refactor: generate CI workflow from gate contracts

scripts/lib/provider-evidence.ts

@@ -44,15 +44,58 @@ export const provenanceProviderAttestationSchema = z
 
 export const providerVerificationArtifactSchema = z
   .object({
-    schemaVersion: z.literal(1),
+    schemaVersion: z.literal(2),
+    artifactType: z.enum(["provider-verification", "promotion-verification"]),
     status: z.enum(["PASS", "FAIL_UNVERIFIED"]),
     vulnerabilityStatus: z.enum(["PASS", "FAIL_UNVERIFIED"]),
     provenanceAttestationStatus: z.enum(["PASS", "FAIL_UNVERIFIED"]),
     lockfileSha256: sha256,
     distSha256: sha256,
+    candidateArchiveSha256: sha256.nullable(),
+    vulnerabilityReportSha256: sha256.nullable(),
+    provenanceAttestationSha256: sha256.nullable(),
     failures: z.array(z.string()),
   })
-  .strict();
+  .strict()
+  .superRefine((artifact, context) => {
+    const passing =
+      artifact.status === "PASS" &&
+      artifact.vulnerabilityStatus === "PASS" &&
+      artifact.provenanceAttestationStatus === "PASS" &&
+      artifact.failures.length === 0;
+    if ((artifact.status === "PASS") !== passing) {
+      context.addIssue({
+        code: "custom",
+        path: ["status"],
+        message: "verification PASS must agree with provider statuses and failures",
+      });
+    }
+    if (
+      artifact.status === "PASS" &&
+      [
+        artifact.candidateArchiveSha256,
+        artifact.vulnerabilityReportSha256,
+        artifact.provenanceAttestationSha256,
+      ].some((digest) => digest === null)
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["candidateArchiveSha256"],
+        message: "passing verification requires every exact input digest",
+      });
+    }
+    if (artifact.status === "FAIL_UNVERIFIED" && artifact.failures.length === 0) {
+      context.addIssue({
+        code: "custom",
+        path: ["failures"],
+        message: "failed verification requires a failure diagnostic",
+      });
+    }
+  });
+
+export type ProviderVerificationArtifactType = z.infer<
+  typeof providerVerificationArtifactSchema
+>["artifactType"];
 
 export type ProviderTrust = Readonly<{
   keyId: string;