fix: fail closed in release drill verification

scripts/verify-release.ts

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
 
 import {
   verifyCompatibilityTuple,
   type CompatibilityTuple,
 } from "../src/application/policies/compatibility.ts";
+import type { InstalledContractPackageIdentity } from "../src/contracts/external-contract-runtime.ts";
 import {
   parseBuildManifestArtifact,
   parseReleaseArtifact,
@@ -36,17 +38,53 @@ type ViteManifestEntry = Readonly<{
   isDynamicEntry?: boolean;
 }>;
 
+export type ReleaseArtifactReader = (path: string) => Promise<unknown>;
+
+export type ReleaseArtifactsCoherenceOptions = Readonly<{
+  readArtifact?: ReleaseArtifactReader;
+  contractPackages?: readonly InstalledContractPackageIdentity[];
+  paths?: Readonly<{ release: string; runtime: string }>;
+}>;
+
+const DEFAULT_RELEASE_COHERENCE_PATHS = Object.freeze({
+  release: "dist/release-manifest.json",
+  runtime: "dist/config.json",
+});
+
+async function readJsonArtifact(path: string): Promise<unknown> {
+  return JSON.parse(await readFile(path, "utf8"));
+}
+
+export async function verifyReleaseArtifactsCoherence(
+  options: ReleaseArtifactsCoherenceOptions = {},
+) {
+  const readArtifact = options.readArtifact ?? readJsonArtifact;
+  const paths = options.paths ?? DEFAULT_RELEASE_COHERENCE_PATHS;
+  const release = parseReleaseDocument(await readArtifact(paths.release));
+  const runtime = parseRuntimeConfigDocument(
+    await readArtifact(paths.runtime),
+  );
+  const coherence = await verifyReleaseRuntimeCoherence({
+    release,
+    runtime,
+    contractPackages:
+      options.contractPackages ?? EXPECTED_CONTRACT_SET_PACKAGES,
+  });
+  return Object.freeze({ release, runtime, coherence });
+}
+
+async function main(): Promise<void> {
 const fixturesDocument = parseFixturesDocument(
   JSON.parse(
     await readFile("config/release/coherence-fixtures.json", "utf8"),
   ),
 );
-const release = parseReleaseDocument(
-  JSON.parse(await readFile("dist/release-manifest.json", "utf8")),
-);
-const runtimeConfig = parseRuntimeConfigDocument(
-  JSON.parse(await readFile("dist/config.json", "utf8")),
-);
+const verifiedRuntime = await verifyReleaseArtifactsCoherence();
+const {
+  release,
+  runtime: runtimeConfig,
+  coherence: artifactComparison,
+} = verifiedRuntime;
 const buildManifestDocument: unknown = JSON.parse(
   await readFile("artifacts/release/build-manifest.json", "utf8"),
 );
@@ -68,11 +106,6 @@ const actualAssetManifestHash = createHash("sha256")
   .update(viteManifest)
   .digest("hex");
 
-const artifactComparison = await verifyReleaseRuntimeCoherence({
-  release,
-  runtime: runtimeConfig,
-  contractPackages: EXPECTED_CONTRACT_SET_PACKAGES,
-});
 const artifactMismatches: string[] = [...artifactComparison.mismatches];
 for (const [token, value] of Object.entries(projectReleaseTokens(release))) {
   if (token !== "schemaVersion" && (typeof value !== "string" || value.length === 0)) {
@@ -193,6 +226,15 @@ if (!passed) {
 process.stdout.write(
   `Release coherence: PASS (${fixtures.length - 1} mixed fixtures rejected)\n`,
 );
+}
+
+const invokedPath = process.argv[1];
+if (
+  invokedPath !== undefined &&
+  import.meta.url === pathToFileURL(invokedPath).href
+) {
+  await main();
+}
 
 function parseFixturesDocument(value: unknown): Readonly<{
   fixtures: readonly CoherenceFixture[];