fix: close immutable promotion trust gaps

scripts/lib/local-release-evidence.ts

@@ -0,0 +1,533 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+import { z, type ZodType } from "zod";
+
+import { EXPECTED_CONTRACT_SET_PACKAGES } from "../../src/features/installed-contract-contributions.ts";
+import {
+  ROUTE_REGISTRY,
+  ROUTE_RUNTIME_CONTRACT,
+} from "../../src/features/installed-feature-contracts.ts";
+import {
+  buildManifestArtifactSchema,
+  bundlePerformanceArtifactSchema,
+  dependencyDiffArtifactSchema,
+  dependencyInventoryArtifactSchema,
+  licenseReportArtifactSchema,
+  provenanceArtifactSchema,
+  releaseManifestArtifactSchema,
+  releaseVerificationArtifactSchema,
+  runtimeConfigArtifactSchema,
+  sbomArtifactSchema,
+  supplyChainVerificationArtifactSchema,
+  vulnerabilityReportArtifactSchema,
+} from "../contracts/release-artifacts.ts";
+import {
+  CANONICAL_VITE_MANIFEST_PATH,
+  verifyBuildManifestOutputs,
+} from "./build-manifest-outputs.ts";
+import { assertMatchesJsonSchema } from "./json-schema.ts";
+import type { ReleaseCandidateManifest } from "./release-candidate.ts";
+import { collectDistOutputs, distSha256 } from "./release-candidate.ts";
+import { verifyReleaseRuntimeCoherence } from "./release-runtime-coherence.ts";
+import { digestReleaseInputFiles } from "./release-input-evidence.ts";
+import {
+  buildRepositoryFileInventory,
+  parseRepositoryFileInventoryPolicy,
+} from "./repository-file-inventory.ts";
+import {
+  isValidSha512Integrity,
+  parsePnpmLockfilePackages,
+  supplyChainDigest,
+  verifySupplyChainCoherence,
+} from "./supply-chain.ts";
+
+const sha256 = z.string().regex(/^[a-f0-9]{64}$/u);
+export const supplyChainCoherenceReportSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    status: z.enum(["PASS", "FAIL"]),
+    dependencyCount: z.int().nonnegative(),
+    lockfileSha256: sha256,
+    distSha256: sha256,
+    sbomSha256: sha256,
+    failures: z.array(z.string()),
+  })
+  .strict();
+
+export type SupplyChainCoherenceReport = z.infer<
+  typeof supplyChainCoherenceReportSchema
+>;
+
+export async function verifyLocalSupplyChainEvidence(
+  repositoryRoot = process.cwd(),
+): Promise<SupplyChainCoherenceReport> {
+  const failures: string[] = [];
+  const inventory = await parseArtifact(
+    repositoryRoot,
+    "artifacts/release/dependency-inventory.json",
+    dependencyInventoryArtifactSchema,
+    "dependency inventory",
+    failures,
+  );
+  const sbom = await parseArtifact(
+    repositoryRoot,
+    "artifacts/release/sbom.cdx.json",
+    sbomArtifactSchema,
+    "SBOM",
+    failures,
+  );
+  const provenance = await parseArtifact(
+    repositoryRoot,
+    "artifacts/release/provenance.json",
+    provenanceArtifactSchema,
+    "local provenance",
+    failures,
+  );
+  const verification = await parseArtifact(
+    repositoryRoot,
+    "artifacts/security/supply-chain-verification.json",
+    supplyChainVerificationArtifactSchema,
+    "supply-chain verification",
+    failures,
+  );
+
+  for (const [schemaPath, artifact, label] of [
+    [
+      "schemas/artifacts/dependency-inventory.schema.json",
+      inventory,
+      "dependency inventory",
+    ],
+    [
+      "schemas/artifacts/supply-chain-verification.schema.json",
+      verification,
+      "supply-chain verification",
+    ],
+  ] as const) {
+    if (!artifact) continue;
+    try {
+      assertMatchesJsonSchema(
+        await readJson(repositoryRoot, schemaPath),
+        artifact,
+        label,
+      );
+    } catch {
+      failures.push(`${label} JSON Schema mismatch`);
+    }
+  }
+
+  let lockfileText = "";
+  let lockfileSha256 = "0".repeat(64);
+  try {
+    const rawLockfile = await readFile(
+      path.join(repositoryRoot, "pnpm-lock.yaml"),
+    );
+    lockfileText = rawLockfile.toString("utf8");
+    lockfileSha256 = createHash("sha256").update(rawLockfile).digest("hex");
+  } catch {
+    failures.push("raw pnpm-lock.yaml is missing or unreadable");
+  }
+
+  let distDigest = "0".repeat(64);
+  try {
+    distDigest = distSha256(await collectDistOutputs(repositoryRoot));
+  } catch {
+    failures.push("candidate dist is missing or unreadable");
+  }
+  const sbomSha256 = sbom ? supplyChainDigest(sbom) : "0".repeat(64);
+
+  if (inventory && sbom && provenance) {
+    failures.push(
+      ...verifySupplyChainCoherence(
+        sbom,
+        inventory,
+        provenance,
+        distDigest,
+      ).failures,
+    );
+  }
+  if (
+    !inventory ||
+    !verification ||
+    inventory.lockfileSha256 !== lockfileSha256 ||
+    verification.lockfileSha256 !== lockfileSha256
+  ) {
+    failures.push("inventory/verification lockfile digest mismatch");
+  }
+  if (
+    !verification ||
+    verification.localStatus !== "PASS" ||
+    verification.failures.length > 0 ||
+    verification.distSha256 !== distDigest ||
+    verification.sbomSha256 !== sbomSha256
+  ) {
+    failures.push("verification digest/status set is incoherent");
+  }
+  if (inventory && sbom && provenance && verification) {
+    try {
+      const policy = parseRepositoryFileInventoryPolicy(
+        await readJson(
+          repositoryRoot,
+          "config/security/secret-scan-policy.json",
+        ),
+      );
+      const repositoryInventory = await buildRepositoryFileInventory({
+        repositoryRoot,
+        trackedRoots: policy.trackedRoots,
+        generatedRoots: policy.generatedRoots,
+        optionalRoots: policy.optionalRoots,
+      });
+      const sourceSetSha256 = await digestReleaseInputFiles(
+        repositoryInventory.trackedFiles,
+        (file) => readFile(path.join(repositoryRoot, file)),
+      );
+      if (
+        verification.sourceSetSha256 !== sourceSetSha256 ||
+        provenance.predicate.materials.sourceSetSha256 !== sourceSetSha256 ||
+        provenance.predicate.materials.sbomSha256 !== sbomSha256
+      ) {
+        failures.push("source/SBOM provenance materials are incoherent");
+      }
+    } catch {
+      failures.push("release source inventory is unavailable or unreadable");
+    }
+  }
+
+  const lockRows = parsePnpmLockfilePackages(lockfileText);
+  const inventoryRows = inventory?.dependencies ?? [];
+  const inventoryByIdentity = new Map<string, (typeof inventoryRows)[number]>(
+    inventoryRows.map(
+      (entry) => [`${entry.name}@${entry.version}`, entry] as const,
+    ),
+  );
+  if (lockRows.length !== inventoryRows.length) {
+    failures.push("transitive dependency count differs from lockfile");
+  }
+  for (const lockRow of lockRows) {
+    const identity = `${lockRow.name}@${lockRow.version}`;
+    const dependency = inventoryByIdentity.get(identity);
+    if (
+      !dependency ||
+      dependency.integrity !== lockRow.integrity ||
+      !isValidSha512Integrity(lockRow.integrity)
+    ) {
+      failures.push(`lockfile inventory integrity mismatch: ${identity}`);
+    }
+  }
+
+  return supplyChainCoherenceReportSchema.parse({
+    schemaVersion: 1,
+    status: failures.length === 0 ? "PASS" : "FAIL",
+    dependencyCount: inventoryRows.length,
+    lockfileSha256,
+    distSha256: distDigest,
+    sbomSha256,
+    failures,
+  });
+}
+
+export async function verifyArchivedLocalEvidence(input: Readonly<{
+  repositoryRoot?: string;
+  candidate: ReleaseCandidateManifest;
+}>): Promise<Readonly<{
+  status: "PASS" | "FAIL";
+  failures: readonly string[];
+}>> {
+  const repositoryRoot = path.resolve(input.repositoryRoot ?? process.cwd());
+  const failures: string[] = [];
+  const supplyReport = await verifyLocalSupplyChainEvidence(repositoryRoot);
+  failures.push(...supplyReport.failures);
+  if (supplyReport.lockfileSha256 !== input.candidate.lockfileSha256) {
+    failures.push("candidate/raw lockfile digest mismatch");
+  }
+
+  const buildManifest = await parseArtifact(
+    repositoryRoot,
+    "artifacts/release/build-manifest.json",
+    buildManifestArtifactSchema,
+    "build manifest",
+    failures,
+  );
+  const release = await parseArtifact(
+    repositoryRoot,
+    "dist/release-manifest.json",
+    releaseManifestArtifactSchema,
+    "release manifest",
+    failures,
+  );
+  const runtime = await parseArtifact(
+    repositoryRoot,
+    "dist/config.json",
+    runtimeConfigArtifactSchema,
+    "runtime config",
+    failures,
+  );
+  const storedRelease = await parseArtifact(
+    repositoryRoot,
+    "artifacts/release/verification.json",
+    releaseVerificationArtifactSchema,
+    "release verification",
+    failures,
+  );
+  const storedSupply = await parseArtifact(
+    repositoryRoot,
+    "artifacts/security/supply-chain-coherence.json",
+    supplyChainCoherenceReportSchema,
+    "supply-chain coherence",
+    failures,
+  );
+
+  await validateSupportingArtifacts(repositoryRoot, failures);
+  if (buildManifest) {
+    try {
+      assertMatchesJsonSchema(
+        await readJson(
+          repositoryRoot,
+          "schemas/artifacts/build-manifest.schema.json",
+        ),
+        buildManifest,
+        "build manifest",
+      );
+    } catch {
+      failures.push("build manifest JSON Schema mismatch");
+    }
+    failures.push(
+      ...(await verifyBuildManifestOutputs(buildManifest, { repositoryRoot })),
+    );
+  }
+
+  if (release && runtime) {
+    if (!runtime.BUILD_ID || !runtime.RELEASE_ID) {
+      failures.push("runtime release identity is missing");
+    } else {
+      const apiContractVersion =
+        release.schemaVersion === 1 && "API_CONTRACT_VERSION" in runtime
+          ? runtime.API_CONTRACT_VERSION
+          : undefined;
+      if (release.schemaVersion === 1 && apiContractVersion === undefined) {
+        failures.push("runtime API contract identity is missing");
+      }
+      const coherence = await verifyReleaseRuntimeCoherence({
+        release,
+        runtime: {
+          BUILD_ID: runtime.BUILD_ID,
+          RELEASE_ID: runtime.RELEASE_ID,
+          CONFIG_SCHEMA_VERSION: runtime.CONFIG_SCHEMA_VERSION,
+          ...(apiContractVersion === undefined
+            ? {}
+            : { API_CONTRACT_VERSION: apiContractVersion }),
+        },
+        contractPackages: EXPECTED_CONTRACT_SET_PACKAGES,
+      });
+      failures.push(...coherence.mismatches.map((item) => `release:${item}`));
+    }
+    await verifyReleaseOutputs(
+      repositoryRoot,
+      release,
+      buildManifest,
+      failures,
+    );
+  }
+
+  if (
+    !storedRelease ||
+    !storedRelease.passed ||
+    !storedRelease.artifact.checked ||
+    !storedRelease.artifact.compatible ||
+    storedRelease.artifact.mismatches.length > 0 ||
+    storedRelease.fixtures.length === 0 ||
+    storedRelease.fixtures.some((fixture) => !fixture.passed) ||
+    storedRelease.artifact.releaseId !== release?.releaseId ||
+    storedRelease.generatedAt !== release?.builtAt
+  ) {
+    failures.push("stored release verification is not a coherent PASS");
+  }
+  if (
+    !storedSupply ||
+    storedSupply.status !== "PASS" ||
+    storedSupply.failures.length > 0 ||
+    storedSupply.dependencyCount !== supplyReport.dependencyCount ||
+    storedSupply.lockfileSha256 !== supplyReport.lockfileSha256 ||
+    storedSupply.distSha256 !== supplyReport.distSha256 ||
+    storedSupply.sbomSha256 !== supplyReport.sbomSha256
+  ) {
+    failures.push("stored supply-chain coherence is not a recomputed PASS");
+  }
+  await verifySecretScan(repositoryRoot, failures);
+
+  return Object.freeze({
+    status: failures.length === 0 ? "PASS" : "FAIL",
+    failures: Object.freeze([...new Set(failures)]),
+  });
+}
+
+async function validateSupportingArtifacts(
+  repositoryRoot: string,
+  failures: string[],
+): Promise<void> {
+  const bundle = await parseArtifact(
+    repositoryRoot,
+    "artifacts/performance/bundle.json",
+    bundlePerformanceArtifactSchema,
+    "bundle report",
+    failures,
+  );
+  if (bundle) {
+    try {
+      const actual = await collectDistOutputs(repositoryRoot);
+      if (JSON.stringify(bundle.outputs) !== JSON.stringify(actual)) {
+        failures.push("bundle report does not describe current dist bytes");
+      }
+    } catch {
+      failures.push("bundle report dist inputs are unreadable");
+    }
+  }
+  const dependencyDiff = await parseArtifact(
+    repositoryRoot,
+    "artifacts/security/dependency-diff.json",
+    dependencyDiffArtifactSchema,
+    "dependency diff",
+    failures,
+  );
+  if (dependencyDiff && dependencyDiff.reviewFailures.length > 0) {
+    failures.push("dependency review evidence is not PASS");
+  }
+  const license = await parseArtifact(
+    repositoryRoot,
+    "artifacts/security/license-report.json",
+    licenseReportArtifactSchema,
+    "license report",
+    failures,
+  );
+  if (license && (license.status !== "PASS" || license.failures.length > 0)) {
+    failures.push("license report is not PASS");
+  }
+  const vulnerability = await parseArtifact(
+    repositoryRoot,
+    "artifacts/security/vulnerability-report.json",
+    vulnerabilityReportArtifactSchema,
+    "local vulnerability report",
+    failures,
+  );
+  if (
+    vulnerability &&
+    (vulnerability.status !== "FAIL_UNVERIFIED" ||
+      vulnerability.provider !== "UNCONFIGURED")
+  ) {
+    failures.push("local vulnerability report may not satisfy promotion");
+  }
+  const provenance = await parseArtifact(
+    repositoryRoot,
+    "artifacts/release/provenance.json",
+    provenanceArtifactSchema,
+    "local provenance",
+    failures,
+  );
+  if (
+    provenance?.predicate.runDetails.metadata.invocationId !== "LOCAL_UNSIGNED"
+  ) {
+    failures.push("local provenance must remain LOCAL_UNSIGNED");
+  }
+}
+
+async function verifyReleaseOutputs(
+  repositoryRoot: string,
+  release: z.infer<typeof releaseManifestArtifactSchema>,
+  buildManifest: z.infer<typeof buildManifestArtifactSchema> | null,
+  failures: string[],
+): Promise<void> {
+  let viteManifest: Record<string, unknown> = {};
+  try {
+    const raw = await readFile(
+      path.join(repositoryRoot, CANONICAL_VITE_MANIFEST_PATH),
+      "utf8",
+    );
+    viteManifest = asRecord(JSON.parse(raw), "Vite manifest");
+    if (createHash("sha256").update(raw).digest("hex") !== release.assetManifestHash) {
+      failures.push("release asset manifest hash mismatch");
+    }
+  } catch {
+    failures.push("Vite manifest is missing or invalid");
+  }
+  if (
+    buildManifest &&
+    (buildManifest.buildId !== release.buildId ||
+      buildManifest.commitSha !== release.commitSha ||
+      buildManifest.releaseId !== release.releaseId ||
+      buildManifest.generatedAt !== release.builtAt)
+  ) {
+    failures.push("build/release identity mismatch");
+  }
+  const runtimeContracts: Readonly<Record<string, { moduleId: string }>> =
+    ROUTE_RUNTIME_CONTRACT;
+  for (const definition of Object.values(ROUTE_REGISTRY)) {
+    const runtime = runtimeContracts[definition.routeId];
+    const viteEntry = Object.values(viteManifest).find(
+      (entry) =>
+        isRecord(entry) &&
+        entry.name === runtime?.moduleId &&
+        entry.isDynamicEntry === true,
+    );
+    const file = isRecord(viteEntry) ? viteEntry.file : null;
+    if (
+      typeof file !== "string" ||
+      release.routeChunks[definition.chunkId] !== file ||
+      buildManifest?.outputs.routeChunks[definition.chunkId] !== file
+    ) {
+      failures.push(`release route chunk mismatch: ${definition.chunkId}`);
+    }
+  }
+}
+
+async function verifySecretScan(
+  repositoryRoot: string,
+  failures: string[],
+): Promise<void> {
+  try {
+    const sarif = asRecord(
+      await readJson(repositoryRoot, "artifacts/security/scan.sarif"),
+      "secret scan SARIF",
+    );
+    const runs = Array.isArray(sarif.runs) ? sarif.runs : [];
+    if (
+      sarif.version !== "2.1.0" ||
+      runs.length !== 1 ||
+      !isRecord(runs[0]) ||
+      !Array.isArray(runs[0].results) ||
+      runs[0].results.length !== 0
+    ) {
+      failures.push("secret scan SARIF is not an empty PASS");
+    }
+  } catch {
+    failures.push("secret scan SARIF is missing or invalid");
+  }
+}
+
+async function parseArtifact<T>(
+  repositoryRoot: string,
+  file: string,
+  schema: ZodType<T>,
+  label: string,
+  failures: string[],
+): Promise<T | null> {
+  try {
+    return schema.parse(await readJson(repositoryRoot, file));
+  } catch {
+    failures.push(`${label} executable schema mismatch`);
+    return null;
+  }
+}
+
+async function readJson(repositoryRoot: string, file: string): Promise<unknown> {
+  return JSON.parse(await readFile(path.join(repositoryRoot, file), "utf8"));
+}
+
+function asRecord(value: unknown, label: string): Record<string, unknown> {
+  if (!isRecord(value)) throw new TypeError(`${label} must be a JSON object`);
+  return value;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

scripts/lib/promotion-verifier.ts

@@ -1,5 +1,6 @@
 import { createPublicKey } from "node:crypto";
 import { readFile } from "node:fs/promises";
+import path from "node:path";
 
 import {
   evaluatePromotionEvidence,
@@ -10,38 +11,63 @@ import {
   releaseCandidateManifestSchema,
   verifyReleaseCandidate,
 } from "./release-candidate.ts";
+import { verifyArchivedLocalEvidence } from "./local-release-evidence.ts";
+
+type LocalEvidenceVerifier = typeof verifyArchivedLocalEvidence;
+
+export type VerifyPromotionInputsOptions = Readonly<{
+  environment?: NodeJS.ProcessEnv;
+  repositoryRoot?: string;
+  verifyLocalEvidence?: LocalEvidenceVerifier;
+}>;
 
 export async function verifyPromotionInputs(
-  environment: NodeJS.ProcessEnv = process.env,
+  options: VerifyPromotionInputsOptions = {},
 ) {
-  const manifestDocument = await requiredJson(RELEASE_CANDIDATE_MANIFEST_PATH);
-  const manifest = releaseCandidateManifestSchema.parse(manifestDocument);
-  const candidate = await verifyReleaseCandidate(manifestDocument);
-  const localVerification = await requiredJson(
-    "artifacts/security/supply-chain-verification.json",
+  const environment = options.environment ?? process.env;
+  const repositoryRoot = path.resolve(options.repositoryRoot ?? process.cwd());
+  const manifestDocument = await requiredJson(
+    repositoryRoot,
+    RELEASE_CANDIDATE_MANIFEST_PATH,
   );
+  const manifest = releaseCandidateManifestSchema.parse(manifestDocument);
+  const candidate = await verifyReleaseCandidate(
+    manifestDocument,
+    repositoryRoot,
+  );
+  const localEvidence = await (
+    options.verifyLocalEvidence ?? verifyArchivedLocalEvidence
+  )({ repositoryRoot, candidate: manifest });
   const vulnerabilityReport = await optionalJson(
+    repositoryRoot,
     environment.VULNERABILITY_REPORT_PATH,
   );
   const provenanceAttestation = await optionalJson(
+    repositoryRoot,
     environment.PROVENANCE_ATTESTATION_PATH,
   );
   const result = evaluatePromotionEvidence({
     candidate: manifest,
     currentDistSha256: candidate.currentDistSha256 ?? "",
-    localStatus: localVerification.localStatus,
+    localStatus: localEvidence.status,
     vulnerabilityReport,
     provenanceAttestation,
     vulnerabilityTrust: await readTrust(
+      repositoryRoot,
       environment.VULNERABILITY_PUBLIC_KEY_PATH,
       environment.VULNERABILITY_KEY_ID,
     ),
     provenanceTrust: await readTrust(
+      repositoryRoot,
       environment.PROVENANCE_PUBLIC_KEY_PATH,
       environment.PROVENANCE_KEY_ID,
     ),
   });
-  const failures = [...candidate.failures, ...result.failures];
+  const failures = [
+    ...candidate.failures,
+    ...localEvidence.failures,
+    ...result.failures,
+  ];
   return Object.freeze({
     schemaVersion: 1 as const,
     status:
@@ -57,6 +83,7 @@ export async function verifyPromotionInputs(
 }
 
 async function readTrust(
+  repositoryRoot: string,
   publicKeyPath: string | undefined,
   keyId: string | undefined,
 ): Promise<ProviderTrust | null> {
@@ -64,24 +91,36 @@ async function readTrust(
   try {
     return Object.freeze({
       keyId,
-      publicKey: createPublicKey(await readFile(publicKeyPath, "utf8")),
+      publicKey: createPublicKey(
+        await readFile(path.resolve(repositoryRoot, publicKeyPath), "utf8"),
+      ),
     });
   } catch {
     return null;
   }
 }
 
-async function optionalJson(file: string | undefined): Promise<unknown> {
+async function optionalJson(
+  repositoryRoot: string,
+  file: string | undefined,
+): Promise<unknown> {
   if (!file) return null;
   try {
-    return JSON.parse(await readFile(file, "utf8")) as unknown;
+    return JSON.parse(
+      await readFile(path.resolve(repositoryRoot, file), "utf8"),
+    ) as unknown;
   } catch {
     return null;
   }
 }
 
-async function requiredJson(file: string): Promise<Record<string, unknown>> {
-  const value: unknown = JSON.parse(await readFile(file, "utf8"));
+async function requiredJson(
+  repositoryRoot: string,
+  file: string,
+): Promise<Record<string, unknown>> {
+  const value: unknown = JSON.parse(
+    await readFile(path.join(repositoryRoot, file), "utf8"),
+  );
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new TypeError(`${file} must be a JSON object`);
   }

scripts/lib/provider-evidence.ts

@@ -1,4 +1,4 @@
-import { verify, type KeyLike } from "node:crypto";
+import { verify, type KeyObject } from "node:crypto";
 
 import { z } from "zod";
 
@@ -56,7 +56,7 @@ export const providerVerificationArtifactSchema = z
 
 export type ProviderTrust = Readonly<{
   keyId: string;
-  publicKey: KeyLike;
+  publicKey: KeyObject;
 }>;
 
 export type PromotionEvidenceResult = Readonly<{
@@ -182,7 +182,13 @@ function signatureMatches(
   >,
   trust: ProviderTrust | null,
 ): boolean {
-  if (!trust || evidence.signature.keyId !== trust.keyId) return false;
+  if (
+    !trust ||
+    evidence.signature.keyId !== trust.keyId ||
+    trust.publicKey.asymmetricKeyType !== "ed25519"
+  ) {
+    return false;
+  }
   try {
     return verify(
       null,

scripts/lib/release-candidate.ts

@@ -34,6 +34,7 @@ export const RELEASE_CANDIDATE_MANIFEST_PATH =
   "artifacts/release/release-candidate.json";
 
 export const RELEASE_CANDIDATE_EVIDENCE_PATHS = Object.freeze([
+  "pnpm-lock.yaml",
   "artifacts/performance/bundle.json",
   "artifacts/quality/vite-module-inventory.json",
   "artifacts/release/build-manifest.json",
@@ -113,10 +114,21 @@ export async function createReleaseCandidateManifest(
       "utf8",
     ),
   ) as { lockfileSha256?: unknown };
+  const rawLockfileSha256 = evidence.find(
+    (file) => file.path === "pnpm-lock.yaml",
+  )?.sha256;
+  if (
+    typeof rawLockfileSha256 !== "string" ||
+    dependencyInventory.lockfileSha256 !== rawLockfileSha256
+  ) {
+    throw new Error(
+      "raw pnpm-lock digest mismatch with dependency inventory",
+    );
+  }
   return releaseCandidateManifestSchema.parse({
     schemaVersion: 1,
     distSha256: distSha256(outputs),
-    lockfileSha256: dependencyInventory.lockfileSha256,
+    lockfileSha256: rawLockfileSha256,
     bundleSha256: supplyChainDigest(files),
     files,
   });

scripts/lib/supply-chain-time.ts

@@ -0,0 +1,24 @@
+export function deterministicSupplyChainGeneratedAt(input: Readonly<{
+  generatedAt: string;
+  sourceDateEpoch: string | null;
+}>): string {
+  const generatedAtMs = Date.parse(input.generatedAt);
+  if (!Number.isFinite(generatedAtMs)) {
+    throw new TypeError("build manifest generatedAt must be an ISO timestamp");
+  }
+  if (input.sourceDateEpoch !== null) {
+    if (!/^(?:0|[1-9]\d*)$/u.test(input.sourceDateEpoch)) {
+      throw new TypeError("SOURCE_DATE_EPOCH must be whole seconds");
+    }
+    const epoch = Number(input.sourceDateEpoch);
+    if (
+      !Number.isSafeInteger(epoch) ||
+      new Date(epoch * 1000).toISOString() !== input.generatedAt
+    ) {
+      throw new TypeError(
+        "build manifest generatedAt must match SOURCE_DATE_EPOCH",
+      );
+    }
+  }
+  return new Date(generatedAtMs).toISOString();
+}