owlrunkit 0.19.1 → 0.20.0

package/scripts/runkit-contract/usage-mode.mjs

@@ -138,14 +138,20 @@ function recommendUsageMode(input, { schemaVersion, commandPrefix }) {
   const forcedFormalReasons = formalReasonCodes(input);
   const continuityReasons = continuityReasonCodes(input);
   const requestedMode = input.requestedMode;
+  const projectDriverPresent = input.projectDriverPresent === true;
 
   let continuity = "none";
   let assurance = "none";
   const triggerReasons = [];
 
-  if (requestedMode === "managed" || (requestedMode === "auto" && continuityReasons.length > 0)) {
+  if (requestedMode === "managed"
+    || (requestedMode === "auto" && (continuityReasons.length > 0 || projectDriverPresent))) {
     continuity = "project_driver";
-    triggerReasons.push(...(continuityReasons.length > 0 ? continuityReasons : ["managed_mode_requested"]));
+    triggerReasons.push(...(continuityReasons.length > 0
+      ? continuityReasons
+      : projectDriverPresent
+        ? ["project_driver_already_initialized"]
+        : ["managed_mode_requested"]));
   }
 
   if (forcedFormalReasons.length > 0) {
@@ -167,7 +173,7 @@ function recommendUsageMode(input, { schemaVersion, commandPrefix }) {
     }
   } else if (requestedMode === "off") {
     triggerReasons.push("off_mode_requested");
-  } else {
+  } else if (continuity === "none") {
     triggerReasons.push("durable_evidence_not_required");
   }
 

package/scripts/runkit-contract/verification-envelope.mjs

@@ -122,21 +122,23 @@ function assertNoSymlink(root, absolutePath, label, { allowMissingLeaf = false }
   }
 }
 
-function validateCommand(value, label) {
+function validateCommand(value, label, { requireCurrentExecutable = true } = {}) {
   if (value === null) return null;
   assertAllowedKeys(value, label, ["executable", "argv", "timeoutMs"]);
   if (typeof value.executable !== "string" || !path.isAbsolute(value.executable)) {
     throw new Error(`${label} executable must be an absolute regular file.`);
   }
-  let executable;
-  try {
-    const stat = lstatSync(value.executable);
-    executable = realpathSync(value.executable);
-    if (stat.isSymbolicLink() || !stat.isFile() || executable !== value.executable) {
-      throw new Error("not-real");
+  let executable = value.executable;
+  if (requireCurrentExecutable) {
+    try {
+      const stat = lstatSync(value.executable);
+      executable = realpathSync(value.executable);
+      if (stat.isSymbolicLink() || !stat.isFile() || executable !== value.executable) {
+        throw new Error("not-real");
+      }
+    } catch {
+      throw new Error(`${label} executable must be an absolute regular file without symlinks.`);
     }
-  } catch {
-    throw new Error(`${label} executable must be an absolute regular file without symlinks.`);
   }
   const argv = argvList(value.argv, `${label} argv`);
   if (!Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 100 || value.timeoutMs > 3_600_000) {
@@ -158,7 +160,11 @@ function homeForbiddenPaths() {
   ];
 }
 
-export function validateVerificationEnvelopeV1({ workspaceRoot, envelope }) {
+export function validateVerificationEnvelopeV1({
+  workspaceRoot,
+  envelope,
+  requireCurrentEnvironment = true,
+}) {
   const root = realpathSync(workspaceRoot);
   assertAllowedKeys(envelope, "Verification Envelope", [
     "schemaVersion", "envelopeId", "cwd", "lockfiles", "paths",
@@ -170,15 +176,23 @@ export function validateVerificationEnvelopeV1({ workspaceRoot, envelope }) {
   safeIdentifier(envelope.envelopeId, "envelopeId");
   const cwd = safeRelativePath(envelope.cwd, "Verification Envelope cwd", { allowDot: true });
   const cwdPath = path.resolve(root, cwd);
-  assertNoSymlink(root, cwdPath, "Verification Envelope cwd");
-  if (!lstatSync(cwdPath).isDirectory()) throw new Error("Verification Envelope cwd must be a directory.");
+  if (requireCurrentEnvironment) {
+    assertNoSymlink(root, cwdPath, "Verification Envelope cwd");
+    if (!lstatSync(cwdPath).isDirectory()) {
+      throw new Error("Verification Envelope cwd must be a directory.");
+    }
+  }
 
   const lockfiles = validatePatterns(envelope.lockfiles, "Verification Envelope lockfiles", { allowEmpty: true });
   for (const lockfile of lockfiles) {
     if (lockfile.endsWith("/**")) throw new Error("Verification Envelope lockfiles must be exact files.");
-    const absolute = path.join(root, lockfile);
-    assertNoSymlink(root, absolute, "Verification Envelope lockfile");
-    if (!lstatSync(absolute).isFile()) throw new Error(`Verification Envelope lockfile is not a file: ${lockfile}.`);
+    if (requireCurrentEnvironment) {
+      const absolute = path.join(root, lockfile);
+      assertNoSymlink(root, absolute, "Verification Envelope lockfile");
+      if (!lstatSync(absolute).isFile()) {
+        throw new Error(`Verification Envelope lockfile is not a file: ${lockfile}.`);
+      }
+    }
   }
 
   assertAllowedKeys(envelope.paths, "Verification Envelope paths", [
@@ -201,18 +215,20 @@ export function validateVerificationEnvelopeV1({ workspaceRoot, envelope }) {
       }
     }
   }
-  for (const pattern of paths.immutableSource) {
-    const absolute = path.join(root, patternRoot(pattern));
-    assertNoSymlink(root, absolute, "immutableSource");
-    const stat = lstatSync(absolute);
-    if (pattern.endsWith("/**") ? !stat.isDirectory() : !stat.isFile()) {
-      throw new Error(`immutableSource type does not match pattern: ${pattern}.`);
+  if (requireCurrentEnvironment) {
+    for (const pattern of paths.immutableSource) {
+      const absolute = path.join(root, patternRoot(pattern));
+      assertNoSymlink(root, absolute, "immutableSource");
+      const stat = lstatSync(absolute);
+      if (pattern.endsWith("/**") ? !stat.isDirectory() : !stat.isFile()) {
+        throw new Error(`immutableSource type does not match pattern: ${pattern}.`);
+      }
+    }
+    for (const pattern of [...paths.declaredOutput, ...paths.disposableScratch, ...paths.forbidden]) {
+      assertNoSymlink(root, path.join(root, patternRoot(pattern)), "Verification Envelope path", {
+        allowMissingLeaf: true,
+      });
     }
-  }
-  for (const pattern of [...paths.declaredOutput, ...paths.disposableScratch, ...paths.forbidden]) {
-    assertNoSymlink(root, path.join(root, patternRoot(pattern)), "Verification Envelope path", {
-      allowMissingLeaf: true,
-    });
   }
 
   assertAllowedKeys(envelope.environment, "Verification Envelope environment", ["allowNames", "values"]);
@@ -248,10 +264,12 @@ export function validateVerificationEnvelopeV1({ workspaceRoot, envelope }) {
     "process allowedExecutables",
   ).map((executable) => {
     if (!path.isAbsolute(executable)) throw new Error("Allowed executable must be absolute.");
-    const stat = lstatSync(executable);
-    const resolved = realpathSync(executable);
-    if (stat.isSymbolicLink() || !stat.isFile() || resolved !== executable) {
-      throw new Error("Allowed executable must be a regular file without symlinks.");
+    if (requireCurrentEnvironment) {
+      const stat = lstatSync(executable);
+      const resolved = realpathSync(executable);
+      if (stat.isSymbolicLink() || !stat.isFile() || resolved !== executable) {
+        throw new Error("Allowed executable must be a regular file without symlinks.");
+      }
     }
     return executable;
   }).sort();
@@ -261,9 +279,15 @@ export function validateVerificationEnvelopeV1({ workspaceRoot, envelope }) {
 
   assertAllowedKeys(envelope.phases, "Verification Envelope phases", ["setup", "check", "teardown"]);
   const phases = {
-    setup: validateCommand(envelope.phases.setup, "setup phase"),
-    check: validateCommand(envelope.phases.check, "check phase"),
-    teardown: validateCommand(envelope.phases.teardown, "teardown phase"),
+    setup: validateCommand(envelope.phases.setup, "setup phase", {
+      requireCurrentExecutable: requireCurrentEnvironment,
+    }),
+    check: validateCommand(envelope.phases.check, "check phase", {
+      requireCurrentExecutable: requireCurrentEnvironment,
+    }),
+    teardown: validateCommand(envelope.phases.teardown, "teardown phase", {
+      requireCurrentExecutable: requireCurrentEnvironment,
+    }),
   };
   if (phases.check === null) throw new Error("Verification Envelope check phase is required.");
   const normalized = {
@@ -289,6 +313,55 @@ export function validateVerificationEnvelopeV1({ workspaceRoot, envelope }) {
   };
 }
 
+export function validateEnvelopeSourceCandidateBoundaryV1({
+  envelope,
+  sourceManifest,
+}) {
+  if (
+    sourceManifest?.schemaVersion !== "OwlCodaRunKitDirtySourceManifestV2"
+    || !Array.isArray(sourceManifest.entries)
+  ) {
+    throw new Error("Formal envelope source boundary requires SourceCandidate V2 manifest.");
+  }
+  const writable = [
+    ...envelope.paths.declaredOutput,
+    ...envelope.paths.disposableScratch,
+  ];
+  const uncovered = [];
+  const writableCandidatePaths = [];
+  for (const entry of sourceManifest.entries) {
+    const candidatePaths = [entry.path, entry.previousPath].filter(Boolean);
+    for (const candidatePath of candidatePaths) {
+      if (writable.some(pattern => patternCovers(pattern, candidatePath))) {
+        writableCandidatePaths.push(candidatePath);
+      }
+    }
+    if (
+      entry.operation !== "deleted"
+      && !envelope.paths.immutableSource.some(
+        pattern => patternCovers(pattern, entry.path),
+      )
+    ) {
+      uncovered.push(entry.path);
+    }
+  }
+  if (uncovered.length > 0 || writableCandidatePaths.length > 0) {
+    const details = [
+      uncovered.length > 0
+        ? `immutableSource does not cover: ${[...new Set(uncovered)].sort().join(", ")}`
+        : null,
+      writableCandidatePaths.length > 0
+        ? `writable paths overlap candidate source: ${[...new Set(writableCandidatePaths)].sort().join(", ")}`
+        : null,
+    ].filter(Boolean).join("; ");
+    throw new Error(`Formal envelope does not preserve the SourceCandidate: ${details}.`);
+  }
+  return {
+    status: "source_candidate_boundary_valid",
+    authorizationGranted: false,
+  };
+}
+
 function commandExists(command) {
   try {
     const stat = lstatSync(command);
@@ -388,6 +461,28 @@ function mkdirDeclaredRoots(root, patterns) {
   }
 }
 
+function mkdirBoundTemporaryDirectory(root, envelope) {
+  if (!envelope.environment.allowNames.includes("TMPDIR")) return null;
+  if (!Object.hasOwn(envelope.environment.values, "TMPDIR")) {
+    throw new Error("Verification Envelope TMPDIR must be explicitly bound, not inherited.");
+  }
+  const absolute = path.resolve(root, envelope.cwd, envelope.environment.values.TMPDIR);
+  if (!within(root, absolute)) {
+    throw new Error("Verification Envelope TMPDIR must remain inside the workspace.");
+  }
+  const relative = path.relative(root, absolute).split(path.sep).join("/");
+  if (!envelope.paths.disposableScratch.some(pattern => (
+    pattern.endsWith("/**") && patternCovers(pattern, relative)
+  ))) {
+    throw new Error(
+      "Verification Envelope TMPDIR must be covered by a disposableScratch/** directory tree.",
+    );
+  }
+  mkdirSync(absolute, { recursive: true });
+  assertNoSymlink(root, absolute, "Verification Envelope TMPDIR");
+  return absolute;
+}
+
 function walkFiles(root, absolute, relativeBase, files) {
   const stat = lstatSync(absolute);
   if (stat.isSymbolicLink()) throw new Error(`Verification Envelope path contains symlink: ${relativeBase}.`);
@@ -480,9 +575,53 @@ function killGroup(groupId) {
   return { terminated: before, remaining };
 }
 
+function phaseToolchainIssue({ root, cwd, phase }) {
+  if (
+    phase.executable !== realpathSync(process.execPath)
+    || typeof phase.argv[0] !== "string"
+    || phase.argv[0].startsWith("-")
+    || !/\.[cm]?js$/u.test(phase.argv[0])
+  ) {
+    return null;
+  }
+  try {
+    const absolute = path.resolve(root, cwd, phase.argv[0]);
+    if (!within(root, absolute)) throw new Error("outside-workspace");
+    assertNoSymlink(root, absolute, "Verification Envelope Node entrypoint");
+    const stat = lstatSync(absolute);
+    if (!stat.isFile()) throw new Error("not-file");
+    return null;
+  } catch {
+    return "node_entrypoint_unavailable";
+  }
+}
+
 function executeMacPhase({ root, cwd, envelope, phase, name, backend }) {
   const policy = buildMacPolicy({ root, envelope, phase });
   const policySha256 = sha256(policy);
+  const toolchainIssue = phaseToolchainIssue({ root, cwd, phase });
+  if (toolchainIssue !== null) {
+    const now = new Date().toISOString();
+    return Promise.resolve({
+      name,
+      executable: phase.executable,
+      argv: [...phase.argv],
+      startedAt: now,
+      finishedAt: now,
+      timeoutMs: phase.timeoutMs,
+      timedOut: false,
+      outputOverflow: false,
+      exitCode: null,
+      signal: null,
+      launchError: toolchainIssue,
+      stdout: Buffer.alloc(0),
+      stderr: Buffer.alloc(0),
+      policy,
+      policySha256,
+      processGroupId: null,
+      cleanup: { terminated: [], remaining: [] },
+    });
+  }
   return new Promise((resolve) => {
     const startedAt = new Date().toISOString();
     const child = spawn(backend.executable, [
@@ -606,6 +745,245 @@ function receiptPathFor(artifactRoot) {
   return path.join(artifactRoot, "verification-envelope-receipt.json");
 }
 
+function exactKeys(value, label, keys) {
+  assertAllowedKeys(value, label, keys);
+  if (!isRecord(value) || keys.some(key => !Object.hasOwn(value, key))) {
+    throw new Error(`${label} is missing required fields.`);
+  }
+}
+
+function validHash(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/u.test(value);
+}
+
+function validNonNegativeInteger(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+
+function validateReceiptFileRow(row, label, { mode = false } = {}) {
+  exactKeys(row, label, mode
+    ? ["path", "sha256", "bytes", "mode"]
+    : ["path", "sha256", "bytes"]);
+  if (
+    typeof row.path !== "string"
+    || row.path.length === 0
+    || !validHash(row.sha256)
+    || !validNonNegativeInteger(row.bytes)
+    || (mode && (!Number.isSafeInteger(row.mode) || row.mode < 0 || row.mode > 0o777))
+  ) {
+    throw new Error(`${label} is invalid.`);
+  }
+}
+
+function validateReceiptPhase(phase, envelope) {
+  exactKeys(phase, "Verification Envelope receipt phase", [
+    "name",
+    "executable",
+    "argv",
+    "startedAt",
+    "finishedAt",
+    "timeoutMs",
+    "timedOut",
+    "outputOverflow",
+    "exitCode",
+    "signal",
+    "launchError",
+    "policySha256",
+    "processGroupId",
+    "stdout",
+    "stderr",
+    "leakedProcessIds",
+  ]);
+  if (!new Set(["setup", "check", "teardown"]).has(phase.name)) {
+    throw new Error("Verification Envelope receipt phase name is invalid.");
+  }
+  const command = envelope.phases[phase.name];
+  if (
+    command === null
+    || phase.executable !== command.executable
+    || canonical(phase.argv) !== canonical(command.argv)
+    || phase.timeoutMs !== command.timeoutMs
+    || typeof phase.startedAt !== "string"
+    || typeof phase.finishedAt !== "string"
+    || typeof phase.timedOut !== "boolean"
+    || typeof phase.outputOverflow !== "boolean"
+    || !(phase.exitCode === null || Number.isInteger(phase.exitCode))
+    || !(phase.signal === null || typeof phase.signal === "string")
+    || !(phase.launchError === null || typeof phase.launchError === "string")
+    || !validHash(phase.policySha256)
+    || !(phase.processGroupId === undefined
+      || phase.processGroupId === null
+      || Number.isSafeInteger(phase.processGroupId))
+    || !Array.isArray(phase.leakedProcessIds)
+    || phase.leakedProcessIds.some(pid => !Number.isSafeInteger(pid) || pid < 1)
+  ) {
+    throw new Error(`Verification Envelope receipt phase is invalid: ${phase.name}.`);
+  }
+  validateReceiptFileRow(phase.stdout, `${phase.name} stdout`);
+  validateReceiptFileRow(phase.stderr, `${phase.name} stderr`);
+}
+
+function validateReceiptDerivations(receipt, validatedEnvelope) {
+  exactKeys(receipt, "Verification Envelope receipt", [
+    "schemaVersion",
+    "envelopeId",
+    "envelope",
+    "envelopeSha256",
+    "status",
+    "formalEligible",
+    "commandExecuted",
+    "backend",
+    "startedAt",
+    "finishedAt",
+    "phases",
+    "source",
+    "outputs",
+    "evidenceObjects",
+    "cleanup",
+    "nextAllowedAction",
+    "authorizationGranted",
+    "receiptSha256",
+  ]);
+  if (
+    receipt.schemaVersion !== RECEIPT_SCHEMA
+    || receipt.envelopeId !== validatedEnvelope.envelope.envelopeId
+    || receipt.envelopeSha256 !== validatedEnvelope.envelopeSha256
+    || receipt.authorizationGranted !== false
+    || typeof receipt.startedAt !== "string"
+    || typeof receipt.finishedAt !== "string"
+    || !Array.isArray(receipt.phases)
+    || !Array.isArray(receipt.outputs)
+    || !Array.isArray(receipt.evidenceObjects)
+  ) {
+    throw new Error("Verification Envelope receipt contract is invalid.");
+  }
+  exactKeys(receipt.cleanup, "Verification Envelope cleanup", [
+    "teardownCompleted",
+    "terminatedProcessIds",
+    "remainingProcessIds",
+    "remainingPorts",
+    "scratchRemoved",
+    "issues",
+  ]);
+  if (
+    typeof receipt.cleanup.teardownCompleted !== "boolean"
+    || !Array.isArray(receipt.cleanup.terminatedProcessIds)
+    || !Array.isArray(receipt.cleanup.remainingProcessIds)
+    || !Array.isArray(receipt.cleanup.remainingPorts)
+    || !Array.isArray(receipt.cleanup.scratchRemoved)
+    || !Array.isArray(receipt.cleanup.issues)
+  ) {
+    throw new Error("Verification Envelope cleanup contract is invalid.");
+  }
+  if (receipt.backend?.available === false) {
+    exactKeys(receipt.backend, "Verification Envelope backend", [
+      "id", "available", "reason", "capabilities",
+    ]);
+    exactKeys(receipt.source, "Verification Envelope source", [
+      "beforeSha256", "afterSha256",
+    ]);
+    if (
+      receipt.backend.id !== "unavailable"
+      || typeof receipt.backend.reason !== "string"
+      || receipt.phases.length !== 0
+      || receipt.outputs.length !== 0
+      || receipt.evidenceObjects.length !== 0
+      || receipt.source.beforeSha256 !== receipt.source.afterSha256
+      || receipt.status !== "policy_backend_unavailable"
+      || receipt.formalEligible !== false
+      || receipt.commandExecuted !== false
+      || receipt.nextAllowedAction
+        !== "install_supported_enforcement_backend_or_use_captured_evidence"
+    ) {
+      throw new Error("Verification Envelope unavailable-backend receipt is inconsistent.");
+    }
+    return;
+  }
+  exactKeys(receipt.backend, "Verification Envelope backend", [
+    "id", "executable", "capabilities", "policySha256",
+  ]);
+  exactKeys(receipt.source, "Verification Envelope source", [
+    "beforeSha256", "afterSha256", "unchanged", "fileCount",
+  ]);
+  if (
+    receipt.backend.id !== "macos_sandbox_exec_v1"
+    || receipt.backend.executable !== "/usr/bin/sandbox-exec"
+    || !validHash(receipt.backend.policySha256)
+    || !validHash(receipt.source.beforeSha256)
+    || !validHash(receipt.source.afterSha256)
+    || !validNonNegativeInteger(receipt.source.fileCount)
+  ) {
+    throw new Error("Verification Envelope receipt backend or source is invalid.");
+  }
+  const phaseNames = receipt.phases.map(phase => phase.name);
+  if (new Set(phaseNames).size !== phaseNames.length) {
+    throw new Error("Verification Envelope receipt phases must be unique.");
+  }
+  for (const phase of receipt.phases) {
+    validateReceiptPhase(phase, validatedEnvelope.envelope);
+  }
+  const setup = receipt.phases.find(phase => phase.name === "setup") ?? null;
+  const expectedPhaseNames = [];
+  if (validatedEnvelope.envelope.phases.setup !== null) expectedPhaseNames.push("setup");
+  const setupPassed = setup === null
+    || (setup.exitCode === 0 && !setup.timedOut && !setup.outputOverflow);
+  if (setupPassed) expectedPhaseNames.push("check");
+  if (validatedEnvelope.envelope.phases.teardown !== null) expectedPhaseNames.push("teardown");
+  if (canonical(phaseNames) !== canonical(expectedPhaseNames)) {
+    throw new Error("Verification Envelope receipt phase sequence is inconsistent.");
+  }
+  const expectedEvidenceObjects = receipt.phases.flatMap(phase => [
+    { label: `${phase.name}:stdout`, ...phase.stdout },
+    { label: `${phase.name}:stderr`, ...phase.stderr },
+  ]);
+  for (const [index, object] of receipt.evidenceObjects.entries()) {
+    exactKeys(object, `Verification evidence object ${index}`, [
+      "label", "path", "sha256", "bytes",
+    ]);
+    validateReceiptFileRow(
+      { path: object.path, sha256: object.sha256, bytes: object.bytes },
+      `Verification evidence object ${index}`,
+    );
+  }
+  if (canonical(receipt.evidenceObjects) !== canonical(expectedEvidenceObjects)) {
+    throw new Error("Verification Envelope evidence objects do not match phase outputs.");
+  }
+  for (const [index, output] of receipt.outputs.entries()) {
+    validateReceiptFileRow(output, `Verification output ${index}`, { mode: true });
+  }
+  const sourceUnchanged = receipt.source.beforeSha256 === receipt.source.afterSha256;
+  const teardown = receipt.phases.find(phase => phase.name === "teardown") ?? null;
+  const teardownCompleted = validatedEnvelope.envelope.phases.teardown === null
+    || (teardown?.exitCode === 0 && !teardown.timedOut);
+  const allPhasesPassed = receipt.phases.some(phase => phase.name === "check")
+    && receipt.phases.every(phase => phase.exitCode === 0
+      && !phase.timedOut
+      && !phase.outputOverflow
+      && phase.launchError === null);
+  const formalEligible = allPhasesPassed
+    && sourceUnchanged
+    && receipt.cleanup.terminatedProcessIds.length === 0
+    && receipt.cleanup.remainingProcessIds.length === 0
+    && receipt.cleanup.issues.length === 0
+    && teardownCompleted;
+  if (
+    receipt.source.unchanged !== sourceUnchanged
+    || receipt.cleanup.teardownCompleted !== teardownCompleted
+    || receipt.commandExecuted !== (receipt.phases.length > 0)
+    || receipt.formalEligible !== formalEligible
+    || receipt.status !== (formalEligible
+      ? "verification_envelope_passed"
+      : "verification_envelope_failed")
+    || receipt.nextAllowedAction !== (formalEligible
+      ? "consume_in_formal_finish"
+      : "inspect_envelope_receipt_and_create_new_check")
+    || receipt.backend.policySha256
+      !== sha256(canonical(receipt.phases.map(phase => phase.policySha256)))
+  ) {
+    throw new Error("Verification Envelope receipt derived fields are inconsistent.");
+  }
+}
+
 export async function runVerificationEnvelopeV1({
   workspaceRoot,
   envelope: rawEnvelope,
@@ -631,6 +1009,7 @@ export async function runVerificationEnvelopeV1({
     }
     return { ...receipt, receiptPath, resumed: true, verification: verified };
   }
+  mkdirBoundTemporaryDirectory(root, validated.envelope);
   mkdirDeclaredRoots(root, [
     ...validated.envelope.paths.declaredOutput,
     ...validated.envelope.paths.disposableScratch,
@@ -792,20 +1171,25 @@ export async function runVerificationEnvelopeV1({
   return { ...receipt, receiptPath, resumed: false };
 }
 
-export function verifyVerificationEnvelopeReceiptV1({ workspaceRoot, receiptPath }) {
+export function verifyVerificationEnvelopeReceiptV1({
+  workspaceRoot,
+  receiptPath,
+  requireCurrentSource = true,
+}) {
   const root = realpathSync(workspaceRoot);
   const absolute = path.resolve(receiptPath);
   if (!within(root, absolute)) throw new Error("Verification Envelope receipt escapes the workspace.");
   assertNoSymlink(root, absolute, "Verification Envelope receipt");
   const receipt = JSON.parse(readFileSync(absolute, "utf8"));
-  if (receipt.schemaVersion !== RECEIPT_SCHEMA) throw new Error("Verification Envelope receipt schemaVersion is invalid.");
   if (receipt.receiptSha256 !== receiptBodyHash(receipt)) {
     throw new Error("Verification Envelope receipt hash mismatch.");
   }
   const validated = validateVerificationEnvelopeV1({
     workspaceRoot: root,
     envelope: receipt.envelope,
+    requireCurrentEnvironment: requireCurrentSource,
   });
+  validateReceiptDerivations(receipt, validated);
   if (validated.envelopeSha256 !== receipt.envelopeSha256) {
     throw new Error("Verification Envelope receipt envelope hash mismatch.");
   }
@@ -827,8 +1211,12 @@ export function verifyVerificationEnvelopeReceiptV1({ workspaceRoot, receiptPath
       throw new Error(`Verification output hash mismatch: ${output.path}.`);
     }
   }
-  const currentSource = snapshotPatterns(root, receipt.envelope.paths.immutableSource);
-  if (receipt.formalEligible && currentSource.sha256 !== receipt.source.afterSha256) {
+  if (
+    requireCurrentSource
+    && receipt.formalEligible
+    && snapshotPatterns(root, receipt.envelope.paths.immutableSource).sha256
+      !== receipt.source.afterSha256
+  ) {
     throw new Error("Verification Envelope receipt source drifted after execution.");
   }
   return {