@xemahq/xema 0.55.0 → 0.56.0

package/edition/develop-git-bundles.mjs

@@ -0,0 +1,201 @@
+// develop-git-bundles — the OCI bundle of a git-sourced biome, in a VENDOR DEVELOP edition only (XEMA-2456).
+//
+// A release and a customer edition never carry an OCI bundle on a git-sourced row: the manifest's `bundleSource` names
+// an artifact the release lane builds, not one built from the pinned commit (resolve-distribution.mjs strips it, the
+// release refuses it). A develop edition freezes a git source at its develop head F, and the source's own develop lane
+// publishes the bundle the manifest names, signed keyless by its develop workflow. This module proves that bundle is
+// the one F describes, and only then does the resolve keep it on the row, by DIGEST, with its develop bundle signer:
+//
+//   1. the bundle: the manifest's own `bundleSource.ociRef` at F (`<repository>:<version>`; the kernel holds the tag to
+//      the manifest version) resolved to its digest at the registry. The lock records `<repository>@sha256:<hex>`, never
+//      the tag, so the edition names immutable bytes;
+//   2. the signer: the ONE `develop` row of the source's repository in the data root's trust policy
+//      (`bundleSignerRowFor`). cosign verifies the digest's signature under that row's identity, issuer, workflow
+//      repository and ref, and states the ONE commit P its certificate was issued at (`verifiedBundleSignerCommit`);
+//      `verifyBundleOnRegistry` then holds the signature AND the SLSA provenance to exactly the row and P. P is never
+//      read from bytes cosign has not verified;
+//   3. the content binding of P to F. A version that is already published is never re-attested by the publisher
+//      (`xema biome publish` "already current"), so P is the commit that last published the version, and F may be a
+//      later commit of the same version. Two checks, refused on either, each naming P, F and the mismatching pair:
+//        (a) the kernel's `computeBiomeSourceManifestHash` of the bundle's own `xema-biome.json` equals the
+//            `sourceManifestHash` of the biome at F (the hash the seal and verify hold to the git source at F);
+//        (b) the git tree id of the biome directory at P equals its tree id at F (the catalogue's `sourceTreeIds`
+//            notion), so the bundle was built from the same biome source F holds.
+//      THE GAP, develop only: build inputs outside the biome directory (shared packages, the lockfile, the publisher's
+//      toolchain) are not bound. A change there between P and F reaches no check here. A release never relies on this:
+//      it carries a third-party bundle only through an `oci` source with a third-party pin, whose evidence is bound to
+//      the pinned commit itself.
+//
+// Every failure is a `DevelopGitBundleError` naming the biome; all subjects are verified before one is refused.
+
+import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
+import { RefusalError } from './collected-refusals.mjs';
+import { EditionChannel } from './edition-channel.mjs';
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
+import { sourceTreeIdAt } from './external-source-walk.mjs';
+import { prepareTrustedCosignBinary } from './image-evidence.mjs';
+import { BundleSignerRefusedError, DevelopGitBundleError } from './locked-bundle-signer.mjs';
+import { createRegistryClientResolver } from './oci-image-source-evidence.mjs';
+import { bundleDigestRef, fetchBundleManifest, verifiedBundleSignerCommit, verifyBundleOnRegistry } from './third-party-bundle-registry.mjs';
+import { bundleSignerRowFor } from './third-party-source-evidence.mjs';
+import { OCI_BUNDLE_SOURCE_KIND } from './third-party-subjects.mjs';
+
+/** The key a verified bundle is looked up by: the source name and the biome id of its index entry. */
+export const developGitBundleKey = (sourceName, biomeId) => `${sourceName}\u0000${biomeId}`;
+
+/**
+ * The rows a develop resolve must verify a bundle for: each git-sourced biome of `lock` (a row with a `source`) whose
+ * index entry declares a biome-level OCI `bundleSource`.
+ *
+ * @returns {{biomeId: string, source: {name: string, url: string, commit: string}, entry: object}[]}
+ */
+export function developGitBundleSubjects({ lock, index }) {
+  const entries = new Map(index.filter((entry) => entry.source !== undefined).map((entry) => [developGitBundleKey(entry.source, entry.id), entry]));
+  return lock.biomes.flatMap((biome) => {
+    if (biome.source === undefined) {return [];}
+    const entry = entries.get(developGitBundleKey(biome.source.name, biome.id));
+    return entry?.bundleSource?.kind === OCI_BUNDLE_SOURCE_KIND ? [{ biomeId: biome.id, source: biome.source, entry }] : [];
+  });
+}
+
+const subjectLabel = ({ biomeId, source }) => `biome "${biomeId}" (git source "${source.name}" at ${source.commit})`;
+
+/** The biome directory relative to its source repository: the index path is `<source name>/<directory>`. */
+function repositoryPathOf({ source, entry }) {
+  const prefix = `${source.name}/`;
+  if (!entry.path.startsWith(prefix)) {
+    throw new Error(`${subjectLabel({ biomeId: entry.id, source })}: index path ${JSON.stringify(entry.path)} is not under the source "${source.name}"`);
+  }
+  return entry.path.slice(prefix.length);
+}
+
+/** Verify every subject, then refuse them all at once: one refusal is rethrown unchanged, several are one error. */
+async function verifyEach(subjects, verifyOne) {
+  const verified = new Map();
+  const refused = [];
+  for (const subject of subjects) {
+    try {
+      verified.set(developGitBundleKey(subject.source.name, subject.biomeId), await verifyOne(subject));
+    } catch (error) {
+      // A refusal, or a plain Error of the registry, cosign or git: this subject is refused. A defect (TypeError, ...) is not.
+      const refusal = error instanceof RefusalError || error?.constructor === Error;
+      if (!refusal) {throw error;}
+      refused.push(error instanceof DevelopGitBundleError ? error : new DevelopGitBundleError(`${subjectLabel(subject)}: ${error.message}`));
+    }
+  }
+  if (refused.length === 1) {throw refused[0];}
+  if (refused.length > 1) {throw new BundleSignerRefusedError(refused);}
+  return verified;
+}
+
+/**
+ * One subject, verified (steps 1 to 3 of this file's header). `context` is `{policy, policyRoot, schemas, trustedCosign}`.
+ *
+ * @returns {Promise<{bundleSource: object}>} the bundle source the lock row carries: the declared one, by digest
+ */
+export async function verifyDevelopGitBundle({
+  subject,
+  checkout,
+  context,
+  clientFor,
+  signerCommit = verifiedBundleSignerCommit,
+  verifyOnRegistry = verifyBundleOnRegistry,
+  treeIdAt = sourceTreeIdAt,
+  env = process.env,
+}) {
+  const { biomeId, source, entry } = subject;
+  const label = subjectLabel(subject);
+  if (checkout === undefined) {
+    throw new Error(`${label}: the source walk holds no checkout of "${source.name}"`);
+  }
+  const repository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(source.url, `${label} source url`), `${label} source url`);
+  const row = bundleSignerRowFor({ policy: context.policy, repository, channel: EditionChannel.Develop, schemas: context.schemas, label: `${label} develop bundle signer` });
+
+  // 1 + 2: the digest the manifest's tag serves; the commit P cosign verified the develop signature at; signature and
+  // provenance held to the row at P.
+  const ociRef = await bundleDigestRef({ clientFor, ociRef: entry.bundleSource.ociRef });
+  const cosign = { trustedCosign: context.trustedCosign, policy: context.policy, policyRoot: context.policyRoot, row, ociRef, env };
+  const attestedCommit = signerCommit(cosign);
+  verifyOnRegistry({ ...cosign, workflowSha: attestedCommit });
+
+  // 3: the content binding of P to F (see the header for the gap it leaves: build inputs outside the biome directory).
+  const binding = `the bundle ${ociRef} attested at ${attestedCommit} (P) against the source at ${source.commit} (F)`;
+  const { manifest } = await fetchBundleManifest({ clientFor, ociRef });
+  if (manifest?.xema?.id !== biomeId) {
+    throw new Error(`${label}: ${ociRef} declares xema.id ${JSON.stringify(manifest?.xema?.id)}, not "${biomeId}"`);
+  }
+  const bundleManifestHash = await context.schemas.computeBiomeSourceManifestHash(manifest);
+  if (bundleManifestHash !== entry.sourceManifestHash) {
+    throw new DevelopGitBundleError(
+      `${label}: ${binding}: the bundle's xema-biome.json hashes to sourceManifestHash ${bundleManifestHash}, but the manifest at F hashes to ${entry.sourceManifestHash}`,
+    );
+  }
+  const path = repositoryPathOf(subject);
+  const treeAtAttested = treeIdAt({ checkout, commit: attestedCommit, path, env });
+  const treeAtFrozen = treeIdAt({ checkout, commit: source.commit, path, env });
+  if (treeAtAttested !== treeAtFrozen) {
+    throw new DevelopGitBundleError(
+      `${label}: ${binding}: the biome directory ${path} is tree ${treeAtAttested} at P but tree ${treeAtFrozen} at F; publish a new version of the biome from F`,
+    );
+  }
+  return { bundleSource: { ...entry.bundleSource, ociRef } };
+}
+
+/**
+ * The verifier a vendor develop resolve hands `prepareDistributionWithIndex` (`inputs.developGitBundles`). Nothing is
+ * read (no trust policy, no cosign) unless a subject exists.
+ *
+ * @param {object} options
+ * @param {string|undefined} options.cosignBinary the cosign the trust policy pins by digest (`--cosign`)
+ * @param {string} options.dataRoot
+ */
+export function createDevelopGitBundleVerifier({ cosignBinary, dataRoot, env = process.env, clientFor, treeIdAt }) {
+  return Object.freeze({
+    async verify({ subjects, checkouts, schemas }) {
+      if (subjects.length === 0) {return new Map();}
+      if (cosignBinary === undefined) {
+        throw new DevelopGitBundleError(
+          `${subjects.map(subjectLabel).join(', ')} declare an OCI bundle; verifying it needs a cosign binary (--cosign), and none was given`,
+        );
+      }
+      const policy = loadPinnedDeclaredTrustPolicy({ dataRoot, declaration: editionWorkspaceConfig().evidenceTrustPolicy, schemas });
+      const trustedCosign = prepareTrustedCosignBinary({ cosignBinary, policy });
+      const context = { policy, policyRoot: dataRoot, schemas, trustedCosign };
+      const registry = clientFor ?? createRegistryClientResolver({ dataRoot });
+      try {
+        return await verifyEach(subjects, (subject) =>
+          verifyDevelopGitBundle({ subject, checkout: checkouts.get(subject.source.name), context, clientFor: registry, env, ...(treeIdAt === undefined ? {} : { treeIdAt }) }),
+        );
+      } finally {
+        trustedCosign.dispose();
+      }
+    },
+  });
+}
+
+/**
+ * The OFFLINE verifier of a candidate re-seal: the bundle the pinned develop edition already verified for the SAME
+ * source commit, carried forward unchanged, with the signer it was verified under (`pinnedBundleSigner`): the resolve
+ * refuses the row when the current trust policy selects any other signer (a rotated develop row). A subject at another commit, or one the pinned edition carried no bundle
+ * for, is refused: verifying a new bundle reads the registry, which an offline re-seal does not.
+ *
+ * @param {object} pinnedLock the pinned edition's parsed distribution lock
+ */
+export function carriedDevelopGitBundles(pinnedLock) {
+  return Object.freeze({
+    async verify({ subjects }) {
+      return verifyEach(subjects, async (subject) => {
+        const row = pinnedLock.biomes.find(
+          (biome) => biome.id === subject.biomeId && biome.source?.name === subject.source.name && biome.source.commit === subject.source.commit,
+        );
+        if (row?.bundleSource?.kind !== OCI_BUNDLE_SOURCE_KIND || row.bundleSigner === undefined) {
+          throw new DevelopGitBundleError(
+            `${subjectLabel(subject)}: the pinned edition carries no verified bundle at this commit, and an offline re-seal cannot verify one; resolve the develop edition instead`,
+          );
+        }
+        return { bundleSource: row.bundleSource, pinnedBundleSigner: row.bundleSigner };
+      });
+    },
+  });
+}

package/edition/external-source-walk.mjs

@@ -180,6 +180,24 @@ function resolveRemoteCommit(source, gitEnv, exec = execFileSync) {
   return commit;
 }
 
+/** Fetch `commit` by id, depth 1, into the checkout at `directory` unless it already holds it. */
+function fetchCommitUnlessHeld(directory, commit, gitEnv, exec) {
+  const have = (() => {
+    try {
+      return git(directory, ['cat-file', '-e', `${commit}^{commit}`], gitEnv, exec) === '';
+    } catch {
+      return false;
+    }
+  })();
+  if (!have) {
+    exec(
+      'git',
+      ['-C', directory, 'fetch', '--quiet', '--depth=1', 'origin', commit],
+      { env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+  }
+}
+
 /**
  * Fetch a declared git source and return the directory + the EXACT commit its
  * manifests will be read at.
@@ -209,20 +227,7 @@ export function materializeGitSource({
       // reuses it: fetch from where the declaration says the source lives NOW.
       git(directory, ['remote', 'set-url', 'origin', source.url], gitEnv, exec);
     }
-    const have = (() => {
-      try {
-        return git(directory, ['cat-file', '-e', `${commit}^{commit}`], gitEnv, exec) === '';
-      } catch {
-        return false;
-      }
-    })();
-    if (!have) {
-      exec(
-        'git',
-        ['-C', directory, 'fetch', '--quiet', '--depth=1', 'origin', commit],
-        { env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'] },
-      );
-    }
+    fetchCommitUnlessHeld(directory, commit, gitEnv, exec);
     git(directory, ['checkout', '--quiet', '--detach', commit], gitEnv, exec);
     return { directory, commit: pinExternalSourceCommit({ name: source.name, directory, commit }) };
   });
@@ -405,6 +410,7 @@ export async function walkDeclaredSources({
 } = {}) {
   const entries = [];
   const sourceRecords = new Map();
+  const checkouts = new Map();
   // Every source is held (kind, then credential and URL) before the first is materialised.
   const heldWorkspace = sources.length === 0 ? undefined : (workspace ?? editionWorkspaceConfig());
   for (const source of sources) {
@@ -446,6 +452,7 @@ export async function walkDeclaredSources({
       entries.push(stampEntry(assertSourceWalkedOrigin(await manifestToIndexEntry(manifest), source.name), source.name));
     }
     sourceRecords.set(source.name, lockedSourceRecord(source, commit));
+    checkouts.set(source.name, { source, directory });
   }
   // The last point at which an unstamped entry can be caught before it reaches
   // the shared index, where absent-is-the-identity makes it admissible
@@ -459,5 +466,20 @@ export async function walkDeclaredSources({
         'open-source edition. Refusing.',
     );
   }
-  return { entries, sourceRecords };
+  return { entries, sourceRecords, checkouts };
+}
+
+/**
+ * The git tree id of `path` (repository-relative, `.` for the root) of a declared git source at `commit`, read in the
+ * walk's checkout of that source (`checkouts` of `walkDeclaredSources`). A commit the checkout does not hold is fetched
+ * by id, depth 1, from the declared URL under the source's own credential hold: no history is needed.
+ */
+export function sourceTreeIdAt({ checkout, commit, path, env = process.env, workspace = editionWorkspaceConfig(), exec = execFileSync }) {
+  if (!EXACT_COMMIT.test(String(commit))) {
+    throw new Error(`source "${checkout.source.name}": tree of ${JSON.stringify(commit)} asked, which is not an exact 40-hex commit`);
+  }
+  return withSourceGitEnv(checkout.source, { workspace, env }, (gitEnv) => {
+    fetchCommitUnlessHeld(checkout.directory, commit, gitEnv, exec);
+    return git(checkout.directory, ['rev-parse', '--verify', path === '.' ? `${commit}^{tree}` : `${commit}:${path}`], gitEnv, exec);
+  });
 }

package/edition/locked-bundle-signer.mjs

@@ -3,7 +3,10 @@
 // Every `bundleSource: {kind: 'oci'}` row of a lock (a biome's, or one of its host modules') states WHO signs its bundle:
 // `bundleSigner: {policyId, signer}`, the kernel's `lockedBundleSignerOf` projection of ONE row of the data root's evidence
 // trust policy. The row is selected, never defaulted:
-//   - a git-sourced row (one with a lock `source`) carries no OCI bundle at all, and a lock stating one is refused;
+//   - a git-sourced row (one with a lock `source`) carries no OCI bundle, and a lock stating one is refused, EXCEPT in a
+//     selection made for a vendor develop edition (`GitSourcedBundle.DevelopVerified`, XEMA-2456): there a git-sourced
+//     biome row may carry the bundle the develop resolve verified (`develop-git-bundles.mjs`), signed by the ONE
+//     `develop` row of the source's repository;
 //   - a third-party row (no `source`, `isThirdPartyOciRow`) by its pin (`third-party-source-pins.json`), whose `bundle.signerPolicyId` names an
 //     `oidc-certificate` row held to the checks `thirdPartySignerRow` makes;
 //   - a first-party row by the data root's `firstPartyBundleSigner.policyId`, a `public-key` row whose key is bound to
@@ -15,13 +18,15 @@
 
 import { createRequire } from 'node:module';
 
+import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
 import { KernelRefusalName, RefusalError, collectRefusals, isRefusal, joinRefusalMessages } from './collected-refusals.mjs';
+import { EditionChannel } from './edition-channel.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
 import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 import { dataRoot, kernelDistPath, kernelPackageDir } from './edition-workspace.mjs';
 import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
 import { loadTrustedThirdPartySourcePins } from './third-party-pins-trusted.mjs';
-import { thirdPartySignerRow } from './third-party-source-evidence.mjs';
+import { bundleSignerRowFor, thirdPartySignerRow } from './third-party-source-evidence.mjs';
 import { OCI_BUNDLE_SOURCE_KIND, isThirdPartyOciRow } from './third-party-subjects.mjs';
 
 const requireFromHere = createRequire(import.meta.url);
@@ -31,6 +36,13 @@ const PUBLIC_KEY_KIND = 'public-key';
 
 const KERNEL_EXPORTS = Object.freeze(['lockedBundleSignerOf', 'assertLockedBundleSignerMatches', 'LockedBundleSignerUnknownPolicyError', 'LockedBundleSignerAmbiguousPolicyError']);
 
+/**
+ * Whether a selection admits an OCI bundle on a git-sourced row. `Refused` is every release, customer and dist-check
+ * selection, unchanged; `DevelopVerified` only a vendor develop edition's resolve, seal and verify, whose git bundles
+ * the develop resolve verified against the source commit (`develop-git-bundles.mjs`).
+ */
+export const GitSourcedBundle = Object.freeze({ Refused: 'refused', DevelopVerified: 'develop-verified' });
+
 /** A named refusal of the bundle signer plane. */
 export class BundleSignerError extends RefusalError {
   constructor(message) {
@@ -56,6 +68,8 @@ export class BundleSignerMissingError extends BundleSignerError {}
 export class BundleSourceOnGitRowError extends BundleSignerError {}
 /** A resolve found an OCI host-module bundle on a git-sourced biome: such a bundle reaches an edition only through an `oci` source. */
 export class GitSourcedHostModuleBundleError extends BundleSignerError {}
+/** A develop resolve could not verify the OCI bundle a git-sourced biome declares (no develop row, cosign, or the content binding refused it). */
+export class DevelopGitBundleError extends BundleSignerError {}
 /** The loaded kernel does not export what the bundle signer plane needs. */
 export class BundleSignerKernelUnsupportedError extends BundleSignerError {}
 /** Several OCI rows were refused in one pass; `.errors` holds each row's own refusal. */
@@ -98,6 +112,13 @@ function assertNotGitSourced(subject) {
   }
 }
 
+/** Refuses a git-sourced subject unless the selection admits develop git bundles and the subject is a biome row. */
+function assertGitSourceAdmitted(subject, gitSourcedBundle) {
+  if (subject.source === undefined) {return;}
+  if (gitSourcedBundle === GitSourcedBundle.DevelopVerified && subject.componentKey === undefined) {return;}
+  assertNotGitSourced(subject);
+}
+
 const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyId === policyId);
 
 /**
@@ -105,7 +126,7 @@ const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyI
  *   firstPartyPolicyId: string|undefined, schemas: object, kernel?: object}} options
  * @returns {{policyIdFor: (subject: object) => string, signerFor: (subject: object) => object, assertSealed: (subject: object, stated: object|undefined) => void}}
  */
-export function createBundleSignerSelection({ policy, thirdPartyPins, firstPartyPolicyId, schemas, kernel }) {
+export function createBundleSignerSelection({ policy, thirdPartyPins, firstPartyPolicyId, schemas, kernel, gitSourcedBundle = GitSourcedBundle.Refused }) {
   let loaded = kernel;
   const kernelExports = () => (loaded ??= loadBundleSignerKernel());
 
@@ -155,6 +176,24 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
     return row;
   }
 
+  // A git-sourced biome's develop bundle: the ONE develop row of the source's repository (a host module never reaches here:
+  // the resolve refuses an OCI host module on a git-sourced biome in every channel).
+  function developGitRow(subject) {
+    const label = `${describeSubject(subject)} develop bundle signer`;
+    const repository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(subject.source.url, `${label} source url`), `${label} source url`);
+    let row;
+    try {
+      row = bundleSignerRowFor({ policy, repository, channel: EditionChannel.Develop, schemas, label });
+    } catch (error) {
+      throw new BundleSignerPolicyAbsentError(error.message);
+    }
+    requireKind(subject, row, OIDC_CERTIFICATE_KIND);
+    return onlyRow(row.policyId);
+  }
+
+  /** Refuses a git-sourced subject this selection does not admit; any other subject passes. */
+  const assertAdmitted = (subject) => assertGitSourceAdmitted(subject, gitSourcedBundle);
+
   function requirePolicy(subject) {
     if (policy === null) {
       throw new BundleSignerPolicyAbsentError(
@@ -164,8 +203,9 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   }
 
   function selectedRow(subject) {
-    assertNotGitSourced(subject);
+    assertAdmitted(subject);
     requirePolicy(subject);
+    if (subject.source !== undefined) {return developGitRow(subject);}
     return isThirdPartyOciRow(subject) ? thirdPartyRow(subject) : firstPartyRow(subject);
   }
 
@@ -178,6 +218,7 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   };
 
   return {
+    assertAdmitted,
     policyIdFor: (subject) => selectedRow(subject).policyId,
     signerFor,
     assertSealed(subject, stated) {
@@ -200,7 +241,7 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
  * The data root's selection, LAZY: nothing is read until the first OCI subject asks, so a lock with no OCI row never
  * needs a policy, a pin or a kernel that speaks v33.
  */
-export function loadBundleSignerSelection({ dataRoot, schemas }) {
+export function loadBundleSignerSelection({ dataRoot, schemas, gitSourcedBundle = GitSourcedBundle.Refused }) {
   let selection;
   const resolved = () => {
     if (selection === undefined) {
@@ -211,11 +252,14 @@ export function loadBundleSignerSelection({ dataRoot, schemas }) {
         thirdPartyPins: loadTrustedThirdPartySourcePins(dataRoot),
         firstPartyPolicyId: config.firstPartyBundleSigner?.policyId,
         schemas,
+        gitSourcedBundle,
       });
     }
     return selection;
   };
   return Object.freeze({
+    // Refusing an unadmitted git-sourced row needs no data root, so it reads none.
+    assertAdmitted: (subject) => assertGitSourceAdmitted(subject, gitSourcedBundle),
     policyIdFor: (subject) => resolved().policyIdFor(subject),
     signerFor: (subject) => resolved().signerFor(subject),
     assertSealed: (subject, stated) => resolved().assertSealed(subject, stated),
@@ -242,12 +286,12 @@ export function lockBundleSubjects(lock) {
  * row is never checked and never resolves a data root: `selection` is used when given, else the data root's is loaded
  * on the first OCI subject.
  */
-export function assertLockBundleSigners({ lock, selection, schemas }) {
+export function assertLockBundleSigners({ lock, selection, schemas, gitSourcedBundle = GitSourcedBundle.Refused }) {
   const subjects = lockBundleSubjects(lock);
   if (subjects.length === 0) {return;}
-  const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas });
+  const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas, gitSourcedBundle });
   collectRefusals(subjects, ({ row, subject }) => {
-    assertNotGitSourced(subject);
+    chosen.assertAdmitted(subject);
     chosen.assertSealed(subject, row.bundleSigner);
   }, isRefusal, BundleSignerRefusedError);
 }

package/edition/resolve-distribution.mjs

@@ -62,6 +62,7 @@
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 
 import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
 import {
@@ -75,6 +76,7 @@ import {
   writeAuthorizationLock,
 } from './authorization-base.mjs';
 import { RefusalError, captureRefusal, isRefusal, throwCollectedRefusals } from './collected-refusals.mjs';
+import { developGitBundleKey, developGitBundleSubjects } from './develop-git-bundles.mjs';
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
@@ -96,7 +98,14 @@ import {
   validateImmutableDistributionLock,
   validateServiceDependencyOwnerParity,
 } from './lib.mjs';
-import { BundleSignerPolicyAbsentError, BundleSignerRefusedError, GitSourcedHostModuleBundleError, loadBundleSignerSelection } from './locked-bundle-signer.mjs';
+import {
+  BundleSignerPolicyAbsentError,
+  BundleSignerRefusedError,
+  DevelopGitBundleError,
+  GitSourcedBundle,
+  GitSourcedHostModuleBundleError,
+  loadBundleSignerSelection,
+} from './locked-bundle-signer.mjs';
 import { admitDistributionLock } from './operation-grant-admission.mjs';
 import { PUBLISHED_PIN_SOURCE, pinnedSource } from './pin-source.mjs';
 import { verifiedPlatformServiceIndex } from './platform-service-ownership.mjs';
@@ -1792,7 +1801,14 @@ export function resolveUnadmittedDistributionFromInputs(
   // trust policy selects for it. See `locked-bundle-signer.mjs`.
   const bundleSignerRefusals = [];
   const bundleSignerOf = (e, bundleSource, componentKey) => {
-    const subject = { biomeId: e.id, ...(componentKey === undefined ? {} : { componentKey }), origin: e.origin, repo: e.repo, bundleSource };
+    const subject = {
+      biomeId: e.id,
+      ...(componentKey === undefined ? {} : { componentKey }),
+      origin: e.origin,
+      repo: e.repo,
+      ...(isGitSourced(e) ? { source: requireSourceRecord(e, sourceRecords) } : {}),
+      bundleSource,
+    };
     if (composed?.bundleSigners === undefined) {
       throw new BundleSignerPolicyAbsentError(
         `${componentKey === undefined ? `biome "${e.id}"` : `host module "${componentKey}" of biome "${e.id}"`} is an OCI bundle, but this resolve was given no bundle signer selection`,
@@ -1801,12 +1817,45 @@ export function resolveUnadmittedDistributionFromInputs(
     // Every row is selected before any is refused, so one run names them all; the lock is not built from a refused row.
     return captureRefusal(bundleSignerRefusals, () => composed.bundleSigners.signerFor(subject), isRefusal);
   };
-  // A row drawn from a GIT source carries no OCI bundle (biome-level; an OCI host-module bundle is refused below), hence no bundleSigner: it is built
-  // from the pinned source, and the manifest's `bundleSource` names a release artifact not built from this commit.
-  // Omitted here, at the copy point. (An entry of a declared `oci` source has a stamp but no record: not git.)
+  // A row drawn from a GIT source is built from the pinned source, and the manifest's biome-level `bundleSource` names an
+  // artifact its release lane publishes, not one proven to be built from this commit. So, at the copy point:
+  //   - with `composed.developGitBundles` (a VENDOR DEVELOP resolve, XEMA-2456) the row carries the bundle the develop
+  //     resolve verified for it (`develop-git-bundles.mjs`: the develop signer at the attested commit, content-bound to
+  //     the frozen one), by digest, and its develop bundle signer. A git-sourced OCI row the resolve did not verify is
+  //     refused, never stripped;
+  //   - otherwise (release, customer, dist-check) it carries neither, as before; the release refuses the declaration.
+  // An OCI host-module bundle on a git-sourced biome is refused below in every channel. (An entry of a declared `oci`
+  // source has a stamp but no record: not git.)
   const isGitSourced = (e) => e.source !== undefined && sourceRecords.has(e.source);
-  const bundleSourceOf = (e) => (e.bundleSource === undefined || isGitSourced(e) ? {} : { bundleSource: e.bundleSource });
-  const bundleSignerFor = (e) => (e.bundleSource?.kind === 'oci' && !isGitSourced(e) ? { bundleSigner: bundleSignerOf(e, e.bundleSource) } : {});
+  const developGitBundleOf = (e) => {
+    if (composed?.developGitBundles === undefined || !isGitSourced(e) || e.bundleSource?.kind !== 'oci') {return undefined;}
+    const verified = composed.developGitBundles.get(developGitBundleKey(e.source, e.id));
+    if (verified === undefined) {
+      throw new DevelopGitBundleError(`biome "${e.id}" (git source "${e.source}") declares an OCI bundle (${e.bundleSource.ociRef}) that this develop resolve did not verify`);
+    }
+    return verified;
+  };
+  const bundleSourceOf = (e) => {
+    if (e.bundleSource === undefined) {return {};}
+    if (!isGitSourced(e)) {return { bundleSource: e.bundleSource };}
+    const verified = developGitBundleOf(e);
+    return verified === undefined ? {} : { bundleSource: verified.bundleSource };
+  };
+  const bundleSignerFor = (e) => {
+    if (e.bundleSource?.kind !== 'oci') {return {};}
+    if (!isGitSourced(e)) {return { bundleSigner: bundleSignerOf(e, e.bundleSource) };}
+    const verified = developGitBundleOf(e);
+    if (verified === undefined) {return {};}
+    const bundleSigner = bundleSignerOf(e, verified.bundleSource);
+    // A bundle carried from a pinned lock (an offline re-seal) was verified under the pinned signer; a develop row rotated
+    // since then would put into the lock a signer the bundle was never verified under, so any difference is refused.
+    if (verified.pinnedBundleSigner !== undefined && !isDeepStrictEqual(verified.pinnedBundleSigner, bundleSigner)) {
+      throw new DevelopGitBundleError(
+        `biome "${e.id}" (git source "${e.source}"): the pinned edition verified ${verified.bundleSource.ociRef} under bundle signer ${JSON.stringify(verified.pinnedBundleSigner)}, but the current trust policy selects ${JSON.stringify(bundleSigner)}; resolve the develop edition to verify the bundle under the current row`,
+      );
+    }
+    return { bundleSigner };
+  };
   const hostModuleOf = (e, hostModule) => {
     if (isGitSourced(e)) {
       // The lock schema requires a host module's bundleSource, so an OCI one cannot be omitted: it is refused, in every
@@ -2405,7 +2454,7 @@ export async function prepareDistributionWithIndex(id, { materialize, inputs, re
     validateImmutableBiomeIndex(inputs?.biomeIndex ?? pinned.biomeIndex),
     platformServiceIndex,
   );
-  const { entries, sourceRecords } = await walkDeclaredSources({
+  const { entries, sourceRecords, checkouts } = await walkDeclaredSources({
     sources: composed.declaredSources,
     ...(materialize === undefined ? {} : { materialize }),
   });
@@ -2416,19 +2465,33 @@ export async function prepareDistributionWithIndex(id, { materialize, inputs, re
     inputs !== undefined && Object.hasOwn(inputs, 'storePublisherTrust')
       ? inputs.storePublisherTrust
       : readStorePublisherTrust();
-  const lock = resolveUnadmittedDistributionFromInputs(
-    id,
-    index,
-    schemas,
-    {
-      ...composed,
-      sourceRecords,
-      storePublisherTrust,
-      bundleSigners: inputs?.bundleSigners ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas }),
-    },
-    new Date().toISOString(),
-    platformServiceIndex,
-  );
+  // A VENDOR DEVELOP resolve hands `inputs.developGitBundles` (develop-git-bundles.mjs); nothing else does, so a release,
+  // customer or dist-check resolve keeps a git-sourced row bundle-less, exactly as before.
+  const developGitBundles = inputs?.developGitBundles;
+  const bundleSigners =
+    inputs?.bundleSigners ??
+    loadBundleSignerSelection({
+      dataRoot: dataRoot(),
+      schemas,
+      gitSourcedBundle: developGitBundles === undefined ? GitSourcedBundle.Refused : GitSourcedBundle.DevelopVerified,
+    });
+  const resolvedAt = new Date().toISOString();
+  const resolveWith = (verified) =>
+    resolveUnadmittedDistributionFromInputs(
+      id,
+      index,
+      schemas,
+      { ...composed, sourceRecords, storePublisherTrust, bundleSigners, ...(verified === undefined ? {} : { developGitBundles: verified }) },
+      resolvedAt,
+      platformServiceIndex,
+    );
+  // Selection never reads a bundle, so the first pass selects exactly the biomes the second ships: only THEIR bundles are
+  // verified (a source's unselected biome is never fetched), and the second pass refuses any git-sourced OCI row the
+  // verifier did not answer for.
+  const selectedOnly = resolveWith(undefined);
+  if (developGitBundles === undefined) {return { lock: selectedOnly, index, schemas };}
+  const subjects = developGitBundleSubjects({ lock: selectedOnly, index });
+  const lock = subjects.length === 0 ? selectedOnly : resolveWith(await developGitBundles.verify({ subjects, checkouts, schemas }));
   return { lock, index, schemas };
 }