@xemahq/xema 0.54.0 → 0.56.0

package/edition/edition-protocol.mjs

@@ -30,27 +30,13 @@ import { RefusalError } from './collected-refusals.mjs';
 import { readBoundedNoFollowFile } from './no-follow-file.mjs';
 
 /** The edition protocols this library interprets: version -> content digest. A protocol is listed only
- * while every kernel published under it exports what this library imports (`kernel-export-coverage.test.mjs`):
- * v27 and older kernels lack `serviceImageSubjects` (first exported by the v28 kernel), so they are not listed.
- * No published kernel declares v29 (0.110.2 is v28, 0.110.3 is v30, 0.111.0 is v31, XEMA-2070 kernel is v32; v33 is the kernel's
- * bundle-signer protocol (`bundleSigner` on every OCI bundle row); v34 is the kernel's output-mapping, JSON Pointer and
- * handoff-repair-turns closure additions (XEMA-2122); v35 is the kernel's independent releases on a resolved deployment (XEMA-2244);
- * v36 is the kernel's JobFailureReason workflow closure addition (XEMA-2282);
- * v37 is the kernel's DistributionLock.catalogueContentDigest and effective-timeout wording (XEMA-2254, XEMA-2282); v38 is the kernel's optionalPeers service-manifest field (XEMA-2315); v39 admits an optional operation on an undeclared domain as ungranted (`owner-undeclared`, TEAM-1 EDR-2); v40 is the kernel's resource `sharing` field (owner or shared; one owner row per resource); v33 to v39 are not yet published: their identities and contracts are captured from the
- * linked kernel), so v29 is not listed either. */
+ * while every kernel published under it exports what this library imports (`kernel-export-coverage.test.mjs`).
+ * Only v45 is listed (contracts 0.119.0: image-lock v5, build record `members`, and an idempotent
+ * `carryForwardComposedArtifacts`). A v44 kernel's carry-forward bumps the generation on every call, so dist-check could never
+ * be green on its seals; v43 cannot carry build record members; v42 and older lack `DEFAULT_COMPOSED_IMAGE_CLASS` and
+ * `dedicatedServiceImageSubjects`. No legacy row is kept. */
 export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
-  Object.freeze({ version: 28, contentDigest: 'f7795478b1bfe9a41bcbea9efe496011fcd209a56c90294029a08801e84cf92c' }),
-  Object.freeze({ version: 30, contentDigest: '91e3cdff255778b5aa94b64ca9316d031be549ead2267a9a9311ff06d4f1db2c' }),
-  Object.freeze({ version: 31, contentDigest: 'b2026847fdd202e7b9e05815cdc2c9819b60be7007c789cc5b5f291c9c682fdd' }),
-  Object.freeze({ version: 32, contentDigest: 'a4ca824486052ca7f61b9a68f759b798defb620b6b3e9cbaab2c701bee2c6700' }),
-  Object.freeze({ version: 33, contentDigest: 'b070713e7abeeefad6da3a9053843b0f7420a466f6d504f60aaa00ef196b2b05' }),
-  Object.freeze({ version: 34, contentDigest: '370ceef5956d66035265ddbf7b9c46aa686cd10c1e95171c806c0d590ef5f49c' }),
-  Object.freeze({ version: 35, contentDigest: '3e616e532c45ecbd6277dde31c0d9c12a12139abe06cc0f56329d1ffe9813f8d' }),
-  Object.freeze({ version: 36, contentDigest: 'b6b0c8ec3fc4182c6c3b623685af6293cfed1321f8d7c1891a83652d864c3df0' }),
-  Object.freeze({ version: 37, contentDigest: 'f10adca1ca5b6f51f3971756261032eeddd60e372ebfcff06a2a9d8a796d0fef' }),
-  Object.freeze({ version: 38, contentDigest: 'f670cb922c989fd40ac03703a612e7a6df2937233a1a20a394a859ec835d47d4' }),
-  Object.freeze({ version: 39, contentDigest: 'b2159ede1755526cb63b6c533bc00caaead8151784864caf1a4d682281f47808' }),
-  Object.freeze({ version: 40, contentDigest: 'e26613bfccc87e2ccc0d94ac2c412cc35d1f48f48559bb8d0606f14d499db528' }),
+  Object.freeze({ version: 45, contentDigest: '54eb2f7d40e966e6efd5bc2ef0f4751b1121786300f4c50066e8add10c3ecb6a' }),
 ]);
 
 /** Where a kernel package publishes its identity and its contract, package-relative. */

package/edition/external-source-walk.mjs

@@ -180,6 +180,24 @@ function resolveRemoteCommit(source, gitEnv, exec = execFileSync) {
   return commit;
 }
 
+/** Fetch `commit` by id, depth 1, into the checkout at `directory` unless it already holds it. */
+function fetchCommitUnlessHeld(directory, commit, gitEnv, exec) {
+  const have = (() => {
+    try {
+      return git(directory, ['cat-file', '-e', `${commit}^{commit}`], gitEnv, exec) === '';
+    } catch {
+      return false;
+    }
+  })();
+  if (!have) {
+    exec(
+      'git',
+      ['-C', directory, 'fetch', '--quiet', '--depth=1', 'origin', commit],
+      { env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+  }
+}
+
 /**
  * Fetch a declared git source and return the directory + the EXACT commit its
  * manifests will be read at.
@@ -209,20 +227,7 @@ export function materializeGitSource({
       // reuses it: fetch from where the declaration says the source lives NOW.
       git(directory, ['remote', 'set-url', 'origin', source.url], gitEnv, exec);
     }
-    const have = (() => {
-      try {
-        return git(directory, ['cat-file', '-e', `${commit}^{commit}`], gitEnv, exec) === '';
-      } catch {
-        return false;
-      }
-    })();
-    if (!have) {
-      exec(
-        'git',
-        ['-C', directory, 'fetch', '--quiet', '--depth=1', 'origin', commit],
-        { env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'] },
-      );
-    }
+    fetchCommitUnlessHeld(directory, commit, gitEnv, exec);
     git(directory, ['checkout', '--quiet', '--detach', commit], gitEnv, exec);
     return { directory, commit: pinExternalSourceCommit({ name: source.name, directory, commit }) };
   });
@@ -405,6 +410,7 @@ export async function walkDeclaredSources({
 } = {}) {
   const entries = [];
   const sourceRecords = new Map();
+  const checkouts = new Map();
   // Every source is held (kind, then credential and URL) before the first is materialised.
   const heldWorkspace = sources.length === 0 ? undefined : (workspace ?? editionWorkspaceConfig());
   for (const source of sources) {
@@ -446,6 +452,7 @@ export async function walkDeclaredSources({
       entries.push(stampEntry(assertSourceWalkedOrigin(await manifestToIndexEntry(manifest), source.name), source.name));
     }
     sourceRecords.set(source.name, lockedSourceRecord(source, commit));
+    checkouts.set(source.name, { source, directory });
   }
   // The last point at which an unstamped entry can be caught before it reaches
   // the shared index, where absent-is-the-identity makes it admissible
@@ -459,5 +466,20 @@ export async function walkDeclaredSources({
         'open-source edition. Refusing.',
     );
   }
-  return { entries, sourceRecords };
+  return { entries, sourceRecords, checkouts };
+}
+
+/**
+ * The git tree id of `path` (repository-relative, `.` for the root) of a declared git source at `commit`, read in the
+ * walk's checkout of that source (`checkouts` of `walkDeclaredSources`). A commit the checkout does not hold is fetched
+ * by id, depth 1, from the declared URL under the source's own credential hold: no history is needed.
+ */
+export function sourceTreeIdAt({ checkout, commit, path, env = process.env, workspace = editionWorkspaceConfig(), exec = execFileSync }) {
+  if (!EXACT_COMMIT.test(String(commit))) {
+    throw new Error(`source "${checkout.source.name}": tree of ${JSON.stringify(commit)} asked, which is not an exact 40-hex commit`);
+  }
+  return withSourceGitEnv(checkout.source, { workspace, env }, (gitEnv) => {
+    fetchCommitUnlessHeld(checkout.directory, commit, gitEnv, exec);
+    return git(checkout.directory, ['rev-parse', '--verify', path === '.' ? `${commit}^{tree}` : `${commit}:${path}`], gitEnv, exec);
+  });
 }

package/edition/image-evidence.mjs

@@ -20,6 +20,7 @@ import { certificateConstraintArgs } from './cosign-certificate-constraints.mjs'
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
 import { effectiveRepositoryPins, manifestSourcePins } from './edition-source-pins.mjs';
 import { SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
+import { evidenceSubjectKey } from './image-subject-identity.mjs';
 import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
 import {
   compareStrings,
@@ -165,7 +166,7 @@ export function assertProducerTtlCeiling({ issuedAt, expiresAt, maxTtlSeconds, l
 }
 
 export function sourceIdentity(subject) {
-  return `${subject.kind}\0${subject.id}`;
+  return evidenceSubjectKey(subject);
 }
 
 /** Root of the committed evidence tree, in every producing repository. */
@@ -424,7 +425,10 @@ export function validateProducerStatementBinding({
 export function compareCompletenessImages(left, right) {
   return (
     compareStrings(left.subjectKind, right.subjectKind) ||
-    compareStrings(left.subjectId, right.subjectId)
+    compareStrings(left.subjectId, right.subjectId) ||
+    // The generations of one composed artifact share kind and id: they order by image, then manifest.
+    compareStrings(left.imageRepository, right.imageRepository) ||
+    compareStrings(left.manifestDigest, right.manifestDigest)
   );
 }
 

package/edition/image-lock-service-rows.mjs

@@ -13,14 +13,14 @@ function isOwnedByBiome(subject, biomeId, enums) {
 /**
  * The subject carrying the image of `kind:id` for the biome `biomeId`, or undefined.
  * A service is served by (a) a Service subject with that id owned by the biome, or (b) a subject owned by the biome
- * whose `members[]` names the service. The member-to-subject step is the kernel's `serviceImageSubjects`
- * (`enums.serviceImageSubjects`), the same rule the launcher's `loadImageLock` applies; this file adds only the
+ * whose `members[]` names the service. The member-to-subject step is the kernel's `dedicatedServiceImageSubjects`
+ * (`enums.dedicatedServiceImageSubjects`), applied to the lock's `schemaVersion` and the biome's subjects; the same rule the launcher's `loadImageLock` applies; this file adds only the
  * biome-owner filter. The biome's own `services` list supplies `id`.
  */
-export function subjectServingBiome(subjects, biomeId, kind, id, enums) {
+export function subjectServingBiome(schemaVersion, subjects, biomeId, kind, id, enums) {
   const owned = subjects.filter((subject) => isOwnedByBiome(subject, biomeId, enums));
   if (kind !== enums.RuntimeImageSubjectKind.Service) {
     return owned.find((subject) => subject.kind === kind && subject.id === id);
   }
-  return enums.serviceImageSubjects(owned).get(id);
+  return enums.dedicatedServiceImageSubjects({ schemaVersion, subjects: owned }).get(id);
 }

package/edition/image-subject-identity.mjs

@@ -0,0 +1,24 @@
+// The identity of a subject of an images lock, as the kernel's image-lock v5 uniqueness rule defines it
+// (`parseImageLock`): a subject is `kind:id`, except a composed-process ARTIFACT, which is `imageRef:contentHash` — the
+// generations of one composed artifact share one id and differ by that coordinate. Every map keyed by subject (digest
+// plans, the seal, the lock validation) uses this one function, so two live generations never collapse onto one key.
+
+const COMPOSED_PROCESS_KIND = 'composed-process';
+
+/** The printable identity of a lock subject (or of a verification entry carrying `kind`, `id`, `imageRef`, `contentHash`). */
+export function imageSubjectIdentity({ kind, id, imageRef, contentHash }) {
+  return kind === COMPOSED_PROCESS_KIND ? `${kind}:${imageRef}:${contentHash}` : `${kind}:${id}`;
+}
+
+/**
+ * The key of a subject in the evidence lane: `kind\0id` for every kind but a composed-process artifact, which is its
+ * `imageSubjectIdentity` (so two live generations of one composed artifact get distinct producer stems and index keys).
+ */
+export function evidenceSubjectKey({ kind, id, imageRef, contentHash }) {
+  return kind === COMPOSED_PROCESS_KIND ? imageSubjectIdentity({ kind, id, imageRef, contentHash }) : `${kind}\0${id}`;
+}
+
+/** The key of one image of a completeness statement, which names its image by repository and manifest digest, not by content hash. */
+export function completenessImageKey({ subjectKind, subjectId, imageRepository, manifestDigest }) {
+  return subjectKind === COMPOSED_PROCESS_KIND ? `${subjectKind}:${imageRepository}@${manifestDigest}` : `${subjectKind}\0${subjectId}`;
+}

package/edition/images-from-record.mjs

@@ -24,13 +24,13 @@
 // A third-party subject (a pinned OCI biome's image) is not built by the job: it keeps its pinned seal, and a record
 // entry naming one is an extra subject.
 //
-// The record schema is CLI-owned and versioned here, behind this one module. It is a generic image-evidence concept
-// that belongs in @xemahq/contracts (beside BuildRecordSchema); moving it there changes only `parseImageBuildRecord`.
+// The record schema is the kernel's (`ImageBuildRecordSchema` / `parseImageBuildRecord`, @xemahq/contracts, edition
+// protocol v41), loaded through the kernel loader; this module owns no parser of its own.
 
 import { canonicalJson } from './canonical-evidence-json.mjs';
 import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
 import { RefusalError } from './collected-refusals.mjs';
-import { developImageRef, isDevelopImageRef } from './develop-image-coordinate.mjs';
+import { developImageRef } from './develop-image-coordinate.mjs';
 import { withRecordVerifier } from './develop-record-verify.mjs';
 import { findVerifiedProducerImageRecord } from './develop-verify-image-record.mjs';
 import { EditionChannel } from './edition-channel.mjs';
@@ -41,9 +41,6 @@ import { RecordRefused } from './record-refused.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 import { FirstPartyImageOrigin } from './workspace-sections.mjs';
 
-/** The one schema version of the image build record this CLI reads. */
-export const IMAGE_BUILD_RECORD_SCHEMA_VERSION = 1;
-
 /** Which list of the record an entry came from: how far it is trusted. */
 export const RecordedImageOrigin = Object.freeze({
   Built: 'images',
@@ -56,17 +53,6 @@ const LIST_OF_ORIGIN = Object.freeze({
   [FirstPartyImageOrigin.Satellite]: RecordedImageOrigin.Satellite,
 });
 
-const RECORD_KEYS = Object.freeze(['schemaVersion', ...Object.values(RecordedImageOrigin)]);
-const ENTRY_KEYS = Object.freeze(['subject', 'repository', 'contentHash', 'digest', 'platforms', 'sourceSha']);
-const PLATFORM_REQUIRED_KEYS = Object.freeze(['os', 'architecture']);
-const PLATFORM_KEYS = Object.freeze([...PLATFORM_REQUIRED_KEYS, 'variant']);
-
-const SUBJECT = /^[a-z][a-z0-9-]*:[a-z0-9][a-z0-9._-]*$/;
-const REPOSITORY = /^[a-z0-9.-]+(?::[1-9]\d{0,4})?\/(?:[a-z0-9._-]+\/)*[a-z0-9._-]+$/;
-const CONTENT_HASH = /^[0-9a-f]{64}$/;
-const DIGEST = /^sha256:[0-9a-f]{64}$/;
-const SOURCE_SHA = /^[0-9a-f]{40}$/;
-
 /** A build record that is malformed, or does not cover the edition exactly. */
 export class ImageBuildRecordError extends RefusalError {
   constructor(message) {
@@ -80,104 +66,32 @@ export const subjectKeyOf = (subject) => `${subject.kind}:${subject.id}`;
 
 const platformKey = (platform) => [platform.os, platform.architecture, platform.variant ?? ''].join('/');
 
-function isPlainObject(value) {
-  return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-
-function refuseUnknownKeys(value, allowed, where, problems) {
-  for (const key of Object.keys(value)) {
-    if (!allowed.includes(key)) {problems.push(`${where}: unknown key ${JSON.stringify(key)}`);}
-  }
-}
-
-function checkText(value, pattern, where, problems) {
-  if (typeof value !== 'string' || !pattern.test(value)) {problems.push(`${where} must match ${pattern}; got ${JSON.stringify(value)}`);}
-}
-
-function checkPlatforms(platforms, where, problems) {
-  if (!Array.isArray(platforms) || platforms.length === 0) {
-    problems.push(`${where} must be a non-empty array of {os, architecture[, variant]}`);
-    return;
-  }
-  const seen = new Set();
-  platforms.forEach((platform, index) => {
-    const at = `${where}[${index}]`;
-    if (!isPlainObject(platform)) {
-      problems.push(`${at} must be an object`);
-      return;
-    }
-    refuseUnknownKeys(platform, PLATFORM_KEYS, at, problems);
-    for (const key of Object.keys(platform).filter((name) => PLATFORM_KEYS.includes(name))) {
-      if (typeof platform[key] !== 'string' || platform[key].length === 0) {problems.push(`${at}.${key} must be a non-empty string`);}
-    }
-    for (const key of PLATFORM_REQUIRED_KEYS) {
-      if (!Object.hasOwn(platform, key)) {problems.push(`${at} has no ${key}`);}
-    }
-    const key = platformKey(platform);
-    if (seen.has(key)) {problems.push(`${at} repeats platform ${key}`);}
-    seen.add(key);
-  });
-}
-
-function checkEntry(entry, where, problems) {
-  if (!isPlainObject(entry)) {
-    problems.push(`${where} must be an object`);
-    return;
+/** The kernel's image-build-record exports, refused as a set when any is absent (a kernel before edition protocol v41). */
+export function requireImageBuildRecordKernel(schemas) {
+  const names = ['ImageBuildRecordSchema', 'parseImageBuildRecord', 'IMAGE_BUILD_RECORD_SCHEMA_VERSION'];
+  const missing = names.filter((name) => schemas?.[name] === undefined);
+  if (missing.length > 0) {
+    throw new ImageBuildRecordError(`the kernel's distribution module does not export ${missing.join(', ')}; the image build record needs a kernel at edition protocol v41 or newer`);
   }
-  refuseUnknownKeys(entry, ENTRY_KEYS, where, problems);
-  for (const key of ENTRY_KEYS) {
-    if (!Object.hasOwn(entry, key)) {problems.push(`${where} has no ${key}`);}
-  }
-  checkText(entry.subject, SUBJECT, `${where}.subject`, problems);
-  checkText(entry.repository, REPOSITORY, `${where}.repository`, problems);
-  if (typeof entry.repository === 'string' && REPOSITORY.test(entry.repository) && !isDevelopImageRef(entry.repository)) {
-    problems.push(`${where}.repository ${entry.repository} is not a develop repository`);
-  }
-  checkText(entry.contentHash, CONTENT_HASH, `${where}.contentHash`, problems);
-  checkText(entry.digest, DIGEST, `${where}.digest`, problems);
-  checkText(entry.sourceSha, SOURCE_SHA, `${where}.sourceSha`, problems);
-  checkPlatforms(entry.platforms, `${where}.platforms`, problems);
+  return schemas;
 }
 
 /**
- * Parse an image build record: `{schemaVersion: 1, images: [entry], satellites: [entry]}`, every list sorted by
- * subject, no subject in two entries, and no unknown key anywhere. Every problem is named in one refusal.
+ * Parse an image build record with the kernel's own parser (`parseImageBuildRecord`, the ONE contract: both the writer
+ * `develop image-record` and this reader go through it): `{schemaVersion: 1, images: [entry], satellites: [entry]}`, every
+ * list sorted by subject, no subject twice, no unknown key. A refusal is an `ImageBuildRecordError` carrying the kernel's message.
  *
  * @param {unknown} document
  * @param {string} source where the record came from (named in the refusal)
- * @returns {{schemaVersion: 1, images: object[], satellites: object[]}}
+ * @param {{loadKernel?: () => Promise<object>}} [injections] tests replace the kernel loader
  */
-export function parseImageBuildRecord(document, source) {
-  const problems = [];
-  if (!isPlainObject(document)) {throw new ImageBuildRecordError(`image build record ${source} must be a JSON object`);}
-  refuseUnknownKeys(document, RECORD_KEYS, 'record', problems);
-  if (document.schemaVersion !== IMAGE_BUILD_RECORD_SCHEMA_VERSION) {
-    problems.push(`record.schemaVersion must be ${IMAGE_BUILD_RECORD_SCHEMA_VERSION}; got ${JSON.stringify(document.schemaVersion)}`);
-  }
-  const owner = new Map();
-  for (const origin of Object.values(RecordedImageOrigin)) {
-    const entries = document[origin];
-    if (!Array.isArray(entries)) {
-      problems.push(`record.${origin} must be an array`);
-      continue;
-    }
-    entries.forEach((entry, index) => {
-      const where = `record.${origin}[${index}]`;
-      checkEntry(entry, where, problems);
-      const subject = entry?.subject;
-      if (typeof subject !== 'string') {return;}
-      const previous = entries[index - 1]?.subject;
-      if (typeof previous === 'string' && previous >= subject && previous !== subject) {
-        problems.push(`${where}: record.${origin} must be sorted by subject ("${subject}" follows "${previous}")`);
-      }
-      if (owner.has(subject)) {problems.push(`${where}: subject ${subject} is already recorded at ${owner.get(subject)}`);}
-      else {owner.set(subject, where);}
-    });
+export async function parseImageBuildRecord(document, source, { loadKernel = loadKernelDistributionSchemas } = {}) {
+  const kernel = requireImageBuildRecordKernel(await loadKernel());
+  try {
+    return kernel.parseImageBuildRecord(document);
+  } catch (error) {
+    throw new ImageBuildRecordError(`image build record ${source} is refused: ${error.message}`);
   }
-  if (problems.length > 0) {
-    throw new ImageBuildRecordError(`image build record ${source} is refused:\n  ${problems.join('\n  ')}`);
-  }
-  return document;
 }
 
 /**
@@ -194,7 +108,7 @@ export function imageBuildRecordDigest(record) {
 }
 
 /** Read and parse the record file `--images-from` names (duplicate JSON keys refused). */
-export function readImageBuildRecord(path) {
+export async function readImageBuildRecord(path) {
   return parseImageBuildRecord(readStrictJsonFile(path), path);
 }
 
@@ -240,7 +154,7 @@ export function createRecordedImages(record, { distributionId, declaredSources =
       const absent = subject.requiredPlatforms.map(platformKey).filter((platform) => !recordedPlatforms.has(platform));
       if (absent.length > 0) {problems.push(`${key}: the record's platforms lack the required ${absent.join(', ')}`);}
       taken.set(key, { subject, ...recorded });
-      return { sourceCommit: entry.sourceSha, contentHash: entry.contentHash };
+      return { sourceCommit: entry.sourceSha, contentHash: entry.contentHash, ...recordedMembers(key, subject, entry, problems) };
     },
     settle() {
       settled = true;
@@ -262,6 +176,28 @@ export function createRecordedImages(record, { distributionId, declaredSources =
   };
 }
 
+/**
+ * A composed subject's members with the keys its record entry carries (`members[{service, key}]`), never computed here.
+ * An entry without members, or whose services are not the subject's members, is a problem named once; a subject that is
+ * not composed gives nothing.
+ */
+function recordedMembers(key, subject, entry, problems) {
+  if (subject.members === undefined) {return {};}
+  if (entry.members === undefined) {
+    problems.push(`${key}: the record's composed entry carries no members[{service, key}]`);
+    return {};
+  }
+  const keyOf = new Map(entry.members.map((member) => [member.service, member.key]));
+  const wanted = subject.members.map((member) => member.service);
+  const absent = wanted.filter((service) => !keyOf.has(service));
+  const extra = [...keyOf.keys()].filter((service) => !wanted.includes(service));
+  if (absent.length > 0 || extra.length > 0) {
+    problems.push(`${key}: the record's members differ from the subject's${absent.length > 0 ? ` (no key for ${absent.join(', ')})` : ''}${extra.length > 0 ? ` (not members: ${extra.join(', ')})` : ''}`);
+    return {};
+  }
+  return { members: subject.members.map((member) => ({ ...member, key: keyOf.get(member.service) })) };
+}
+
 /** Why the record list `origin` may not carry the subject's entry, or null when its source's declared origin names it. */
 function recordListProblem(key, subject, origin, declaredSources) {
   if (!Object.hasOwn(declaredSources, subject.repo)) {
@@ -337,9 +273,9 @@ export function createSatelliteVerifier({ registry, cosignBinary, env = process.
  *
  * @returns {Promise<{imageLock: object, recorded: ReturnType<typeof createRecordedImages>}>}
  */
-export async function resolveImagesFromRecord({ id, inputs, lock, record, resolveImages, verifySatellites }) {
+export async function resolveImagesFromRecord({ id, inputs, lock, record, resolveImages, verifySatellites, previousLock = null }) {
   const recorded = createRecordedImages(record, { distributionId: id });
-  const { imageLock } = await resolveImages(id, { inputs, lock, recordedImages: recorded });
+  const { imageLock } = await resolveImages(id, { inputs, lock, recordedImages: recorded, previousLock });
   await verifySatellites(recorded.satelliteClaims());
   return { imageLock, recorded };
 }

package/edition/lib.mjs

@@ -36,6 +36,7 @@ import {
 } from './edition-workspace.mjs';
 import { SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
 import { readGitJsonAtCommit } from './git-json.mjs';
+import { imageSubjectIdentity } from './image-subject-identity.mjs';
 import { isKernelCapabilityDomain } from './kernel-capability-domain.mjs';
 import {
   PRINCIPAL_PRIVILEGE_FIELDS,
@@ -719,23 +720,6 @@ export function assertKernelSealsComposedMembership(schemas, subjects, label) {
   );
 }
 
-/**
- * The READ side of the same rule, for a kernel before image-lock
- * schemaVersion 4 (no `ImageLockSchemaVersion`): it reads only schemaVersion
- * 3, which names no composed members, so a v3 lock carrying a composed-process
- * subject cannot say which services run from it and is refused (worded as the
- * kernel's own `LegacyComposedImageLockError`).
- */
-export function assertLegacyLockHasNoComposedSubject(lock) {
-  const composed = (lock.subjects ?? []).find((subject) => subject.kind === 'composed-process');
-  if (composed === undefined) {return;}
-  throw new ComposedProcessNeedsLockV4Error(
-    `distribution "${lock.distributionId}": subjects "${composed.id}" is a schemaVersion ` +
-      `${String(lock.schemaVersion)} composed-process subject, which names no members: regenerate with a CLI ` +
-      'that writes image-lock schemaVersion 4, against a kernel at edition protocol >= v14',
-  );
-}
-
 /**
  * The image-lock schemaVersion a writer emits for `subjects`: the loaded
  * kernel's `IMAGE_LOCK_WRITE_SCHEMA_VERSION`. A kernel before edition protocol
@@ -800,7 +784,10 @@ export async function loadKernelDistributionSchemas() {
     parseOciDigest,
     parseGitTreeId,
     parseImageLock,
-    serviceImageSubjects,
+    dedicatedServiceImageSubjects,
+    carryForwardComposedArtifacts,
+    DEFAULT_COMPOSED_IMAGE_CLASS,
+    ComposedImageClassSchema,
     IMAGE_LOCK_WRITE_SCHEMA_VERSION,
     ImageLockSchemaVersion,
     parseImageProducerStatement,
@@ -893,7 +880,10 @@ export async function loadKernelDistributionSchemas() {
     typeof parseOciDigest !== 'function' ||
     typeof parseGitTreeId !== 'function' ||
     typeof parseImageLock !== 'function' ||
-    typeof serviceImageSubjects !== 'function' ||
+    typeof dedicatedServiceImageSubjects !== 'function' ||
+    typeof carryForwardComposedArtifacts !== 'function' ||
+    typeof DEFAULT_COMPOSED_IMAGE_CLASS !== 'string' ||
+    typeof ComposedImageClassSchema?.safeParse !== 'function' ||
     typeof parseImageProducerStatement !== 'function' ||
     typeof parseDistributionImagesStatement !== 'function' ||
     typeof parseImageDeliveryEntitlementStatement !== 'function' ||
@@ -997,6 +987,8 @@ export async function loadKernelDistributionSchemas() {
   // The build-record exports (absent from a kernel before the build-record contract): carried as-is, NOT required
   // here, so every other verb still loads an older kernel. `select-records` refuses a kernel that lacks them.
   const { BUILD_RECORD_MEDIA_TYPE, BuildRecordSchema, buildRecordTag, parseBuildRecordTag, compareBuildRecordRuns, parseBuildRecord } = mod;
+  // The image-build-record exports (edition protocol v41): the same, carried as-is; `develop image-record` and `--images-from` refuse an older kernel.
+  const { IMAGE_BUILD_RECORD_SCHEMA_VERSION, ImageBuildRecordSchema, parseImageBuildRecord } = mod;
   return {
     BUILD_RECORD_MEDIA_TYPE,
     BuildRecordSchema,
@@ -1004,6 +996,9 @@ export async function loadKernelDistributionSchemas() {
     parseBuildRecordTag,
     compareBuildRecordRuns,
     parseBuildRecord,
+    IMAGE_BUILD_RECORD_SCHEMA_VERSION,
+    ImageBuildRecordSchema,
+    parseImageBuildRecord,
     parseDistribution,
     parseDistributionLock,
     parseDistributionLockForReading,
@@ -1022,7 +1017,10 @@ export async function loadKernelDistributionSchemas() {
     parseOciDigest,
     parseGitTreeId,
     parseImageLock,
-    serviceImageSubjects,
+    dedicatedServiceImageSubjects,
+    carryForwardComposedArtifacts,
+    DEFAULT_COMPOSED_IMAGE_CLASS,
+    ComposedImageClassSchema,
     IMAGE_LOCK_WRITE_SCHEMA_VERSION,
     ImageLockSchemaVersion,
     parseImageProducerStatement,
@@ -3111,9 +3109,7 @@ export function validateImmutableImageLock(lock, schemas) {
     throw new Error('trusted kernel distribution schemas are required');
   }
   assertKernelSealsComposedMembership(schemas, lock.subjects, `distribution "${lock.distributionId}"`);
-  // The revisions the loaded kernel reads (`ImageLockSchemaVersion`: 3 without
-  // composed membership, 4 with it); a kernel before image-lock v4 reads only 3.
-  if (schemas.ImageLockSchemaVersion === undefined) {assertLegacyLockHasNoComposedSubject(lock);}
+  // The revisions the loaded kernel reads (`ImageLockSchemaVersion`).
   const readableVersions =
     schemas.ImageLockSchemaVersion === undefined
       ? [PRE_V14_IMAGE_LOCK_SCHEMA_VERSION]
@@ -3128,11 +3124,13 @@ export function validateImmutableImageLock(lock, schemas) {
     );
   }
   const identities = new Set();
+  const namedSubjects = new Set();
   for (const subject of lock.subjects ?? []) {
-    const identity = `${subject.kind}\0${subject.id}`;
+    namedSubjects.add(`${subject.kind}:${subject.id}`);
+    const identity = imageSubjectIdentity(subject);
     if (identities.has(identity)) {
       throw new Error(
-        `distribution "${lock.distributionId}" has duplicate runtime image subject "${subject.kind}:${subject.id}"`,
+        `distribution "${lock.distributionId}" has duplicate runtime image subject "${identity}"`,
       );
     }
     identities.add(identity);
@@ -3167,7 +3165,7 @@ export function validateImmutableImageLock(lock, schemas) {
       );
     }
     platformServices.add(binding.platformService);
-    if (!identities.has(`${binding.subjectKind}\0${binding.subjectId}`)) {
+    if (!namedSubjects.has(`${binding.subjectKind}:${binding.subjectId}`)) {
       throw new Error(
         `distribution "${lock.distributionId}": platform service "${binding.platformService}" binds unknown runtime subject "${binding.subjectKind}:${binding.subjectId}"`,
       );