@xemahq/xema 0.54.0 → 0.56.0

package/edition/develop-edition.mjs

@@ -41,10 +41,14 @@
 //       the same for a customer edition (id = the definition's; the tag covers the pinned catalogue digest).
 //   freeze-graph --data-sha <sha> --kernel-sha <sha>
 //                --deploy-sha <sha> [--editions-root-url <https url>]
-//                [--overrides <json>] --out <file>
+//                [--overrides <json> | --member-pins <selection file>] --out <file>
 //       resolve refs/heads/develop once per develop-graph repository (the data root's
 //       firstPartySources, at each declared URL) and the editions root; the three checked-out
-//       repositories are pinned at what the workflow checked out; write the pins. --kernel-sha is refused
+//       repositories are pinned at what the workflow checked out; write the pins. --member-pins takes a select-records
+//       selection (only .pins, 40-hex, is read) and pins each graph member at its selected record commit instead of its
+//       develop head: the selection must pin exactly the graph minus its currentResolution members (which must equal
+//       the graph members' declared currentResolution), a missing or extra member is refused by name, and a currentResolution
+//       member is pinned at its develop head. --member-pins together with --overrides is refused. --kernel-sha is refused
 //       unless its declared edition protocol is one this CLI supports (the check choose-kernel applies to a pin).
 //   check-existing <id> --pins <file> --artifact <dir> --engine-image <repository>@sha256:<digest>
 //       refuse to reuse a pulled artifact whose descriptor disagrees with this snapshot.
@@ -71,7 +75,7 @@
 //       for every develop-graph member, take the newest build record the data root's record workflow signed for
 //       the branch (<root>/build-records/<name>, verified offline by digest against the pinned trusted root, as
 //       signed by <data root>/.github/workflows/record-build.yaml at refs/heads/<branch>, called by the member at the
-//       record's own commit) and write { pins, snapshot, images }, once (wx). Any missing, unsigned, mismatched or
+//       record's own commit) and write { pins, snapshot, behind, images, currentResolution }, once (wx); a member that keeps its current resolution (a declared currentResolution, develop-current-resolution.mjs) is skipped with no registry read, listed in currentResolution, and printed as `xema-docs: current resolution (leaves the edition, XEMA-2373)`; behind is { <repo>: { head, commits } }, develop's head and how many commits the selected one trails it by, and one line per member `<short name>: record <commit>, <N> commits behind HEAD` goes to stdout (always `commits`; short name = the repo's last path segment, refused when two members share one); images[] entries carry `member`, the owning repo handle. Any missing, unsigned, mismatched or
 //       unreadable record refuses the whole run and writes nothing: a newer bad record is never skipped for an older
 //       one. --at takes the newest record completed at or before that time. Only `develop` has a declared signer; the
 //       data root must declare dataRootRepositoryUrl. Takes the roots `resolve` takes (no registry root is implied).
@@ -83,6 +87,14 @@
 //       part 07 passes the flag.
 //       Residual: anyone who can delete registry tags can remove newer records, and this then pins the newest remaining
 //       valid one; the guard is part 07's, deploy-latest's owner refuses a snapshot that goes backwards.
+//   image-record <id> --selection <file> --pins <file> --out <file>
+//       write the edition's image build record (the file `resolve --images-from` reads) from a select-records selection:
+//       the subjects are the checked-out snapshot's first-party image subjects (enumerated as `coverage` does). A subject of
+//       a member that keeps its current resolution (a declared currentResolution, develop-current-resolution.mjs) is probed as resolve probes it
+//       and goes in `images`; every other first-party subject takes the selection's image of its develop repository, whose
+//       selected commit must be the snapshot's, and goes in `satellites`. Platforms are read from the registry by digest.
+//       Any subject without an image, any commit mismatch refuses the whole run and writes nothing, once (wx). Third-party
+//       subjects are ignored. Takes the roots `resolve` takes.
 //   choose-kernel [--kernel-pin <40-hex>] --out <file>
 //       choose the develop kernel commit in the --kernel checkout (full history; its refs/remotes/origin/develop is the develop head):
 //       the newest first-parent commit whose declared edition protocol this CLI supports
@@ -106,14 +118,17 @@
 import { resolve } from 'node:path';
 
 import { writeCatalogue } from './catalogue.mjs';
-import { CUSTOMER_ROOTS, IMAGES_FROM_FLAG, headResolver, parseEditionVerbArgs, runCustomerVerb, writeOnce } from './customer-edition-verbs.mjs';
+import { CUSTOMER_ROOTS, FIRST_SEAL_FLAG, IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG, headResolver, parseEditionVerbArgs, runCustomerVerb, writeOnce } from './customer-edition-verbs.mjs';
 import { DEFINITION_FLAG } from './customer-flags.mjs';
 import { runDevelopCoverage } from './develop-coverage-run.mjs';
 import { CoverageExit } from './develop-coverage.mjs';
 import { resolveDevelopEdition } from './develop-edition-resolve.mjs';
 import { resolveDevelopEngineImage } from './develop-engine-image.mjs';
 import { assertNoToolingOverride, freezeGraph, freezeSources } from './develop-freeze.mjs';
+import { developGraphMembers } from './develop-graph.mjs';
+import { runImageRecord } from './develop-image-record.mjs';
 import { runSelectRecords } from './develop-select-records.mjs';
+import { readSelectionPins } from './develop-selection-pins.mjs';
 import { runVerifyImageRecord } from './develop-verify-image-record.mjs';
 import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { EditionChannel, EditionKind } from './edition-constants.mjs';
@@ -124,6 +139,7 @@ import { assertKernelCommitSupported, chooseKernelCommit } from './kernel-protoc
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { snapshotPinSource } from './pin-source.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
+import { resolvePreviousSeal } from './resolve-images.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 
 // The roots a verb takes. A customer form (it names --definition) takes fewer, and never the kernel (the
@@ -167,8 +183,8 @@ function parseOverrides(text) {
 }
 
 /** The target-tag input of `--images-from`: the record's digest, or nothing on the probe path. */
-function imageBuildRecordTagInput(options) {
-  return options[IMAGES_FROM_FLAG] === undefined ? {} : { imageBuildRecordDigest: imageBuildRecordDigest(readImageBuildRecord(options[IMAGES_FROM_FLAG])) };
+async function imageBuildRecordTagInput(options) {
+  return options[IMAGES_FROM_FLAG] === undefined ? {} : { imageBuildRecordDigest: imageBuildRecordDigest(await readImageBuildRecord(options[IMAGES_FROM_FLAG])) };
 }
 
 async function run(argv, env) {
@@ -176,7 +192,7 @@ async function run(argv, env) {
   switch (command) {
     case 'target': {
       if (customer) {return runCustomerVerb({ channel: EditionChannel.Develop, command, options, env });}
-      console.log(developEditionTarget(id, readStrictJsonFile(options['--pins']), { registry: options['--registry'], engineImage: options['--engine-image'], ...imageBuildRecordTagInput(options) }));
+      console.log(developEditionTarget(id, readStrictJsonFile(options['--pins']), { registry: options['--registry'], engineImage: options['--engine-image'], ...(await imageBuildRecordTagInput(options)) }));
       return;
     }
     case 'resolve': {
@@ -190,12 +206,13 @@ async function run(argv, env) {
         env,
         engine: { repository: options['--engine-repository'], signer: options['--engine-signer'] },
         cosignBinary: options['--cosign'],
+        previousLock: await resolvePreviousSeal({ distributionId: id, previousLockPath: options[PREVIOUS_LOCK_FLAG], previousLockSha256: options[PREVIOUS_LOCK_SHA256_FLAG], firstSeal: Boolean(options[FIRST_SEAL_FLAG]) }),
         ...(options[IMAGES_FROM_FLAG] === undefined ? {} : {
-          imagesFrom: readImageBuildRecord(options[IMAGES_FROM_FLAG]),
+          imagesFrom: await readImageBuildRecord(options[IMAGES_FROM_FLAG]),
           verifySatellites: createSatelliteVerifier({ registry: options['--registry'], cosignBinary: options['--cosign'], env }),
         }),
       });
-      const target = developEditionTarget(id, pins, { registry: options['--registry'], engineImage, ...imageBuildRecordTagInput(options) });
+      const target = developEditionTarget(id, pins, { registry: options['--registry'], engineImage, ...(await imageBuildRecordTagInput(options)) });
       const outDir = resolve(options['--out']);
       writeEditionArtifact({
         outDir,
@@ -232,6 +249,9 @@ async function run(argv, env) {
     case 'select-records':
       await runSelectRecords({ options, env });
       return;
+    case 'image-record':
+      await runImageRecord({ id, options, env });
+      return;
     case 'verify-image-record':
       await runVerifyImageRecord({ options, env });
       return;
@@ -265,6 +285,7 @@ async function run(argv, env) {
         deploySha: options['--deploy-sha'],
         editionsRootUrl: options['--editions-root-url'],
         overrides: parseOverrides(options['--overrides']),
+        ...(options['--member-pins'] === undefined ? {} : { memberPins: readSelectionPins(options['--member-pins'], '--member-pins', developGraphMembers()) }),
         ...headResolver(EditionChannel.Develop, env),
       });
       writeOnce(options['--out'], pins);

package/edition/develop-freeze.mjs

@@ -9,6 +9,9 @@
 //   freezeGraph    the graph repositories, the data root, the kernel, the deploy checkout, the editions root
 //   freezeSources  one pin per `sources[]` entry the chain declares
 //
+// With `memberPins` (a select-records selection) the members are pinned at the selected build records instead; the one
+// declared exception, a member that keeps its current resolution, is pinned at its develop head.
+//
 // `resolveHead({ name, url })` is the one network seam (default: `git ls-remote` through
 // git-source-auth: the data root's token only for a repository under its
 // `sourceRepositoryUrlPrefix`, no credential for any other, never argv).
@@ -16,6 +19,7 @@
 import { execFileSync } from 'node:child_process';
 
 import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
+import { currentResolutionOf } from './develop-current-resolution.mjs';
 import { developGraphMembers } from './develop-graph.mjs';
 import { EditionChannel } from './edition-channel.mjs';
 import { assertCanonicalSourceUrl, assertSourceDeclaresNoCredential, isUnderSourcePrefix, withSourceGitEnv } from './git-source-auth.mjs';
@@ -124,6 +128,17 @@ function assertOverrides(overrides, allowed) {
   }
 }
 
+/** The member pins name exactly the graph minus the current-resolution members; a missing or extra member is refused by name. */
+function assertMemberPinsAreTheGraph(memberPins, members) {
+  const current = new Set(Object.keys(currentResolutionOf(members)));
+  const expected = members.map(({ repo }) => repo).filter((repo) => !current.has(repo));
+  const missing = expected.filter((repo) => !Object.hasOwn(memberPins, repo));
+  const extra = Object.keys(memberPins).filter((repo) => !expected.includes(repo));
+  if (missing.length > 0 || extra.length > 0) {
+    throw new Error(`--member-pins must pin exactly the develop graph minus ${JSON.stringify([...current])}: missing ${JSON.stringify(missing)}, extra ${JSON.stringify(extra)}`);
+  }
+}
+
 const GRAPH_PHASE = new Set([
   SnapshotPinNamespace.Graph,
   SnapshotPinNamespace.Distributions,
@@ -149,6 +164,9 @@ function assertCheckedOutPin({ key, sha, flag, what, overrides }) {
  * @param {string} request.kernelSha the commit the kernel checkout is at
  * @param {string} request.deploySha the commit the deploy checkout is at
  * @param {string} [request.editionsRootUrl] https URL of the editions root; absent = this repository
+ * @param {Record<string, string>} [request.memberPins] the graph members' pins from a selection (`--member-pins`): exactly the
+ *   graph minus the members that keep their current resolution (develop-current-resolution.mjs), which are pinned at their
+ *   develop head; refused together with overrides
  * @param {(source: {name: string, url: string}) => void} request.holdSource the hold of one source; runs for ALL graph sources before the first head
  */
 export function freezeGraph({
@@ -157,9 +175,13 @@ export function freezeGraph({
   deploySha,
   editionsRootUrl,
   overrides = {},
+  memberPins,
   resolveHead,
   holdSource,
 }) {
+  if (memberPins !== undefined && Object.keys(overrides).length > 0) {
+    throw new Error('--member-pins and --overrides are exclusive: the member pins are the selected build records, never overridden');
+  }
   assertNoToolingOverride(overrides);
   assertOverrides(overrides, GRAPH_PHASE);
   const head = memoizedHeads(resolveHead);
@@ -171,6 +193,7 @@ export function freezeGraph({
       throw new Error(`override names "${key}", which is not a repository in the graph`);
     }
   }
+  if (memberPins !== undefined) {assertMemberPinsAreTheGraph(memberPins, members);}
   const checkedOut = [
     { key: dataPinKey(), sha: dataSha, flag: '--data-sha', what: 'the data root checkout' },
     { key: kernelPinKey(), sha: kernelSha, flag: '--kernel-sha', what: 'the kernel checkout' },
@@ -188,7 +211,7 @@ export function freezeGraph({
   }
   const pins = Object.fromEntries(checkedOut.map(({ key, sha }) => [key, sha]));
   for (const member of members) {
-    pins[member.repo] = overrides[member.repo] ?? head({ name: member.repo, url: member.repositoryUrl });
+    pins[member.repo] = overrides[member.repo] ?? memberPins?.[member.repo] ?? head({ name: member.repo, url: member.repositoryUrl });
   }
   if (editionsRootUrl !== undefined) {
     const url = canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url');

package/edition/develop-git-bundles.mjs

@@ -0,0 +1,201 @@
+// develop-git-bundles — the OCI bundle of a git-sourced biome, in a VENDOR DEVELOP edition only (XEMA-2456).
+//
+// A release and a customer edition never carry an OCI bundle on a git-sourced row: the manifest's `bundleSource` names
+// an artifact the release lane builds, not one built from the pinned commit (resolve-distribution.mjs strips it, the
+// release refuses it). A develop edition freezes a git source at its develop head F, and the source's own develop lane
+// publishes the bundle the manifest names, signed keyless by its develop workflow. This module proves that bundle is
+// the one F describes, and only then does the resolve keep it on the row, by DIGEST, with its develop bundle signer:
+//
+//   1. the bundle: the manifest's own `bundleSource.ociRef` at F (`<repository>:<version>`; the kernel holds the tag to
+//      the manifest version) resolved to its digest at the registry. The lock records `<repository>@sha256:<hex>`, never
+//      the tag, so the edition names immutable bytes;
+//   2. the signer: the ONE `develop` row of the source's repository in the data root's trust policy
+//      (`bundleSignerRowFor`). cosign verifies the digest's signature under that row's identity, issuer, workflow
+//      repository and ref, and states the ONE commit P its certificate was issued at (`verifiedBundleSignerCommit`);
+//      `verifyBundleOnRegistry` then holds the signature AND the SLSA provenance to exactly the row and P. P is never
+//      read from bytes cosign has not verified;
+//   3. the content binding of P to F. A version that is already published is never re-attested by the publisher
+//      (`xema biome publish` "already current"), so P is the commit that last published the version, and F may be a
+//      later commit of the same version. Two checks, refused on either, each naming P, F and the mismatching pair:
+//        (a) the kernel's `computeBiomeSourceManifestHash` of the bundle's own `xema-biome.json` equals the
+//            `sourceManifestHash` of the biome at F (the hash the seal and verify hold to the git source at F);
+//        (b) the git tree id of the biome directory at P equals its tree id at F (the catalogue's `sourceTreeIds`
+//            notion), so the bundle was built from the same biome source F holds.
+//      THE GAP, develop only: build inputs outside the biome directory (shared packages, the lockfile, the publisher's
+//      toolchain) are not bound. A change there between P and F reaches no check here. A release never relies on this:
+//      it carries a third-party bundle only through an `oci` source with a third-party pin, whose evidence is bound to
+//      the pinned commit itself.
+//
+// Every failure is a `DevelopGitBundleError` naming the biome; all subjects are verified before one is refused.
+
+import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
+import { RefusalError } from './collected-refusals.mjs';
+import { EditionChannel } from './edition-channel.mjs';
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
+import { sourceTreeIdAt } from './external-source-walk.mjs';
+import { prepareTrustedCosignBinary } from './image-evidence.mjs';
+import { BundleSignerRefusedError, DevelopGitBundleError } from './locked-bundle-signer.mjs';
+import { createRegistryClientResolver } from './oci-image-source-evidence.mjs';
+import { bundleDigestRef, fetchBundleManifest, verifiedBundleSignerCommit, verifyBundleOnRegistry } from './third-party-bundle-registry.mjs';
+import { bundleSignerRowFor } from './third-party-source-evidence.mjs';
+import { OCI_BUNDLE_SOURCE_KIND } from './third-party-subjects.mjs';
+
+/** The key a verified bundle is looked up by: the source name and the biome id of its index entry. */
+export const developGitBundleKey = (sourceName, biomeId) => `${sourceName}\u0000${biomeId}`;
+
+/**
+ * The rows a develop resolve must verify a bundle for: each git-sourced biome of `lock` (a row with a `source`) whose
+ * index entry declares a biome-level OCI `bundleSource`.
+ *
+ * @returns {{biomeId: string, source: {name: string, url: string, commit: string}, entry: object}[]}
+ */
+export function developGitBundleSubjects({ lock, index }) {
+  const entries = new Map(index.filter((entry) => entry.source !== undefined).map((entry) => [developGitBundleKey(entry.source, entry.id), entry]));
+  return lock.biomes.flatMap((biome) => {
+    if (biome.source === undefined) {return [];}
+    const entry = entries.get(developGitBundleKey(biome.source.name, biome.id));
+    return entry?.bundleSource?.kind === OCI_BUNDLE_SOURCE_KIND ? [{ biomeId: biome.id, source: biome.source, entry }] : [];
+  });
+}
+
+const subjectLabel = ({ biomeId, source }) => `biome "${biomeId}" (git source "${source.name}" at ${source.commit})`;
+
+/** The biome directory relative to its source repository: the index path is `<source name>/<directory>`. */
+function repositoryPathOf({ source, entry }) {
+  const prefix = `${source.name}/`;
+  if (!entry.path.startsWith(prefix)) {
+    throw new Error(`${subjectLabel({ biomeId: entry.id, source })}: index path ${JSON.stringify(entry.path)} is not under the source "${source.name}"`);
+  }
+  return entry.path.slice(prefix.length);
+}
+
+/** Verify every subject, then refuse them all at once: one refusal is rethrown unchanged, several are one error. */
+async function verifyEach(subjects, verifyOne) {
+  const verified = new Map();
+  const refused = [];
+  for (const subject of subjects) {
+    try {
+      verified.set(developGitBundleKey(subject.source.name, subject.biomeId), await verifyOne(subject));
+    } catch (error) {
+      // A refusal, or a plain Error of the registry, cosign or git: this subject is refused. A defect (TypeError, ...) is not.
+      const refusal = error instanceof RefusalError || error?.constructor === Error;
+      if (!refusal) {throw error;}
+      refused.push(error instanceof DevelopGitBundleError ? error : new DevelopGitBundleError(`${subjectLabel(subject)}: ${error.message}`));
+    }
+  }
+  if (refused.length === 1) {throw refused[0];}
+  if (refused.length > 1) {throw new BundleSignerRefusedError(refused);}
+  return verified;
+}
+
+/**
+ * One subject, verified (steps 1 to 3 of this file's header). `context` is `{policy, policyRoot, schemas, trustedCosign}`.
+ *
+ * @returns {Promise<{bundleSource: object}>} the bundle source the lock row carries: the declared one, by digest
+ */
+export async function verifyDevelopGitBundle({
+  subject,
+  checkout,
+  context,
+  clientFor,
+  signerCommit = verifiedBundleSignerCommit,
+  verifyOnRegistry = verifyBundleOnRegistry,
+  treeIdAt = sourceTreeIdAt,
+  env = process.env,
+}) {
+  const { biomeId, source, entry } = subject;
+  const label = subjectLabel(subject);
+  if (checkout === undefined) {
+    throw new Error(`${label}: the source walk holds no checkout of "${source.name}"`);
+  }
+  const repository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(source.url, `${label} source url`), `${label} source url`);
+  const row = bundleSignerRowFor({ policy: context.policy, repository, channel: EditionChannel.Develop, schemas: context.schemas, label: `${label} develop bundle signer` });
+
+  // 1 + 2: the digest the manifest's tag serves; the commit P cosign verified the develop signature at; signature and
+  // provenance held to the row at P.
+  const ociRef = await bundleDigestRef({ clientFor, ociRef: entry.bundleSource.ociRef });
+  const cosign = { trustedCosign: context.trustedCosign, policy: context.policy, policyRoot: context.policyRoot, row, ociRef, env };
+  const attestedCommit = signerCommit(cosign);
+  verifyOnRegistry({ ...cosign, workflowSha: attestedCommit });
+
+  // 3: the content binding of P to F (see the header for the gap it leaves: build inputs outside the biome directory).
+  const binding = `the bundle ${ociRef} attested at ${attestedCommit} (P) against the source at ${source.commit} (F)`;
+  const { manifest } = await fetchBundleManifest({ clientFor, ociRef });
+  if (manifest?.xema?.id !== biomeId) {
+    throw new Error(`${label}: ${ociRef} declares xema.id ${JSON.stringify(manifest?.xema?.id)}, not "${biomeId}"`);
+  }
+  const bundleManifestHash = await context.schemas.computeBiomeSourceManifestHash(manifest);
+  if (bundleManifestHash !== entry.sourceManifestHash) {
+    throw new DevelopGitBundleError(
+      `${label}: ${binding}: the bundle's xema-biome.json hashes to sourceManifestHash ${bundleManifestHash}, but the manifest at F hashes to ${entry.sourceManifestHash}`,
+    );
+  }
+  const path = repositoryPathOf(subject);
+  const treeAtAttested = treeIdAt({ checkout, commit: attestedCommit, path, env });
+  const treeAtFrozen = treeIdAt({ checkout, commit: source.commit, path, env });
+  if (treeAtAttested !== treeAtFrozen) {
+    throw new DevelopGitBundleError(
+      `${label}: ${binding}: the biome directory ${path} is tree ${treeAtAttested} at P but tree ${treeAtFrozen} at F; publish a new version of the biome from F`,
+    );
+  }
+  return { bundleSource: { ...entry.bundleSource, ociRef } };
+}
+
+/**
+ * The verifier a vendor develop resolve hands `prepareDistributionWithIndex` (`inputs.developGitBundles`). Nothing is
+ * read (no trust policy, no cosign) unless a subject exists.
+ *
+ * @param {object} options
+ * @param {string|undefined} options.cosignBinary the cosign the trust policy pins by digest (`--cosign`)
+ * @param {string} options.dataRoot
+ */
+export function createDevelopGitBundleVerifier({ cosignBinary, dataRoot, env = process.env, clientFor, treeIdAt }) {
+  return Object.freeze({
+    async verify({ subjects, checkouts, schemas }) {
+      if (subjects.length === 0) {return new Map();}
+      if (cosignBinary === undefined) {
+        throw new DevelopGitBundleError(
+          `${subjects.map(subjectLabel).join(', ')} declare an OCI bundle; verifying it needs a cosign binary (--cosign), and none was given`,
+        );
+      }
+      const policy = loadPinnedDeclaredTrustPolicy({ dataRoot, declaration: editionWorkspaceConfig().evidenceTrustPolicy, schemas });
+      const trustedCosign = prepareTrustedCosignBinary({ cosignBinary, policy });
+      const context = { policy, policyRoot: dataRoot, schemas, trustedCosign };
+      const registry = clientFor ?? createRegistryClientResolver({ dataRoot });
+      try {
+        return await verifyEach(subjects, (subject) =>
+          verifyDevelopGitBundle({ subject, checkout: checkouts.get(subject.source.name), context, clientFor: registry, env, ...(treeIdAt === undefined ? {} : { treeIdAt }) }),
+        );
+      } finally {
+        trustedCosign.dispose();
+      }
+    },
+  });
+}
+
+/**
+ * The OFFLINE verifier of a candidate re-seal: the bundle the pinned develop edition already verified for the SAME
+ * source commit, carried forward unchanged, with the signer it was verified under (`pinnedBundleSigner`): the resolve
+ * refuses the row when the current trust policy selects any other signer (a rotated develop row). A subject at another commit, or one the pinned edition carried no bundle
+ * for, is refused: verifying a new bundle reads the registry, which an offline re-seal does not.
+ *
+ * @param {object} pinnedLock the pinned edition's parsed distribution lock
+ */
+export function carriedDevelopGitBundles(pinnedLock) {
+  return Object.freeze({
+    async verify({ subjects }) {
+      return verifyEach(subjects, async (subject) => {
+        const row = pinnedLock.biomes.find(
+          (biome) => biome.id === subject.biomeId && biome.source?.name === subject.source.name && biome.source.commit === subject.source.commit,
+        );
+        if (row?.bundleSource?.kind !== OCI_BUNDLE_SOURCE_KIND || row.bundleSigner === undefined) {
+          throw new DevelopGitBundleError(
+            `${subjectLabel(subject)}: the pinned edition carries no verified bundle at this commit, and an offline re-seal cannot verify one; resolve the develop edition instead`,
+          );
+        }
+        return { bundleSource: row.bundleSource, pinnedBundleSigner: row.bundleSigner };
+      });
+    },
+  });
+}

package/edition/develop-graph.mjs

@@ -13,14 +13,16 @@ import { compareStrings } from './lib.mjs';
 
 /**
  * The develop graph: `{ repo, repositoryUrl }` per declared first-party
- * repository, sorted by repo handle.
+ * repository, sorted by repo handle, plus `currentResolution` (its ticket) on a
+ * member the data root declares one for (develop-current-resolution.mjs).
  *
- * @returns {readonly { repo: string, repositoryUrl: string }[]}
+ * @returns {readonly { repo: string, repositoryUrl: string, currentResolution?: string }[]}
  */
 export function developGraphMembers() {
   return Object.freeze(
     Object.entries(firstPartySources('the develop graph'))
-      .map(([repo, { repositoryUrl }]) => Object.freeze({ repo, repositoryUrl }))
+      .map(([repo, { repositoryUrl, currentResolution }]) =>
+        Object.freeze({ repo, repositoryUrl, ...(currentResolution === undefined ? {} : { currentResolution }) }))
       .sort((a, b) => compareStrings(a.repo, b.repo)),
   );
 }

package/edition/develop-image-probe.mjs

@@ -8,7 +8,8 @@
 // hash-verified manifest — as soon as that subject's hash exists, in parallel
 // with the hashing of the rest, and `settle()` refuses with ONE error naming
 // every missing coordinate. It verifies existence only: the platform check, the
-// digest decision and the size bounds stay in the seal, which still runs.
+// digest decision and the size bounds stay in the seal, which still runs. `settle()` also answers the digest each
+// present coordinate resolved to (`<kind>:<id>` -> digest), for a caller that records it (develop image-record).
 
 import { RefusalError } from './collected-refusals.mjs';
 import { developImageRef } from './develop-image-coordinate.mjs';
@@ -39,7 +40,7 @@ export function notBuiltYetError(distributionId, missingSubjects, channel = 'dev
 /**
  * @param {object} request
  * @param {string} request.distributionId the edition (named in the refusal)
- * @returns {{ observe(subject: object): void, settle(): Promise<void> }}
+ * @returns {{ observe(subject: object): void, settle(): Promise<Map<string, string>> }}
  *   `observe` takes a subject with `repo`, `sourceCommit`, `imageRef` (release ref) and `contentHash`
  *   and starts its probe; `settle` waits for all of them and throws when any is absent or unreadable.
  */
@@ -72,9 +73,9 @@ export function createDevelopImageProbe({
     const startedAt = Date.now();
     const { repository } = splitImageRef(subject.imageRef);
     try {
-      await clientFor(subject).getManifestByTag(repository, subject.contentHash);
+      const { digest } = await clientFor(subject).getManifestByTag(repository, subject.contentHash);
       progress?.(`[probe] ${subject.kind}:${subject.id} present ${Date.now() - startedAt}ms`);
-      return { subject };
+      return { subject, digest };
     } catch (error) {
       progress?.(`[probe] ${subject.kind}:${subject.id} ${isNotPublishedYet(error) ? 'ABSENT' : 'FAILED'} ${Date.now() - startedAt}ms`);
       return { subject, error };
@@ -113,6 +114,7 @@ export function createDevelopImageProbe({
       if (aborting) {throw aborting.error;}
       const missing = settled.filter(({ error }) => error !== undefined).map(({ subject }) => subject);
       if (missing.length > 0) {throw notBuiltYetError(distributionId, missing);}
+      return new Map(settled.map(({ subject, digest }) => [`${subject.kind}:${subject.id}`, digest]));
     },
   };
 }