fix: enforce exact local evidence defaults

scripts/lib/local-release-evidence.ts

@@ -35,8 +35,10 @@ import { digestReleaseInputFiles } from "./release-input-evidence.ts";
 import {
   compareStoredDependencyEvidence,
   compareStoredLicenseEvidence,
+  compareStoredLocalVulnerabilityReport,
   recomputeDependencyEvidence,
   recomputeLicenseEvidence,
+  verifyLocalSupplyChainDefaults,
   verifyStoredDistChecksums,
 } from "./local-policy-evidence.ts";
 import {
@@ -175,6 +177,9 @@ export async function verifyLocalSupplyChainEvidence(
   ) {
     failures.push("verification digest/status set is incoherent");
   }
+  if (verification) {
+    failures.push(...verifyLocalSupplyChainDefaults(verification));
+  }
   if (inventory && sbom && provenance && verification) {
     try {
       const policy = parseRepositoryFileInventoryPolicy(
@@ -336,7 +341,11 @@ export async function verifyArchivedLocalEvidence(input: Readonly<{
     failures,
   );
 
-  await validateSupportingArtifacts(repositoryRoot, failures);
+  await validateSupportingArtifacts(
+    repositoryRoot,
+    failures,
+    supplyReport.lockfileSha256,
+  );
   if (buildManifest) {
     try {
       assertMatchesJsonSchema(
@@ -423,6 +432,7 @@ export async function verifyArchivedLocalEvidence(input: Readonly<{
 async function validateSupportingArtifacts(
   repositoryRoot: string,
   failures: string[],
+  lockfileSha256: string,
 ): Promise<void> {
   let actualOutputs: Awaited<ReturnType<typeof collectDistOutputs>> | null =
     null;
@@ -526,12 +536,10 @@ async function validateSupportingArtifacts(
     "local vulnerability report",
     failures,
   );
-  if (
-    vulnerability &&
-    (vulnerability.status !== "FAIL_UNVERIFIED" ||
-      vulnerability.provider !== "UNCONFIGURED")
-  ) {
-    failures.push("local vulnerability report may not satisfy promotion");
+  if (vulnerability) {
+    failures.push(
+      ...compareStoredLocalVulnerabilityReport(lockfileSha256, vulnerability),
+    );
   }
   const provenance = await parseArtifact(
     repositoryRoot,