@xemahq/xema 0.54.0 → 0.55.0

package/dist/runtime/lock-loader.d.ts

@@ -1,4 +1,4 @@
-import { type DistributionLockReadView, type RuntimeImagePlatform } from '@xemahq/contracts/distribution';
+import { type DistributionLockReadView, type RuntimeImagePlatform, type RuntimeImageSubject } from '@xemahq/contracts/distribution';
 import { type ArtifactResolution } from './paths';
 export interface LoadedDistributionLock {
     readonly lock: DistributionLockReadView;
@@ -20,4 +20,5 @@ export interface LoadedImageLock {
     readonly resolution: ArtifactResolution;
 }
 export declare function loadImageLock(opts: LoadLockOptions): LoadedImageLock;
+export declare function subjectIdentity(subject: RuntimeImageSubject): string;
 //# sourceMappingURL=lock-loader.d.ts.map

package/dist/runtime/lock-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock-loader.d.ts","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAE1B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAqD,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAarG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,sBAAsB,CASlF;AAQD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAQ7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAQ9B,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AA0BD,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAwBpE"}
+{"version":3,"file":"lock-loader.d.ts","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAqD,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAarG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,sBAAsB,CASlF;AAQD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAQ7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAQ9B,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AA0BD,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CA+BpE;AASD,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAIpE"}

package/dist/runtime/lock-loader.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadDistributionLock = loadDistributionLock;
 exports.loadImageLock = loadImageLock;
+exports.subjectIdentity = subjectIdentity;
 const node_fs_1 = require("node:fs");
 const distribution_1 = require("@xemahq/contracts/distribution");
 const paths_1 = require("./paths");
@@ -20,14 +21,21 @@ function loadImageLock(opts) {
     const lock = (0, distribution_1.parseImageLock)(readJson(resolution.path));
     const subjectsByKey = new Map();
     const imagesByService = new Map();
+    const subjectsByName = new Map();
     for (const subject of lock.subjects) {
-        subjectsByKey.set(subjectKey(subject.kind, subject.id), subject);
+        subjectsByKey.set(subjectIdentity(subject), subject);
     }
-    for (const [service, subject] of (0, distribution_1.serviceImageSubjects)(lock.subjects)) {
+    for (const subject of subjectsByKey.values()) {
+        const named = subjectsByName.get(`${subject.kind}:${subject.id}`);
+        if (named === undefined || (subject.generation ?? 0) >= (named.generation ?? 0)) {
+            subjectsByName.set(`${subject.kind}:${subject.id}`, subject);
+        }
+    }
+    for (const [service, subject] of (0, distribution_1.dedicatedServiceImageSubjects)(lock)) {
         imagesByService.set(service, toImageEntry(subject));
     }
     for (const binding of lock.platformServiceBindings) {
-        const subject = subjectsByKey.get(subjectKey(binding.subjectKind, binding.subjectId));
+        const subject = subjectsByName.get(`${binding.subjectKind}:${binding.subjectId}`);
         if (subject === undefined) {
             throw new Error(`Invariant violated reading ${resolution.path}: platform service ` +
                 `"${binding.platformService}" binds the ${binding.subjectKind} subject ` +
@@ -37,8 +45,10 @@ function loadImageLock(opts) {
     }
     return { imagesByService, resolution };
 }
-function subjectKey(kind, id) {
-    return `${kind}:${id}`;
+function subjectIdentity(subject) {
+    return subject.kind === distribution_1.RuntimeImageSubjectKind.ComposedProcess
+        ? `${subject.kind}:${subject.imageRef}:${subject.contentHash}`
+        : `${subject.kind}:${subject.id}`;
 }
 function toImageEntry(subject) {
     return {

package/dist/runtime/lock-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock-loader.js","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":";;AAoCA,oDASC;AAyDD,sCAwBC;AA9HD,qCAAuC;AAEvC,iEAQwC;AAExC,mCAAqG;AAwBrG,SAAgB,oBAAoB,CAAC,IAAqB;IACxD,MAAM,UAAU,GAAG,IAAA,mCAA2B,EAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,8CAA+B,EAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAyDD,SAAgB,aAAa,CAAC,IAAqB;IACjD,MAAM,UAAU,GAAG,IAAA,4BAAoB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAA,mCAAoB,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8BAA8B,UAAU,CAAC,IAAI,qBAAqB;gBAChE,IAAI,OAAO,CAAC,eAAe,eAAe,OAAO,CAAC,WAAW,WAAW;gBACxE,IAAI,OAAO,CAAC,SAAS,+CAA+C,CACvE,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,IAA6B,EAAE,EAAU;IAC3D,OAAO,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}
+{"version":3,"file":"lock-loader.js","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":";;AAoCA,oDASC;AAyDD,sCA+BC;AASD,0CAIC;AAlJD,qCAAuC;AAEvC,iEAQwC;AAExC,mCAAqG;AAwBrG,SAAgB,oBAAoB,CAAC,IAAqB;IACxD,MAAM,UAAU,GAAG,IAAA,mCAA2B,EAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,8CAA+B,EAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAyDD,SAAgB,aAAa,CAAC,IAAqB;IACjD,MAAM,UAAU,GAAG,IAAA,4BAAoB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;YAChF,cAAc,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAA,4CAA6B,EAAC,IAAI,CAAC,EAAE,CAAC;QACrE,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8BAA8B,UAAU,CAAC,IAAI,qBAAqB;gBAChE,IAAI,OAAO,CAAC,eAAe,eAAe,OAAO,CAAC,WAAW,WAAW;gBACxE,IAAI,OAAO,CAAC,SAAS,+CAA+C,CACvE,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AASD,SAAgB,eAAe,CAAC,OAA4B;IAC1D,OAAO,OAAO,CAAC,IAAI,KAAK,sCAAuB,CAAC,eAAe;QAC7D,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE;QAC9D,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/edition/README.md

@@ -82,7 +82,8 @@ xema edition artifact <id> --channel release --registry <ns> --coordinate <tag>
 xema edition develop <freeze-sources|resolve|target|check-existing> ...
 # develop tag = sha256 of { cli, engine, pins, sourceImages }; target and check-existing take --engine-image, and a customer's --source-image
 xema edition develop coverage <id> --pins <file> --cosign <abs path> [--json]   # read-only forecast (policy held to its pin, this CLI's own verifier code): is each develop image producer-signed? exit 0 covered, 1 not, 2 error
-xema edition develop select-records --branch develop --registry <root> --cosign <abs path> --out <file> [--at <ISO-8601 UTC>] [--published-pins <file>]   # newest signed build record per graph member (the newest COMMIT on develop, every record verified; --published-pins keeps a published commit the records are not ahead of, part 07 passes it) -> { pins, snapshot, images }, written once; any bad record refuses the run (needs dataRootRepositoryUrl in edition-workspace.json; anyone who can delete registry tags can remove newer records and this then pins the newest remaining valid one, and the guard is part 07's: deploy-latest's owner refuses a snapshot that goes backwards)
+xema edition develop select-records --branch develop --registry <root> --cosign <abs path> --out <file> [--at <ISO-8601 UTC>] [--published-pins <file>]   # newest signed build record per graph member (the newest COMMIT on develop, every record verified; --published-pins keeps a published commit the records are not ahead of, part 07 passes it) -> { pins, snapshot, behind, images, currentResolution }, written once (a member whose firstPartySources entry declares `currentResolution: "<ticket>"`, xema-docs until XEMA-2373, is skipped with no registry read, listed in currentResolution and printed as `xema-docs: current resolution (leaves the edition, XEMA-2373)`) (behind = { <repo>: { head, commits } }: develop's head and the commits the pinned one trails it by; stdout gets one `<short name>: record <commit>, <N> commits behind HEAD` line per member, always `commits`, short name = the repo's last path segment and unambiguous; images[] entries carry `member`); any bad record refuses the run (needs dataRootRepositoryUrl in edition-workspace.json; anyone who can delete registry tags can remove newer records and this then pins the newest remaining valid one, and the guard is part 07's: deploy-latest's owner refuses a snapshot that goes backwards)
+xema edition develop image-record <id> --selection <file> --pins <file> --out <file>   # the edition's image build record (what `resolve --images-from` reads) from a select-records selection: subjects are the checked-out snapshot's first-party image subjects; a current-resolution member's (xema-docs) is probed and goes in `images`, every other takes the selection's image of its develop repository (selected commit must equal the snapshot's) and goes in `satellites`; platforms read by digest; any gap refuses and writes nothing; written once
 xema edition develop verify-image-record --image <name>@sha256:<digest> --producer <owner/repo> --registry <root> --cosign <abs path>   # is the digest bound to the producer by an authenticated develop build record (shared verify core with select-records). Records are read newest run first (listBuildRecordRuns sorts by compareBuildRecordRuns: run, then attempt, highest first), a verified record of a workflow other than the producer's `.github/workflows/ci.yaml` is skipped, and the answer is the newest ci.yaml record listing the exact image -> { image, digest, producer, commit }. `commit` is the commit of the newest verified ci.yaml record (by run number, then attempt) that lists the digest; it can be an older commit when a later run targeted it, and for an image the producer reused by content hash it is NOT the commit that built it. This is safe because the digest is what binds the bytes. Refuses when no ci.yaml record lists the image, the record names another producer, or cosign refuses the identity
 xema edition develop check-overrides --overrides <json> --data-root <dir>   # data root only
 xema edition ceiling --distribution <id> --at <distributions sha> --producer-commit <owner/repo>=<sha> [...] --data-root <dir> --sources-root <dir> --kernel <dir>   # the dev ceiling (DevelopCeilingSchema from @xemahq/contracts/develop-ceiling): selection, origin, repo and trustCeiling from the definition and indexes at --at; version, services, runtimeComponents and serviceProcessFacts from each producer's xema-biome.json and xema-biome.index.json at its --producer-commit; a missing commit or manifest refuses, with no fallback
@@ -126,7 +127,7 @@ The develop graph is the data root's first-party repositories, declared in `edit
 
 - Each key is a repository handle (`repos/<x>` or `submodules/<x>`); `sourceId` is its kebab-case source id; `repositoryUrl` is canonical HTTPS under `sourceRepositoryUrlPrefix`. Both are unique. The retired string form (`"repos/x": "x"`) is refused with `RetiredFirstPartySourceShapeError`.
 - `imageOrigin` says where the source's images come from on the everyday lane: `workspace` (built by the job in the aggregator workspace) or `satellite` (a producer outside it, such as `submodules/xema-host-web`, that publishes its own signed develop digest). The parse accepts a source without it and fills in no default; `--images-from` refuses such a source (see below).
-- `xema edition develop freeze-graph` pins every declared repository at the `develop` head of its declared URL; overrides may name any of them. The snapshot's `repositoryPins` (`develop resolve`, `checkout-indexed-source-repositories.mjs --snapshot-pins`) are exactly these repositories. The runtime image source index's `repositoryPins` are release pins and are not read on develop.
+- `xema edition develop freeze-graph` pins every declared repository at the `develop` head of its declared URL; overrides may name any of them. With `--member-pins <selection file>` (a select-records selection; only `.pins`, 40-hex, is read) each member is pinned at its selected record commit instead: the selection must pin exactly the graph minus its `currentResolution` members (equal to the graph members' declared `currentResolution`; a missing or extra member is refused by name), a `currentResolution` member (xema-docs, XEMA-2373) is pinned at its develop head, and `--member-pins` with `--overrides` is refused. The snapshot's `repositoryPins` (`develop resolve`, `checkout-indexed-source-repositories.mjs --snapshot-pins`) are exactly these repositories. The runtime image source index's `repositoryPins` are release pins and are not read on develop.
 - A first-party repository is in the develop graph before any release pins it. The converse is checked offline: every `repositoryPins` entry must be declared first-party at the same `repositoryUrl`.
 
 ## Develop images from a build record
@@ -177,9 +178,13 @@ The edition library builds, validates and verifies evidence statements; it never
 - `xema edition evidence statement catalogue stage|accept` (vendor) derives the E4 statement from `--artifact oci://<repository>@sha256:<digest>` and `--offering <id>`, and `accept` attaches the signed statement and bundle to the artifact as a referrer. A release catalogue is verified before it is read, by the data root's pinned built verifier (`catalogue-evidence arming|verify` mode of the bundle, which uses its own embedded kernel because the catalogue's kernel is not adopted yet); `xema edition release resolve` and `check-existing` take `--cosign <absolute path>` for it.
 - `oras` is located with `XEMA_ORAS_BIN` or `PATH` and must hash to a pinned digest. It runs with a scrubbed environment, so proxy and CA variables do not reach it.
 
+## Previous seal
+
+A write of `images.lock.json` (`resolve-images`, `xema edition develop resolve`) takes exactly one of `--previous-lock <lock> --previous-lock-sha256 <hex>` or `--first-seal`; the CLI refuses unless the lock's bytes hash to the digest, which the caller takes from the images.lock layer of the signed, published edition (the latest, under the per-edition concurrency group). The in-repo resolve and pin/unpin take the committed `images.lock.json` at the target path as the previous lock (first seal when absent). The the composed artifacts' generations carry forward from it.
+
 ## Kernel protocol and pins
 
-The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39 and v40 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
+The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40 and v41 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
 
 A develop edition does not take the kernel's develop head blindly: `xema edition develop choose-kernel --kernel <package dir> [--kernel-pin <40-hex>] --out <file>` reads the declared protocol of each commit on the checkout's first-parent history (from source, unbuilt) and chooses the newest one this CLI supports. It writes `{chosenSha, headSha, held, reason}` (`reason`: `head-supported` | `head-ahead` | `explicit-pin`; `held` is `head-ahead`), and when held prints `kernel held at v<N> (<sha12>), head at v<M> (<sha12>): raise the CLI` (stdout only, never persisted). The head is the checkout's `refs/remotes/origin/develop` (a full-history checkout). An explicit pin wins but is still checked, and must be on that head's first-parent history (`not-on-develop` otherwise); when no commit is supported it refuses (`EditionProtocolMismatchError`, `no-supported-commit`; the walk ends at the first commit with no declaration file) and never falls back to the head; a declaration that exists but does not parse, at the head or any walked commit, is refused by name (`unparseable`), never skipped. `freeze-graph` applies the same check to `--kernel-sha`.
 

package/edition/check-committed-image-evidence.mjs

@@ -66,6 +66,7 @@ import {
   evidenceDirectoryForDigest,
   sha256Digest,
 } from './image-evidence.mjs';
+import { evidenceSubjectKey } from './image-subject-identity.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import {
   assertProducerInput,
@@ -124,6 +125,29 @@ function assertContainedRelativePath(value, label) {
  *
  * @returns {{ evidenceDirectory: string, reusable: boolean, reason: string }}
  */
+/**
+ * The key of an index entry: its subject's evidence identity, which for a composed artifact names the generation, so it is read
+ * from the statement the entry points at (the index states only kind and id). An entry whose statement cannot be read keeps
+ * `kind\0id`; the unusable statement is reported below.
+ */
+export function entryKey(entry, absoluteDirectory) {
+  try {
+    const { predicate } = JSON.parse(
+      readBoundedFile(join(absoluteDirectory, assertContainedRelativePath(entry.evidence.statementPath, 'statementPath'))).toString('utf8'),
+    );
+    return evidenceSubjectKey({
+      kind: entry.subjectKind,
+      id: entry.subjectId,
+      imageRef: predicate.artifact.imageRepository,
+      contentHash: predicate.source.sourceTreeHash,
+    });
+  } catch {
+    return `${entry.subjectKind}\0${entry.subjectId}`;
+  }
+}
+
+const printable = (key) => key.replaceAll('\0', ':');
+
 export async function assessCommittedEvidence({
   input,
   repositoryRoot,
@@ -190,7 +214,12 @@ export async function assessCommittedEvidence({
   }
   const expectedByKey = new Map(
     expectedStatements.map((statement) => [
-      `${statement.predicate.source.kind}:${statement.predicate.source.id}`,
+      evidenceSubjectKey({
+        kind: statement.predicate.source.kind,
+        id: statement.predicate.source.id,
+        imageRef: statement.predicate.artifact.imageRepository,
+        contentHash: statement.predicate.source.sourceTreeHash,
+      }),
       statement,
     ]),
   );
@@ -200,20 +229,20 @@ export async function assessCommittedEvidence({
     if (entry === null || typeof entry !== 'object') {
       return unusable('producer-evidence.json carries a non-object entry');
     }
-    const key = `${entry.subjectKind}:${entry.subjectId}`;
+    const key = entryKey(entry, absoluteDirectory);
     if (seen.has(key)) {
-      return unusable(`producer-evidence.json duplicates subject ${key}`);
+      return unusable(`producer-evidence.json duplicates subject ${printable(key)}`);
     }
     seen.add(key);
     const expected = expectedByKey.get(key);
     if (expected === undefined) {
       return unusable(
-        `committed evidence carries subject ${key}, which this input does not evidence`,
+        `committed evidence carries subject ${printable(key)}, which this input does not evidence`,
       );
     }
     const descriptor = entry.evidence;
     if (descriptor === null || typeof descriptor !== 'object') {
-      return unusable(`subject ${key} has no evidence descriptor`);
+      return unusable(`subject ${printable(key)} has no evidence descriptor`);
     }
     let statementBytes;
     let bundleBytes;
@@ -223,7 +252,7 @@ export async function assessCommittedEvidence({
           absoluteDirectory,
           assertContainedRelativePath(
             descriptor.statementPath,
-            `subject ${key} statementPath`,
+            `subject ${printable(key)} statementPath`,
           ),
         ),
       );
@@ -232,25 +261,25 @@ export async function assessCommittedEvidence({
           absoluteDirectory,
           assertContainedRelativePath(
             descriptor.bundlePath,
-            `subject ${key} bundlePath`,
+            `subject ${printable(key)} bundlePath`,
           ),
         ),
       );
     } catch (error) {
-      return unusable(`subject ${key} artifacts are unreadable: ${error.message}`);
+      return unusable(`subject ${printable(key)} artifacts are unreadable: ${error.message}`);
     }
     if (
       sha256Digest(statementBytes) !== descriptor.statementDigest ||
       sha256Digest(bundleBytes) !== descriptor.bundleDigest
     ) {
       return unusable(
-        `subject ${key} artifacts do not match the digests producer-evidence.json records`,
+        `subject ${printable(key)} artifacts do not match the digests producer-evidence.json records`,
       );
     }
     try {
       validateProducedBundle(statementBytes, bundleBytes);
     } catch (error) {
-      return unusable(`subject ${key} bundle is malformed: ${error.message}`);
+      return unusable(`subject ${printable(key)} bundle is malformed: ${error.message}`);
     }
     let committed;
     try {
@@ -259,7 +288,7 @@ export async function assessCommittedEvidence({
       );
     } catch (error) {
       return unusable(
-        `subject ${key} statement does not parse under the kernel schema: ${error.message}`,
+        `subject ${printable(key)} statement does not parse under the kernel schema: ${error.message}`,
       );
     }
     // producerRun is deliberately fresh on every execution (run id, attempt,
@@ -269,24 +298,24 @@ export async function assessCommittedEvidence({
     // validate the existing run's own signature and lifetime independently.
     if (!producerStatementMatchesInput(committed, expected)) {
       return unusable(
-        `subject ${key} committed statement is not bound to this producer input ` +
+        `subject ${printable(key)} committed statement is not bound to this producer input ` +
           '(authority, source, build, artifact or platform set changed)',
       );
     }
     const expiresAt = Date.parse(committed.predicate.producerRun.expiresAt);
     if (!Number.isFinite(expiresAt)) {
-      return unusable(`subject ${key} statement has an unreadable expiresAt`);
+      return unusable(`subject ${printable(key)} statement has an unreadable expiresAt`);
     }
     const remainingSeconds = Math.floor((expiresAt - now) / 1000);
     if (remainingSeconds <= 0) {
       return unusable(
-        `subject ${key} evidence EXPIRED at ${committed.predicate.producerRun.expiresAt} — ` +
+        `subject ${printable(key)} evidence EXPIRED at ${committed.predicate.producerRun.expiresAt} — ` +
           'it can never verify again and must be re-produced',
       );
     }
     if (remainingSeconds < MIN_REMAINING_TTL_SECONDS) {
       return unusable(
-        `subject ${key} evidence expires in ${remainingSeconds}s, under the ` +
+        `subject ${printable(key)} evidence expires in ${remainingSeconds}s, under the ` +
           `${MIN_REMAINING_TTL_SECONDS}s reuse floor — refreshing it now`,
       );
     }

package/edition/customer-edition-verbs.mjs

@@ -183,15 +183,20 @@ const ENGINE_IMAGE_FLAG = '--engine-image';
 const ENGINE_REPOSITORY_FLAG = '--engine-repository';
 const ENGINE_SIGNER_FLAG = '--engine-signer';
 export const IMAGES_FROM_FLAG = '--images-from';
+export const PREVIOUS_LOCK_FLAG = '--previous-lock';
+export const PREVIOUS_LOCK_SHA256_FLAG = '--previous-lock-sha256';
+export const FIRST_SEAL_FLAG = '--first-seal';
 
 const COMMANDS = Object.freeze({
   resolve: {
     positional: true,
     // --images-from: the everyday job's image build record (images-from-record.mjs) instead of the registry probe; vendor only.
-    values: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG, IMAGES_FROM_FLAG],
-    switches: ['--local'],
+    // --previous-lock with --previous-lock-sha256 (the digest of the latest signed, published edition's images.lock layer, passed by the workflow under
+    // the per-edition concurrency group) or --first-seal: the previous seal whose composed artifacts carry their generation forward; vendor only.
+    values: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG, IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG],
+    switches: ['--local', FIRST_SEAL_FLAG],
     required: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG],
-    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS, SOURCE_IMAGE_FLAG, COSIGN_FLAG, ENGINE_IMAGE_FLAG], required: ['--pins', '--out', '--registry', '--engine-image'], refused: [IMAGES_FROM_FLAG], cosign: true },
+    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS, SOURCE_IMAGE_FLAG, COSIGN_FLAG, ENGINE_IMAGE_FLAG], required: ['--pins', '--out', '--registry', '--engine-image'], refused: [IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG, FIRST_SEAL_FLAG], cosign: true },
     // A vendor resolve finds its engine itself; the old flag is refused by name, never read as a customer flag.
     removedFromVendor: { [ENGINE_IMAGE_FLAG]: `use ${ENGINE_REPOSITORY_FLAG} and ${ENGINE_SIGNER_FLAG}` },
   },
@@ -210,7 +215,7 @@ const COMMANDS = Object.freeze({
   },
   'freeze-graph': {
     positional: false,
-    values: ['--data-sha', '--kernel-sha', '--deploy-sha', '--editions-root-url', '--overrides', '--out'],
+    values: ['--data-sha', '--kernel-sha', '--deploy-sha', '--editions-root-url', '--overrides', '--member-pins', '--out'],
     switches: [],
     required: ['--data-sha', '--kernel-sha', '--deploy-sha', '--out'],
   },
@@ -233,6 +238,12 @@ const COMMANDS = Object.freeze({
     switches: [],
     required: ['--branch', '--registry', '--cosign', '--out'],
   },
+  'image-record': {
+    positional: true,
+    values: ['--selection', '--pins', '--out'],
+    switches: [],
+    required: ['--selection', '--pins', '--out'],
+  },
   'verify-image-record': {
     positional: false,
     values: ['--image', '--producer', '--registry', '--cosign'],

package/edition/develop-current-resolution.mjs

@@ -0,0 +1,29 @@
+// develop-current-resolution — the members that keep the CURRENT develop resolution instead of a signed build record.
+//
+// A member keeps its current resolution (develop HEAD freeze plus the registry probe) only when the data root declares
+// it: `currentResolution: "<ticket>"` on its `firstPartySources` entry in edition-workspace.json, the ticket that
+// removes the exception (today xema-docs, whose develop lane is unsigned by owner decision and which leaves the
+// edition). It is a declared exception, not a fallback: absent means none, and every other member without a record
+// still refuses.
+
+import { compareStrings } from './lib.mjs';
+
+/** Whether a member (or its `firstPartySources` entry) keeps its current resolution. */
+export const keepsCurrentResolution = (member) => Object.hasOwn(member, 'currentResolution');
+
+/** The graph `members` that declare a current resolution, repo -> ticket, keys sorted: what a selection records. */
+export function currentResolutionOf(members) {
+  return Object.fromEntries(
+    members
+      .filter(keepsCurrentResolution)
+      .map(({ repo, currentResolution }) => [repo, currentResolution])
+      .sort(([a], [b]) => compareStrings(a, b)),
+  );
+}
+
+/** Why a selection's `currentResolution` (absent = none) is not exactly the one the graph `members` declare; null when it is. */
+export function currentResolutionProblem(declared, members) {
+  const expected = currentResolutionOf(members);
+  if (JSON.stringify(declared ?? {}) === JSON.stringify(expected)) {return null;}
+  return `"currentResolution" is ${JSON.stringify(declared)}, not ${JSON.stringify(expected)}, the members the data root declares keep their current resolution`;
+}

package/edition/develop-edition-resolve.mjs

@@ -79,8 +79,9 @@ export async function resolveDevelopSnapshot({ id, pins, steps = DEVELOP_EDITION
  * @param {object} request
  * @param {object} [request.imagesFrom] a parsed image build record (images-from-record.mjs): the digests are the record's,
  *   with no probe and no rehash, and `verifySatellites` (createSatelliteVerifier) admits its satellite entries
+ * @param {object|null} [request.previousLock] the previous edition's parsed images lock: its composed artifacts carry their generation forward (null: generation 1)
  */
-export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, env = process.env, sealOptions = {}, fetchKernelTarball, fetchManifest = fetchRegistryManifest, progress = stderrProgress, steps = DEVELOP_EDITION_STEPS, imagesFrom, verifySatellites }) {
+export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, env = process.env, sealOptions = {}, fetchKernelTarball, fetchManifest = fetchRegistryManifest, progress = stderrProgress, steps = DEVELOP_EDITION_STEPS, imagesFrom, verifySatellites, previousLock = null }) {
   if ((imagesFrom === undefined) !== (verifySatellites === undefined)) {
     throw new Error('resolveDevelopEdition takes an image build record and its satellite verifier together, or neither');
   }
@@ -135,7 +136,7 @@ export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, en
   let recorded;
   const imageLock = await checked(DevelopResolveCheck.DevelopImages, async () => {
     if (imagesFrom !== undefined) {
-      const fromRecord = await resolveImagesFromRecord({ id, inputs, lock, record: imagesFrom, resolveImages: steps.resolveImages, verifySatellites });
+      const fromRecord = await resolveImagesFromRecord({ id, inputs, lock, record: imagesFrom, resolveImages: steps.resolveImages, verifySatellites, previousLock });
       ({ recorded } = fromRecord);
       phase(`image subjects taken from the build record (${fromRecord.imageLock.subjects.length} subjects); satellites verified`);
       return fromRecord.imageLock;
@@ -148,7 +149,7 @@ export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, en
       ...(sealOptions.run === undefined ? {} : { run: sealOptions.run }),
       progress,
     });
-    const resolved = await steps.resolveImages(id, { inputs, lock, onSubjectHashed: probe.observe });
+    const resolved = await steps.resolveImages(id, { inputs, lock, onSubjectHashed: probe.observe, previousLock });
     phase(`image content hashes computed (${resolved.imageLock.subjects.length} subjects)`);
     await probe.settle();
     phase('every develop image is present');

package/edition/develop-edition.mjs

@@ -41,10 +41,14 @@
 //       the same for a customer edition (id = the definition's; the tag covers the pinned catalogue digest).
 //   freeze-graph --data-sha <sha> --kernel-sha <sha>
 //                --deploy-sha <sha> [--editions-root-url <https url>]
-//                [--overrides <json>] --out <file>
+//                [--overrides <json> | --member-pins <selection file>] --out <file>
 //       resolve refs/heads/develop once per develop-graph repository (the data root's
 //       firstPartySources, at each declared URL) and the editions root; the three checked-out
-//       repositories are pinned at what the workflow checked out; write the pins. --kernel-sha is refused
+//       repositories are pinned at what the workflow checked out; write the pins. --member-pins takes a select-records
+//       selection (only .pins, 40-hex, is read) and pins each graph member at its selected record commit instead of its
+//       develop head: the selection must pin exactly the graph minus its currentResolution members (which must equal
+//       the graph members' declared currentResolution), a missing or extra member is refused by name, and a currentResolution
+//       member is pinned at its develop head. --member-pins together with --overrides is refused. --kernel-sha is refused
 //       unless its declared edition protocol is one this CLI supports (the check choose-kernel applies to a pin).
 //   check-existing <id> --pins <file> --artifact <dir> --engine-image <repository>@sha256:<digest>
 //       refuse to reuse a pulled artifact whose descriptor disagrees with this snapshot.
@@ -71,7 +75,7 @@
 //       for every develop-graph member, take the newest build record the data root's record workflow signed for
 //       the branch (<root>/build-records/<name>, verified offline by digest against the pinned trusted root, as
 //       signed by <data root>/.github/workflows/record-build.yaml at refs/heads/<branch>, called by the member at the
-//       record's own commit) and write { pins, snapshot, images }, once (wx). Any missing, unsigned, mismatched or
+//       record's own commit) and write { pins, snapshot, behind, images, currentResolution }, once (wx); a member that keeps its current resolution (a declared currentResolution, develop-current-resolution.mjs) is skipped with no registry read, listed in currentResolution, and printed as `xema-docs: current resolution (leaves the edition, XEMA-2373)`; behind is { <repo>: { head, commits } }, develop's head and how many commits the selected one trails it by, and one line per member `<short name>: record <commit>, <N> commits behind HEAD` goes to stdout (always `commits`; short name = the repo's last path segment, refused when two members share one); images[] entries carry `member`, the owning repo handle. Any missing, unsigned, mismatched or
 //       unreadable record refuses the whole run and writes nothing: a newer bad record is never skipped for an older
 //       one. --at takes the newest record completed at or before that time. Only `develop` has a declared signer; the
 //       data root must declare dataRootRepositoryUrl. Takes the roots `resolve` takes (no registry root is implied).
@@ -83,6 +87,14 @@
 //       part 07 passes the flag.
 //       Residual: anyone who can delete registry tags can remove newer records, and this then pins the newest remaining
 //       valid one; the guard is part 07's, deploy-latest's owner refuses a snapshot that goes backwards.
+//   image-record <id> --selection <file> --pins <file> --out <file>
+//       write the edition's image build record (the file `resolve --images-from` reads) from a select-records selection:
+//       the subjects are the checked-out snapshot's first-party image subjects (enumerated as `coverage` does). A subject of
+//       a member that keeps its current resolution (a declared currentResolution, develop-current-resolution.mjs) is probed as resolve probes it
+//       and goes in `images`; every other first-party subject takes the selection's image of its develop repository, whose
+//       selected commit must be the snapshot's, and goes in `satellites`. Platforms are read from the registry by digest.
+//       Any subject without an image, any commit mismatch refuses the whole run and writes nothing, once (wx). Third-party
+//       subjects are ignored. Takes the roots `resolve` takes.
 //   choose-kernel [--kernel-pin <40-hex>] --out <file>
 //       choose the develop kernel commit in the --kernel checkout (full history; its refs/remotes/origin/develop is the develop head):
 //       the newest first-parent commit whose declared edition protocol this CLI supports
@@ -106,14 +118,17 @@
 import { resolve } from 'node:path';
 
 import { writeCatalogue } from './catalogue.mjs';
-import { CUSTOMER_ROOTS, IMAGES_FROM_FLAG, headResolver, parseEditionVerbArgs, runCustomerVerb, writeOnce } from './customer-edition-verbs.mjs';
+import { CUSTOMER_ROOTS, FIRST_SEAL_FLAG, IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG, headResolver, parseEditionVerbArgs, runCustomerVerb, writeOnce } from './customer-edition-verbs.mjs';
 import { DEFINITION_FLAG } from './customer-flags.mjs';
 import { runDevelopCoverage } from './develop-coverage-run.mjs';
 import { CoverageExit } from './develop-coverage.mjs';
 import { resolveDevelopEdition } from './develop-edition-resolve.mjs';
 import { resolveDevelopEngineImage } from './develop-engine-image.mjs';
 import { assertNoToolingOverride, freezeGraph, freezeSources } from './develop-freeze.mjs';
+import { developGraphMembers } from './develop-graph.mjs';
+import { runImageRecord } from './develop-image-record.mjs';
 import { runSelectRecords } from './develop-select-records.mjs';
+import { readSelectionPins } from './develop-selection-pins.mjs';
 import { runVerifyImageRecord } from './develop-verify-image-record.mjs';
 import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { EditionChannel, EditionKind } from './edition-constants.mjs';
@@ -124,6 +139,7 @@ import { assertKernelCommitSupported, chooseKernelCommit } from './kernel-protoc
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { snapshotPinSource } from './pin-source.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
+import { resolvePreviousSeal } from './resolve-images.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 
 // The roots a verb takes. A customer form (it names --definition) takes fewer, and never the kernel (the
@@ -167,8 +183,8 @@ function parseOverrides(text) {
 }
 
 /** The target-tag input of `--images-from`: the record's digest, or nothing on the probe path. */
-function imageBuildRecordTagInput(options) {
-  return options[IMAGES_FROM_FLAG] === undefined ? {} : { imageBuildRecordDigest: imageBuildRecordDigest(readImageBuildRecord(options[IMAGES_FROM_FLAG])) };
+async function imageBuildRecordTagInput(options) {
+  return options[IMAGES_FROM_FLAG] === undefined ? {} : { imageBuildRecordDigest: imageBuildRecordDigest(await readImageBuildRecord(options[IMAGES_FROM_FLAG])) };
 }
 
 async function run(argv, env) {
@@ -176,7 +192,7 @@ async function run(argv, env) {
   switch (command) {
     case 'target': {
       if (customer) {return runCustomerVerb({ channel: EditionChannel.Develop, command, options, env });}
-      console.log(developEditionTarget(id, readStrictJsonFile(options['--pins']), { registry: options['--registry'], engineImage: options['--engine-image'], ...imageBuildRecordTagInput(options) }));
+      console.log(developEditionTarget(id, readStrictJsonFile(options['--pins']), { registry: options['--registry'], engineImage: options['--engine-image'], ...(await imageBuildRecordTagInput(options)) }));
       return;
     }
     case 'resolve': {
@@ -190,12 +206,13 @@ async function run(argv, env) {
         env,
         engine: { repository: options['--engine-repository'], signer: options['--engine-signer'] },
         cosignBinary: options['--cosign'],
+        previousLock: await resolvePreviousSeal({ distributionId: id, previousLockPath: options[PREVIOUS_LOCK_FLAG], previousLockSha256: options[PREVIOUS_LOCK_SHA256_FLAG], firstSeal: Boolean(options[FIRST_SEAL_FLAG]) }),
         ...(options[IMAGES_FROM_FLAG] === undefined ? {} : {
-          imagesFrom: readImageBuildRecord(options[IMAGES_FROM_FLAG]),
+          imagesFrom: await readImageBuildRecord(options[IMAGES_FROM_FLAG]),
           verifySatellites: createSatelliteVerifier({ registry: options['--registry'], cosignBinary: options['--cosign'], env }),
         }),
       });
-      const target = developEditionTarget(id, pins, { registry: options['--registry'], engineImage, ...imageBuildRecordTagInput(options) });
+      const target = developEditionTarget(id, pins, { registry: options['--registry'], engineImage, ...(await imageBuildRecordTagInput(options)) });
       const outDir = resolve(options['--out']);
       writeEditionArtifact({
         outDir,
@@ -232,6 +249,9 @@ async function run(argv, env) {
     case 'select-records':
       await runSelectRecords({ options, env });
       return;
+    case 'image-record':
+      await runImageRecord({ id, options, env });
+      return;
     case 'verify-image-record':
       await runVerifyImageRecord({ options, env });
       return;
@@ -265,6 +285,7 @@ async function run(argv, env) {
         deploySha: options['--deploy-sha'],
         editionsRootUrl: options['--editions-root-url'],
         overrides: parseOverrides(options['--overrides']),
+        ...(options['--member-pins'] === undefined ? {} : { memberPins: readSelectionPins(options['--member-pins'], '--member-pins', developGraphMembers()) }),
         ...headResolver(EditionChannel.Develop, env),
       });
       writeOnce(options['--out'], pins);

package/edition/develop-freeze.mjs

@@ -9,6 +9,9 @@
 //   freezeGraph    the graph repositories, the data root, the kernel, the deploy checkout, the editions root
 //   freezeSources  one pin per `sources[]` entry the chain declares
 //
+// With `memberPins` (a select-records selection) the members are pinned at the selected build records instead; the one
+// declared exception, a member that keeps its current resolution, is pinned at its develop head.
+//
 // `resolveHead({ name, url })` is the one network seam (default: `git ls-remote` through
 // git-source-auth: the data root's token only for a repository under its
 // `sourceRepositoryUrlPrefix`, no credential for any other, never argv).
@@ -16,6 +19,7 @@
 import { execFileSync } from 'node:child_process';
 
 import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
+import { currentResolutionOf } from './develop-current-resolution.mjs';
 import { developGraphMembers } from './develop-graph.mjs';
 import { EditionChannel } from './edition-channel.mjs';
 import { assertCanonicalSourceUrl, assertSourceDeclaresNoCredential, isUnderSourcePrefix, withSourceGitEnv } from './git-source-auth.mjs';
@@ -124,6 +128,17 @@ function assertOverrides(overrides, allowed) {
   }
 }
 
+/** The member pins name exactly the graph minus the current-resolution members; a missing or extra member is refused by name. */
+function assertMemberPinsAreTheGraph(memberPins, members) {
+  const current = new Set(Object.keys(currentResolutionOf(members)));
+  const expected = members.map(({ repo }) => repo).filter((repo) => !current.has(repo));
+  const missing = expected.filter((repo) => !Object.hasOwn(memberPins, repo));
+  const extra = Object.keys(memberPins).filter((repo) => !expected.includes(repo));
+  if (missing.length > 0 || extra.length > 0) {
+    throw new Error(`--member-pins must pin exactly the develop graph minus ${JSON.stringify([...current])}: missing ${JSON.stringify(missing)}, extra ${JSON.stringify(extra)}`);
+  }
+}
+
 const GRAPH_PHASE = new Set([
   SnapshotPinNamespace.Graph,
   SnapshotPinNamespace.Distributions,
@@ -149,6 +164,9 @@ function assertCheckedOutPin({ key, sha, flag, what, overrides }) {
  * @param {string} request.kernelSha the commit the kernel checkout is at
  * @param {string} request.deploySha the commit the deploy checkout is at
  * @param {string} [request.editionsRootUrl] https URL of the editions root; absent = this repository
+ * @param {Record<string, string>} [request.memberPins] the graph members' pins from a selection (`--member-pins`): exactly the
+ *   graph minus the members that keep their current resolution (develop-current-resolution.mjs), which are pinned at their
+ *   develop head; refused together with overrides
  * @param {(source: {name: string, url: string}) => void} request.holdSource the hold of one source; runs for ALL graph sources before the first head
  */
 export function freezeGraph({
@@ -157,9 +175,13 @@ export function freezeGraph({
   deploySha,
   editionsRootUrl,
   overrides = {},
+  memberPins,
   resolveHead,
   holdSource,
 }) {
+  if (memberPins !== undefined && Object.keys(overrides).length > 0) {
+    throw new Error('--member-pins and --overrides are exclusive: the member pins are the selected build records, never overridden');
+  }
   assertNoToolingOverride(overrides);
   assertOverrides(overrides, GRAPH_PHASE);
   const head = memoizedHeads(resolveHead);
@@ -171,6 +193,7 @@ export function freezeGraph({
       throw new Error(`override names "${key}", which is not a repository in the graph`);
     }
   }
+  if (memberPins !== undefined) {assertMemberPinsAreTheGraph(memberPins, members);}
   const checkedOut = [
     { key: dataPinKey(), sha: dataSha, flag: '--data-sha', what: 'the data root checkout' },
     { key: kernelPinKey(), sha: kernelSha, flag: '--kernel-sha', what: 'the kernel checkout' },
@@ -188,7 +211,7 @@ export function freezeGraph({
   }
   const pins = Object.fromEntries(checkedOut.map(({ key, sha }) => [key, sha]));
   for (const member of members) {
-    pins[member.repo] = overrides[member.repo] ?? head({ name: member.repo, url: member.repositoryUrl });
+    pins[member.repo] = overrides[member.repo] ?? memberPins?.[member.repo] ?? head({ name: member.repo, url: member.repositoryUrl });
   }
   if (editionsRootUrl !== undefined) {
     const url = canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url');

package/edition/develop-graph.mjs

@@ -13,14 +13,16 @@ import { compareStrings } from './lib.mjs';
 
 /**
  * The develop graph: `{ repo, repositoryUrl }` per declared first-party
- * repository, sorted by repo handle.
+ * repository, sorted by repo handle, plus `currentResolution` (its ticket) on a
+ * member the data root declares one for (develop-current-resolution.mjs).
  *
- * @returns {readonly { repo: string, repositoryUrl: string }[]}
+ * @returns {readonly { repo: string, repositoryUrl: string, currentResolution?: string }[]}
  */
 export function developGraphMembers() {
   return Object.freeze(
     Object.entries(firstPartySources('the develop graph'))
-      .map(([repo, { repositoryUrl }]) => Object.freeze({ repo, repositoryUrl }))
+      .map(([repo, { repositoryUrl, currentResolution }]) =>
+        Object.freeze({ repo, repositoryUrl, ...(currentResolution === undefined ? {} : { currentResolution }) }))
       .sort((a, b) => compareStrings(a.repo, b.repo)),
   );
 }