edition library builds, validates and verifies evidence statements; it never
 
 ## Kernel protocol and pins
 
-The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports exactly protocol v5 and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
+The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports exactly protocol v8 (a data root whose pinned kernel speaks v5 stays on CLI 0.33.x) and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
 
 - `xema edition evidence statement entitlement stage` writes entitlement predicate v2 (`lockDigest`, `catalogueDigest`, read from the edition's committed locks), so it takes `--editions-root` besides `--data-root` and `--kernel`.
 - The runtime image source index is v2 and carries operator-stated `producerWorkflowPins` (the workflow commit a producer certificate must be signed from, per repository). `xema edition index runtime-image-source [--producer-workflow-pin <owner/repo>=<40-hex>]...` preserves the committed pins exactly; each flag sets one repository's pin (repeatable; a repeated or non-GitHub `owner/repo` is refused; only `--trusted-write` writes an index, so the flag with any other mode, `--check-sources` included, is refused); a bootstrap index with none writes `[]`. A v1 index is refused, never migrated: delete it and bootstrap a new one with `--kernel-commit`.
@@ -125,7 +125,7 @@ A held commit is authorized, never trusted, and nothing overrides it: the commit
 
 ## Customer editions
 
-A customer edition is resolved against a catalogue pinned in `catalogue.pin.json` beside the definition file. The catalogue is the ceiling: it supplies availability, pins and digests and never adds a component. It also names the kernel: `kernel` is `{name, version, integrity}` (`@xemahq/contracts`, an exact `x.y.z`, the npm `sha512-` integrity of that tarball), and a catalogue without it is refused.
+A customer edition is resolved against a catalogue pinned in `catalogue.pin.json` beside the definition file. The catalogue is the ceiling: it supplies availability, pins and digests and never adds a component. It also names the kernel: `kernel` is `{name, version, integrity}` (`@xemahq/contracts`, an exact `x.y.z`, the npm `sha512-` integrity of that tarball), and a catalogue without it is refused. Its `ceiling.storePublisherTrust` is the offering lock's Store publishers (or `null`); a definition selects among them with `storePublisherAnchorKeys`, the resolve copies the selected entries into the customer lock, and the kernel's `customerLockCeilingIssues` refuses, at resolve, seal and verify, an entry the definition does not select, a key the catalogue does not vouch for, or an entry that differs from the catalogue's.
 
 ```bash
 xema edition resolve --definition <file> --channel <release|develop> \

package/edition/biome-content.mjs

@@ -19,6 +19,7 @@
 import { execFileSync } from 'node:child_process';
 import { relative, sep } from 'node:path';
 
+import { assertCustomerLockWithinCatalogueCeiling } from './catalogue.mjs';
 import { readGitJsonAtCommit } from './lib.mjs';
 import {
   assertOperationGrantsAdmitted,
@@ -191,7 +192,7 @@ async function catalogueFacts({ schemas, biome, imageLock, catalogue }) {
  * the catalogue supplied. A lock without `catalogueDigest`, or with another one, was not
  * resolved against this catalogue, so its hashes cannot be checked on this catalogue's authority.
  */
-function assertLockNamesCatalogue({ lock, catalogue, catalogueDigest }) {
+function assertLockNamesCatalogue({ schemas, lock, catalogue, catalogueDigest, storePublisherAnchorKeys }) {
   if (catalogueDigest === undefined) {
     throw new BiomeContentHashError(`customer mode needs the digest of catalogue "${catalogue.offeringId}"`);
   }
@@ -205,6 +206,8 @@ function assertLockNamesCatalogue({ lock, catalogue, catalogueDigest }) {
       `distribution "${lock.distributionId}": the lock was resolved against catalogue ${lock.catalogueDigest}, not the supplied ${catalogueDigest}`,
     );
   }
+  // The lock is within the catalogue's ceiling: the kernel's one check, its Store publishers against the definition's selection.
+  assertCustomerLockWithinCatalogueCeiling({ schemas, catalogue, lock, storePublisherAnchorKeys });
 }
 
 /**
@@ -218,10 +221,11 @@ function assertLockNamesCatalogue({ lock, catalogue, catalogueDigest }) {
  * @param {(repo: string) => string} request.vendoredCommit the vendored-source pin of a first-party repo
  * @param {object} [request.catalogue] customer mode: the digest-pinned catalogue vendor biomes are taken from
  * @param {string} [request.catalogueDigest] customer mode: the digest of that catalogue; the lock must carry the same one
+ * @param {readonly string[]} [request.storePublisherAnchorKeys] customer mode: the definition's Store publisher selection (absent = none)
  * @returns {Promise<Map<string, string>>} biome id -> BiomeContentHash
  */
-export async function computeBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest }) {
-  if (catalogue !== undefined) {assertLockNamesCatalogue({ lock, catalogue, catalogueDigest });}
+export async function computeBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys }) {
+  if (catalogue !== undefined) {assertLockNamesCatalogue({ schemas, lock, catalogue, catalogueDigest, storePublisherAnchorKeys });}
   const hashes = new Map();
   for (const biome of lock.biomes) {
     const facts =
@@ -248,8 +252,8 @@ export async function biomeSourceTreeIds({ schemas, lock, imageLock, locate, ven
 }
 
 /** Seal: the unsealed lock + the recomputed hashes -> the kernel's `sealDistributionLock`. */
-export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest }) {
-  const hashes = await computeBiomeContentHashes({ schemas, lock: unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest });
+export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys }) {
+  const hashes = await computeBiomeContentHashes({ schemas, lock: unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys });
   assertOperationGrantsAdmitted(schemas, unsealed);
   assertOrganizationSweepsAdmitted(schemas, unsealed);
   return schemas.sealDistributionLock(unsealed, hashes);
@@ -259,8 +263,8 @@ export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredC
  * Verify: recompute every biome's hash and REFUSE a mismatch, naming the biome.
  * The lock's own field is never trusted; a missing or extra biome is a mismatch.
  */
-export async function verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest }) {
-  const expected = await computeBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest });
+export async function verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys }) {
+  const expected = await computeBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys });
   const mismatched = lock.biomes
     .filter((biome) => biome.biomeContentHash !== expected.get(biome.id))
     .map((biome) => `${biome.id} (lock ${String(biome.biomeContentHash)}, recomputed ${expected.get(biome.id)})`);

package/edition/catalogue-edition.mjs

@@ -24,11 +24,11 @@ if (isEntryModule(import.meta.url)) {
   configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
 }
 
-/** `{ id, out }` of `catalogue <distribution-id> --out <dir>`; anything else is the usage error. */
+/** `{ id, out }` of `<distribution-id> --out <dir>` (the argv AFTER the `catalogue` verb, which the edition dispatcher has already stripped); anything else is the usage error. */
 export function parseCatalogueArgs(argv) {
-  const [command, id, flag, out, ...extra] = argv;
-  if (command !== 'catalogue' || id === undefined || flag !== '--out' || out === undefined || out.startsWith('--') || extra.length > 0) {
-    throw new Error('usage: catalogue <distribution-id> --out <dir>');
+  const [id, flag, out, ...extra] = argv;
+  if (id === undefined || flag !== '--out' || out === undefined || out.startsWith('--') || extra.length > 0) {
+    throw new Error('usage: xema edition catalogue <distribution-id> --out <dir>');
   }
   assertCanonicalDistributionId(id);
   return { id, out };

package/edition/catalogue.mjs

@@ -17,11 +17,13 @@ import { serializeJson } from './lib.mjs';
 import { verifiedPlatformServiceIndex } from './platform-service-ownership.mjs';
 
 export const CATALOGUE_FILE = EDITION_OFFERING_LAYERS.catalogue;
-export const CATALOGUE_SCHEMA = 'xema.edition-catalogue/v1';
+// v2 (edition protocol v8): `ceiling.storePublisherTrust`, the Store publishers the offering
+// vouches for, from which a customer definition selects (`storePublisherAnchorKeys`).
+export const CATALOGUE_SCHEMA = 'xema.edition-catalogue/v2';
 
 const TOP_KEYS = ['schema', 'offeringId', 'channel', 'biomes', 'sourceTreeIds', 'platformServices', 'images', 'chartSet', 'contractAuthority', 'kernel', 'ceiling'];
 const IMAGES_KEYS = ['sourceHashAlgorithm', 'subjects', 'platformServiceBindings', 'webBiomes'];
-const CEILING_KEYS = ['trustPolicy', 'trustCeiling'];
+const CEILING_KEYS = ['trustPolicy', 'trustCeiling', 'storePublisherTrust'];
 const KERNEL_KEYS = ['name', 'version', 'integrity'];
 const KERNEL_PACKAGE = '@xemahq/contracts';
 const EXACT_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -140,8 +142,76 @@ export function buildCatalogue({
     chartSet: chartSetLock,
     contractAuthority,
     kernel,
-    ceiling: { trustPolicy: leaf?.trustPolicy ?? null, trustCeiling: leaf?.trustCeiling ?? null },
+    ceiling: {
+      trustPolicy: leaf?.trustPolicy ?? null,
+      trustCeiling: leaf?.trustCeiling ?? null,
+      // The Store publishers the offering's lock vouches for: a customer edition copies only those it selects.
+      storePublisherTrust: distributionLock.storePublisherTrust ?? null,
+    },
+  });
+}
+
+/** A customer lock outside its catalogue's ceiling, or a selection or dependency the catalogue does not offer. */
+export class CatalogueCeilingError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'CatalogueCeilingError';
+  }
+}
+
+/**
+ * The catalogue's declared ceiling, read by the kernel's grammars: `trustPolicy` is the offering's
+ * origin allow list, `trustCeiling` its trust-domain assignments, `storePublisherTrust` the Store
+ * publishers the offering vouches for (each a kernel `LockedStorePublisher`). `null` states none.
+ */
+export function catalogueCeiling(catalogue, schemas) {
+  const read = (key, schema) => {
+    const value = catalogue.ceiling[key];
+    if (value === null) {return undefined;}
+    const parsed = schema.safeParse(value);
+    if (!parsed.success) {
+      throw new CatalogueError(
+        `${CATALOGUE_FILE}: ceiling.${key} of "${catalogue.offeringId}" is not the kernel's shape: ` +
+          parsed.error.issues.map((issue) => `[${issue.path.join('.')}] ${issue.message}`).join('; '),
+      );
+    }
+    return parsed.data;
+  };
+  return {
+    trustPolicy: read('trustPolicy', schemas.DistributionTrustPolicySchema),
+    trustCeiling: read('trustCeiling', schemas.ProcessTrustPolicySchema),
+    storePublisherTrust: read('storePublisherTrust', schemas.LockedStorePublisherSchema.array()),
+  };
+}
+
+/**
+ * The Store publishers a customer lock carries: the entries of the catalogue's parsed ceiling
+ * (`catalogueCeiling(...).storePublisherTrust`) whose anchorKey the definition selects
+ * (`storePublisherAnchorKeys`), copied as they are. No selection, or none of it offered, is no
+ * field; a key the catalogue does not vouch for is refused by the kernel's ceiling check, not here.
+ */
+export function selectedStorePublisherTrust(base, storePublisherAnchorKeys) {
+  if (storePublisherAnchorKeys === undefined) {return undefined;}
+  const selected = new Set(storePublisherAnchorKeys);
+  const rows = (base ?? []).filter((row) => selected.has(row.anchorKey));
+  return rows.length > 0 ? rows : undefined;
+}
+
+/**
+ * The kernel's `customerLockCeilingIssues` is the one check of a customer lock against its catalogue:
+ * the biomes' trust ceilings, and the Store publishers (base = the catalogue's, selected = the
+ * definition's `storePublisherAnchorKeys`, customer = the lock's).
+ */
+export function assertCustomerLockWithinCatalogueCeiling({ schemas, catalogue, lock, storePublisherAnchorKeys }) {
+  const ceiling = catalogueCeiling(catalogue, schemas);
+  const issues = schemas.customerLockCeilingIssues(ceiling.trustCeiling, lock.biomes, {
+    base: ceiling.storePublisherTrust,
+    selected: storePublisherAnchorKeys,
+    customer: lock.storePublisherTrust,
   });
+  if (issues.length > 0) {
+    throw new CatalogueCeilingError(`catalogue "${catalogue.offeringId}" (${catalogue.channel}): "${lock.distributionId}" is outside the catalogue's ceiling: ${issues.join('; ')}`);
+  }
 }
 
 /** Write `catalogue.json` into an artifact directory (deterministic serialization); returns its path. */

package/edition/develop-customer-edition.mjs

@@ -98,6 +98,7 @@ export async function resolveCustomerDevelopEdition({ rawDefinition, catalogue,
     },
     catalogue,
     catalogueDigest,
+    storePublisherAnchorKeys: resolved.storePublisherAnchorKeys,
   });
   return { ...resolved, distributionLock, pins: frozen };
 }

package/edition/edition-pinned-inputs.mjs

@@ -16,7 +16,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 
-import { assertEditionPinsAuthorized, effectiveRepositoryPins, EditionSourcePinsError, readEditionSourcePins } from './edition-source-pins.mjs';
+import { assertEditionPinsAuthorized, effectiveRepositoryPins, EditionSourcePinsError, readKernelEditionSourcePins } from './edition-source-pins.mjs';
 import { biomeIndexPath, dataRoot, editionsRoot, platformServiceIndexPath, runtimeImageSourceIndexPath, sourcesRoot } from './edition-workspace.mjs';
 import { buildIndexesAtPins } from './indexes-at-pins.mjs';
 import { commandFor } from './remedy-command.mjs';
@@ -102,7 +102,7 @@ function committedInputs({ schemas, sourcePins }) {
  * pins and committed runtime index, so one process pays the rebuild once.
  */
 export async function editionPinnedInputs(id, { schemas }) {
-  const sourcePins = readEditionSourcePins(id);
+  const sourcePins = readKernelEditionSourcePins(id, schemas.parseDistribution);
   if (sourcePins.length === 0) {return committedInputs({ schemas, sourcePins });}
   const indexText = readFileSync(runtimeImageSourceIndexPath(), 'utf8');
   const committed = schemas.parseRuntimeImageSourceIndex(readStrictJsonFile(runtimeImageSourceIndexPath()));

package/edition/edition-protocol.mjs

@@ -31,8 +31,8 @@ import { readBoundedNoFollowFile } from './no-follow-file.mjs';
 /** The edition protocols this library interprets: version -> content digest. */
 export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
   Object.freeze({
-    version: 5,
-    contentDigest: '326d8b62ba87073fa91cf726eb596f9371904f056db688729d8800cc94c2d646',
+    version: 8,
+    contentDigest: '5f878e9eaa2cd0ab39b645e4a67259b1e39383e4931e9849c4cc746f7ae43047',
   }),
 ]);
 

package/edition/edition-source-pins.mjs

@@ -8,11 +8,12 @@
 // `until` states the condition under which the hold ends. Entries are sparse:
 // one exists only for a repository the edition holds back, so an entry equal to
 // the shared pin is refused (it is not a hold). `xema edition pin|unpin` are the
-// only supported way to change them. It is a
-// CLI key, not a kernel one: the kernel's `parseDistribution` is strict, so the
-// key is REMOVED before the kernel parse (the precedent is a customer
-// definition's `imageRegistryMirror`, customer-definition.mjs), by the one
-// splitter below. Every reader of an edition definition goes through it.
+// only supported way to change them. The kernel's Distribution schema models and
+// validates the key (`DistributionSourcePinsSchema`), so the definition reaches
+// `parseDistribution` unchanged and a reader that parses with the kernel takes
+// `sourcePins` from the parsed manifest (`readKernelEditionSourcePins`).
+// `parseEditionSourcePins` remains for the one reader that runs before any kernel
+// exists (the source checkout plan, `readEditionSourcePins`) and for the pin verbs.
 //
 // `effectiveRepositoryPins` is the ONLY computation of an edition's pins: the
 // committed pins untouched (the same array) when the edition holds nothing,
@@ -87,26 +88,27 @@ export function parseEditionSourcePins(raw, id) {
   });
 }
 
-/**
- * Split a raw edition definition into the document the kernel parses (without
- * the CLI key) and the parsed `sourcePins`. A value that is not an object is
- * returned as it is for the kernel to refuse.
- */
-export function splitEditionDefinition(raw, id) {
-  if (raw === null || typeof raw !== 'object' || Array.isArray(raw) || !Object.hasOwn(raw, SOURCE_PINS_KEY)) {
-    return { document: raw, sourcePins: [] };
-  }
-  const { [SOURCE_PINS_KEY]: declared, ...document } = raw;
-  return { document, sourcePins: parseEditionSourcePins(declared, id) };
-}
-
-/** The `sourcePins` of edition `id`, read from the configured editions root. */
-export function readEditionSourcePins(id) {
+/** The raw definition of edition `id` in the configured editions root. */
+function readEditionDefinition(id) {
   const path = join(editionsRoot(), id, 'xema-distribution.json');
   if (!existsSync(path)) {
     throw new Error(`distribution "${id}" not found: ${path} does not exist`);
   }
-  return splitEditionDefinition(readStrictJsonFile(path), id).sourcePins;
+  return readStrictJsonFile(path);
+}
+
+/** The `sourcePins` of a kernel-parsed Distribution manifest; absent is none. */
+export const manifestSourcePins = (manifest) => manifest.sourcePins ?? [];
+
+/** The `sourcePins` of edition `id`, parsed by the kernel's `parseDistribution` (the one validator). */
+export function readKernelEditionSourcePins(id, parseDistribution) {
+  return manifestSourcePins(parseDistribution(readEditionDefinition(id)));
+}
+
+/** The `sourcePins` of edition `id` where no kernel is loaded yet (the source checkout plan). */
+export function readEditionSourcePins(id) {
+  const raw = readEditionDefinition(id);
+  return raw !== null && typeof raw === 'object' && !Array.isArray(raw) ? parseEditionSourcePins(raw[SOURCE_PINS_KEY], id) : [];
 }
 
 /** A repository URL without a trailing `.git`, so the two forms a pin may carry compare equal. */

package/edition/edition-workspace.mjs

@@ -108,6 +108,7 @@ export const kernelDistPath = (...segments) =>
   join(kernelPackageDir(), 'dist', ...segments);
 
 export const biomeIndexPath = () => join(dataRoot(), 'biome-index.json');
+export const storePublisherIdentitiesPath = () => join(dataRoot(), 'store-publisher-identities.json');
 export const platformServiceIndexPath = () =>
   join(dataRoot(), 'platform-service-index.json');
 export const runtimeImageSourceIndexPath = () =>

package/edition/image-evidence.mjs

@@ -18,7 +18,7 @@ import {
 import { TextDecoder } from 'node:util';
 
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
-import { effectiveRepositoryPins, splitEditionDefinition } from './edition-source-pins.mjs';
+import { effectiveRepositoryPins, manifestSourcePins } from './edition-source-pins.mjs';
 import { SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
 import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
 import {
@@ -40,6 +40,8 @@ const MAX_CANONICAL_JSON_BYTES = 2 * 1024 * 1024;
 const MAX_STATEMENT_BYTES = 2 * 1024 * 1024;
 const MAX_SIGSTORE_BUNDLE_BYTES = 16 * 1024 * 1024;
 const MAX_TRUSTED_ROOT_BYTES = 8 * 1024 * 1024;
+/** The kernel's `SignerKind.OidcCertificate`: the one signer kind this verifier runs (cosign keyless). */
+const OIDC_CERTIFICATE_SIGNER = 'oidc-certificate';
 const COSIGN_ENV = Object.freeze({
   LANG: 'C',
   LC_ALL: 'C',
@@ -631,13 +633,21 @@ function assertEvidenceChannel(channel) {
  * certificate matching a row of that channel.
  */
 function policyCandidates(policy, predicateType, channel, imageRepository) {
-  return policy.policies.filter(
+  const candidates = policy.policies.filter(
     (candidate) =>
       candidate.channel === channel &&
       candidate.predicateTypes.includes(predicateType) &&
       (imageRepository === undefined ||
         candidate.imageRepositories?.includes(imageRepository) === true),
   );
+  // The kernel policy also admits `public-key` signers; this verifier runs cosign keyless only, so such a row is refused, never skipped.
+  const unsupported = candidates.find((candidate) => candidate.kind !== OIDC_CERTIFICATE_SIGNER);
+  if (unsupported !== undefined) {
+    throw new Error(
+      `policy row "${unsupported.policyId}" is a ${JSON.stringify(unsupported.kind)} signer; this CLI verifies ${OIDC_CERTIFICATE_SIGNER} signers only`,
+    );
+  }
+  return candidates;
 }
 
 function cosignVersion(cosignBinary) {
@@ -1317,19 +1327,18 @@ export async function loadValidatedImageLocks(
       'images.lock.json kernel contract authority does not exactly match runtime-image-source-index.json',
     );
   }
-  // The definition carries the CLI-owned `sourcePins` (the repositories this edition holds at an exact
-  // commit); the kernel parses the document without it. Each subject is graded against the EFFECTIVE pin
-  // of THIS edition. Pure: no git, no sources root (this runs inside the built verifier).
-  const { document, sourcePins } = splitEditionDefinition(
+  // The definition's `sourcePins` (the repositories this edition holds at an exact commit) is parsed by the
+  // kernel with the rest of it. Each subject is graded against the EFFECTIVE pin of THIS edition. Pure: no
+  // git, no sources root (this runs inside the built verifier).
+  const distribution = schemas.parseDistribution(
     JSON.parse(
       readFileSync(
         join(editionsRoot, distributionId, 'xema-distribution.json'),
         'utf8',
       ),
     ),
-    distributionId,
   );
-  const distribution = schemas.parseDistribution(document);
+  const sourcePins = manifestSourcePins(distribution);
   const repositoryPins = new Map(
     effectiveRepositoryPins(runtimeSourceIndex.repositoryPins, sourcePins, { id: distributionId, contractAuthority: runtimeSourceIndex.contractAuthority }).map((repository) => [
       repository.repo,

package/edition/lib.mjs

@@ -778,6 +778,7 @@ export async function loadKernelDistributionSchemas() {
     distributionImagesPredicateChannelRefusal,
     admitOperationGrants,
     admitOrganizationSweeps,
+    contractRequiredServiceTargets,
   } = mod;
   let topology;
   try {
@@ -789,7 +790,7 @@ export async function loadKernelDistributionSchemas() {
     );
   }
   const { deriveTrustCeiling, defaultTrustDomain, FIRST_PARTY_TRUST_DOMAIN, ProcessTrustPolicySchema } = topology;
-  const { DistributionTrustPolicySchema } = mod;
+  const { DistributionTrustPolicySchema, LockedStorePublisherSchema } = mod;
   if (
     typeof parseDistribution !== 'function' ||
     typeof parseDistributionLock !== 'function' ||
@@ -874,6 +875,7 @@ export async function loadKernelDistributionSchemas() {
     // the resolve refuse through it (`assertOperationGrantsAdmitted`).
     typeof admitOperationGrants !== 'function' ||
     typeof admitOrganizationSweeps !== 'function' ||
+    typeof contractRequiredServiceTargets !== 'function' ||
     typeof distributionImagesPredicateLockRefusal !== 'function' ||
     typeof distributionLockDigest !== 'function' ||
     typeof imageDeliveryEntitlementRefusal !== 'function' ||
@@ -884,7 +886,9 @@ export async function loadKernelDistributionSchemas() {
     typeof defaultTrustDomain !== 'function' ||
     typeof FIRST_PARTY_TRUST_DOMAIN !== 'string' ||
     typeof ProcessTrustPolicySchema?.safeParse !== 'function' ||
-    typeof DistributionTrustPolicySchema?.safeParse !== 'function'
+    typeof DistributionTrustPolicySchema?.safeParse !== 'function' ||
+    // One Store publisher entry of a lock: the grammar a catalogue's `ceiling.storePublisherTrust` is read by.
+    typeof LockedStorePublisherSchema?.array !== 'function'
   ) {
     throw new Error(
       `Built kernel distribution module at ${kernelDistributionDist()} does not export ` +
@@ -894,7 +898,7 @@ export async function loadKernelDistributionSchemas() {
         `kernel contract-authority digest SSOT/compareLockedServiceResources/resolveNexusBindings/describeNexusBindingRefusal/canonicalNexusFacts/` +
         `positive closure (resolveBiomeClosure/platformInvariantRoots/DistributionResolutionMode/provenance)/` +
         `deriveWorkflowSubjects/deriveTrustCeiling (>= 0.71.0)/admitOperationGrants/admitOrganizationSweeps/` +
-        `defaultTrustDomain/FIRST_PARTY_TRUST_DOMAIN/ProcessTrustPolicySchema/DistributionTrustPolicySchema/` +
+        `defaultTrustDomain/FIRST_PARTY_TRUST_DOMAIN/ProcessTrustPolicySchema/DistributionTrustPolicySchema/LockedStorePublisherSchema/` +
         `resolveFirstPartyCapabilityDomains/DistributionVisibility/` +
         `BiomeInstallPolicy/BiomeLaunchMode/ImageSourceHashAlgorithm/runtime-image enums — ` +
         `the dist is stale; rebuild kernel-contracts.`,
@@ -968,10 +972,12 @@ export async function loadKernelDistributionSchemas() {
     FIRST_PARTY_TRUST_DOMAIN,
     ProcessTrustPolicySchema,
     DistributionTrustPolicySchema,
+    LockedStorePublisherSchema,
     distributionLockDigest,
     distributionImagesPredicateChannelRefusal,
     admitOperationGrants,
     admitOrganizationSweeps,
+    contractRequiredServiceTargets,
     distributionImagesPredicateLockRefusal,
     imageDeliveryEntitlementRefusal,
     producerWorkflowPinRefusal,

package/edition/operation-grant-admission.mjs

@@ -25,16 +25,31 @@ export class OperationGrantAdmissionError extends Error {
   }
 }
 
+/**
+ * One informational line per optional operation the kernel left ungranted
+ * (`ungrantedOptional`): the edition is valid, the caller runs without it.
+ */
+export function ungrantedOptionalOperationLines(distributionId, ungrantedOptional) {
+  return ungrantedOptional.map(
+    ({ caller, operation, reason }) =>
+      `distribution "${distributionId}": optional operation ${operation} of ${caller.biome}/${caller.component} is not granted (${reason})`,
+  );
+}
+
 /**
  * Admit every operation requirement of `lock` through the kernel, or throw
  * {@link OperationGrantAdmissionError} listing every refusal. Returns the
- * admitted grants.
+ * admitted grants. `report`, when given, receives each line of
+ * {@link ungrantedOptionalOperationLines}; an ungranted optional operation never fails.
  */
-export function assertOperationGrantsAdmitted(schemas, lock) {
-  const { grants, refusals } = schemas.admitOperationGrants(lock);
+export function assertOperationGrantsAdmitted(schemas, lock, { report } = {}) {
+  const { grants, refusals, ungrantedOptional } = schemas.admitOperationGrants(lock);
   if (refusals.length > 0) {
     throw new OperationGrantAdmissionError(lock.distributionId, refusals);
   }
+  if (report !== undefined) {
+    for (const line of ungrantedOptionalOperationLines(lock.distributionId, ungrantedOptional)) {report(line);}
+  }
   return grants;
 }
 

package/edition/release-edition-artifact.mjs

@@ -2,7 +2,7 @@
 // release-edition-artifact — write the OCI artifact of a RELEASE edition from
 // the committed, sealed locks of the editions root.
 //
-//   artifact <id> --channel release --registry <root> --coordinate <tag>
+//   <id> --channel release --registry <root> --coordinate <tag>
 //            --engine-image <repository>@sha256:<digest> --out <dir> [--local]
 //
 // The artifact has the layout of every edition (edition-artifact.mjs): the
@@ -28,6 +28,7 @@ import { loadKernelDistributionSchemas, validateImmutableImageLock } from './lib
 import { releaseCatalogue } from './release-catalogue.mjs';
 import { assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
+import { readSealedDistributionLock } from './sealed-distribution-lock.mjs';
 import { createPinnedSourceAuthority } from './source-authority.mjs';
 
 if (isEntryModule(import.meta.url)) {
@@ -38,10 +39,9 @@ const VALUE_FLAGS = Object.freeze(['--channel', '--registry', '--coordinate', '-
 const REQUIRED_FLAGS = VALUE_FLAGS;
 const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 
-/** Parse `artifact <id> --flag value ...`; only the release channel is written by this verb. */
+/** Parse `<id> --flag value ...` (the argv AFTER the `artifact` verb, which the edition dispatcher has already stripped); only the release channel is written by this verb. */
 export function parseReleaseArtifactArgs(argv) {
-  const [command, ...rest] = argv;
-  if (command !== 'artifact') {throw new Error(`unknown command ${JSON.stringify(command)}; expected artifact`);}
+  const rest = argv;
   const options = {};
   const positional = [];
   for (let i = 0; i < rest.length; i += 1) {
@@ -100,17 +100,11 @@ export async function readCommittedEdition(id, root = editionsRoot()) {
   const schemas = await loadKernelDistributionSchemas();
   const imageLock = validateImmutableImageLock(schemas.parseImageLock(read(EditionLockFile.Images)), schemas);
   assertSealedImageLock(imageLock, join(dir, EditionLockFile.Images));
-  const distributionLock = read(EditionLockFile.Distribution);
-  let sealed;
-  try {
-    sealed = schemas.parseDistributionLock(distributionLock);
-  } catch (error) {
-    throw new Error(
-      `${join(dir, EditionLockFile.Distribution)} is not a sealed distribution lock, so nothing is published from it. ` +
-        `Run \`xema edition seal ${id}\` first. (${error.message})`,
-      { cause: error },
-    );
-  }
+  const { raw: distributionLock, sealed } = readSealedDistributionLock({
+    schemas,
+    lockPath: join(dir, EditionLockFile.Distribution),
+    distributionId: id,
+  });
   const authority = createPinnedSourceAuthority({ pins: (await editionPinnedInputs(id, { schemas })).repositoryPins });
   await verifyBiomeContentHashes({
     schemas,

package/edition/resolve-customer-edition.mjs

@@ -20,7 +20,13 @@ import { isDeepStrictEqual } from 'node:util';
 
 import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
 import { AUTHORIZATION_LOCK_FILENAME, writeAuthorizationLock } from './authorization-base.mjs';
-import { CATALOGUE_FILE, CatalogueError } from './catalogue.mjs';
+import {
+  assertCustomerLockWithinCatalogueCeiling,
+  CatalogueCeilingError,
+  CatalogueError,
+  catalogueCeiling,
+  selectedStorePublisherTrust,
+} from './catalogue.mjs';
 import {
   assertTrustCeilingAssignsCustomerBiomes,
   mirrorVendorSubjects,
@@ -36,45 +42,11 @@ import { pinnedSource, snapshotPinSource } from './pin-source.mjs';
 import { composeAuthorizationBase, composeManifest, resolveDistributionWithIndex, UnknownSelectionError } from './resolve-distribution.mjs';
 import { resolveImageRows } from './resolve-images.mjs';
 
-/** A selection or dependency the catalogue does not offer: the catalogue is the ceiling. */
-export class CatalogueCeilingError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'CatalogueCeilingError';
-  }
-}
-
-/**
- * The catalogue's declared ceiling, read by the kernel's two grammars: `trustPolicy` is the
- * offering's origin allow list, `trustCeiling` its trust-domain assignments. `null` states none.
- */
-function catalogueCeiling(catalogue, schemas) {
-  const read = (key, schema) => {
-    const value = catalogue.ceiling[key];
-    if (value === null) {return undefined;}
-    const parsed = schema.safeParse(value);
-    if (!parsed.success) {
-      throw new CatalogueError(
-        `${CATALOGUE_FILE}: ceiling.${key} of "${catalogue.offeringId}" is not the kernel's shape: ` +
-          parsed.error.issues.map((issue) => `[${issue.path.join('.')}] ${issue.message}`).join('; '),
-      );
-    }
-    return parsed.data;
-  };
-  return { trustPolicy: read('trustPolicy', schemas.DistributionTrustPolicySchema), trustCeiling: read('trustCeiling', schemas.ProcessTrustPolicySchema) };
-}
+export { CatalogueCeilingError };
 
 /** A catalogue whose ceiling states no trust-domain assignments reserves no domain: the kernel's required ceiling argument is the empty policy. */
 const NO_CATALOGUE_TRUST_CEILING = Object.freeze({ assignments: [] });
 
-/** The kernel's `customerLockCeilingIssues` is the one check of a customer lock against the catalogue's ceiling. */
-function assertLockWithinCatalogueCeiling({ catalogue, definition, lock, schemas }) {
-  const issues = schemas.customerLockCeilingIssues(catalogueCeiling(catalogue, schemas).trustCeiling, lock.biomes);
-  if (issues.length > 0) {
-    throw new CatalogueCeilingError(`catalogue "${catalogue.offeringId}" (${catalogue.channel}): "${definition.id}" is outside the catalogue's trustCeiling: ${issues.join('; ')}`);
-  }
-}
-
 /**
  * The ceiling policy the customer's lock is written under: the catalogue's assignments, then
  * the definition's for what the catalogue leaves open. An assignment of the definition that
@@ -128,7 +100,9 @@ function withSourceImages(definition, sourceImages, pins) {
 /** The composition of a customer definition over the catalogue. */
 export function composeCustomerEdition({ schemas, definition, mirror, catalogue, sourceImages, pins }) {
   const ceiling = catalogueCeiling(catalogue, schemas);
-  const manifest = schemas.parseDistribution({ ...definition, ...(definition.sources === undefined ? {} : { sources: withSourceImages(definition, sourceImages, pins) }) });
+  // `storePublisherAnchorKeys` selects from the catalogue (`selectedStorePublisherTrust`); the Distribution manifest is strict and has no such key.
+  const { storePublisherAnchorKeys: _selection, ...document } = definition;
+  const manifest = schemas.parseDistribution({ ...document, ...(definition.sources === undefined ? {} : { sources: withSourceImages(definition, sourceImages, pins) }) });
   if (definition.sources === undefined && sourceImages.size > 0) {
     throw new Error('--source-image given, but the definition declares no sources');
   }
@@ -295,7 +269,14 @@ export async function resolveCustomerDistribution({
   // `sourcesAvailable: false`: a customer machine holds no vendor source checkouts, so the platform
   // services' ownership cannot be re-derived here. It is verified where the catalogue is produced
   // (`buildCatalogue`), and the catalogue is digest-pinned.
-  const inputs = { composed, biomeIndex: catalogue.biomes, platformServiceIndex: { schemaVersion: 1, services: catalogue.platformServices }, sourcesAvailable: false };
+  // A customer edition carries only the catalogue's Store publishers its definition selects, copied (`storePublisherTrust`).
+  const inputs = {
+    composed,
+    biomeIndex: catalogue.biomes,
+    platformServiceIndex: { schemaVersion: 1, services: catalogue.platformServices },
+    sourcesAvailable: false,
+    storePublisherTrust: selectedStorePublisherTrust(catalogueCeiling(catalogue, schemas).storePublisherTrust, definition.storePublisherAnchorKeys),
+  };
   let resolved;
   try {
     resolved = await resolveDistributionWithIndex(id, { inputs, ...(materialize === undefined ? {} : { materialize }) });
@@ -312,22 +293,24 @@ export async function resolveCustomerDistribution({
     lock.biomes.filter((biome) => biome.source !== undefined).map((biome) => biome.id),
     catalogueCeiling(catalogue, schemas).trustCeiling ?? NO_CATALOGUE_TRUST_CEILING,
   );
-  assertLockWithinCatalogueCeiling({ catalogue, definition, lock, schemas });
+  const { storePublisherAnchorKeys } = definition;
+  assertCustomerLockWithinCatalogueCeiling({ schemas, catalogue, lock, storePublisherAnchorKeys });
   await assertAdapterBundlesMatchHost({ lock, hostRow: adapterHostRow(catalogue.biomes), fetchManifest });
   const authorizationLock = await composeAuthorizationBase(id, lock, index);
   // A customer lock names the catalogue it was resolved against; seal and verify refuse any other.
-  return { id, schemas, composed, inputs, lock: { ...lock, catalogueDigest }, authorizationLock };
+  return { id, schemas, composed, inputs, lock: { ...lock, catalogueDigest }, authorizationLock, storePublisherAnchorKeys };
 }
 
 /** Resolve the customer edition of `channel` against `catalogue`; returns the four locks. `sealOwn` seals the customer's OWN image rows only (a develop edition); vendor rows arrive sealed. */
 export async function resolveCustomerEdition(request) {
-  const { id, schemas, composed, inputs, lock, authorizationLock } = await resolveCustomerDistribution(request);
+  const { id, schemas, composed, inputs, lock, authorizationLock, storePublisherAnchorKeys } = await resolveCustomerDistribution(request);
   const { catalogue } = request;
   const imageLock = await resolveCustomerImages({ id, catalogue, lock, composed, schemas, inputs, sealOwn: request.sealOwn });
   // The chart-set is copied whole, so it carries the coordinates of the channel it was published on:
   // the edition being written states its channel, and a chart-set of the other one is refused here.
   const chartSetLock = assertRosteredChartSetLock(catalogue.chartSet, `the catalogue's chart-set of "${catalogue.offeringId}"`);
-  return { id, distributionLock: lock, imageLock, authorizationLock, chartSetLock };
+  // `storePublisherAnchorKeys` (the definition's selection) is what the seal checks the lock's Store publishers against.
+  return { id, distributionLock: lock, imageLock, authorizationLock, chartSetLock, storePublisherAnchorKeys };
 }
 
 /** Write the four locks to `<out>/<id>/` (the layout of an editions root). */