@xemahq/xema 0.45.0 → 0.45.1

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2431,277 +2431,277 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/canonical-repository-url.mjs",
       "sha256": "sha256:91e7590afba782a3ee2fa64084e7c715e6a5b52c11e8a9cc68c64397f181b888"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/develop-graph.mjs",
       "sha256": "sha256:319db77e708dd73a9dd4a81a963d86e52b030cad3346b104c0862af4e38a2237"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:282b6d5e70736f7e41cff41167d2cd99b7d0127dcc2b712132888dcfc82e36cd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:7604e79a480c9b9db1d1c256155f05298adf6caa49da95ad232f6be581f3c72e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:d3747ca300f38832796521b47d12076bdba7f214199a1dec52c9384ab3dde394"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:af7c88854007e63e4e77863cf72610f59ff838959dbd381087ec50ba782ae0e1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:31865053af2085c0654d39228617135ec0962d32c958c9f7cefce1f2d0527e99"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:65077589d1d9bd129c175c03a6dca6bb4eaf277fa29d6391e1065654fe8cc246"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/first-party-source-ids.mjs",
       "sha256": "sha256:20cb1ad7cfb8c6e6686a6be5a51289da4bba76c20b58d9c1b5b6b3813a38dc1c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/git-source-auth.mjs",
       "sha256": "sha256:c1b32aa6f7d59798db58238d632cafeadbd4f07376396a31acdeb5f0ac56dcac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:8ccbd4e7ce482cbb25521e893ac047d31ca1da782e87ee2179629e8911aa6aa3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/lib.mjs",
       "sha256": "sha256:2cf8f4b52f9532f536a27c8bf6736cc760d7026754945209b1cf5be23391ef49"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:92656c5e920fca2a5a75c0b8db133d551ba044c84a149f33435479248b3dff8b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:32fa918729a83587b4d3bca6e5fe381f5a525397ebc49d52729ec1f8cf216c37"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:6f6f192118407e71a744087caea988bcf3d33aca9803217bceb8134d7e2b9120"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:d7e42efc9edced97e4330cddc46183445a870ba22f57896a7ea6bc600d369137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:396936f3d9e0ed68902b8b03c6fa02479e439357e6194ac8ce0e0991be834706"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:18c28e9fa2a6b7d8589c8434fc6ed9f1e93954d41339813e711ed0fbbcf5c61d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.45.0",
+      "version": "0.45.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/dist/runtime/infra/infra-catalog.js

@@ -189,7 +189,7 @@ exports.INFRA_CATALOG = Object.freeze({
 exports.INFRA_COMPONENTS = Object.freeze(Object.values(schema_1.InfraComponent));
 exports.OBJECT_STORE_BUCKETS = Object.freeze([
     'session-session-attachments',
-    'session-opencode-sessions',
+    'session-session-snapshots',
     'kb-knowledge-base-pages',
     'plugin-bundles',
     'artifact-store',

package/edition/develop-coverage-readers.mjs

@@ -12,7 +12,7 @@ import { promisify } from 'node:util';
 
 import { AttestationStatus, DEVELOP_EVIDENCE_CHANNEL } from './develop-coverage-verdict.mjs';
 import { COSIGN_ENV, policyCandidates, sha256Digest, validatePinnedTrustedRoot, verifySigstoreEvidenceDescriptor } from './image-evidence.mjs';
-import { resolveImageSourceEvidenceReferrer } from './oci-image-source-evidence.mjs';
+import { resolveImageSourceEvidenceReferrer, writeForeignAuthorityReferrerReport } from './oci-image-source-evidence.mjs';
 import { BUNDLE_MEDIA_TYPE } from './produce-image-source-evidence.mjs';
 import { loadRegistryCredentialDeclarations, resolveRegistryCredential, splitImageRef } from './registry-credentials.mjs';
 import { isNotPublishedYet } from './seal-image-digests.mjs';
@@ -81,13 +81,14 @@ function basicAuthParts(credential) {
  * @param {string} request.policyRoot the directory the policy's trusted root is read from (the data root)
  * @param {object} request.trustedCosign the digest-pinned cosign handle (prepareTrustedCosignBinary)
  * @param {object} request.schemas kernel distribution schemas
+ * @param {object} request.expectedContractAuthority the kernel contract authority the data root pins
  * @param {string} request.dataRoot declares how each registry is read
  * @param {object} request.env environment the registry credentials are named in
  * @param {Function} [request.runCosign] (path, args, env) => { code, stdout, stderr }; replaced by tests
  * @param {Function} [request.fetchImpl] @param {Function} [request.run] oras runner, replaced by tests
  * @param {Function} [request.clientFor] (authority) => registry client, replaced by tests
  */
-export function createCoverageReaders({ policy, policyRoot, trustedCosign, schemas, dataRoot, env, runCosign = defaultRunCosign, fetchImpl, run, clientFor: injectedClientFor }) {
+export function createCoverageReaders({ policy, policyRoot, trustedCosign, schemas, expectedContractAuthority, dataRoot, env, runCosign = defaultRunCosign, fetchImpl, run, clientFor: injectedClientFor }) {
   const cosignPath = assertPreparedExecutable(trustedCosign, 'cosign');
   const declarations = injectedClientFor === undefined ? loadRegistryCredentialDeclarations(dataRoot) : null;
   const scratch = mkdtempSync(join(tmpdir(), 'xema-coverage-'));
@@ -141,6 +142,8 @@ export function createCoverageReaders({ policy, policyRoot, trustedCosign, schem
       imageRepository: subject.imageRef,
       subjectDigest: digest,
       schemas,
+      expectedContractAuthority,
+      onForeignAuthorityReferrer: writeForeignAuthorityReferrerReport,
     });
     if (evidence === null) {return { status: AttestationStatus.None };}
     if (rows.length === 0) {return { status: AttestationStatus.NoRow };}

package/edition/develop-coverage-run.mjs

@@ -8,6 +8,7 @@ import { collectCoverage, coverageExitCode, renderCoverageTable } from './develo
 import { DEVELOP_EDITION_STEPS, resolveDevelopSnapshot } from './develop-edition-resolve.mjs';
 import { loadDeclaredPinnedPolicy } from './evidence-trust-policy.mjs';
 import { prepareTrustedCosignBinary } from './image-evidence.mjs';
+import { readPinnedContractAuthority } from './produce-image-source-evidence.mjs';
 
 const stderrProgress = (line) => process.stderr.write(`${line}\n`);
 
@@ -34,7 +35,7 @@ export async function runDevelopCoverage({
     const { schemas, inputs, lock } = await resolveDevelopSnapshot({ id, pins, steps, phase: (name) => progress(`[coverage] ${name}`) });
     const { imageLock } = await steps.resolveImages(id, { inputs, lock });
     progress(`[coverage] image content hashes computed (${imageLock.subjects.length} subjects)`);
-    const readers = createCoverageReaders({ policy, policyRoot: dataRoot, trustedCosign, schemas, dataRoot, env, ...readerOptions });
+    const readers = createCoverageReaders({ policy, policyRoot: dataRoot, trustedCosign, schemas, expectedContractAuthority: readPinnedContractAuthority({ dataRoot, schemas }), dataRoot, env, ...readerOptions });
     try {
       const report = await collectCoverage({ distributionId: id, subjects: imageLock.subjects, policy, readers, progress });
       write(json ? `${JSON.stringify(report, null, 2)}\n` : renderCoverageTable(report));

package/edition/distribution-evidence-set.mjs

@@ -62,6 +62,7 @@ import { readBoundedNoFollowFile } from './no-follow-file.mjs';
 import {
   createRegistryClientResolver,
   resolveImageSourceEvidenceReferrer,
+  writeForeignAuthorityReferrerReport,
 } from './oci-image-source-evidence.mjs';
 import { BUNDLE_MEDIA_TYPE, canonicalSignedBundleBytes, cosignVerifyAttestationArgs, validateProducedBundle } from './produce-image-source-evidence.mjs';
 import { splitImageRef } from './registry-credentials.mjs';
@@ -499,6 +500,8 @@ export async function resolveProducerEvidence({
       imageRepository: subject.imageRef,
       subjectDigest: image.digest,
       schemas,
+      expectedContractAuthority,
+      onForeignAuthorityReferrer: writeForeignAuthorityReferrerReport,
     });
     if (ociEvidence === null) {
       throw new Error(

package/edition/oci-evidence-verbs.mjs

@@ -39,6 +39,7 @@ import {
   createRegistryClientResolver,
   resolveImageSourceEvidenceReferrer,
   validateMaterializedImageSourceEvidence,
+  writeForeignAuthorityReferrerReport,
 } from './oci-image-source-evidence.mjs';
 import { REFERRERS_DISTRIBUTION_SPEC } from './oras.mjs';
 import { assertProducerInput, buildImageSourceStatements, cosignVerifyAttestationArgs, createCosignVerifier, readPinnedContractAuthority } from './produce-image-source-evidence.mjs';
@@ -216,6 +217,7 @@ export async function planOciEvidenceBackfill({
   editionsRoot: editions,
   producerRepositoryRoots,
   schemas,
+  expectedContractAuthority,
   registryClientFactory,
 }) {
   const gitIndex = indexCommittedProducerEvidence({
@@ -281,6 +283,8 @@ export async function planOciEvidenceBackfill({
       imageRepository: item.imageRepository,
       subjectDigest: item.subjectDigest,
       schemas,
+      expectedContractAuthority,
+      onForeignAuthorityReferrer: writeForeignAuthorityReferrerReport,
     });
     const reported = {
       subjectKind: item.subject.kind,
@@ -367,12 +371,14 @@ async function main() {
       WorkspaceRoot.Kernel,
     ]);
     const flags = parseEvidenceCliFlags(rest, { repeated: ['distribution', 'producer-repository-root'] });
+    const schemas = await loadKernelDistributionSchemas();
     const plan = await planOciEvidenceBackfill({
       distributionIds: flags.requireMany('distribution'),
       dataRoot: dataRoot(),
       editionsRoot: editionsRoot(),
       producerRepositoryRoots: flags.requireMany('producer-repository-root').map((root) => resolve(root)),
-      schemas: await loadKernelDistributionSchemas(),
+      schemas,
+      expectedContractAuthority: readPinnedContractAuthority({ dataRoot: dataRoot(), schemas }),
     });
     process.stdout.write(serializeJson(plan));
     // 2: something is still to be produced or attached.

package/edition/oci-image-source-evidence.mjs

@@ -13,6 +13,7 @@ import {
   PRODUCER_STATEMENT_MEDIA_TYPE,
   producerEvidenceLayerFiles,
   readProducerEvidenceDirectory,
+  readRawStatementAuthorityCommits,
 } from './producer-evidence-bundle.mjs';
 import {
   loadRegistryCredentialDeclarations,
@@ -156,9 +157,39 @@ export function validateMaterializedImageSourceEvidence({
   return { ...evidence, created };
 }
 
+function assertExpectedAuthorityCommit(value) {
+  if (typeof value !== 'string' || value.length === 0) {
+    throw new Error('the expected kernel contract authority commit is required');
+  }
+}
+
+/** The artifact states a kernel contract authority other than the one evidence is read under. */
+export class ForeignAuthorityReferrerError extends Error {
+  constructor({ artifactDigest, sourceCommit }) {
+    super(
+      `evidence referrer ${artifactDigest} is stated under kernel contract authority ${sourceCommit}`,
+    );
+    this.name = 'ForeignAuthorityReferrerError';
+    this.artifactDigest = artifactDigest;
+    this.sourceCommit = sourceCommit;
+  }
+}
+
+/** The one stderr line that names a skipped foreign-authority referrer. */
+export function writeForeignAuthorityReferrerReport(skipped) {
+  process.stderr.write(
+    `[evidence] skipped ${skipped.imageRepository}@${skipped.subjectDigest} referrer ${skipped.artifactDigest}: ` +
+      `stated under kernel contract authority ${skipped.sourceCommit}, ` +
+      `not ${skipped.expectedAuthorityCommit}\n`,
+  );
+}
+
 /**
  * Fetch, content-address validate and decode one OCI evidence artifact.
  * `getBlob` verifies every digest again, independently of the manifest.
+ * An artifact whose RAW statements state another authority commit than
+ * `expectedAuthorityCommit` is refused with `ForeignAuthorityReferrerError`
+ * before the strict parse, which is bound to the expected authority.
  */
 export async function readImageSourceEvidenceArtifact({
   client,
@@ -166,7 +197,9 @@ export async function readImageSourceEvidenceArtifact({
   subjectDigest,
   artifactDigest,
   schemas,
+  expectedAuthorityCommit,
 }) {
+  assertExpectedAuthorityCommit(expectedAuthorityCommit);
   const fetched = await client.getManifestByDigest(repository, artifactDigest);
   const { created, layers } = validateImageSourceEvidenceManifest({
     manifest: fetched.document,
@@ -184,6 +217,11 @@ export async function readImageSourceEvidenceArtifact({
       mkdirSync(dirname(path), { recursive: true });
       writeFileSync(path, bytes, { flag: 'wx', mode: 0o600 });
     }
+    for (const sourceCommit of readRawStatementAuthorityCommits({ directory })) {
+      if (sourceCommit !== expectedAuthorityCommit) {
+        throw new ForeignAuthorityReferrerError({ artifactDigest, sourceCommit });
+      }
+    }
     const evidence = validateMaterializedImageSourceEvidence({
       directory,
       manifest: fetched.document,
@@ -196,13 +234,25 @@ export async function readImageSourceEvidenceArtifact({
   }
 }
 
-/** Resolve the newest valid evidence referrer deterministically. */
+/**
+ * Resolve the newest valid evidence referrer deterministically. A referrer
+ * stated under a different kernel contract authority is not evidence under
+ * `expectedContractAuthority`: it is reported to `onForeignAuthorityReferrer`
+ * and skipped. Every other defect of a referrer still throws.
+ */
 export async function resolveImageSourceEvidenceReferrer({
   client,
   imageRepository,
   subjectDigest,
   schemas,
+  expectedContractAuthority,
+  onForeignAuthorityReferrer,
 }) {
+  const expectedAuthorityCommit = expectedContractAuthority?.sourceCommit;
+  assertExpectedAuthorityCommit(expectedAuthorityCommit);
+  if (typeof onForeignAuthorityReferrer !== 'function') {
+    throw new Error('a foreign-authority referrer report handler is required');
+  }
   const { authority, repository } = splitImageRef(imageRepository);
   if (client.authority !== authority) {
     throw new Error(
@@ -224,16 +274,29 @@ export async function resolveImageSourceEvidenceReferrer({
     if (!SHA256_DIGEST_PATTERN.test(descriptor.digest ?? '')) {
       throw new Error('registry returned a non-canonical evidence referrer digest');
     }
-    candidates.push(
-      await readImageSourceEvidenceArtifact({
-        client,
-        repository,
+    try {
+      candidates.push(
+        await readImageSourceEvidenceArtifact({
+          client,
+          repository,
+          subjectDigest,
+          artifactDigest: descriptor.digest,
+          schemas,
+          expectedAuthorityCommit,
+        }),
+      );
+    } catch (error) {
+      if (!(error instanceof ForeignAuthorityReferrerError)) {throw error;}
+      onForeignAuthorityReferrer({
+        imageRepository,
         subjectDigest,
-        artifactDigest: descriptor.digest,
-        schemas,
-      }),
-    );
+        artifactDigest: error.artifactDigest,
+        sourceCommit: error.sourceCommit,
+        expectedAuthorityCommit,
+      });
+    }
   }
+  if (candidates.length === 0) {return null;}
   candidates.sort((left, right) => {
     const byCreated = compareStrings(right.created, left.created);
     return byCreated || compareStrings(left.artifactDigest, right.artifactDigest);

package/edition/plan-image-evidence-refresh.mjs

@@ -73,6 +73,7 @@ import { compareStrings, loadKernelDistributionSchemas } from './lib.mjs';
 import {
   createRegistryClientResolver,
   resolveImageSourceEvidenceReferrer,
+  writeForeignAuthorityReferrerReport,
 } from './oci-image-source-evidence.mjs';
 import {
   loadProducerKernelSchemas,
@@ -193,6 +194,8 @@ export async function planImageEvidenceRefresh({
             imageRepository: subject.imageRef,
             subjectDigest: image.digest,
             schemas,
+            expectedContractAuthority,
+            onForeignAuthorityReferrer: writeForeignAuthorityReferrerReport,
           });
           if (artifact !== null) {
             matches = artifact.records.filter(

package/edition/producer-evidence-bundle.mjs

@@ -62,6 +62,37 @@ export function producerStatementMatchesInput(statement, expectedStatement) {
   );
 }
 
+/**
+ * The RAW `predicate.contractAuthority.sourceCommit` of every statement a
+ * producer evidence directory carries, read BEFORE any schema parse: the parse
+ * is bound to one kernel authority, so deciding whose authority a statement
+ * speaks under cannot go through it. A statement that states no string commit
+ * contributes nothing here; the strict parse refuses it later.
+ */
+export function readRawStatementAuthorityCommits({ directory }) {
+  const index = JSON.parse(
+    decodeExactUtf8(
+      readBounded(directory, PRODUCER_EVIDENCE_INDEX_FILE, 'producer evidence index'),
+      'producer evidence index',
+    ),
+  );
+  if (!Array.isArray(index?.producerEvidence)) {
+    throw new Error('producer evidence index is not non-empty schemaVersion 1');
+  }
+  const commits = new Set();
+  for (const entry of index.producerEvidence) {
+    const statement = JSON.parse(
+      decodeExactUtf8(
+        readBounded(directory, entry?.evidence?.statementPath, 'producer statement'),
+        'producer statement',
+      ),
+    );
+    const commit = statement?.predicate?.contractAuthority?.sourceCommit;
+    if (typeof commit === 'string') {commits.add(commit);}
+  }
+  return commits;
+}
+
 /** Read and structurally validate one producer evidence directory. */
 export function readProducerEvidenceDirectory({ directory, schemas }) {
   if (!isAbsolute(directory)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.45.0",
+  "version": "0.45.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:97a574d113d6c30640832ec00008c3788c449ec45456db7b5d117c98460340cc"
+    "sourceDigest": "sha256:04abcd3c081c6cd50d0133c543310f75801357071b18834ec4b15af587760461"
   }
 }