@xemahq/xema 0.54.0 → 0.56.0

package/dist/runtime/lock-loader.d.ts

@@ -1,4 +1,4 @@
-import { type DistributionLockReadView, type RuntimeImagePlatform } from '@xemahq/contracts/distribution';
+import { type DistributionLockReadView, type RuntimeImagePlatform, type RuntimeImageSubject } from '@xemahq/contracts/distribution';
 import { type ArtifactResolution } from './paths';
 export interface LoadedDistributionLock {
     readonly lock: DistributionLockReadView;
@@ -20,4 +20,5 @@ export interface LoadedImageLock {
     readonly resolution: ArtifactResolution;
 }
 export declare function loadImageLock(opts: LoadLockOptions): LoadedImageLock;
+export declare function subjectIdentity(subject: RuntimeImageSubject): string;
 //# sourceMappingURL=lock-loader.d.ts.map

package/dist/runtime/lock-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock-loader.d.ts","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAE1B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAqD,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAarG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,sBAAsB,CASlF;AAQD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAQ7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAQ9B,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AA0BD,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAwBpE"}
+{"version":3,"file":"lock-loader.d.ts","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAqD,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAarG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,sBAAsB,CASlF;AAQD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAQ7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAQ9B,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AA0BD,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CA+BpE;AASD,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAIpE"}

package/dist/runtime/lock-loader.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadDistributionLock = loadDistributionLock;
 exports.loadImageLock = loadImageLock;
+exports.subjectIdentity = subjectIdentity;
 const node_fs_1 = require("node:fs");
 const distribution_1 = require("@xemahq/contracts/distribution");
 const paths_1 = require("./paths");
@@ -20,14 +21,21 @@ function loadImageLock(opts) {
     const lock = (0, distribution_1.parseImageLock)(readJson(resolution.path));
     const subjectsByKey = new Map();
     const imagesByService = new Map();
+    const subjectsByName = new Map();
     for (const subject of lock.subjects) {
-        subjectsByKey.set(subjectKey(subject.kind, subject.id), subject);
+        subjectsByKey.set(subjectIdentity(subject), subject);
     }
-    for (const [service, subject] of (0, distribution_1.serviceImageSubjects)(lock.subjects)) {
+    for (const subject of subjectsByKey.values()) {
+        const named = subjectsByName.get(`${subject.kind}:${subject.id}`);
+        if (named === undefined || (subject.generation ?? 0) >= (named.generation ?? 0)) {
+            subjectsByName.set(`${subject.kind}:${subject.id}`, subject);
+        }
+    }
+    for (const [service, subject] of (0, distribution_1.dedicatedServiceImageSubjects)(lock)) {
         imagesByService.set(service, toImageEntry(subject));
     }
     for (const binding of lock.platformServiceBindings) {
-        const subject = subjectsByKey.get(subjectKey(binding.subjectKind, binding.subjectId));
+        const subject = subjectsByName.get(`${binding.subjectKind}:${binding.subjectId}`);
         if (subject === undefined) {
             throw new Error(`Invariant violated reading ${resolution.path}: platform service ` +
                 `"${binding.platformService}" binds the ${binding.subjectKind} subject ` +
@@ -37,8 +45,10 @@ function loadImageLock(opts) {
     }
     return { imagesByService, resolution };
 }
-function subjectKey(kind, id) {
-    return `${kind}:${id}`;
+function subjectIdentity(subject) {
+    return subject.kind === distribution_1.RuntimeImageSubjectKind.ComposedProcess
+        ? `${subject.kind}:${subject.imageRef}:${subject.contentHash}`
+        : `${subject.kind}:${subject.id}`;
 }
 function toImageEntry(subject) {
     return {

package/dist/runtime/lock-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock-loader.js","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":";;AAoCA,oDASC;AAyDD,sCAwBC;AA9HD,qCAAuC;AAEvC,iEAQwC;AAExC,mCAAqG;AAwBrG,SAAgB,oBAAoB,CAAC,IAAqB;IACxD,MAAM,UAAU,GAAG,IAAA,mCAA2B,EAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,8CAA+B,EAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAyDD,SAAgB,aAAa,CAAC,IAAqB;IACjD,MAAM,UAAU,GAAG,IAAA,4BAAoB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAA,mCAAoB,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8BAA8B,UAAU,CAAC,IAAI,qBAAqB;gBAChE,IAAI,OAAO,CAAC,eAAe,eAAe,OAAO,CAAC,WAAW,WAAW;gBACxE,IAAI,OAAO,CAAC,SAAS,+CAA+C,CACvE,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,IAA6B,EAAE,EAAU;IAC3D,OAAO,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}
+{"version":3,"file":"lock-loader.js","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":";;AAoCA,oDASC;AAyDD,sCA+BC;AASD,0CAIC;AAlJD,qCAAuC;AAEvC,iEAQwC;AAExC,mCAAqG;AAwBrG,SAAgB,oBAAoB,CAAC,IAAqB;IACxD,MAAM,UAAU,GAAG,IAAA,mCAA2B,EAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,8CAA+B,EAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAyDD,SAAgB,aAAa,CAAC,IAAqB;IACjD,MAAM,UAAU,GAAG,IAAA,4BAAoB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;YAChF,cAAc,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAA,4CAA6B,EAAC,IAAI,CAAC,EAAE,CAAC;QACrE,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8BAA8B,UAAU,CAAC,IAAI,qBAAqB;gBAChE,IAAI,OAAO,CAAC,eAAe,eAAe,OAAO,CAAC,WAAW,WAAW;gBACxE,IAAI,OAAO,CAAC,SAAS,+CAA+C,CACvE,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AASD,SAAgB,eAAe,CAAC,OAA4B;IAC1D,OAAO,OAAO,CAAC,IAAI,KAAK,sCAAuB,CAAC,eAAe;QAC7D,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE;QAC9D,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/edition/README.md

@@ -82,7 +82,8 @@ xema edition artifact <id> --channel release --registry <ns> --coordinate <tag>
 xema edition develop <freeze-sources|resolve|target|check-existing> ...
 # develop tag = sha256 of { cli, engine, pins, sourceImages }; target and check-existing take --engine-image, and a customer's --source-image
 xema edition develop coverage <id> --pins <file> --cosign <abs path> [--json]   # read-only forecast (policy held to its pin, this CLI's own verifier code): is each develop image producer-signed? exit 0 covered, 1 not, 2 error
-xema edition develop select-records --branch develop --registry <root> --cosign <abs path> --out <file> [--at <ISO-8601 UTC>] [--published-pins <file>]   # newest signed build record per graph member (the newest COMMIT on develop, every record verified; --published-pins keeps a published commit the records are not ahead of, part 07 passes it) -> { pins, snapshot, images }, written once; any bad record refuses the run (needs dataRootRepositoryUrl in edition-workspace.json; anyone who can delete registry tags can remove newer records and this then pins the newest remaining valid one, and the guard is part 07's: deploy-latest's owner refuses a snapshot that goes backwards)
+xema edition develop select-records --branch develop --registry <root> --cosign <abs path> --out <file> [--at <ISO-8601 UTC>] [--published-pins <file>]   # newest signed build record per graph member (the newest COMMIT on develop, every record verified; --published-pins keeps a published commit the records are not ahead of, part 07 passes it) -> { pins, snapshot, behind, images, currentResolution }, written once (a member whose firstPartySources entry declares `currentResolution: "<ticket>"`, xema-docs until XEMA-2373, is skipped with no registry read, listed in currentResolution and printed as `xema-docs: current resolution (leaves the edition, XEMA-2373)`) (behind = { <repo>: { head, commits } }: develop's head and the commits the pinned one trails it by; stdout gets one `<short name>: record <commit>, <N> commits behind HEAD` line per member, always `commits`, short name = the repo's last path segment and unambiguous; images[] entries carry `member`); any bad record refuses the run (needs dataRootRepositoryUrl in edition-workspace.json; anyone who can delete registry tags can remove newer records and this then pins the newest remaining valid one, and the guard is part 07's: deploy-latest's owner refuses a snapshot that goes backwards)
+xema edition develop image-record <id> --selection <file> --pins <file> --out <file>   # the edition's image build record (what `resolve --images-from` reads) from a select-records selection: subjects are the checked-out snapshot's first-party image subjects; a current-resolution member's (xema-docs) is probed and goes in `images`, every other takes the selection's image of its develop repository (selected commit must equal the snapshot's) and goes in `satellites`; platforms read by digest; any gap refuses and writes nothing; written once
 xema edition develop verify-image-record --image <name>@sha256:<digest> --producer <owner/repo> --registry <root> --cosign <abs path>   # is the digest bound to the producer by an authenticated develop build record (shared verify core with select-records). Records are read newest run first (listBuildRecordRuns sorts by compareBuildRecordRuns: run, then attempt, highest first), a verified record of a workflow other than the producer's `.github/workflows/ci.yaml` is skipped, and the answer is the newest ci.yaml record listing the exact image -> { image, digest, producer, commit }. `commit` is the commit of the newest verified ci.yaml record (by run number, then attempt) that lists the digest; it can be an older commit when a later run targeted it, and for an image the producer reused by content hash it is NOT the commit that built it. This is safe because the digest is what binds the bytes. Refuses when no ci.yaml record lists the image, the record names another producer, or cosign refuses the identity
 xema edition develop check-overrides --overrides <json> --data-root <dir>   # data root only
 xema edition ceiling --distribution <id> --at <distributions sha> --producer-commit <owner/repo>=<sha> [...] --data-root <dir> --sources-root <dir> --kernel <dir>   # the dev ceiling (DevelopCeilingSchema from @xemahq/contracts/develop-ceiling): selection, origin, repo and trustCeiling from the definition and indexes at --at; version, services, runtimeComponents and serviceProcessFacts from each producer's xema-biome.json and xema-biome.index.json at its --producer-commit; a missing commit or manifest refuses, with no fallback
@@ -126,7 +127,7 @@ The develop graph is the data root's first-party repositories, declared in `edit
 
 - Each key is a repository handle (`repos/<x>` or `submodules/<x>`); `sourceId` is its kebab-case source id; `repositoryUrl` is canonical HTTPS under `sourceRepositoryUrlPrefix`. Both are unique. The retired string form (`"repos/x": "x"`) is refused with `RetiredFirstPartySourceShapeError`.
 - `imageOrigin` says where the source's images come from on the everyday lane: `workspace` (built by the job in the aggregator workspace) or `satellite` (a producer outside it, such as `submodules/xema-host-web`, that publishes its own signed develop digest). The parse accepts a source without it and fills in no default; `--images-from` refuses such a source (see below).
-- `xema edition develop freeze-graph` pins every declared repository at the `develop` head of its declared URL; overrides may name any of them. The snapshot's `repositoryPins` (`develop resolve`, `checkout-indexed-source-repositories.mjs --snapshot-pins`) are exactly these repositories. The runtime image source index's `repositoryPins` are release pins and are not read on develop.
+- `xema edition develop freeze-graph` pins every declared repository at the `develop` head of its declared URL; overrides may name any of them. With `--member-pins <selection file>` (a select-records selection; only `.pins`, 40-hex, is read) each member is pinned at its selected record commit instead: the selection must pin exactly the graph minus its `currentResolution` members (equal to the graph members' declared `currentResolution`; a missing or extra member is refused by name), a `currentResolution` member (xema-docs, XEMA-2373) is pinned at its develop head, and `--member-pins` with `--overrides` is refused. The snapshot's `repositoryPins` (`develop resolve`, `checkout-indexed-source-repositories.mjs --snapshot-pins`) are exactly these repositories. The runtime image source index's `repositoryPins` are release pins and are not read on develop.
 - A first-party repository is in the develop graph before any release pins it. The converse is checked offline: every `repositoryPins` entry must be declared first-party at the same `repositoryUrl`.
 
 ## Develop images from a build record
@@ -177,9 +178,13 @@ The edition library builds, validates and verifies evidence statements; it never
 - `xema edition evidence statement catalogue stage|accept` (vendor) derives the E4 statement from `--artifact oci://<repository>@sha256:<digest>` and `--offering <id>`, and `accept` attaches the signed statement and bundle to the artifact as a referrer. A release catalogue is verified before it is read, by the data root's pinned built verifier (`catalogue-evidence arming|verify` mode of the bundle, which uses its own embedded kernel because the catalogue's kernel is not adopted yet); `xema edition release resolve` and `check-existing` take `--cosign <absolute path>` for it.
 - `oras` is located with `XEMA_ORAS_BIN` or `PATH` and must hash to a pinned digest. It runs with a scrubbed environment, so proxy and CA variables do not reach it.
 
+## Previous seal
+
+A write of `images.lock.json` (`resolve-images`, `xema edition develop resolve`) takes exactly one of `--previous-lock <lock> --previous-lock-sha256 <hex>` or `--first-seal`; the CLI refuses unless the lock's bytes hash to the digest, which the caller takes from the images.lock layer of the signed, published edition (the latest, under the per-edition concurrency group). The in-repo resolve and pin/unpin take the committed `images.lock.json` at the target path as the previous lock (first seal when absent). The the composed artifacts' generations carry forward from it.
+
 ## Kernel protocol and pins
 
-The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39 and v40 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
+The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40 and v41 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
 
 A develop edition does not take the kernel's develop head blindly: `xema edition develop choose-kernel --kernel <package dir> [--kernel-pin <40-hex>] --out <file>` reads the declared protocol of each commit on the checkout's first-parent history (from source, unbuilt) and chooses the newest one this CLI supports. It writes `{chosenSha, headSha, held, reason}` (`reason`: `head-supported` | `head-ahead` | `explicit-pin`; `held` is `head-ahead`), and when held prints `kernel held at v<N> (<sha12>), head at v<M> (<sha12>): raise the CLI` (stdout only, never persisted). The head is the checkout's `refs/remotes/origin/develop` (a full-history checkout). An explicit pin wins but is still checked, and must be on that head's first-parent history (`not-on-develop` otherwise); when no commit is supported it refuses (`EditionProtocolMismatchError`, `no-supported-commit`; the walk ends at the first commit with no declaration file) and never falls back to the head; a declaration that exists but does not parse, at the head or any walked commit, is refused by name (`unparseable`), never skipped. `freeze-graph` applies the same check to `--kernel-sha`.
 

package/edition/biome-content.mjs

@@ -291,8 +291,8 @@ export async function biomeSourceTreeIds({ schemas, lock, imageLock, locate, ven
 }
 
 /** Seal: the unsealed lock + the recomputed hashes -> the kernel's `sealDistributionLock`. */
-export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, sourceFactsById, bundleSigners, contentCommits }) {
-  assertLockBundleSigners({ lock: unsealed, selection: bundleSigners, schemas });
+export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, sourceFactsById, bundleSigners, contentCommits, gitSourcedBundle }) {
+  assertLockBundleSigners({ lock: unsealed, selection: bundleSigners, schemas, gitSourcedBundle });
   const hashes = await computeBiomeContentHashes({ schemas, lock: unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, sourceFactsById, contentCommits });
   admitDistributionLock(schemas, unsealed);
   return schemas.sealDistributionLock(unsealed, hashes);
@@ -302,9 +302,9 @@ export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredC
  * Verify: recompute every biome's hash and REFUSE a mismatch, naming the biome.
  * The lock's own field is never trusted; a missing or extra biome is a mismatch.
  */
-export async function verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, bundleSigners, contentCommits }) {
+export async function verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, bundleSigners, contentCommits, gitSourcedBundle }) {
   const expected = await computeBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, contentCommits });
-  assertLockBundleSigners({ lock, selection: bundleSigners, schemas });
+  assertLockBundleSigners({ lock, selection: bundleSigners, schemas, gitSourcedBundle });
   const mismatched = lock.biomes
     .filter((biome) => biome.biomeContentHash !== expected.get(biome.id))
     .map((biome) => `${biome.id} (lock ${String(biome.biomeContentHash)}, recomputed ${expected.get(biome.id)})`);

package/edition/candidate-edition.mjs

@@ -38,6 +38,7 @@ import {
   sourceCheckoutPlan,
 } from './checkout-indexed-source-repositories.mjs';
 import { assertDevelopEditionInvariants } from './develop-edition-invariants.mjs';
+import { carriedDevelopGitBundles } from './develop-git-bundles.mjs';
 import { buildSnapshotInputs } from './develop-snapshot-inputs.mjs';
 import { parseEditionDescriptor } from './edition-artifact.mjs';
 import { resetEditionWorkspaceConfig, editionWorkspaceConfig } from './edition-config.mjs';
@@ -55,7 +56,7 @@ import {
 import { materializeGitSource, externalSourceCacheDir } from './external-source-walk.mjs';
 import { withSourceGitEnv } from './git-source-auth.mjs';
 import { loadKernelDistributionSchemas, serializeJson, sha256Hex } from './lib.mjs';
-import { assertLockBundleSigners } from './locked-bundle-signer.mjs';
+import { GitSourcedBundle, assertLockBundleSigners } from './locked-bundle-signer.mjs';
 import { admitDistributionLock } from './operation-grant-admission.mjs';
 import {
   EDITIONS_ROOT_PIN_KEY,
@@ -581,8 +582,10 @@ async function resealStaged({ edition: pinned, pins, read, deployment }) {
   const id = pinned.id;
   const schemas = await loadKernelDistributionSchemas();
   const inputs = await buildSnapshotInputs({ id, pins, schemas });
-  const { lock, index } = await prepareDistributionWithIndex(id, { inputs });
-  assertLockBundleSigners({ lock, schemas });
+  // A git-sourced biome's OCI bundle is carried from the pinned edition for the same source commit, never re-fetched.
+  const pinnedLock = JSON.parse(pinned.bytes[EditionLockFile.Distribution].toString('utf8'));
+  const { lock, index } = await prepareDistributionWithIndex(id, { inputs: { ...inputs, developGitBundles: carriedDevelopGitBundles(pinnedLock) } });
+  assertLockBundleSigners({ lock, schemas, gitSourcedBundle: GitSourcedBundle.DevelopVerified });
   assertDevelopEditionInvariants({ id, lock, biomeIndex: inputs.biomeIndex, schemas });
   admitDistributionLock(schemas, lock);
   const authorizationLock = await composeAuthorizationBase(id, lock, index);
@@ -600,6 +603,7 @@ async function resealStaged({ edition: pinned, pins, read, deployment }) {
     locate: sourceTreeLocator(externalSourceTrees(lock)),
     vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
     contentCommits,
+    gitSourcedBundle: GitSourcedBundle.DevelopVerified,
   });
   const lockBytes = Buffer.from(serializeJson(sealed), 'utf8');
   const authorizationLockBytes = Buffer.from(serializeJson(authorizationLock), 'utf8');
@@ -684,6 +688,7 @@ export async function verifyCandidateContentHashes({ tripleDir, checkouts, candi
         locate: sourceTreeLocator(externalSourceTrees(lock)),
         vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
         ...(contentCommits === undefined ? {} : { contentCommits }),
+        gitSourcedBundle: GitSourcedBundle.DevelopVerified,
       });
     });
   } finally {

package/edition/check-committed-image-evidence.mjs

@@ -66,6 +66,7 @@ import {
   evidenceDirectoryForDigest,
   sha256Digest,
 } from './image-evidence.mjs';
+import { evidenceSubjectKey } from './image-subject-identity.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import {
   assertProducerInput,
@@ -124,6 +125,29 @@ function assertContainedRelativePath(value, label) {
  *
  * @returns {{ evidenceDirectory: string, reusable: boolean, reason: string }}
  */
+/**
+ * The key of an index entry: its subject's evidence identity, which for a composed artifact names the generation, so it is read
+ * from the statement the entry points at (the index states only kind and id). An entry whose statement cannot be read keeps
+ * `kind\0id`; the unusable statement is reported below.
+ */
+export function entryKey(entry, absoluteDirectory) {
+  try {
+    const { predicate } = JSON.parse(
+      readBoundedFile(join(absoluteDirectory, assertContainedRelativePath(entry.evidence.statementPath, 'statementPath'))).toString('utf8'),
+    );
+    return evidenceSubjectKey({
+      kind: entry.subjectKind,
+      id: entry.subjectId,
+      imageRef: predicate.artifact.imageRepository,
+      contentHash: predicate.source.sourceTreeHash,
+    });
+  } catch {
+    return `${entry.subjectKind}\0${entry.subjectId}`;
+  }
+}
+
+const printable = (key) => key.replaceAll('\0', ':');
+
 export async function assessCommittedEvidence({
   input,
   repositoryRoot,
@@ -190,7 +214,12 @@ export async function assessCommittedEvidence({
   }
   const expectedByKey = new Map(
     expectedStatements.map((statement) => [
-      `${statement.predicate.source.kind}:${statement.predicate.source.id}`,
+      evidenceSubjectKey({
+        kind: statement.predicate.source.kind,
+        id: statement.predicate.source.id,
+        imageRef: statement.predicate.artifact.imageRepository,
+        contentHash: statement.predicate.source.sourceTreeHash,
+      }),
       statement,
     ]),
   );
@@ -200,20 +229,20 @@ export async function assessCommittedEvidence({
     if (entry === null || typeof entry !== 'object') {
       return unusable('producer-evidence.json carries a non-object entry');
     }
-    const key = `${entry.subjectKind}:${entry.subjectId}`;
+    const key = entryKey(entry, absoluteDirectory);
     if (seen.has(key)) {
-      return unusable(`producer-evidence.json duplicates subject ${key}`);
+      return unusable(`producer-evidence.json duplicates subject ${printable(key)}`);
     }
     seen.add(key);
     const expected = expectedByKey.get(key);
     if (expected === undefined) {
       return unusable(
-        `committed evidence carries subject ${key}, which this input does not evidence`,
+        `committed evidence carries subject ${printable(key)}, which this input does not evidence`,
       );
     }
     const descriptor = entry.evidence;
     if (descriptor === null || typeof descriptor !== 'object') {
-      return unusable(`subject ${key} has no evidence descriptor`);
+      return unusable(`subject ${printable(key)} has no evidence descriptor`);
     }
     let statementBytes;
     let bundleBytes;
@@ -223,7 +252,7 @@ export async function assessCommittedEvidence({
           absoluteDirectory,
           assertContainedRelativePath(
             descriptor.statementPath,
-            `subject ${key} statementPath`,
+            `subject ${printable(key)} statementPath`,
           ),
         ),
       );
@@ -232,25 +261,25 @@ export async function assessCommittedEvidence({
           absoluteDirectory,
           assertContainedRelativePath(
             descriptor.bundlePath,
-            `subject ${key} bundlePath`,
+            `subject ${printable(key)} bundlePath`,
           ),
         ),
       );
     } catch (error) {
-      return unusable(`subject ${key} artifacts are unreadable: ${error.message}`);
+      return unusable(`subject ${printable(key)} artifacts are unreadable: ${error.message}`);
     }
     if (
       sha256Digest(statementBytes) !== descriptor.statementDigest ||
       sha256Digest(bundleBytes) !== descriptor.bundleDigest
     ) {
       return unusable(
-        `subject ${key} artifacts do not match the digests producer-evidence.json records`,
+        `subject ${printable(key)} artifacts do not match the digests producer-evidence.json records`,
       );
     }
     try {
       validateProducedBundle(statementBytes, bundleBytes);
     } catch (error) {
-      return unusable(`subject ${key} bundle is malformed: ${error.message}`);
+      return unusable(`subject ${printable(key)} bundle is malformed: ${error.message}`);
     }
     let committed;
     try {
@@ -259,7 +288,7 @@ export async function assessCommittedEvidence({
       );
     } catch (error) {
       return unusable(
-        `subject ${key} statement does not parse under the kernel schema: ${error.message}`,
+        `subject ${printable(key)} statement does not parse under the kernel schema: ${error.message}`,
       );
     }
     // producerRun is deliberately fresh on every execution (run id, attempt,
@@ -269,24 +298,24 @@ export async function assessCommittedEvidence({
     // validate the existing run's own signature and lifetime independently.
     if (!producerStatementMatchesInput(committed, expected)) {
       return unusable(
-        `subject ${key} committed statement is not bound to this producer input ` +
+        `subject ${printable(key)} committed statement is not bound to this producer input ` +
           '(authority, source, build, artifact or platform set changed)',
       );
     }
     const expiresAt = Date.parse(committed.predicate.producerRun.expiresAt);
     if (!Number.isFinite(expiresAt)) {
-      return unusable(`subject ${key} statement has an unreadable expiresAt`);
+      return unusable(`subject ${printable(key)} statement has an unreadable expiresAt`);
     }
     const remainingSeconds = Math.floor((expiresAt - now) / 1000);
     if (remainingSeconds <= 0) {
       return unusable(
-        `subject ${key} evidence EXPIRED at ${committed.predicate.producerRun.expiresAt} — ` +
+        `subject ${printable(key)} evidence EXPIRED at ${committed.predicate.producerRun.expiresAt} — ` +
           'it can never verify again and must be re-produced',
       );
     }
     if (remainingSeconds < MIN_REMAINING_TTL_SECONDS) {
       return unusable(
-        `subject ${key} evidence expires in ${remainingSeconds}s, under the ` +
+        `subject ${printable(key)} evidence expires in ${remainingSeconds}s, under the ` +
           `${MIN_REMAINING_TTL_SECONDS}s reuse floor — refreshing it now`,
       );
     }

package/edition/customer-edition-verbs.mjs

@@ -183,15 +183,20 @@ const ENGINE_IMAGE_FLAG = '--engine-image';
 const ENGINE_REPOSITORY_FLAG = '--engine-repository';
 const ENGINE_SIGNER_FLAG = '--engine-signer';
 export const IMAGES_FROM_FLAG = '--images-from';
+export const PREVIOUS_LOCK_FLAG = '--previous-lock';
+export const PREVIOUS_LOCK_SHA256_FLAG = '--previous-lock-sha256';
+export const FIRST_SEAL_FLAG = '--first-seal';
 
 const COMMANDS = Object.freeze({
   resolve: {
     positional: true,
     // --images-from: the everyday job's image build record (images-from-record.mjs) instead of the registry probe; vendor only.
-    values: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG, IMAGES_FROM_FLAG],
-    switches: ['--local'],
+    // --previous-lock with --previous-lock-sha256 (the digest of the latest signed, published edition's images.lock layer, passed by the workflow under
+    // the per-edition concurrency group) or --first-seal: the previous seal whose composed artifacts carry their generation forward; vendor only.
+    values: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG, IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG],
+    switches: ['--local', FIRST_SEAL_FLAG],
     required: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG],
-    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS, SOURCE_IMAGE_FLAG, COSIGN_FLAG, ENGINE_IMAGE_FLAG], required: ['--pins', '--out', '--registry', '--engine-image'], refused: [IMAGES_FROM_FLAG], cosign: true },
+    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS, SOURCE_IMAGE_FLAG, COSIGN_FLAG, ENGINE_IMAGE_FLAG], required: ['--pins', '--out', '--registry', '--engine-image'], refused: [IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG, FIRST_SEAL_FLAG], cosign: true },
     // A vendor resolve finds its engine itself; the old flag is refused by name, never read as a customer flag.
     removedFromVendor: { [ENGINE_IMAGE_FLAG]: `use ${ENGINE_REPOSITORY_FLAG} and ${ENGINE_SIGNER_FLAG}` },
   },
@@ -210,7 +215,7 @@ const COMMANDS = Object.freeze({
   },
   'freeze-graph': {
     positional: false,
-    values: ['--data-sha', '--kernel-sha', '--deploy-sha', '--editions-root-url', '--overrides', '--out'],
+    values: ['--data-sha', '--kernel-sha', '--deploy-sha', '--editions-root-url', '--overrides', '--member-pins', '--out'],
     switches: [],
     required: ['--data-sha', '--kernel-sha', '--deploy-sha', '--out'],
   },
@@ -233,6 +238,12 @@ const COMMANDS = Object.freeze({
     switches: [],
     required: ['--branch', '--registry', '--cosign', '--out'],
   },
+  'image-record': {
+    positional: true,
+    values: ['--selection', '--pins', '--out'],
+    switches: [],
+    required: ['--selection', '--pins', '--out'],
+  },
   'verify-image-record': {
     positional: false,
     values: ['--image', '--producer', '--registry', '--cosign'],

package/edition/develop-current-resolution.mjs

@@ -0,0 +1,29 @@
+// develop-current-resolution — the members that keep the CURRENT develop resolution instead of a signed build record.
+//
+// A member keeps its current resolution (develop HEAD freeze plus the registry probe) only when the data root declares
+// it: `currentResolution: "<ticket>"` on its `firstPartySources` entry in edition-workspace.json, the ticket that
+// removes the exception (today xema-docs, whose develop lane is unsigned by owner decision and which leaves the
+// edition). It is a declared exception, not a fallback: absent means none, and every other member without a record
+// still refuses.
+
+import { compareStrings } from './lib.mjs';
+
+/** Whether a member (or its `firstPartySources` entry) keeps its current resolution. */
+export const keepsCurrentResolution = (member) => Object.hasOwn(member, 'currentResolution');
+
+/** The graph `members` that declare a current resolution, repo -> ticket, keys sorted: what a selection records. */
+export function currentResolutionOf(members) {
+  return Object.fromEntries(
+    members
+      .filter(keepsCurrentResolution)
+      .map(({ repo, currentResolution }) => [repo, currentResolution])
+      .sort(([a], [b]) => compareStrings(a, b)),
+  );
+}
+
+/** Why a selection's `currentResolution` (absent = none) is not exactly the one the graph `members` declare; null when it is. */
+export function currentResolutionProblem(declared, members) {
+  const expected = currentResolutionOf(members);
+  if (JSON.stringify(declared ?? {}) === JSON.stringify(expected)) {return null;}
+  return `"currentResolution" is ${JSON.stringify(declared)}, not ${JSON.stringify(expected)}, the members the data root declares keep their current resolution`;
+}

package/edition/develop-edition-resolve.mjs

@@ -13,6 +13,7 @@ import { buildCatalogue } from './catalogue.mjs';
 import { resolveDevelopChartSet } from './develop-chart-set.mjs';
 import { assertDevelopEditionInvariants } from './develop-edition-invariants.mjs';
 import { resolveDevelopEngineImage } from './develop-engine-image.mjs';
+import { createDevelopGitBundleVerifier } from './develop-git-bundles.mjs';
 import { createDevelopImageProbe } from './develop-image-probe.mjs';
 import { BLOCKED, DevelopResolveCheck, RESOLVE_CHECK_DEPENDENCIES, createResolveReport } from './develop-resolve-report.mjs';
 import { assertFrozenCheckouts, buildSnapshotInputs } from './develop-snapshot-inputs.mjs';
@@ -23,7 +24,7 @@ import { dataRoot, kernelPackageDir } from './edition-workspace.mjs';
 import { resolveImagesFromRecord, sealImagesFromRecord } from './images-from-record.mjs';
 import { kernelPackageOfAuthority } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
-import { assertLockBundleSigners, isBundleSignerRefusal } from './locked-bundle-signer.mjs';
+import { GitSourcedBundle, assertLockBundleSigners, isBundleSignerRefusal } from './locked-bundle-signer.mjs';
 import { admitDistributionLock, ungrantedOptionalLinesOfRefusal } from './operation-grant-admission.mjs';
 import { deployPinKey } from './pin-source.mjs';
 import { admitResolvedLock, composeAuthorizationBase, prepareDistributionWithIndex } from './resolve-distribution.mjs';
@@ -58,17 +59,21 @@ const stderrProgress = (line) => process.stderr.write(`${line}\n`);
  * admits it as one of its checks; `resolveDevelopSnapshot` admits it at once. Both
  * start here, so the content hash each computes for a subject is the same by construction.
  */
-async function prepareDevelopSnapshot({ id, pins, steps, phase }) {
+async function prepareDevelopSnapshot({ id, pins, steps, phase, developGitBundles }) {
   const schemas = await loadKernelDistributionSchemas();
   steps.assertFrozenCheckouts(pins);
   const inputs = await steps.buildSnapshotInputs({ id, pins, schemas });
   phase('snapshot inputs built');
-  const prepared = await steps.prepareDistributionWithIndex(id, { inputs });
+  const prepared = await steps.prepareDistributionWithIndex(id, { inputs: developGitBundles === undefined ? inputs : { ...inputs, developGitBundles } });
   // The schemas the lock was composed with are the ones that admit it.
   return { inputs, ...prepared };
 }
 
-/** The read-only `coverage` verb's snapshot: prepared as the resolve prepares it, then admitted (a refusal throws). */
+/**
+ * The read-only `coverage` and image-record snapshot: prepared as the resolve prepares it, then admitted (a refusal
+ * throws). It seals no distribution lock, so it verifies no git-sourced OCI bundle (no registry, no cosign): its lock
+ * rows of a git source carry none, which neither verb reads.
+ */
 export async function resolveDevelopSnapshot({ id, pins, steps = DEVELOP_EDITION_STEPS, phase = () => {} }) {
   const snapshot = await prepareDevelopSnapshot({ id, pins, steps, phase });
   admitResolvedLock(snapshot.schemas, snapshot.lock);
@@ -79,8 +84,9 @@ export async function resolveDevelopSnapshot({ id, pins, steps = DEVELOP_EDITION
  * @param {object} request
  * @param {object} [request.imagesFrom] a parsed image build record (images-from-record.mjs): the digests are the record's,
  *   with no probe and no rehash, and `verifySatellites` (createSatelliteVerifier) admits its satellite entries
+ * @param {object|null} [request.previousLock] the previous edition's parsed images lock: its composed artifacts carry their generation forward (null: generation 1)
  */
-export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, env = process.env, sealOptions = {}, fetchKernelTarball, fetchManifest = fetchRegistryManifest, progress = stderrProgress, steps = DEVELOP_EDITION_STEPS, imagesFrom, verifySatellites }) {
+export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, env = process.env, sealOptions = {}, fetchKernelTarball, fetchManifest = fetchRegistryManifest, progress = stderrProgress, steps = DEVELOP_EDITION_STEPS, imagesFrom, verifySatellites, previousLock = null }) {
   if ((imagesFrom === undefined) !== (verifySatellites === undefined)) {
     throw new Error('resolveDevelopEdition takes an image build record and its satellite verifier together, or neither');
   }
@@ -101,13 +107,15 @@ export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, en
     return image;
   });
   await checked(DevelopResolveCheck.EditionProtocol, () => steps.assertKernelEditionProtocol(kernelPackageDir()));
-  const snapshot = await checked(DevelopResolveCheck.DistributionLock, () => prepareDevelopSnapshot({ id, pins, steps, phase }), {
+  // A git-sourced biome's OCI bundle is kept only when verified against the frozen source (develop-git-bundles.mjs).
+  const developGitBundles = createDevelopGitBundleVerifier({ cosignBinary, dataRoot: dataRoot(), env });
+  const snapshot = await checked(DevelopResolveCheck.DistributionLock, () => prepareDevelopSnapshot({ id, pins, steps, phase, developGitBundles }), {
     classify: (error) => (isBundleSignerRefusal(error) ? DevelopResolveCheck.BundleSigner : DevelopResolveCheck.DistributionLock),
   });
   const lockProduced = snapshot !== BLOCKED;
   const { schemas, inputs, lock, index } = lockProduced ? snapshot : {};
   if (lockProduced) {
-    await checked(DevelopResolveCheck.BundleSigner, () => assertLockBundleSigners({ lock, schemas }));
+    await checked(DevelopResolveCheck.BundleSigner, () => assertLockBundleSigners({ lock, schemas, gitSourcedBundle: GitSourcedBundle.DevelopVerified }));
   }
   // The plane invariants, against the graph this candidate froze (develop-edition-invariants.mjs).
   await checked(DevelopResolveCheck.PlaneInvariants, () => {
@@ -135,7 +143,7 @@ export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, en
   let recorded;
   const imageLock = await checked(DevelopResolveCheck.DevelopImages, async () => {
     if (imagesFrom !== undefined) {
-      const fromRecord = await resolveImagesFromRecord({ id, inputs, lock, record: imagesFrom, resolveImages: steps.resolveImages, verifySatellites });
+      const fromRecord = await resolveImagesFromRecord({ id, inputs, lock, record: imagesFrom, resolveImages: steps.resolveImages, verifySatellites, previousLock });
       ({ recorded } = fromRecord);
       phase(`image subjects taken from the build record (${fromRecord.imageLock.subjects.length} subjects); satellites verified`);
       return fromRecord.imageLock;
@@ -148,7 +156,7 @@ export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, en
       ...(sealOptions.run === undefined ? {} : { run: sealOptions.run }),
       progress,
     });
-    const resolved = await steps.resolveImages(id, { inputs, lock, onSubjectHashed: probe.observe });
+    const resolved = await steps.resolveImages(id, { inputs, lock, onSubjectHashed: probe.observe, previousLock });
     phase(`image content hashes computed (${resolved.imageLock.subjects.length} subjects)`);
     await probe.settle();
     phase('every develop image is present');
@@ -178,7 +186,7 @@ export async function resolveDevelopEdition({ id, pins, engine, cosignBinary, en
   // ONE walk of the biome checkouts: the content hashes and the tree ids both read it.
   const sourceFactsById = await readBiomeSourceFacts({ ...biomeSources, lock });
   phase(`biome sources read (${sourceFactsById.size} biomes)`);
-  const sealedLock = await sealLock({ ...biomeSources, unsealed: lock, sourceFactsById });
+  const sealedLock = await sealLock({ ...biomeSources, unsealed: lock, sourceFactsById, gitSourcedBundle: GitSourcedBundle.DevelopVerified });
   phase('distribution lock sealed');
   const sourceTreeIds = await biomeSourceTreeIds({ ...biomeSources, lock, sourceFactsById });
   const catalogue = buildCatalogue({