gate-evm-tools 1.0.28 → 1.2.0

package/runtime/delivery/production-finalization.ts

@@ -0,0 +1,181 @@
+/** Static production acceptance. No project module, HRE, compiler process or signing port is loaded. */
+import path from 'node:path';
+import {getCreate2Address,Interface} from 'ethers';
+import {withDefaults} from '@openzeppelin/hardhat-upgrades/dist/utils/options';
+import {TRANSPARENT_PROXY_ARTIFACT,PROXY_ADMIN_ARTIFACT,ERC1967_ADMIN_SLOT,PROXY_ADMIN_INTERFACE,transparentAdminAddress,assertTransparentAdminImmutable,BytecodeChecker,artifactIdentity,hashStorageLayout,mergeEvmManifestCandidate,parseTargetManifest,resolveTargetManifestPaths} from 'gate-evm-tools/workflow';
+import {canonicalJson,deepFreeze,semanticHash} from '../workflow/lib/canonicalData';
+import {validateContractInfo,resolveDeployment} from '../workflow/lib/deployments';
+import {validateDeploymentInfo} from '../workflow/lib/deploymentInfo';
+import {mergeDevelopmentRegistration} from './development';
+import {parsePreparationJournal} from './journal';
+import {validateDevelopmentCheckReport,type ExpectedDevelopmentCode} from './check-code';
+import {atomicDevelopmentWrite,byteHash,fileBytes,readDevelopmentJournal,withDevelopmentFileLock,commitDevelopmentFilesLocked,type DevelopmentFile} from './materialization';
+import type {CompilerEvidence} from './compiler';
+import type {DeliveryCollection} from './planning';
+import type {EoaExecutionOptions} from './eoa';
+import {parseObservation} from './observations';
+export interface ProductionFinalizationInputs {compiler:CompilerEvidence;registration:{registry:unknown;metadata:unknown};manifests?:Array<{path:string;contents:string|null}>}
+export interface ProductionFinalizationReady {plan:DeliveryCollection['plan'];collection:DeliveryCollection;artifactHash:string;releaseHash:string;finalization?:ProductionFinalizationInputs}
+export interface FinalizedAnchor {hash:string;number:string;timestamp:string}
+const json=(v:unknown)=>canonicalJson(v)+'\n';
+const same=(a:unknown,b:unknown,label:string)=>{if(canonicalJson(a)!==canonicalJson(b))throw Error(`${label} mismatch`);};
+const slot='0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc';
+const recordPath=(r:ProductionFinalizationReady)=>`scripts/tasks/${r.plan.deploymentId}/results/${r.plan.target}/${r.plan.executionId}/deployment.json`;
+function identity(r:ProductionFinalizationReady){return semanticHash({protocol:'static-production-finalizer@1',executionId:r.plan.executionId,planHash:r.plan.planHash,releaseHash:r.releaseHash,artifactHash:r.artifactHash});}
+/** A file retry uses the original canonical state anchor, never a new business execution. */
+export function retainedProductionFinalizationAnchor(root:string,ready:ProductionFinalizationReady):FinalizedAnchor|undefined {
+ const journal=readDevelopmentJournal(root,ready.plan.executionId);if(!journal)return;
+ if(journal.identity!==identity(ready))throw Error('Production finalization identity conflict');
+ const record=journal.files.find((f:any)=>f.path===recordPath(ready));if(!record)throw Error('Production finalization record missing');
+ const value=JSON.parse(record.after);if(value.identity!==journal.identity||value.planHash!==ready.plan.planHash||value.releaseHash!==ready.releaseHash)throw Error('Production finalization record conflict');
+ return value.anchor;
+}
+export async function finalizeProductionExecution(input:{root:string;ready:ProductionFinalizationReady;provider:EoaExecutionOptions['provider'];anchor:FinalizedAnchor;finalized:unknown[];assertions:unknown[];assertCurrent():void;assertInputs():void}){
+ const {root,ready,provider,anchor}=input,{plan}=ready,configuration=ready.finalization;
+ if(!configuration)throw Error('Production finalization inputs missing; explicit recovery required');
+ if(!/^0x[0-9a-fA-F]{64}$/.test(anchor.hash)||!/^0x[0-9a-fA-F]+$/.test(anchor.number)||!/^0x[0-9a-fA-F]+$/.test(anchor.timestamp)||input.finalized.length!==plan.transactions.length||!input.finalized.length)throw Error('Incomplete production finalized evidence');
+ const rpc=async(method:string,params:readonly unknown[])=>{input.assertCurrent();const result=await provider.request(method,params);input.assertCurrent();return result;};
+ const block={blockHash:anchor.hash,requireCanonical:true};
+ const finalized=input.finalized.map((o,i)=>parseObservation(o,plan,i));
+ if(finalized.some(o=>o.state!=='finalized-success'||BigInt(o.blockNumber!)>BigInt(anchor.number)))throw Error('Production anchor precedes finalized execution');
+ if(BigInt(await rpc('eth_chainId',[]) as string).toString()!==plan.chainId)throw Error('Production finalization chain mismatch');
+ const finalBlock:any=await rpc('eth_getBlockByNumber',['finalized',false]);if(!finalBlock?.number||BigInt(finalBlock.number)<BigInt(anchor.number))throw Error('Production code anchor is not finalized');
+ const assertAnchor=async()=>{const current:any=await rpc('eth_getBlockByNumber',[anchor.number,false]);if(current?.hash!==anchor.hash)throw Error('Production finalization anchor changed');};
+ await assertAnchor();
+ const preparations=parsePreparationJournal(ready.collection.preparations,plan.transactions,plan.derivedBindings,{target:plan.target,chainId:plan.chainId,expectedStepIds:plan.deploymentBindings.map(b=>b.stepId)});
+ const compiler=configuration.compiler,base={registry:validateContractInfo(configuration.registration.registry),metadata:validateDeploymentInfo(configuration.registration.metadata)};
+ // Only pure comparison/report methods are used. No HRE object or filesystem artifact loader exists.
+ const checker=new BytecodeChecker(undefined as never,{},'evm');
+ function local(name:string){
+  const matches=compiler.artifacts.filter(a=>name.includes(':')?a.fqn===name:a.artifact.contractName===name);
+  if(matches.length!==1)throw Error(`Missing unique sealed compiler artifact: ${name}`);
+  const entry=matches[0],artifact=entry.artifact,build=compiler.builds.find(b=>b.digest===entry.buildInfo);
+  if(semanticHash(artifact)!==entry.digest||canonicalJson(JSON.parse(entry.contents))!==canonicalJson(artifact)||!build||byteHash(build.contents)!==build.digest)throw Error('Sealed compiler artifact/build mismatch');
+  const output=JSON.parse(build.contents).output?.contracts?.[artifact.sourceName]?.[artifact.contractName];if(!output)throw Error('Missing sealed compiler output');
+  return {entry,artifact,immutableReferences:output.evm?.deployedBytecode?.immutableReferences??{}};
+ }
+ async function compare(address:string,name:string,key:string){
+  const compiled=local(name),code=await rpc('eth_getCode',[address,block]);
+  if(typeof code!=='string'||!/^0x(?:[0-9a-fA-F]{2})+$/.test(code))throw Error(`Production code missing: ${key}`);
+  const localCode=compiled.artifact.deployedBytecode;if(typeof localCode!=='string'||!/^0x(?:[0-9a-fA-F]{2})+$/.test(localCode))throw Error('Missing sealed runtime bytecode');
+  const comparison=checker.compareBytecode(code,localCode,compiled.artifact.abi as any[],compiled.immutableReferences);
+  if(!comparison.matches)throw Error(`Production CheckCode mismatch: ${key}: ${comparison.reason}`);
+  return {contract:compiled.artifact.contractName,contractName:key,network:plan.target,scheme:'evm',address:address.toLowerCase(),matches:true,error:null,reason:comparison.reason,onChainBytecodeLength:code.length,localBytecodeLength:localCode.length,onChainBytecodeHash:byteHash(code),localBytecodeHash:byteHash(localCode),onChainBytecodeHashNormalized:byteHash(checker.normalizeBytecode(code)),localBytecodeHashNormalized:byteHash(checker.normalizeBytecode(localCode))};
+ }
+ const changes=new Map<string,any>();
+ for(const entry of preparations){
+  const p=entry.prepared.plan,r=entry.prepared.request;const compiled=local(p.contract);same(artifactIdentity(compiled.artifact,'evm'),p.artifact,'Prepared sealed artifact');
+  for(const deployment of p.deployments){
+   if(deployment.initCodeHash&&getCreate2Address(r.factory,deployment.salt,deployment.initCodeHash).toLowerCase()!==deployment.address.toLowerCase())throw Error('Production CREATE2 address mismatch');
+   await compare(deployment.address,deployment.role==='proxy'?(p.proxyKind==='transparent'?TRANSPARENT_PROXY_ARTIFACT:'@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol:ERC1967Proxy'):p.contract,`${entry.change.instanceId}:${deployment.role}`);
+  }
+  const address=p.deployments.find(d=>d.role==='proxy')?.address??('proxy' in r?r.proxy:p.deployments.find(d=>d.role==='contract')?.address);
+  if(!address)throw Error('Production prepared address missing');
+  changes.set(entry.change.instanceId,{...entry.change,address,...(p.proxyKind?{proxyAddress:address,proxyKind:p.proxyKind}:{})});
+ }
+ const candidates:any[]=[],expected:ExpectedDevelopmentCode[]=[],effective:Record<string,Record<string,string>>={[plan.target]:{}},checked=new Map<string,{address:string;contract:string;key:string}>();
+ function expect(address:string,contract:string,key:string){const row={key,contract:local(contract).artifact.contractName,address:address.toLowerCase()},old=checked.get(key);if(old)same(old,row,'Production CheckCode key');else{checked.set(key,row);expected.push(row);}}
+ const deployed=[...changes.values()],unchangedAliases=new Set<string>();
+ const registrationContext={base,target:plan.target,deploymentId:plan.deploymentId,executionId:plan.executionId,recordPath:recordPath(ready),updatedAt:new Date(Number(BigInt(anchor.timestamp))*1000).toISOString(),changes:deployed,preparations};
+ // Apply the same validated upgrade replacement before resolving code coverage.
+ const candidate=mergeDevelopmentRegistration({...base,...registrationContext}),registry=candidate.registry[plan.target],metadata=candidate.metadata.networks[plan.target];
+ const requiredAddresses=new Set([...deployed.map(c=>c.address.toLowerCase()),...ready.collection.verification.map(a=>a.address.toLowerCase()),...plan.transactionBindings.filter(b=>b.role==='call').map(b=>plan.transactions.find(t=>t.transactionId===b.transactionId)!.to.toLowerCase())]);
+ for(const address of requiredAddresses){
+  const rows=Object.entries(registry).filter(([,a])=>a.toLowerCase()===address);if(rows.length!==1)throw Error('Production code target requires unique frozen registration');
+  const [key]=rows[0],alias=key.split(':')[0],m=metadata[alias],contract=m?.actualContract??key.split(':').at(-1)!;
+  effective[plan.target][key]=address;if(!changes.has(alias))unchangedAliases.add(alias);
+  if(m?.proxyKind&&m.proxyKind!=='uups'&&m.proxyKind!=='transparent')throw Error('Unsupported production proxy kind');
+  if(m?.proxyKind==='uups'||m?.proxyKind==='transparent'){
+   const storage=await rpc('eth_getStorageAt',[address,slot,block]);if(typeof storage!=='string'||!/^0x0{24}[a-fA-F0-9]{40}$/.test(storage))throw Error('Invalid finalized UUPS implementation slot');
+   const implementation='0x'+storage.slice(-40).toLowerCase();if(implementation!==m.implementationAddress?.toLowerCase())throw Error('Final production UUPS implementation mismatch');
+   expect(implementation,contract,alias);expect(address,m.proxyKind==='transparent'?TRANSPARENT_PROXY_ARTIFACT:'ERC1967Proxy',`${alias}_Proxy`);
+   if(m.proxyKind==='transparent'){
+    const admin=m.proxyAdminAddress?.toLowerCase();if(!admin||admin!==transparentAdminAddress(address)||!m.proxyAdminOwner)throw Error('Missing frozen Transparent admin identity');
+    const value=await rpc('eth_getStorageAt',[address,ERC1967_ADMIN_SLOT,block]);if(typeof value!=='string'||!/^0x0{24}[a-fA-F0-9]{40}$/.test(value)||'0x'+value.slice(-40).toLowerCase()!==admin)throw Error('Final production Transparent admin mismatch');
+    assertTransparentAdminImmutable(await rpc('eth_getCode',[address,block]) as string,local(TRANSPARENT_PROXY_ARTIFACT).immutableReferences,admin);
+    const owner=PROXY_ADMIN_INTERFACE.decodeFunctionResult('owner',await rpc('eth_call',[{to:admin,data:PROXY_ADMIN_INTERFACE.encodeFunctionData('owner')},block]) as string)[0];
+    const version=PROXY_ADMIN_INTERFACE.decodeFunctionResult('UPGRADE_INTERFACE_VERSION',await rpc('eth_call',[{to:admin,data:PROXY_ADMIN_INTERFACE.encodeFunctionData('UPGRADE_INTERFACE_VERSION')},block]) as string)[0];
+    if(owner.toLowerCase()!==m.proxyAdminOwner.toLowerCase()||version!=='5.0.0')throw Error('Final production ProxyAdmin owner/version mismatch');
+    expect(admin,PROXY_ADMIN_ARTIFACT,`${alias}_ProxyAdmin`);
+   }
+   const artifact=local(contract).entry;
+   const paths=resolveTargetManifestPaths(root,plan.target,Number(plan.chainId),{}),manifestPath=path.relative(root,paths.file).split(path.sep).join('/');
+   if(paths.file!==paths.fallbackFile&&fileBytes(root,path.relative(root,paths.fallbackFile))!==null)throw Error('Noncanonical manifest fallback requires explicit migration');
+   let versionKey:string,layout:any;
+   if(changes.has(alias)){
+    const preparation=preparations.find(p=>p.stepId===changes.get(alias).stepId&&p.change.instanceId===alias),request=preparation?.prepared.request;
+    if(!request||request.kind==='create2-deploy')throw Error('Missing UUPS preparation selection request');
+    // Match the compiler's preparationSelection identity. Canonical request data
+    // contains no undefined values; omit official optional top-level safety flags.
+    const options=Object.fromEntries(Object.entries(withDefaults({kind:request.proxyKind,constructorArgs:request.constructorArgs,...(request.unsafeAllow?{unsafeAllow:request.unsafeAllow}: {})} as Parameters<typeof withDefaults>[0])).filter(([,value])=>value!==undefined));
+    const encodedArgs=new Interface(artifact.artifact.abi).encodeDeploy(request.constructorArgs),optionsHash=semanticHash(options);
+    const selections=compiler.selections.filter(s=>s.fqn===artifact.fqn&&s.artifactDigest===artifact.digest&&s.encodedArgs===encodedArgs&&semanticHash(s.options)===optionsHash);
+    if(selections.length!==1)throw Error('Missing unique frozen OZ implementation selection');
+    const selected=selections[0];versionKey=selected.version.linkedWithoutMetadata;layout=selected.layout;if(!selected.validation)throw Error('Invalid frozen OZ validation');
+   }else{
+    // Unchanged UUPS instances retain their own sealed official registration,
+    // regardless of selections made for other instances of the same artifact.
+    const frozen=configuration.manifests?.filter(f=>f.path===manifestPath);if(frozen?.length!==1||frozen[0].contents===null)throw Error('Missing frozen existing UUPS manifest');
+    const manifest=parseTargetManifest(Buffer.from(frozen[0].contents)),proxies=manifest.proxies.filter(p=>p.address.toLowerCase()===address),implementations=Object.entries(manifest.impls).filter(([,v])=>v&&[v.address,...(v.allAddresses??[])].some(a=>a.toLowerCase()===implementation));
+    if(proxies.length!==1||proxies[0].kind!==m.proxyKind||implementations.length!==1)throw Error('Invalid frozen existing UUPS manifest registration');
+    versionKey=implementations[0][0];layout=implementations[0][1]!.layout;
+   }
+   if(typeof versionKey!=='string'||!/^[a-f0-9]{64}$/.test(versionKey))throw Error('Invalid frozen OZ version');
+   candidates.push({path:manifestPath,proxy:address,proxyKind:m.proxyKind,implementation,versionKey,layout,layoutHash:hashStorageLayout(layout)});
+  }else expect(address,contract,alias);
+ }
+ if(!expected.length)throw Error('Empty production CheckCode coverage');
+ // Validate all business code before promoting any address, then check again after commit for the raw report.
+ for(const row of expected)await compare(row.address,row.contract,row.key);
+ await assertAnchor();
+ function verifyCommitted(journal:any){
+  const reg=validateContractInfo(JSON.parse(fileBytes(root,'contractInfo.json')??'{}')),meta=validateDeploymentInfo(JSON.parse(fileBytes(root,'deploymentInfo.json')??'{}'));
+  const oldReg=validateContractInfo(JSON.parse(journal.files.find((f:any)=>f.path==='contractInfo.json').after)),oldMeta=validateDeploymentInfo(JSON.parse(journal.files.find((f:any)=>f.path==='deploymentInfo.json').after));
+  for(const key of Object.keys(effective[plan.target])){const alias=key.split(':')[0];same(resolveDeployment(reg,plan.target,alias),resolveDeployment(oldReg,plan.target,alias),'Committed production registration');same(meta.networks[plan.target]?.[alias]??null,oldMeta.networks[plan.target]?.[alias]??null,'Committed production metadata');}
+  for(const f of journal.files){
+   if(['contractInfo.json','deploymentInfo.json'].includes(f.path))continue;
+   const owned=candidates.filter(c=>c.path===f.path);
+   if(!owned.length){if(fileBytes(root,f.path)!==f.after)throw Error('Committed production file changed');continue;}
+   const currentBytes=fileBytes(root,f.path);if(currentBytes===null)throw Error('Committed production manifest missing');
+   const current=parseTargetManifest(Buffer.from(currentBytes)),original=parseTargetManifest(Buffer.from(f.after));
+   for(const c of owned){
+    const proxies=current.proxies.filter(p=>p.address.toLowerCase()===c.proxy),oldProxies=original.proxies.filter(p=>p.address.toLowerCase()===c.proxy);
+    if(proxies.length!==1||oldProxies.length!==1)throw Error('Committed production manifest proxy missing or ambiguous');
+    same(proxies[0],oldProxies[0],'Committed production manifest proxy');
+    const actual=current.impls[c.versionKey],expected=original.impls[c.versionKey];
+    if(!actual||!expected)throw Error('Committed production manifest implementation missing');
+    const {allAddresses:actualAddresses,...actualEntry}=actual,{allAddresses:expectedAddresses,...expectedEntry}=expected;
+    same(actualEntry,expectedEntry,'Committed production manifest implementation');
+    const addresses=new Set([actual.address,...(actualAddresses??[])].map(a=>a.toLowerCase()));
+    if([expected.address,...(expectedAddresses??[]),c.implementation].some(a=>!addresses.has(a.toLowerCase())))throw Error('Committed production manifest address removed');
+   }
+  }
+ }
+ const executionIdentity=identity(ready),record=recordPath(ready),evidence={version:1,identity:executionIdentity,executionId:plan.executionId,planHash:plan.planHash,releaseHash:ready.releaseHash,artifactHash:ready.artifactHash,inputsHash:plan.inputsHash,sourceDefinitionHash:plan.sourceDefinitionHash,planRuntimeIdentity:plan.runtimeIdentity,finalizer:'static-production-finalizer@1',anchor,preparations,finalized,assertions:input.assertions,changes:deployed};
+ const journal=await withDevelopmentFileLock(root,async()=>{
+  input.assertInputs();const prior=readDevelopmentJournal(root,plan.executionId);
+  const currentRegistry=validateContractInfo(JSON.parse(fileBytes(root,'contractInfo.json')??'{}')),currentMetadata=validateDeploymentInfo(JSON.parse(fileBytes(root,'deploymentInfo.json')??'{"version":1,"networks":{}}'));
+  for(const alias of unchangedAliases){
+   same(resolveDeployment(currentRegistry,plan.target,alias)??null,resolveDeployment(base.registry,plan.target,alias)??null,'Unchanged production registration');
+   same(currentMetadata.networks[plan.target]?.[alias]??null,base.metadata.networks[plan.target]?.[alias]??null,'Unchanged production metadata');
+  }
+  const before=(name:string)=>prior?prior.files.find((f:any)=>f.path===name)?.before:fileBytes(root,name);
+  const registryBefore=before('contractInfo.json'),metadataBefore=before('deploymentInfo.json');
+  if(registryBefore===undefined||metadataBefore===undefined)throw Error('Production journal registry missing');
+  const merged=mergeDevelopmentRegistration({registry:JSON.parse(registryBefore??'{}'),metadata:JSON.parse(metadataBefore??'{"version":1,"networks":{}}'),...registrationContext});
+  // Keep exact original containers for pure-call plans; no unrelated metadata is invented.
+  const files:DevelopmentFile[]=[{path:record,before:before(record),after:json(evidence)},{path:'contractInfo.json',before:registryBefore,after:deployed.length?json(merged.registry):registryBefore??json(merged.registry)},{path:'deploymentInfo.json',before:metadataBefore,after:deployed.length?json(merged.metadata):metadataBefore??json(merged.metadata)}];
+  for(const c of candidates){const old=files.find(f=>f.path===c.path),bytes=old?.after??before(c.path),document=bytes===null?{manifestVersion:'3.2',impls:{},proxies:[]}:parseTargetManifest(Buffer.from(bytes));const after=json(mergeEvmManifestCandidate(document,c));if(old)old.after=after;else files.push({path:c.path,before:bytes,after});}
+  if(prior){if(prior.identity!==executionIdentity)throw Error('Production journal identity conflict');same(prior.files.map(({path,before,after}:DevelopmentFile)=>({path,before,after})),files,'Production finalization journal');if(prior.state==='committed'){verifyCommitted(prior);return prior;}}
+  else if(files[0].before!==null)throw Error('Production deployment record already exists without journal');
+  return commitDevelopmentFilesLocked({root,executionId:plan.executionId,identity:executionIdentity,files});
+ });
+ const rows=[];for(const row of expected)rows.push(await compare(row.address,row.contract,row.key));
+ const report=checker.generateNetworkContractResults(rows as any);validateDevelopmentCheckReport(report,plan.target,expected);await assertAnchor();input.assertInputs();
+ verifyCommitted(journal);
+ const reportPath=`.gate-delivery/check-code/${plan.executionId}/production.raw.json`,reportBytes=json(report),acceptancePath=`.gate-delivery/production/${plan.executionId}.acceptance.json`;
+ const acceptance={...evidence,status:'accepted',materialization:{intentHash:journal.intentHash,recordPath:record,recordHash:byteHash(json(evidence)),manifests:candidates.map(c=>({file:c.path,hash:byteHash(journal.files.find((f:any)=>f.path===c.path).after),layoutHash:c.layoutHash,proxy:c.proxy,implementation:c.implementation}))},checkCode:{version:1,executionId:plan.executionId,planHash:plan.planHash,target:plan.target,anchor,rawFile:reportPath,rawHash:byteHash(reportBytes),registryHash:byteHash(journal.files.find((f:any)=>f.path==='contractInfo.json').after),metadataHash:byteHash(journal.files.find((f:any)=>f.path==='deploymentInfo.json').after),effectiveHash:byteHash(json(effective)),expected,artifacts:compiler.artifacts.map(a=>artifactIdentity(a.artifact,'evm'))},receiptPath:acceptancePath};
+ const saved=fileBytes(root,acceptancePath);if(saved!==null){same(JSON.parse(saved),acceptance,'Production acceptance');if(fileBytes(root,reportPath)!==reportBytes)throw Error('Production CheckCode report changed');}
+ else{atomicDevelopmentWrite(root,reportPath,reportBytes);atomicDevelopmentWrite(root,acceptancePath,json(acceptance));}
+ return deepFreeze(acceptance);
+}

package/runtime/delivery/production-intent.ts

@@ -0,0 +1,14 @@
+/** Re-simulation may change operator routing, but cannot replace released transaction intent. */
+import { canonicalJson } from '../workflow/lib/canonicalData';
+import { parseCalldataReviews } from './calldata-review';
+import type { DeliveryCollection } from './planning';
+
+export function assertReleasedCalldataIntent(actual: DeliveryCollection, released: DeliveryCollection): void {
+  const current = parseCalldataReviews(actual.calldata, actual.plan.transactions);
+  const frozen = parseCalldataReviews(released.calldata, released.plan.transactions);
+  if (canonicalJson(current) !== canonicalJson(frozen))
+    throw Error('Final simulation changed released calldata ABI intent');
+  for (const key of ['derivationSeed', 'values'] as const)
+    if (canonicalJson(actual.plan.derivedBindings[key]) !== canonicalJson(released.plan.derivedBindings[key]))
+      throw Error('Final simulation changed released derivation');
+}