Certify alpha8 production and rollback tuples (#7)

* Add explicit rollback bootstrap and maintenance model

* Certify alpha8 production and rollback tuples

test/repository_test.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "digest"
 require "minitest/autorun"
 require_relative "../lib/opencode_compat/client_candidate"
 require_relative "../lib/opencode_compat/runtime_tuple_promoter"
@@ -48,7 +49,14 @@ class RepositoryTest < Minitest::Test
       assert_equal ["ruby-rest-sse"], target.fetch("profiles")
       assert_equal "shared-client-contract-only",
         target.fetch("certification_scope", "shared-client-contract-only")
-      assert_equal "pending", target.fetch("certification_status")
+      assert_equal "certified", target.fetch("certification_status")
+      current = target.fetch("current_certification")
+      assert_equal "certified", current.fetch("status")
+      assert_match(/\A[0-9a-f]{40}\z/, current.fetch("client_commit"))
+      assert_match(/\A[0-9a-f]{40}\z/, current.fetch("rails_commit"))
+      assert_equal current.fetch("expected_text"), current.fetch("full_text")
+      assert_equal 1, current.fetch("llm_request_count")
+      assert_path_exists File.join(ROOT, current.fetch("evidence"))
       previous = target["previous_certification"]
       next unless previous
 
@@ -88,22 +96,29 @@ class RepositoryTest < Minitest::Test
     assert_equal clients.fetch("opencode-ruby").fetch("ref"), dependency.fetch("ref")
   end
 
-  def test_image_matrix_is_pending_and_bound_to_the_exact_client_candidate
+  def test_image_matrix_is_certified_and_bound_to_the_exact_unpublished_client_candidate
     candidate = json("manifests/client-candidate.json")
     clients = candidate.fetch("clients")
     matrix_candidate = json("manifests/image-matrix.json").fetch("client_candidate")
 
-    assert_equal "pending", matrix_candidate.fetch("certification_status")
+    assert_equal "certified", matrix_candidate.fetch("certification_status")
+    assert_equal "unpublished", matrix_candidate.fetch("publication_state")
+    assert_path_exists File.join(ROOT, matrix_candidate.fetch("evidence"))
     assert_equal candidate.fetch("release_train"), matrix_candidate.fetch("release_train")
     assert_equal candidate.fetch("publication_state"), matrix_candidate.fetch("publication_state")
     assert_equal clients.dig("opencode-ruby", "ref"), matrix_candidate.fetch("opencode_ruby_commit")
     assert_equal clients.dig("opencode-rails", "ref"), matrix_candidate.fetch("opencode_rails_commit")
 
     json("manifests/image-matrix.json").fetch("host_canary").each do |target|
-      assert_equal "pending", target.fetch("certification_status")
+      assert_equal "certified", target.fetch("certification_status")
+      current = target.fetch("current_certification")
+      assert_equal "certified", current.fetch("status")
+      assert_match(/\A[0-9a-f]{40}\z/, current.fetch("client_commit"))
+      assert_path_exists File.join(ROOT, current.fetch("evidence"))
       previous = target.fetch("previous_certification")
-      assert_includes %w[candidate-certified certified], previous.fetch("status")
+      assert_equal "certified", previous.fetch("status")
       assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
+      assert_path_exists File.join(ROOT, previous.fetch("evidence"))
     end
   end
 
@@ -129,6 +144,32 @@ class RepositoryTest < Minitest::Test
     assert evidence.fetch("limitations").any? { |entry| entry.include?("remain unverified") }
   end
 
+  def test_alpha8_ci_evidence_certifies_shared_and_lockstep_scopes_without_claiming_apps
+    evidence = json("evidence/2026-07-20-opencode-alpha8-shared-client-ci.json")
+    candidate = json("manifests/client-candidate.json").fetch("clients")
+
+    assert_equal "pass", evidence.fetch("status")
+    assert_equal "unpublished", evidence.fetch("publication_state")
+    assert_equal candidate.dig("opencode-ruby", "ref"), evidence.dig("clients", "opencode_ruby", "commit")
+    assert_equal candidate.dig("opencode-rails", "ref"), evidence.dig("clients", "opencode_rails", "commit")
+    assert_equal "29725021192", evidence.dig("github_workflow", "run_id")
+    assert_equal "2717", evidence.dig("gitea_workflow", "run_id")
+    assert_equal false, evidence.dig("gitea_workflow", "artifact_evidence_claimed")
+    assert_operator evidence.fetch("certified_at"), :>=, evidence.dig("github_workflow", "completed_at")
+    assert_operator evidence.fetch("certified_at"), :>=, evidence.dig("gitea_workflow", "completed_at")
+    assert_equal %w[3.2.11 3.3.12 3.4.10 4.0.6],
+      evidence.fetch("rails_lockstep").map { |entry| entry.fetch("ruby_runtime_version") }
+    assert evidence.fetch("rails_lockstep").all? { |entry| entry.fetch("status") == "pass" }
+    assert_equal 3, evidence.fetch("exact_image_contracts").length
+    evidence.fetch("exact_image_contracts").each do |contract|
+      assert_equal "pass", contract.fetch("status")
+      assert_equal contract.fetch("expected_text"), contract.fetch("full_text")
+      assert_equal 1, contract.fetch("authoritative_assistant_message_count")
+      assert_equal 1, contract.fetch("llm_request_count")
+    end
+    assert evidence.fetch("limitations").any? { |entry| entry.include?("application profile") }
+  end
+
   def test_certified_migration_keeps_previous_tuple
     tuples = json("manifests/runtime-tuples.json")
     return unless tuples.fetch("migration_state") == "certified"
@@ -155,7 +196,7 @@ class RepositoryTest < Minitest::Test
   def test_runtime_tuples_use_full_commits_and_no_mutable_registry_coordinate
     tuples = json("manifests/runtime-tuples.json")
     tuples.fetch("consumers").each_value do |consumer|
-      %w[current candidate previous].each do |slot|
+      %w[current candidate previous emergency_provenance].each do |slot|
         tuple = consumer[slot]
         next unless tuple
 
@@ -176,37 +217,83 @@ class RepositoryTest < Minitest::Test
     end
   end
 
-  def test_failed_alpha2_baselines_block_promotion_instead_of_becoming_previous
+  def test_failed_alpha2_baselines_remain_uncertified_emergency_provenance
     tuples = json("manifests/runtime-tuples.json")
     readiness = tuples.fetch("promotion_readiness")
 
-    assert_equal "blocked", readiness.fetch("status")
-    assert_path_exists File.join(ROOT, readiness.fetch("evidence"))
+    assert_equal "certified", tuples.fetch("migration_state")
+    assert_equal "certified", readiness.fetch("status")
     tuples.fetch("consumers").each_value do |consumer|
-      assert_equal "observed-production-contract-failed", consumer.dig("current", "status")
-      assert_nil consumer.fetch("previous")
+      emergency = consumer.fetch("emergency_provenance")
+      assert_equal "observed-production-contract-failed", emergency.fetch("status")
+      refute emergency.key?("certification")
+      assert_equal "certified", consumer.dig("current", "status")
+      assert_equal "0.0.1.alpha8", consumer.dig("current", "opencode_ruby", "version")
+      assert_equal "certified", consumer.dig("previous", "status")
+      assert_equal "0.0.1.alpha7", consumer.dig("previous", "opencode_ruby", "version")
+      refute consumer.key?("rollback_state")
     end
   end
 
-  def test_candidate_evidence_is_bound_to_complete_tuple_fingerprints
+  def test_platform_one_click_targets_are_explicitly_uncertified_and_separate
+    consumers = json("manifests/runtime-tuples.json").fetch("consumers")
+
+    %w[travelwolf mushu].each do |name|
+      rollback = consumers.fetch(name).fetch("immediate_platform_rollback")
+      assert_match(/\Auncertified-/, rollback.fetch("status"))
+      assert_match(/\A[0-9a-f]{40}\z/, rollback.fetch("consumer_commit"))
+      assert_match(/\A[0-9a-f]{40}\z/, rollback.dig("opencode_ruby", "git_commit"))
+      refute rollback.key?("certification")
+      refute_equal consumers.dig(name, "previous", "consumer_commit"), rollback.fetch("consumer_commit")
+    end
+
+    travelwolf_runtime = consumers.dig("travelwolf", "immediate_platform_rollback", "runtime")
+    assert_match(/@sha256:[0-9a-f]{64}\z/, travelwolf_runtime.fetch("image"))
+    assert_match(/\Asha256:[0-9a-f]{64}\z/, travelwolf_runtime.fetch("application_image_id"))
+
+    mushu_runtime = consumers.dig("mushu", "immediate_platform_rollback", "runtime")
+    assert_match(/@sha256:[0-9a-f]{64}\z/, mushu_runtime.fetch("registry_ref"))
+    assert_nil mushu_runtime.fetch("application_image")
+    assert_equal "not-retained", mushu_runtime.fetch("application_image_provenance")
+  end
+
+  def test_certified_tuple_evidence_is_bound_to_complete_tuple_fingerprints
     promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: ROOT)
-    evidence_paths = {
-      "ajent-rails" => "evidence/2026-07-18-ajent-rails-alpha7-candidate.json",
-      "travelwolf" => "evidence/2026-07-18-travelwolf-alpha7-candidate.json",
-      "mushu" => "evidence/2026-07-18-mushu-alpha7-candidate.json"
-    }
 
-    evidence_paths.each do |consumer, path|
-      evidence = json(path)
-      fingerprints = promoter.fingerprints(
-        consumer: consumer,
-        consumer_commit: evidence.fetch("consumer_commit")
-      )
+    json("manifests/runtime-tuples.json").fetch("consumers").each do |consumer, entry|
+      profile = entry.fetch("profile")
+      %w[current previous].each do |slot|
+        tuple = entry.fetch(slot)
+        fingerprint = promoter.send(:tuple_fingerprint, tuple, consumer: consumer, profile: profile)
+        certification = tuple.fetch("certification")
+        promoter.send(
+          :validate_recorded_certification!,
+          tuple,
+          consumer: consumer,
+          profile: profile,
+          expected_fingerprint: fingerprint,
+          label: "#{consumer} #{slot}"
+        )
 
-      assert_equal consumer, evidence.fetch("consumer")
-      assert_equal fingerprints.fetch("profile"), evidence.fetch("profile")
-      assert_equal fingerprints.fetch("candidate_tuple_sha256"), evidence.fetch("tuple_sha256")
-      assert_equal "pass", evidence.fetch("status")
+        assert_equal "certified", tuple.fetch("status")
+        assert_equal "pass", certification.fetch("status")
+        assert_equal fingerprint, certification.fetch("tuple_sha256")
+        refute_empty certification.fetch("evidence")
+
+        certification.fetch("evidence").each do |reference|
+          assert_equal %w[path sha256], reference.keys.sort
+          path = reference.fetch("path")
+          bytes = File.binread(File.join(ROOT, path))
+          assert_equal "sha256:#{Digest::SHA256.hexdigest(bytes)}", reference.fetch("sha256")
+          evidence = json(path)
+          assert_equal consumer, evidence.fetch("consumer")
+          assert_equal profile, evidence.fetch("profile")
+          assert_equal tuple.fetch("consumer_commit"), evidence.fetch("consumer_commit")
+          assert_equal certification.fetch("certified_at"), evidence.fetch("certified_at")
+          assert_equal fingerprint, evidence.fetch("tuple_sha256")
+          assert_equal "pass", evidence.fetch("status")
+        end
+      end
     end
   end
 

test/runtime_tuple_promoter_test.rb

@@ -10,14 +10,22 @@ class RuntimeTuplePromoterTest < Minitest::Test
   CONSUMER = "example"
   CURRENT_COMMIT = "1" * 40
   CANDIDATE_COMMIT = "2" * 40
+  NEXT_COMMIT = "7" * 40
   RUBY_CURRENT = "3" * 40
   RUBY_CANDIDATE = "4" * 40
+  RUBY_NEXT = "8" * 40
   RAILS_CURRENT = "5" * 40
   RAILS_CANDIDATE = "6" * 40
+  RAILS_NEXT = "9" * 40
+  CURRENT_TREE = "a" * 40
+  CANDIDATE_TREE = "b" * 40
+  NEXT_TREE = "c" * 40
   CURRENT_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'a' * 64}"
   CANDIDATE_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'b' * 64}"
+  NEXT_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'c' * 64}"
   CURRENT_TIME = "2026-07-17T12:00:00Z"
   CANDIDATE_TIME = "2026-07-18T12:00:00Z"
+  NEXT_TIME = "2026-07-19T12:00:00Z"
 
   def setup
     @root = Dir.mktmpdir("opencode-compat-promotion")
@@ -49,10 +57,12 @@ class RuntimeTuplePromoterTest < Minitest::Test
     assert_equal RUBY_CANDIDATE, consumer.dig("current", "opencode_ruby", "git_commit")
     assert_equal "certified", consumer.dig("current", "status")
     assert_equal candidate.fetch("tuple_sha256"), consumer.dig("current", "certification", "tuple_sha256")
+    assert_equal evidence_reference(candidate), consumer.dig("current", "certification", "evidence", 0)
     assert_equal CURRENT_COMMIT, consumer.dig("previous", "consumer_commit")
     assert_equal RUBY_CURRENT, consumer.dig("previous", "opencode_ruby", "git_commit")
     assert_equal "certified", consumer.dig("previous", "status")
     assert_equal previous.fetch("tuple_sha256"), consumer.dig("previous", "certification", "tuple_sha256")
+    assert_equal evidence_reference(previous), consumer.dig("previous", "certification", "evidence", 0)
     assert_equal "certified", promoted.fetch("migration_state")
     assert_equal promoted, JSON.parse(File.read(manifest_path))
   end
@@ -121,6 +131,41 @@ class RuntimeTuplePromoterTest < Minitest::Test
     assert_match(/full 40-character/, error.message)
   end
 
+  def test_rejects_malformed_immutable_tuple_coordinates_but_allows_unknown_build_source
+    mutations = {
+      "consumer tree" => lambda { |candidate| candidate["consumer_tree"] = "abc123" },
+      "build source commit" => lambda { |candidate| candidate.fetch("runtime")["build_source_commit"] = "abc123" },
+      "rollback commit" => lambda do |candidate|
+        candidate["rollback_operability"] = {"immediate_platform_rollback_commit" => "abc123"}
+      end,
+      "artifact digest" => lambda do |candidate|
+        candidate["application_canary"] = {"database_sha256" => "sha256:abc123"}
+      end
+    }
+
+    mutations.each do |label, mutate|
+      manifest = valid_manifest
+      mutate.call(manifest.dig("consumers", CONSUMER, "candidate"))
+      write_manifest(manifest)
+
+      error = assert_raises(OpenCodeCompat::PromotionError, label) do
+        @promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
+      end
+      assert_match(/full 40-character|exact sha256 digest/, error.message, label)
+    end
+
+    manifest = valid_manifest
+    manifest.dig("consumers", CONSUMER, "candidate", "runtime")["build_source_commit"] = nil
+    write_manifest(manifest)
+    assert_match(
+      /\Asha256:[0-9a-f]{64}\z/,
+      @promoter.fingerprints(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT
+      ).fetch("candidate_tuple_sha256")
+    )
+  end
+
   def test_rejects_missing_server_version_or_unknown_profile
     manifest = valid_manifest
     manifest.dig("consumers", CONSUMER, "candidate", "runtime").delete("reported_version")
@@ -175,6 +220,163 @@ class RuntimeTuplePromoterTest < Minitest::Test
     assert_equal before, File.binread(manifest_path)
   end
 
+  def test_explicit_degraded_bootstrap_preserves_failed_emergency_provenance
+    manifest = valid_manifest
+    manifest.dig("consumers", CONSUMER, "current")["status"] = "observed-production-contract-failed"
+    write_manifest(manifest)
+    candidate_fingerprint = @promoter.fingerprints(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT
+    ).fetch("candidate_tuple_sha256")
+    evidence = write_evidence(
+      "bootstrap-candidate.json",
+      commit: CANDIDATE_COMMIT,
+      timestamp: CANDIDATE_TIME,
+      fingerprint: candidate_fingerprint
+    )
+    before = File.binread(manifest_path)
+
+    preview = @promoter.bootstrap_current(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT,
+      certification: certification(CANDIDATE_TIME, evidence),
+      acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT,
+      dry_run: true
+    )
+
+    assert_equal before, File.binread(manifest_path)
+    assert_equal "bootstrap-current-only", preview.fetch("migration_state")
+
+    bootstrapped = @promoter.bootstrap_current(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT,
+      certification: certification(CANDIDATE_TIME, evidence),
+      acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT
+    )
+    consumer = bootstrapped.dig("consumers", CONSUMER)
+
+    assert_equal "certified", consumer.dig("current", "status")
+    assert_equal CANDIDATE_COMMIT, consumer.dig("current", "consumer_commit")
+    assert_nil consumer["candidate"]
+    assert_nil consumer["previous"]
+    assert_equal "observed-production-contract-failed", consumer.dig("emergency_provenance", "status")
+    assert_nil consumer.dig("emergency_provenance", "certification")
+    assert_equal "degraded-no-certified-previous", consumer.dig("rollback_state", "status")
+    assert_equal "bootstrap-current-only", bootstrapped.dig("promotion_readiness", "status")
+    assert_equal bootstrapped, JSON.parse(File.read(manifest_path))
+  end
+
+  def test_bootstrap_then_normal_promotion_retains_the_first_passing_tuple_as_previous
+    manifest = valid_manifest
+    manifest.dig("consumers", CONSUMER, "current")["status"] = "observed-production-contract-failed"
+    write_manifest(manifest)
+    bootstrap_fingerprint = @promoter.fingerprints(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT
+    ).fetch("candidate_tuple_sha256")
+    bootstrap_evidence = write_evidence(
+      "bootstrap-rollback.json",
+      commit: CANDIDATE_COMMIT,
+      timestamp: CANDIDATE_TIME,
+      fingerprint: bootstrap_fingerprint
+    )
+    @promoter.bootstrap_current(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT,
+      certification: certification(CANDIDATE_TIME, bootstrap_evidence),
+      acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT
+    )
+
+    manifest = JSON.parse(File.read(manifest_path))
+    manifest.dig("consumers", CONSUMER)["candidate"] = {
+      "status" => "compatibility-certified",
+      "certified_at" => NEXT_TIME,
+      "consumer_commit" => NEXT_COMMIT,
+      "opencode_ruby" => {"version" => "0.0.1.alpha8", "git_commit" => RUBY_NEXT},
+      "opencode_rails" => {"version" => "0.0.1.alpha8", "git_commit" => RAILS_NEXT},
+      "runtime" => {"image" => NEXT_IMAGE, "reported_version" => "1.19.0"}
+    }
+    write_manifest(manifest)
+    next_fingerprint = @promoter.fingerprints(
+      consumer: CONSUMER,
+      consumer_commit: NEXT_COMMIT
+    ).fetch("candidate_tuple_sha256")
+    next_evidence = write_evidence(
+      "next-current.json",
+      commit: NEXT_COMMIT,
+      timestamp: NEXT_TIME,
+      fingerprint: next_fingerprint
+    )
+
+    promoted = @promoter.promote(
+      consumer: CONSUMER,
+      consumer_commit: NEXT_COMMIT,
+      certification: certification(NEXT_TIME, next_evidence)
+    )
+    consumer = promoted.dig("consumers", CONSUMER)
+
+    assert_equal NEXT_COMMIT, consumer.dig("current", "consumer_commit")
+    assert_equal CANDIDATE_COMMIT, consumer.dig("previous", "consumer_commit")
+    assert_equal "certified", consumer.dig("previous", "status")
+    assert_equal "observed-production-contract-failed", consumer.dig("emergency_provenance", "status")
+    refute consumer.key?("rollback_state")
+    assert_equal "certified", promoted.fetch("migration_state")
+    assert_equal "certified", promoted.dig("promotion_readiness", "status")
+  end
+
+  def test_degraded_bootstrap_requires_exact_acknowledgement
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.bootstrap_current(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: {},
+        acknowledgement: "yes",
+        dry_run: true
+      )
+    end
+
+    assert_match(/explicit acknowledgement/, error.message)
+  end
+
+  def test_degraded_bootstrap_rejects_a_passing_baseline_or_existing_previous_tuple
+    candidate, = write_matching_evidence
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.bootstrap_current(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: certification(CANDIDATE_TIME, candidate),
+        acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT,
+        dry_run: true
+      )
+    end
+    assert_match(/only for a current tuple known to fail/, error.message)
+
+    manifest = valid_manifest
+    manifest.dig("consumers", CONSUMER, "current")["status"] = "observed-production-contract-failed"
+    manifest.dig("consumers", CONSUMER)["previous"] = manifest.dig("consumers", CONSUMER, "current").dup
+    write_manifest(manifest)
+    candidate_fingerprint = @promoter.fingerprints(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT
+    ).fetch("candidate_tuple_sha256")
+    evidence = write_evidence(
+      "bootstrap-existing-previous.json",
+      commit: CANDIDATE_COMMIT,
+      timestamp: CANDIDATE_TIME,
+      fingerprint: candidate_fingerprint
+    )
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.bootstrap_current(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: certification(CANDIDATE_TIME, evidence),
+        acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT,
+        dry_run: true
+      )
+    end
+    assert_match(/cannot replace an existing previous/, error.message)
+  end
+
   def test_rejects_evidence_that_does_not_match_the_complete_tuple
     candidate, previous = write_matching_evidence
     manifest = JSON.parse(File.read(manifest_path))
@@ -196,6 +398,114 @@ class RuntimeTuplePromoterTest < Minitest::Test
     assert_equal before, File.binread(manifest_path)
   end
 
+  def test_hash_binds_evidence_and_accepts_a_structured_reference
+    candidate, previous = write_matching_evidence
+    structured_candidate = evidence_reference(candidate)
+    structured_previous = evidence_reference(previous)
+
+    promoted = @promoter.promote(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT,
+      certification: certification(CANDIDATE_TIME, candidate).merge("evidence" => [structured_candidate]),
+      previous_certification: certification(CURRENT_TIME, previous).merge("evidence" => [structured_previous]),
+      dry_run: true
+    )
+
+    assert_equal structured_candidate, promoted.dig("consumers", CONSUMER, "current", "certification", "evidence", 0)
+
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.promote(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: certification(CANDIDATE_TIME, candidate).merge(
+          "evidence" => [structured_candidate.merge("sha256" => "sha256:#{'0' * 64}")]
+        ),
+        previous_certification: certification(CURRENT_TIME, previous).merge("evidence" => [structured_previous]),
+        dry_run: true
+      )
+    end
+    assert_match(/has sha256=.*expected/, error.message)
+  end
+
+  def test_rejects_evidence_coordinates_that_disagree_with_the_tuple
+    mutations = {
+      "consumer_tree" => lambda { |document| document["consumer_tree"] = "f" * 40 },
+      "opencode_ruby.commit" => lambda do |document|
+        document["clients"] = {
+          "opencode_ruby" => {"version" => "0.0.1.alpha7", "commit" => "f" * 40}
+        }
+      end,
+      "runtime.image" => lambda do |document|
+        document["runtime"] = {
+          "image" => "ghcr.io/anomalyco/opencode@sha256:#{'f' * 64}",
+          "reported_version" => "1.18.3"
+        }
+      end
+    }
+
+    mutations.each do |field, mutate|
+      write_manifest(valid_manifest)
+      candidate, previous = write_matching_evidence
+      path = File.join(@root, candidate.fetch("path"))
+      document = JSON.parse(File.read(path))
+      mutate.call(document)
+      File.write(path, JSON.pretty_generate(document) + "\n")
+
+      error = assert_raises(OpenCodeCompat::PromotionError, field) do
+        @promoter.promote(
+          consumer: CONSUMER,
+          consumer_commit: CANDIDATE_COMMIT,
+          certification: certification(CANDIDATE_TIME, candidate),
+          previous_certification: certification(CURRENT_TIME, previous),
+          dry_run: true
+        )
+      end
+      assert_match(/#{Regexp.escape(field)}/, error.message, field)
+    end
+  end
+
+  def test_recorded_certifications_require_hash_bound_evidence_references
+    candidate, previous = write_matching_evidence
+    promoted = @promoter.promote(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT,
+      certification: certification(CANDIDATE_TIME, candidate),
+      previous_certification: certification(CURRENT_TIME, previous)
+    )
+    consumer = promoted.dig("consumers", CONSUMER)
+    consumer.dig("current", "certification")["evidence"] = [candidate.fetch("path")]
+    consumer["candidate"] = {
+      "status" => "compatibility-certified",
+      "certified_at" => NEXT_TIME,
+      "consumer_commit" => NEXT_COMMIT,
+      "consumer_tree" => NEXT_TREE,
+      "opencode_ruby" => {"version" => "0.0.1.alpha8", "git_commit" => RUBY_NEXT},
+      "opencode_rails" => {"version" => "0.0.1.alpha8", "git_commit" => RAILS_NEXT},
+      "runtime" => {"image" => NEXT_IMAGE, "reported_version" => "1.19.0"}
+    }
+    write_manifest(promoted)
+    fingerprint = @promoter.fingerprints(
+      consumer: CONSUMER,
+      consumer_commit: NEXT_COMMIT
+    ).fetch("candidate_tuple_sha256")
+    next_evidence = write_evidence(
+      "next-after-legacy-reference.json",
+      commit: NEXT_COMMIT,
+      timestamp: NEXT_TIME,
+      fingerprint: fingerprint
+    )
+
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.promote(
+        consumer: CONSUMER,
+        consumer_commit: NEXT_COMMIT,
+        certification: certification(NEXT_TIME, next_evidence),
+        dry_run: true
+      )
+    end
+    assert_match(/hash-bound \{path, sha256\}/, error.message)
+  end
+
   def test_rejects_non_passing_or_implicit_certification_metadata
     candidate, previous = write_matching_evidence
 
@@ -262,6 +572,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
           "current" => {
             "status" => "observed-production",
             "consumer_commit" => CURRENT_COMMIT,
+            "consumer_tree" => CURRENT_TREE,
             "opencode_ruby" => {"version" => "0.0.1.alpha2", "git_commit" => RUBY_CURRENT},
             "opencode_rails" => {"version" => "0.0.1.alpha2", "git_commit" => RAILS_CURRENT},
             "runtime" => {"image" => CURRENT_IMAGE, "reported_version" => "1.16.1"}
@@ -269,6 +580,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
           "candidate" => {
             "status" => "compatibility-certified",
             "certified_at" => "2026-07-18T10:00:00Z",
+            "consumer_tree" => CANDIDATE_TREE,
             "opencode_ruby" => {"version" => "0.0.1.alpha7", "git_commit" => RUBY_CANDIDATE},
             "opencode_rails" => {"version" => "0.0.1.alpha7", "git_commit" => RAILS_CANDIDATE},
             "runtime" => {"image" => CANDIDATE_IMAGE, "reported_version" => "1.18.3"}
@@ -319,6 +631,14 @@ class RuntimeTuplePromoterTest < Minitest::Test
     }
   end
 
+  def evidence_reference(evidence)
+    path = evidence.fetch("path")
+    {
+      "path" => path,
+      "sha256" => "sha256:#{Digest::SHA256.file(File.join(@root, path)).hexdigest}"
+    }
+  end
+
   def manifest_path
     File.join(@root, "manifests", "runtime-tuples.json")
   end