@xemahq/xema 0.42.0 → 0.44.0

package/edition/authored-source-check.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// authored-source-check — `xema edition check-authored`: grades the AUTHORED
+// distribution source, the develop lifecycle's gate. It is its own mode, not
+// the release check with assertions turned off: `xema edition check`
+// (dist-check.mjs) stays the full release-path grade, and nothing here can
+// make it skip anything.
+//
+// Authored and release state are separate lifecycles. What is authored is
+// graded here, offline; what only a release carries is not read: no lock
+// content (the committed distribution / images / authorization / chart-set
+// locks; the trust-arming rule counts lock files by presence), and nothing that
+// needs a source checkout at a committed `repositoryPins` commit. No edition is
+// resolved here: the plane invariants over a resolved edition (the
+// capability-domain reservation table and biome confinement) are asserted on
+// develop by the develop resolve against the graph it froze
+// (develop-edition-invariants.mjs), and on the release path by
+// `xema edition check` over the committed locks. One place per assertion.
+//
+// KEPT (each refuses):
+//   - the kernel speaks a supported edition protocol;
+//   - biome-index.json: immutable entries, deterministic order, no duplicate
+//     source identity, a serviceDependencies projection on every entry;
+//   - platform-service-index.json: parses, matches the declared
+//     platformServiceSources offline, service-dependency owner parity;
+//   - runtime-image-source-index.json: the offline `--check`;
+//   - the evidence trust policy, its data-root pin and its arming assessment;
+//   - the data-root readers (store source repositories, publisher trust);
+//   - the fleet chart-set pin is a rostered chart-set lock;
+//   - the pinned kernel's authorization composer loads;
+//   - the ownership self-tests: the kernel's capability-domain reader refuses
+//     two owners of one domain and an invalid domain, and counts no unlisted
+//     domain as first-party (synthetic tables, no lock);
+//   - every edition definition is structurally valid: the kernel parses it
+//     (its `sourcePins` included) and it composes.
+//
+// NOT HERE:
+//   - lock currency, sealed hashes, the authorization lock, each edition's
+//     chart-set.lock.json copy, platform-service ownership at pinned commits,
+//     `--check-sources` (refused): release state, `xema edition check`;
+//   - the definition resolve, reservations, confinement: the develop resolve.
+
+import {
+  checkDataRootPlane,
+  discoverDistributionIds,
+  loadPlaneAuthorizationKernel,
+  ownershipSelfTestFailures,
+  readFleetChartSetPin,
+} from './dist-check.mjs';
+import { describeEditionHolds } from './edition-source-pins.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule } from './edition-workspace.mjs';
+import { loadKernelDistributionSchemas } from './lib.mjs';
+import { composeEdition } from './resolve-distribution.mjs';
+
+/** The release-path flag this mode refuses rather than ignores. */
+const CHECK_SOURCES_FLAG = '--check-sources';
+
+/**
+ * Whether edition `id`'s definition is structurally valid: the kernel parses it
+ * and it composes. Nothing is resolved and no index or source is read.
+ *
+ * @returns {Promise<string | null>} the refusal, or null when valid
+ */
+export async function definitionRefusal(id) {
+  try {
+    const schemas = await loadKernelDistributionSchemas();
+    composeEdition(schemas.parseDistribution, id);
+    return null;
+  } catch (err) {
+    return err.message;
+  }
+}
+
+/**
+ * The ownership self-tests (dist-check.mjs): the kernel's capability-domain
+ * reader, against synthetic tables. Lock-free. Returns true when green.
+ */
+async function checkOwnershipSelfTests(resolveFirstPartyCapabilityDomains) {
+  let failures;
+  try {
+    failures = ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains);
+  } catch (err) {
+    failures = [`the kernel's capability-domain reader threw on a valid table: ${err.message}`];
+  }
+  for (const failure of failures) {console.error(`[dist:check-authored] ownership self-test FAILED: ${failure}`);}
+  if (failures.length === 0) {console.log('[dist:check-authored] ownership self-tests: green.');}
+  return failures.length === 0;
+}
+
+/**
+ * The authored check over the configured roots. Returns true when green.
+ * `resolveFirstPartyCapabilityDomains` is the kernel's reader unless a test
+ * stands in for it.
+ */
+export async function checkAuthoredSource({ resolveFirstPartyCapabilityDomains } = {}) {
+  let green = await checkDataRootPlane({ checkSources: false });
+  const reader = resolveFirstPartyCapabilityDomains ?? (await loadKernelDistributionSchemas()).resolveFirstPartyCapabilityDomains;
+  if (!(await checkOwnershipSelfTests(reader))) {green = false;}
+
+  const distributionIds = discoverDistributionIds();
+  for (const line of describeEditionHolds(distributionIds)) {console.log(line);}
+  for (const id of distributionIds) {
+    const refusal = await definitionRefusal(id);
+    if (refusal === null) {
+      console.log(`[dist:check-authored] ${id}: the definition is valid.`);
+    } else {
+      console.error(`[dist:check-authored] ${id}: the definition is invalid — ${refusal}`);
+      green = false;
+    }
+  }
+
+  const { green: authorizationKernelGreen } = await loadPlaneAuthorizationKernel();
+  if (!authorizationKernelGreen) {green = false;}
+  if (readFleetChartSetPin() === null) {green = false;}
+
+  return green;
+}
+
+async function main() {
+  if (process.argv.includes(CHECK_SOURCES_FLAG)) {
+    throw new Error(
+      `${CHECK_SOURCES_FLAG} audits the indexes against source checkouts, which is release state: ` +
+        `run \`xema edition check ${CHECK_SOURCES_FLAG}\`.`,
+    );
+  }
+  if (!(await checkAuthoredSource())) {process.exit(1);}
+  console.log('[dist:check-authored] the authored distribution source is green.');
+}
+
+if (isEntryModule(import.meta.url)) {
+  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
+  main().catch((err) => {
+    console.error(`[dist:check-authored] ${err.message}`);
+    process.exit(1);
+  });
+}

package/edition/build-platform-service-index.mjs

@@ -3,9 +3,9 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 import { platformServiceIndexPath , WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath } from './edition-workspace.mjs';
 import {
-  canonicalPublicHttpsRepositoryUrl,
   loadKernelDistributionSchemas,
   readGitJsonAtCommit,
   serializeJson,

package/edition/build-runtime-image-source-index.mjs

@@ -5,10 +5,12 @@ import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 
 import { buildValidatedPlatformServiceIndex } from './build-platform-service-index.mjs';
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 import { connectorCrossRepoBuildInputs } from './connector-source-authority.mjs';
 import { editionWorkspaceConfig, workspaceSection } from './edition-config.mjs';
 import { biomeIndexPath, dataRoot, platformServiceIndexPath, runtimeImageSourceIndexPath, WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath } from './edition-workspace.mjs';
 import { COMMIT_PATTERN } from './evidence-grammars.mjs';
+import { firstPartySources } from './first-party-source-ids.mjs';
 import {
   buildTrustedKernelContractAuthority,
   KERNEL_COMMIT_FLAG,
@@ -17,7 +19,6 @@ import {
 } from './kernel-contract-authority.mjs';
 import {
   buildBiomeIndex,
-  canonicalPublicHttpsRepositoryUrl,
   compareStrings,
   distributionBiomeSourceRepositories,
   loadKernelDistributionSchemas,
@@ -572,6 +573,28 @@ function compareSubject(left, right) {
   );
 }
 
+/**
+ * Every release pin names a first-party repository (`firstPartySources`) at
+ * the URL declared there. The converse is not required: a first-party
+ * repository is in the develop graph before any release pins it.
+ */
+function assertPinsAreFirstParty(repositoryPins) {
+  const declared = firstPartySources('checking that every release pin is a first-party repository');
+  for (const pin of repositoryPins) {
+    const source = declared[pin.repo];
+    if (source === undefined) {
+      throw new Error(
+        `runtime-image-source-index pins ${JSON.stringify(pin.repo)}, which edition-workspace.json does not declare under "firstPartySources"`,
+      );
+    }
+    if (source.repositoryUrl !== pin.repositoryUrl) {
+      throw new Error(
+        `runtime-image-source-index pins ${pin.repo} at ${pin.repositoryUrl}, but "firstPartySources" declares it at ${source.repositoryUrl}`,
+      );
+    }
+  }
+}
+
 export async function validateRuntimeImageSourceIndex(
   index,
   schemas,
@@ -658,6 +681,7 @@ export async function validateRuntimeImageSourceIndex(
       throw new Error(`${repository.repo} repositoryUrl is not canonical`);
     }
   }
+  assertPinsAreFirstParty(index.repositoryPins);
   // Every subject a biome contributes to the image plane — BOTH the standing
   // services and the runtime components. A runtime component is a full image
   // subject (built, signed, mirrored) that simply is never scheduled, so a

package/edition/canonical-repository-url.mjs

@@ -0,0 +1,35 @@
+// The canonical form of a public HTTPS repository URL, and the refusals that
+// define it. Leaf module: the workspace config and the git source hold read it
+// without importing the edition library.
+
+export function canonicalPublicHttpsRepositoryUrl(raw, context) {
+  if (typeof raw !== 'string' || raw.length === 0 || raw.trim() !== raw) {
+    throw new Error(`${context} must be a non-empty canonical HTTPS URL`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error(`${context} is not a valid URL`);
+  }
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`${context} must use HTTPS`);
+  }
+  if (parsed.username.length > 0 || parsed.password.length > 0) {
+    throw new Error(
+      `${context} must not contain username/password credentials`,
+    );
+  }
+  if (
+    parsed.search.length > 0 ||
+    parsed.hash.length > 0 ||
+    raw.includes('?') ||
+    raw.includes('#')
+  ) {
+    throw new Error(`${context} must not contain a query or fragment`);
+  }
+  if (parsed.hostname.length === 0) {
+    throw new Error(`${context} must identify a repository host`);
+  }
+  return parsed.toString();
+}

package/edition/checkout-indexed-source-repositories.mjs

@@ -250,7 +250,8 @@ const SNAPSHOT_PINS_FLAG = '--snapshot-pins';
 
 /**
  * `--snapshot-pins <file>` is the only argument: with it, the plan is the
- * committed index applied to that snapshot (the develop edition's frozen pins);
+ * develop graph (the data root's firstPartySources) at that snapshot (the
+ * develop edition's frozen pins), never the committed index's repositoryPins;
  * without it, the committed index untouched.
  */
 export function indexForCheckout(committedIndex, argv) {

package/edition/develop-edition-invariants.mjs

@@ -0,0 +1,141 @@
+// develop-edition-invariants — the plane invariants a DEVELOP candidate asserts
+// itself, against the develop graph it froze: the capability-domain
+// reservation table and biome confinement.
+//
+// On develop these live ONLY here. `xema edition check-authored` reads no
+// resolved edition, and `xema edition check` (the release path) grades the
+// same two invariants over the committed locks.
+//
+// RESERVATION. Ownership is a property of the platform, not of what an edition
+// preloads (see `buildCapabilityDomainOwners`): every edition carries the table
+// built from the FULL index. The release check proves it by comparing the
+// committed locks with each other. A single candidate proves the same thing
+// alone: its table must be exactly the one the frozen graph's full biome index
+// builds, so any two candidates over one graph carry the identical table. It
+// must also be non-empty (an empty table makes nothing first-party), and the
+// kernel's reader must accept it (one owner per domain, valid domains).
+//
+// CONFINEMENT. The data root's `confinedBiomes` name biomes whose contents must
+// not reach an unadmitted installation. The candidate is one graded edition:
+// a declaration naming a biome the frozen index does not carry guards nothing
+// and is refused; shipping a confined biome without an admission is refused; an
+// admission of this edition for a biome it does not ship is a stale permission
+// and is refused; a declaration without a substantive consequence is refused.
+
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import { buildCapabilityDomainOwners, serializeJson } from './lib.mjs';
+
+/** Why a develop candidate was refused. */
+export const DevelopEditionInvariantReason = Object.freeze({
+  RESERVATION_TABLE_EMPTY: 'reservation-table-empty',
+  RESERVATION_TABLE_NOT_PLATFORM_TABLE: 'reservation-table-not-platform-table',
+  RESERVATION_TABLE_REFUSED_BY_KERNEL: 'reservation-table-refused-by-kernel',
+  CONFINED_BIOME_UNKNOWN: 'confined-biome-unknown',
+  CONFINED_BIOME_UNADMITTED: 'confined-biome-unadmitted',
+  CONFINEMENT_ADMISSION_STALE: 'confinement-admission-stale',
+  CONFINEMENT_CONSEQUENCE_MISSING: 'confinement-consequence-missing',
+});
+
+/** The shortest `consequence` that can name what a confinement protects. */
+const MIN_CONSEQUENCE_LENGTH = 40;
+
+/** A develop candidate broke a plane invariant. `violations` carries every one, each with its reason. */
+export class DevelopEditionInvariantError extends Error {
+  /** @param {string} id @param {{ reason: string, detail: string }[]} violations */
+  constructor(id, violations) {
+    super(
+      `develop edition "${id}" breaks ${violations.length} plane invariant(s):\n` +
+        violations.map(({ reason, detail }) => `  - [${reason}] ${detail}`).join('\n'),
+    );
+    this.name = 'DevelopEditionInvariantError';
+    this.distributionId = id;
+    this.violations = violations;
+  }
+}
+
+/**
+ * The reservation violations of `lock`, whose graph's full biome index is
+ * `biomeIndex`. `resolveFirstPartyCapabilityDomains` is the kernel's reader.
+ */
+export function reservationViolations({ lock, biomeIndex, resolveFirstPartyCapabilityDomains }) {
+  const R = DevelopEditionInvariantReason;
+  const table = lock.capabilityDomainOwners;
+  if (!Array.isArray(table) || table.length === 0) {
+    return [{
+      reason: R.RESERVATION_TABLE_EMPTY,
+      detail: 'capabilityDomainOwners is missing or empty: an empty reservation table makes NOTHING first-party (fail-open)',
+    }];
+  }
+  const violations = [];
+  try {
+    resolveFirstPartyCapabilityDomains(lock);
+  } catch (err) {
+    violations.push({ reason: R.RESERVATION_TABLE_REFUSED_BY_KERNEL, detail: err.message });
+  }
+  if (serializeJson(table) !== serializeJson(buildCapabilityDomainOwners(biomeIndex))) {
+    violations.push({
+      reason: R.RESERVATION_TABLE_NOT_PLATFORM_TABLE,
+      detail:
+        'capabilityDomainOwners is not the table the frozen graph\'s full biome index builds. Ownership must not vary ' +
+        'by edition, or a trimmed edition leaves domains org-bindable',
+    });
+  }
+  return violations;
+}
+
+/**
+ * The confinement violations of edition `id` shipping `lock`, under the data
+ * root's `declarations`, with `knownBiomeIds` the frozen index's biome ids.
+ */
+export function confinementViolations({ id, lock, declarations, knownBiomeIds }) {
+  const R = DevelopEditionInvariantReason;
+  const shipped = new Set(lock.biomes.map((biome) => biome.id));
+  const violations = [];
+  for (const decl of declarations) {
+    if (typeof decl.consequence !== 'string' || decl.consequence.trim().length < MIN_CONSEQUENCE_LENGTH) {
+      violations.push({
+        reason: R.CONFINEMENT_CONSEQUENCE_MISSING,
+        detail: `confinement declaration "${decl.biomeId}" carries no substantive \`consequence\`; a refusal would name a rule without naming what it protects`,
+      });
+    }
+    if (!knownBiomeIds.has(decl.biomeId)) {
+      violations.push({
+        reason: R.CONFINED_BIOME_UNKNOWN,
+        detail:
+          `confinement declaration names biome "${decl.biomeId}", which the frozen biome index does not carry: it would ` +
+          'guard nothing. Repoint it to the renamed biome, or delete it if the biome is gone',
+      });
+      continue;
+    }
+    const admitted = decl.admittedEditions.includes(id);
+    if (shipped.has(decl.biomeId) && !admitted) {
+      violations.push({
+        reason: R.CONFINED_BIOME_UNADMITTED,
+        detail:
+          `ships biome "${decl.biomeId}", which holds ${decl.holds}. That is a CONFINEMENT decision, not a packaging one: ` +
+          `${decl.consequence}. If intended, add "${id}" to its admittedEditions in edition-workspace.json in its own commit, naming who agreed`,
+      });
+    }
+    if (!shipped.has(decl.biomeId) && admitted) {
+      violations.push({
+        reason: R.CONFINEMENT_ADMISSION_STALE,
+        detail: `the admission "${decl.biomeId}" -> "${id}" suppresses NOTHING: the edition does not ship the biome. Delete it`,
+      });
+    }
+  }
+  return violations;
+}
+
+/**
+ * Assert both invariants on develop candidate `id`. Throws
+ * {@link DevelopEditionInvariantError} naming every violation; returns the
+ * counts it graded otherwise.
+ */
+export function assertDevelopEditionInvariants({ id, lock, biomeIndex, schemas, declarations = editionWorkspaceConfig().confinedBiomes ?? [] }) {
+  const violations = [
+    ...reservationViolations({ lock, biomeIndex, resolveFirstPartyCapabilityDomains: schemas.resolveFirstPartyCapabilityDomains }),
+    ...confinementViolations({ id, lock, declarations, knownBiomeIds: new Set(biomeIndex.map((entry) => entry.id)) }),
+  ];
+  if (violations.length > 0) {throw new DevelopEditionInvariantError(id, violations);}
+  return { reservedDomains: lock.capabilityDomainOwners.length, confinedBiomes: declarations.length };
+}

package/edition/develop-edition-resolve.mjs

@@ -1,7 +1,8 @@
 // develop-edition-resolve — resolve and seal one DEVELOP edition from a snapshot.
 //
 // The whole pipeline, in the order the release runs it, over the snapshot's
-// injected inputs: distribution lock -> authorization base (composed, never
+// injected inputs: distribution lock -> plane invariants (reservation table,
+// confinement; develop-edition-invariants.mjs) -> authorization base (composed, never
 // written) -> images lock -> develop seal, plus the chart-set lock: the frozen
 // deploy commit's develop chart set (develop-chart-set.mjs). Nothing here writes to the editions
 // trees; the caller writes the artifact (edition-artifact.mjs).
@@ -10,6 +11,7 @@ import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest }
 import { biomeSourceTreeIds, readBiomeSourceFacts, sealLock } from './biome-content.mjs';
 import { buildCatalogue } from './catalogue.mjs';
 import { resolveDevelopChartSet } from './develop-chart-set.mjs';
+import { assertDevelopEditionInvariants } from './develop-edition-invariants.mjs';
 import { createDevelopImageProbe } from './develop-image-probe.mjs';
 import { assertFrozenCheckouts, buildSnapshotInputs } from './develop-snapshot-inputs.mjs';
 import { EditionChannel } from './edition-constants.mjs';
@@ -30,6 +32,7 @@ export const DEVELOP_EDITION_STEPS = Object.freeze({
   assertFrozenCheckouts,
   buildSnapshotInputs,
   resolveDistributionWithIndex,
+  assertDevelopEditionInvariants,
   assertAdapterBundlesMatchHost,
   composeAuthorizationBase,
   resolveImages,
@@ -59,6 +62,9 @@ export async function resolveDevelopEdition({ id, pins, env = process.env, sealO
   // One line per phase, with the time since the resolve began, so the step is never silent for long.
   const phase = (name) => progress(`[develop-edition] ${name} (+${Date.now() - startedAt}ms)`);
   const { schemas, inputs, lock, index } = await resolveDevelopSnapshot({ id, pins, steps, phase });
+  // The plane invariants, against the graph this candidate froze (develop-edition-invariants.mjs).
+  const graded = steps.assertDevelopEditionInvariants({ id, lock, biomeIndex: inputs.biomeIndex, schemas });
+  phase(`reservation table asserted (${graded.reservedDomains} domains); confinement asserted (${graded.confinedBiomes} declaration(s))`);
   await steps.assertAdapterBundlesMatchHost({ lock, hostRow: adapterHostRow(index), fetchManifest });
   const authorizationLock = await steps.composeAuthorizationBase(id, lock, index);
   phase('distribution lock resolved');

package/edition/develop-edition.mjs

@@ -28,8 +28,8 @@
 //   freeze-graph --data-sha <sha> --kernel-sha <sha>
 //                --deploy-sha <sha> [--editions-root-url <https url>]
 //                [--overrides <json>] --out <file>
-//       resolve refs/heads/develop once per graph repository (and the editions
-//       root) from this checkout's runtime-image-source-index.json; the three checked-out
+//       resolve refs/heads/develop once per develop-graph repository (the data root's
+//       firstPartySources, at each declared URL) and the editions root; the three checked-out
 //       repositories are pinned at what the workflow checked out; write the pins. --kernel-sha is refused
 //       unless its declared edition protocol is one this CLI supports (the check choose-kernel applies to a pin).
 //   check-existing <id> --pins <file> --artifact <dir> --engine-image <repository>@sha256:<digest>
@@ -76,7 +76,7 @@ import { resolveDevelopEdition } from './develop-edition-resolve.mjs';
 import { assertNoToolingOverride, freezeGraph, freezeSources } from './develop-freeze.mjs';
 import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { EditionChannel } from './edition-constants.mjs';
-import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, kernelRepoDir, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, kernelRepoDir } from './edition-workspace.mjs';
 import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
 import { assertKernelCommitSupported, chooseKernelCommit } from './kernel-protocol-choice.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
@@ -187,7 +187,6 @@ async function run(argv, env) {
     case 'freeze-graph': {
       assertKernelCommitSupported({ repoDir: kernelRepoDir(), commit: options['--kernel-sha'], label: `--kernel-sha ${options['--kernel-sha']}` });
       const pins = freezeGraph({
-        runtimeSourceIndex: readStrictJsonFile(runtimeImageSourceIndexPath()),
         dataSha: options['--data-sha'],
         kernelSha: options['--kernel-sha'],
         deploySha: options['--deploy-sha'],

package/edition/develop-freeze.mjs

@@ -15,9 +15,10 @@
 
 import { execFileSync } from 'node:child_process';
 
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
+import { developGraphMembers } from './develop-graph.mjs';
 import { EditionChannel } from './edition-channel.mjs';
 import { assertCanonicalSourceUrl, assertSourceDeclaresNoCredential, isUnderSourcePrefix, withSourceGitEnv } from './git-source-auth.mjs';
-import { canonicalPublicHttpsRepositoryUrl } from './lib.mjs';
 import {
   dataPinKey,
   EDITIONS_ROOT_PIN_KEY,
@@ -144,7 +145,6 @@ function assertCheckedOutPin({ key, sha, flag, what, overrides }) {
 
 /**
  * @param {object} request
- * @param {object} request.runtimeSourceIndex the checkout's runtime-image-source-index.json (raw)
  * @param {string} request.dataSha the commit the data root checkout is at
  * @param {string} request.kernelSha the commit the kernel checkout is at
  * @param {string} request.deploySha the commit the deploy checkout is at
@@ -152,7 +152,6 @@ function assertCheckedOutPin({ key, sha, flag, what, overrides }) {
  * @param {(source: {name: string, url: string}) => void} request.holdSource the hold of one source; runs for ALL graph sources before the first head
  */
 export function freezeGraph({
-  runtimeSourceIndex,
   dataSha,
   kernelSha,
   deploySha,
@@ -164,7 +163,9 @@ export function freezeGraph({
   assertNoToolingOverride(overrides);
   assertOverrides(overrides, GRAPH_PHASE);
   const head = memoizedHeads(resolveHead);
-  const graph = new Set(runtimeSourceIndex.repositoryPins.map((pin) => pin.repo));
+  // The develop graph is the data root's first-party repositories (develop-graph.mjs), never the release pins.
+  const members = developGraphMembers();
+  const graph = new Set(members.map((member) => member.repo));
   for (const [key] of Object.entries(overrides)) {
     if (snapshotPinNamespace(key) === SnapshotPinNamespace.Graph && !graph.has(key)) {
       throw new Error(`override names "${key}", which is not a repository in the graph`);
@@ -176,7 +177,7 @@ export function freezeGraph({
     { key: deployPinKey(), sha: deploySha, flag: '--deploy-sha', what: 'the deploy checkout' },
   ];
   for (const { key, sha, flag, what } of checkedOut) {assertCheckedOutPin({ key, sha, flag, what, overrides });}
-  const toResolve = runtimeSourceIndex.repositoryPins.map((pin) => ({ name: pin.repo, url: pin.repositoryUrl }));
+  const toResolve = members.map((member) => ({ name: member.repo, url: member.repositoryUrl }));
   if (editionsRootUrl !== undefined) {
     toResolve.push({ name: EDITIONS_ROOT_PIN_KEY, url: canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url') });
   }
@@ -186,8 +187,8 @@ export function freezeGraph({
     throw new Error(`override names "${EDITIONS_ROOT_PIN_KEY}", but the editions root is this repository`);
   }
   const pins = Object.fromEntries(checkedOut.map(({ key, sha }) => [key, sha]));
-  for (const pin of runtimeSourceIndex.repositoryPins) {
-    pins[pin.repo] = overrides[pin.repo] ?? head({ name: pin.repo, url: pin.repositoryUrl });
+  for (const member of members) {
+    pins[member.repo] = overrides[member.repo] ?? head({ name: member.repo, url: member.repositoryUrl });
   }
   if (editionsRootUrl !== undefined) {
     const url = canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url');

package/edition/develop-graph.mjs

@@ -0,0 +1,26 @@
+// develop-graph — which repositories a DEVELOP candidate is built from.
+//
+// The develop graph is every first-party repository the data root declares
+// (`firstPartySources` in edition-workspace.json), each at its declared
+// `repositoryUrl`. It is never read from the release pins
+// (`runtime-image-source-index.json#repositoryPins`): develop and release are
+// separate lifecycles, and a repository is first-party on develop before any
+// release pins it. freeze-graph, the snapshot checkout, the snapshot pins'
+// validation and the snapshot's index all take their members from here.
+
+import { firstPartySources } from './first-party-source-ids.mjs';
+import { compareStrings } from './lib.mjs';
+
+/**
+ * The develop graph: `{ repo, repositoryUrl }` per declared first-party
+ * repository, sorted by repo handle.
+ *
+ * @returns {readonly { repo: string, repositoryUrl: string }[]}
+ */
+export function developGraphMembers() {
+  return Object.freeze(
+    Object.entries(firstPartySources('the develop graph'))
+      .map(([repo, { repositoryUrl }]) => Object.freeze({ repo, repositoryUrl }))
+      .sort((a, b) => compareStrings(a.repo, b.repo)),
+  );
+}

package/edition/develop-snapshot-inputs.mjs

@@ -81,7 +81,6 @@ export async function buildSnapshotInputs({ id, pins, schemas }) {
     readStrictJsonFile(runtimeImageSourceIndexPath()),
   );
   validateSnapshotPins(pins, {
-    runtimeSourceIndex: committedIndex,
     declaredSourceNames: composed.declaredSourceNames,
     editionsRootExternal: editionsRoot() !== dataRoot(),
   });