Harden runtime tuple recertification policy

.github/workflows/candidate.yml

@@ -6,205 +6,67 @@ on:
   pull_request:
     branches: [main]
   workflow_dispatch:
-
+    inputs:
-permissions:
+      opencode_ruby_ref:
-  contents: read
+        description: Candidate opencode-ruby ref; blank uses the manifest
+        required: false
+        type: string
 
 jobs:
   repository:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: "3.4"
-      - run: |
+      - run: ruby test/repository_test.rb && ruby test/runtime_tuple_promoter_test.rb && ruby test/exact_live_contract_test.rb
-          ruby test/repository_test.rb
-          ruby test/runtime_tuple_promoter_test.rb
-          ruby test/exact_live_contract_test.rb
-          ruby test/watcher_test.rb
-          ruby test/client_candidate_test.rb
-          ruby test/lockstep_client_contract_test.rb
-          ruby test/matrix_json_test.rb
-          ruby test/image_contract_evidence_test.rb
 
   prepare:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.matrix.outputs.value }}
-      publication_state: ${{ steps.clients.outputs.publication_state }}
+      client_ref: ${{ steps.client.outputs.value }}
-      ruby_provenance_kind: ${{ steps.clients.outputs.ruby_provenance_kind }}
-      ruby_ref: ${{ steps.clients.outputs.ruby_ref }}
-      ruby_version: ${{ steps.clients.outputs.ruby_version }}
-      ruby_tag: ${{ steps.clients.outputs.ruby_tag }}
-      ruby_tag_object: ${{ steps.clients.outputs.ruby_tag_object }}
-      rails_provenance_kind: ${{ steps.clients.outputs.rails_provenance_kind }}
-      rails_ref: ${{ steps.clients.outputs.rails_ref }}
-      rails_version: ${{ steps.clients.outputs.rails_version }}
-      rails_tag: ${{ steps.clients.outputs.rails_tag }}
-      rails_tag_object: ${{ steps.clients.outputs.rails_tag_object }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
-        with:
-          ruby-version: "3.4"
       - id: matrix
         run: echo "value=$(ruby scripts/matrix_json.rb)" >> "$GITHUB_OUTPUT"
-      - id: clients
+      - id: client
-        run: ruby scripts/client_candidate_outputs.rb >> "$GITHUB_OUTPUT"
+        env:
+          INPUT_REF: ${{ inputs.opencode_ruby_ref }}
+        run: |
+          if [ -n "$INPUT_REF" ]; then
+            echo "value=$INPUT_REF" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=$(jq -r .ref manifests/client-candidate.json)" >> "$GITHUB_OUTPUT"
+          fi
 
   fixture-contract:
     needs: prepare
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v4
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v4
         with:
           repository: ajaynomics/opencode-ruby
-          ref: ${{ needs.prepare.outputs.ruby_ref }}
+          ref: ${{ needs.prepare.outputs.client_ref }}
-          path: ruby-client
+          path: client
-      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: "3.4"
-          bundler-cache: ${{ github.server_url == 'https://github.com' }}
+          bundler-cache: true
-          working-directory: ruby-client
+          working-directory: client
-      - name: Install candidate dependencies without the unavailable Gitea cache service
-        if: github.server_url != 'https://github.com'
-        working-directory: ruby-client
-        env:
-          BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-fixture-bundle-config
-          BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-fixture-bundle
-        run: |
-          echo "BUNDLE_APP_CONFIG=$BUNDLE_APP_CONFIG" >> "$GITHUB_ENV"
-          echo "BUNDLE_PATH=$BUNDLE_PATH" >> "$GITHUB_ENV"
-          bundle install --jobs 4 --retry 3
-      - id: client-sha
-        name: Verify immutable Ruby candidate checkout
-        env:
-          EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
-        run: |
-          actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
-          test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
-          echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
       - name: Candidate unit tests
-        working-directory: ruby-client
+        working-directory: client
         run: bundle exec rake test
       - name: Shared fixture contract
-        working-directory: ruby-client
+        working-directory: client
         env:
-          OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
+          OPENCODE_RUBY_PATH: ${{ github.workspace }}/client
-          OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
+          OPENCODE_RUBY_COMMIT: ${{ needs.prepare.outputs.client_ref }}
-          OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/ruby-fixtures.json
+        run: bundle exec ruby ../ruby/opencode_ruby_fixture_contract.rb
-          OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
-          OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
-          OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
-          OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
-          OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          mkdir -p ../.compat-evidence
-          bundle exec ruby ../ruby/opencode_ruby_fixture_contract.rb
-      - name: Upload fixture evidence
-        if: always() && github.server_url == 'https://github.com'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ruby-fixtures-${{ github.run_id }}-${{ github.run_attempt }}
-          path: .compat-evidence/ruby-fixtures.json
-          include-hidden-files: true
-          if-no-files-found: warn
-          retention-days: 30
-      - name: State the Gitea evidence boundary
-        if: always() && github.server_url != 'https://github.com'
-        run: echo "Gitea executed the fixture contract, but this forge has no supported immutable artifact upload; generated JSON is transient and is not review evidence."
-
-  lockstep-client-contract:
-    needs: prepare
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        ruby: ["3.2", "3.3", "3.4", "4.0"]
-    name: lockstep clients Ruby ${{ matrix.ruby }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: ajaynomics/opencode-ruby
-          ref: ${{ needs.prepare.outputs.ruby_ref }}
-          path: ruby-client
-          fetch-depth: 0
-          fetch-tags: true
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: ajaynomics/opencode-rails
-          ref: ${{ needs.prepare.outputs.rails_ref }}
-          path: opencode-rails
-          fetch-depth: 0
-          fetch-tags: true
-      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
-        with:
-          ruby-version: ${{ matrix.ruby }}
-          bundler-cache: ${{ github.server_url == 'https://github.com' }}
-          working-directory: opencode-rails
-      - name: Install candidate dependencies without the unavailable Gitea cache service
-        if: github.server_url != 'https://github.com'
-        working-directory: opencode-rails
-        env:
-          BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-rails-${{ matrix.ruby }}-bundle-config
-          BUNDLE_PATH: ${{ runner.temp }}/opencode-rails-${{ matrix.ruby }}-bundle
-        run: |
-          echo "BUNDLE_APP_CONFIG=$BUNDLE_APP_CONFIG" >> "$GITHUB_ENV"
-          echo "BUNDLE_PATH=$BUNDLE_PATH" >> "$GITHUB_ENV"
-          bundle install --jobs 4 --retry 3
-      - name: Verify immutable candidate checkouts
-        env:
-          EXPECTED_RUBY_SHA: ${{ needs.prepare.outputs.ruby_ref }}
-          EXPECTED_RAILS_SHA: ${{ needs.prepare.outputs.rails_ref }}
-        run: |
-          test "$(git -C ruby-client rev-parse HEAD)" = "$EXPECTED_RUBY_SHA"
-          test "$(git -C opencode-rails rev-parse HEAD)" = "$EXPECTED_RAILS_SHA"
-      - name: Rails candidate unit tests
-        working-directory: opencode-rails
-        run: bundle exec rake test
-      - name: Lockstep client provenance contract
-        working-directory: opencode-rails
-        env:
-          OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
-          OPENCODE_RAILS_PATH: ${{ github.workspace }}/opencode-rails
-          OPENCODE_CLIENT_PUBLICATION_STATE: ${{ needs.prepare.outputs.publication_state }}
-          OPENCODE_RUBY_COMMIT: ${{ needs.prepare.outputs.ruby_ref }}
-          OPENCODE_RUBY_PROVENANCE_KIND: ${{ needs.prepare.outputs.ruby_provenance_kind }}
-          OPENCODE_RUBY_TAG: ${{ needs.prepare.outputs.ruby_tag }}
-          OPENCODE_RUBY_TAG_OBJECT: ${{ needs.prepare.outputs.ruby_tag_object }}
-          OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
-          OPENCODE_RAILS_PROVENANCE_KIND: ${{ needs.prepare.outputs.rails_provenance_kind }}
-          OPENCODE_RAILS_TAG: ${{ needs.prepare.outputs.rails_tag }}
-          OPENCODE_RAILS_TAG_OBJECT: ${{ needs.prepare.outputs.rails_tag_object }}
-          OPENCODE_RUBY_VERSION: ${{ needs.prepare.outputs.ruby_version }}
-          OPENCODE_RAILS_VERSION: ${{ needs.prepare.outputs.rails_version }}
-          OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/lockstep-ruby-${{ matrix.ruby }}.json
-          OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
-          OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
-          OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
-          OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
-          OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          mkdir -p ../.compat-evidence
-          bundle exec ruby ../ruby/lockstep_client_contract.rb
-      - name: Upload lockstep evidence
-        if: always() && github.server_url == 'https://github.com'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: lockstep-ruby-${{ matrix.ruby }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: .compat-evidence/lockstep-ruby-${{ matrix.ruby }}.json
-          include-hidden-files: true
-          if-no-files-found: warn
-          retention-days: 30
-      - name: State the Gitea evidence boundary
-        if: always() && github.server_url != 'https://github.com'
-        run: echo "Gitea executed the lockstep client contract, but this forge has no supported immutable artifact upload; generated JSON is transient and is not review evidence."
 
   exact-image-contract:
-    if: github.server_url == 'https://github.com'
     needs: prepare
     runs-on: ubuntu-latest
     strategy:
@@ -212,109 +74,20 @@ jobs:
       matrix: ${{ fromJSON(needs.prepare.outputs.matrix) }}
     name: image ${{ matrix.id }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v4
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v4
         with:
           repository: ajaynomics/opencode-ruby
-          ref: ${{ needs.prepare.outputs.ruby_ref }}
+          ref: ${{ needs.prepare.outputs.client_ref }}
-          path: ruby-client
+          path: client
-      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: "3.4"
-      - name: Install candidate dependencies outside the checkout
+          bundler-cache: true
-        working-directory: ruby-client
+          working-directory: client
-        env:
-          BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
-          BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
-        run: bundle install --jobs 4 --retry 3
-      - id: client-sha
-        name: Verify immutable Ruby candidate checkout
-        env:
-          EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
-        run: |
-          actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
-          test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
-          echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
       - name: Exercise complete REST and SSE turn
         env:
-          BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile
+          BUNDLE_GEMFILE: ${{ github.workspace }}/client/Gemfile
-          BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
-          BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
           OPENCODE_IMAGE: ${{ matrix.image }}
-          OPENCODE_EXPECTED_VERSION: ${{ matrix.version }}
+          OPENCODE_RUBY_PATH: ${{ github.workspace }}/client
-          OPENCODE_MATRIX_ID: ${{ matrix.id }}
+        run: bundle exec scripts/run_image_contract.sh
-          OPENCODE_REQUIRED_CONSUMER_PROFILES: ${{ toJSON(matrix.required_consumer_profiles) }}
-          OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
-          OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
-          OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
-          OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/${{ matrix.id }}.json
-          OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
-          OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
-          OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
-          OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
-          OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          mkdir -p .compat-evidence
-          bundle exec scripts/run_image_contract.sh
-      - name: Upload exact-image evidence
-        if: always() && github.server_url == 'https://github.com'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: image-${{ matrix.id }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: .compat-evidence/${{ matrix.id }}.json
-          include-hidden-files: true
-          if-no-files-found: warn
-          retention-days: 30
-
-  exact-image-contract-gitea:
-    if: github.server_url != 'https://github.com'
-    needs: prepare
-    runs-on: ubuntu-latest
-    name: Gitea full exact image matrix
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: ajaynomics/opencode-ruby
-          ref: ${{ needs.prepare.outputs.ruby_ref }}
-          path: ruby-client
-      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
-        with:
-          ruby-version: "3.4"
-      - name: Install candidate dependencies outside the checkout
-        working-directory: ruby-client
-        env:
-          BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
-          BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
-        run: |
-          echo "BUNDLE_APP_CONFIG=$BUNDLE_APP_CONFIG" >> "$GITHUB_ENV"
-          echo "BUNDLE_PATH=$BUNDLE_PATH" >> "$GITHUB_ENV"
-          bundle install --jobs 4 --retry 3
-      - id: client-sha
-        name: Verify immutable Ruby candidate checkout
-        env:
-          EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
-        run: |
-          actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
-          test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
-          echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
-      - name: Resolve the private Docker host transport
-        run: |
-          probe_host="$(ruby scripts/private_default_gateway.rb)"
-          echo "OPENCODE_PROBE_HOST=$probe_host" >> "$GITHUB_ENV"
-      - name: Exercise the complete manifest matrix without artifact claims
-        env:
-          BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile
-          OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
-          OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
-          OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
-          OPENCODE_COMPAT_EVIDENCE_DIR: ${{ github.workspace }}/.compat-evidence
-          OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
-          OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
-          OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
-          OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
-          OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: scripts/run_image_matrix_contract.sh
-      - name: State the Gitea evidence boundary
-        if: always()
-        run: echo "Gitea's exact-image path uploads nothing; generated JSON is transient and is not review evidence. This job passes only after every manifest image passes."

.github/workflows/watch-upstream.yml

@@ -17,7 +17,7 @@ jobs:
   open-compatibility-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Resolve latest release
@@ -27,153 +27,55 @@ jobs:
         run: |
           release="$(gh api repos/anomalyco/opencode/releases/latest)"
           tag="$(jq -r .tag_name <<<"$release")"
-          digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${tag#v}" --format '{{json .Manifest}}' | jq -r .digest)"
-          image="ghcr.io/anomalyco/opencode@$digest"
-          published_at="$(jq -r .published_at <<<"$release")"
-          release_url="$(jq -r .html_url <<<"$release")"
           current="$(jq -r .release_tag manifests/upstream.json)"
-          current_image="$(jq -r .image manifests/upstream.json)"
-          current_image_count="$(
-            jq \
-              --arg image "$image" \
-              '[.public_ci[]? | select(.image == $image)] | length' \
-              manifests/image-matrix.json
-          )"
-          ruby scripts/upstream_branch_name.rb "$tag" "$digest" >/dev/null
-          ruby -rtime -e 'Time.iso8601(ARGV.fetch(0))' "$published_at"
-          test "$release_url" = "https://github.com/anomalyco/opencode/releases/tag/$tag"
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+          echo "published_at=$(jq -r .published_at <<<"$release")" >> "$GITHUB_OUTPUT"
-          echo "published_at=$published_at" >> "$GITHUB_OUTPUT"
+          echo "release_url=$(jq -r .html_url <<<"$release")" >> "$GITHUB_OUTPUT"
-          echo "release_url=$release_url" >> "$GITHUB_OUTPUT"
+          if [ "$tag" = "$current" ]; then
-          if [ "$tag" = "$current" ] && [ "$image" != "$current_image" ]; then
-            echo "same_tag_digest_changed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "same_tag_digest_changed=false" >> "$GITHUB_OUTPUT"
-          fi
-          if [ "$tag" = "$current" ] && [ "$image" = "$current_image" ] && [ "$current_image_count" -eq 1 ]; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
-      - name: Resolve collision-safe compatibility branch
+      - name: Stop when a PR already exists
         if: steps.release.outputs.changed == 'true'
-        id: branch
+        id: existing
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ steps.release.outputs.tag }}
-          DIGEST: ${{ steps.release.outputs.digest }}
         run: |
-          base_branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST")"
+          branch="compat/upstream-${TAG#v}"
-          expected_image="ghcr.io/anomalyco/opencode@$DIGEST"
+          count="$(gh pr list --state open --head "$branch" --json number --jq length)"
-          open_branch=""
-          open_prs="$(
-            gh pr list --state open --base main --limit 1000 \
-              --json baseRefName,headRefName,headRefOid,headRepository,headRepositoryOwner,isCrossRepository
-          )"
-          while IFS=$'\t' read -r candidate_branch head_oid; do
-            [ -n "$candidate_branch" ] || continue
-            if ! candidate_upstream="$(
-              gh api \
-                -H "Accept: application/vnd.github.raw+json" \
-                "repos/$GITHUB_REPOSITORY/contents/manifests/upstream.json?ref=$head_oid" 2>/dev/null
-            )"; then
-              continue
-            fi
-            if ! candidate_matrix="$(
-              gh api \
-                -H "Accept: application/vnd.github.raw+json" \
-                "repos/$GITHUB_REPOSITORY/contents/manifests/image-matrix.json?ref=$head_oid" 2>/dev/null
-            )"; then
-              continue
-            fi
-            if jq -e \
-                --arg tag "$TAG" \
-                --arg image "$expected_image" \
-                '.release_tag == $tag and .image == $image' \
-                >/dev/null <<<"$candidate_upstream" &&
-              jq -e \
-                --arg image "$expected_image" \
-                '([.public_ci[]? | select(.image == $image)] | length) == 1' \
-                >/dev/null <<<"$candidate_matrix"; then
-              open_branch="$candidate_branch"
-              break
-            fi
-          done < <(
-            jq -r \
-              --arg base "$base_branch" \
-              --arg owner "${GITHUB_REPOSITORY%%/*}" \
-              --arg repository "${GITHUB_REPOSITORY#*/}" \
-              '.[] | select(
-                .baseRefName == "main" and
-                .isCrossRepository == false and
-                .headRepositoryOwner.login == $owner and
-                .headRepository.name == $repository and
-                (.headRefName == $base or (.headRefName | startswith($base + "-r")))
-              ) | [.headRefName, .headRefOid] | @tsv' \
-              <<<"$open_prs"
-          )
-          if [ -n "$open_branch" ]; then
-            echo "branch=$open_branch" >> "$GITHUB_OUTPUT"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          branch="$base_branch"
-          existing_count="$(
-            gh pr list --state all --base main --head "$base_branch" --limit 1000 \
-              --json baseRefName,headRepository,headRepositoryOwner,isCrossRepository |
-              jq \
-                --arg owner "${GITHUB_REPOSITORY%%/*}" \
-                --arg repository "${GITHUB_REPOSITORY#*/}" \
-                '[.[] | select(
-                  .baseRefName == "main" and
-                  .isCrossRepository == false and
-                  .headRepositoryOwner.login == $owner and
-                  .headRepository.name == $repository
-                )] | length'
-          )"
-          if [ "$existing_count" -gt 0 ] || git ls-remote --exit-code --heads origin "$base_branch" >/dev/null 2>&1; then
-            branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST" "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}")"
-          fi
           echo "branch=$branch" >> "$GITHUB_OUTPUT"
-          echo "skip=false" >> "$GITHUB_OUTPUT"
+          if [ "$count" -gt 0 ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Resolve immutable image and update manifests
-        if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
+        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
         env:
           TAG: ${{ steps.release.outputs.tag }}
           PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
           RELEASE_URL: ${{ steps.release.outputs.release_url }}
-          DIGEST: ${{ steps.release.outputs.digest }}
         run: |
-          ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$DIGEST"
+          digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${TAG#v}" --format '{{json .Manifest}}' | jq -r .digest)"
+          ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$digest"
           ruby test/repository_test.rb
-          ruby test/watcher_test.rb
       - name: Open compatibility PR
-        if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
+        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ steps.release.outputs.tag }}
-          DIGEST: ${{ steps.release.outputs.digest }}
+          BRANCH: ${{ steps.existing.outputs.branch }}
-          BRANCH: ${{ steps.branch.outputs.branch }}
-          SAME_TAG_DIGEST_CHANGED: ${{ steps.release.outputs.same_tag_digest_changed }}
         run: |
           git config user.name "opencode-compat-bot"
           git config user.email "opencode-compat-bot@users.noreply.github.com"
-          short_digest="${DIGEST#sha256:}"
-          short_digest="${short_digest:0:12}"
           git switch -c "$BRANCH"
           git add manifests/image-matrix.json manifests/upstream.json
-          git commit -m "Test OpenCode ${TAG} compatibility (${short_digest})"
+          git commit -m "Test OpenCode ${TAG} compatibility"
           git push --set-upstream origin "$BRANCH"
-          title="Test OpenCode ${TAG} compatibility (${short_digest})"
-          notice="Upstream watcher resolved ${TAG} to immutable OCI digest ${DIGEST}."
-          if [ "$SAME_TAG_DIGEST_CHANGED" = "true" ]; then
-            title="Review changed OCI digest for existing OpenCode ${TAG} (${short_digest})"
-            notice="Security-sensitive change: existing release ${TAG} now resolves to a different OCI digest, ${DIGEST}."
-          fi
           gh pr create \
             --base main \
             --head "$BRANCH" \
-            --title "$title" \
+            --title "Test OpenCode ${TAG} compatibility" \
-            --body "${notice} The watcher added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."
+            --body "Upstream watcher detected ${TAG}, resolved its immutable OCI digest, and added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."

README.md

@@ -8,25 +8,37 @@ prompts, credentials, sessions, or user data belong here.
 
 ## Policy
 
-- An unpublished gem build is a candidate until the fixture suite and every
+- A gem release is a candidate until the fixture suite and every required image
-  required image profile pass. It is identified only by an exact commit.
+  profile pass.
-- `opencode-ruby` and `opencode-rails` are one candidate release train. The
-  manifest records both exact commits, and CI rejects a Rails candidate whose
-  exact runtime dependency resolves to a different Ruby version or commit.
-- Once a train is published, commit-only provenance is no longer accepted. The
-  manifest and lockstep contract require each annotated tag object, local tag
-  ref, and peeled commit to bind to the tested checkout.
 - Image references are immutable OCI index digests. A tag may be recorded as
   human-readable provenance, but it is never an execution coordinate.
 - Custom consumer images are certified with an isolated canary on the host that
   can pull them. Public CI certifies their upstream base plus the same profile.
 - Promotion is explicit. CI may certify a tuple and the watcher may open a PR;
   neither workflow deploys or changes a consumer.
-- Each consumer retains both `current` and `previous` certified tuples so a
+- A passing pull-request head is candidate evidence only. Promotion and
-  rollback restores the gem and server together.
+  deployed certification use the actual main/merge commit, or an explicit
+  equal-tree attestation paired with a passing post-merge canary.
+- Git-sourced gems use the full peeled commit as the Bundler `ref` and lockfile
+  revision. A consumer test must also prove the running process loaded that
+  exact `Bundler::Source::Git`; a release tag or lockfile alone is provenance,
+  not loaded-source proof.
+- Ajent records AIGL, Blackline, and Raven selections together. Every selected
+  product needs a content digest or local image ID before promotion; a full
+  commit tag selects a candidate build but does not prove its content.
+- In steady state, each consumer retains both `current` and `previous`
+  certified tuples so a rollback restores the gem and server together. The
+  explicitly labeled bootstrap state is the temporary degraded exception.
 - A failing bootstrap baseline is never relabeled as a certified `previous`
-  tuple. Promotion stays blocked until a distinct rollback consumer commit is
+  tuple. After a real main/deploy canary, an explicitly acknowledged degraded
-  pinned to a passing client/runtime tuple and canaried.
+  bootstrap may certify only `current`; it leaves `previous` null and keeps the
+  failed baseline as emergency provenance. The next meaningful passing release
+  becomes the first genuine certified rollback tuple.
+
+The runtime ledger is schema version 2; its machine-readable shape lives at
+[`schemas/runtime-tuples.schema.json`](schemas/runtime-tuples.schema.json).
+The current candidates remain deliberately unpromotable PR-head records, and
+all `previous` slots remain `null` because no passing rollback tuple exists.
 
 ## What is covered
 
@@ -52,26 +64,11 @@ Prerequisites are Ruby 3.2+, Python 3, `jq`, and Docker.
 ruby test/repository_test.rb
 ruby test/runtime_tuple_promoter_test.rb
 ruby test/exact_live_contract_test.rb
-ruby test/watcher_test.rb
+OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-78b6f9c9e9c7d58b699af1c3c17764acd33de798 \
-ruby test/client_candidate_test.rb
-OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-9277646a4bb2cf25a8384ffc140b154f49ea5766 \
   ruby ruby/opencode_ruby_fixture_contract.rb
-BUNDLE_GEMFILE=/path/to/opencode-rails/Gemfile \
+OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-78b6f9c9e9c7d58b699af1c3c17764acd33de798 \
-OPENCODE_RUBY_PATH=/path/to/opencode-ruby \
-OPENCODE_RAILS_PATH=/path/to/opencode-rails \
-OPENCODE_CLIENT_PUBLICATION_STATE=unpublished \
-OPENCODE_RUBY_COMMIT=9277646a4bb2cf25a8384ffc140b154f49ea5766 \
-OPENCODE_RUBY_PROVENANCE_KIND=commit \
-OPENCODE_RAILS_COMMIT=a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f \
-OPENCODE_RAILS_PROVENANCE_KIND=commit \
-OPENCODE_RUBY_VERSION=0.0.1.alpha8 \
-OPENCODE_RAILS_VERSION=0.0.1.alpha8 \
-  bundle exec ruby ruby/lockstep_client_contract.rb
-BUNDLE_GEMFILE=/path/to/opencode-ruby-at-9277646a4bb2cf25a8384ffc140b154f49ea5766/Gemfile \
-OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-9277646a4bb2cf25a8384ffc140b154f49ea5766 \
-OPENCODE_RUBY_COMMIT=9277646a4bb2cf25a8384ffc140b154f49ea5766 \
 OPENCODE_IMAGE='ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a' \
-  bundle exec scripts/run_image_contract.sh
+  scripts/run_image_contract.sh
 ```
 
 The live contract starts a deterministic local OpenAI-compatible model stub and
@@ -79,47 +76,15 @@ an isolated OpenCode container. It creates a session, subscribes, submits an
 async prompt, observes terminal SSE, fetches the authoritative exchange, and
 deletes the session. Passing requires the authoritative final text to equal the
 expected text byte-for-byte and the deterministic model stub to observe exactly
-one request and exactly one authoritative assistant message. It never calls an
+one request. It never calls an external model provider.
-external model provider.
-
-On GitHub, candidate CI uploads machine-readable fixture, lockstep-client, and
-exact-image evidence for 30 days. These artifacts are review inputs, not
-certification by themselves. Gitea runs the same repository, fixture, and
-lockstep contracts and executes every exact-image manifest entry sequentially,
-because its runner cannot expand a matrix from a dependency job's JSON output.
-The installed Gitea artifact service does not support the pinned GitHub upload
-action, so Gitea deliberately uploads nothing: its generated JSON is transient
-and must not be described as review evidence. A person must review a passing
-GitHub artifact and commit the durable certification document under `evidence/`;
-no workflow commits or promotes its own result.
-
-`manifests/image-matrix.json` binds the active pending matrix to both candidate
-commits. Its `previous_certification` entries preserve the last alpha7 result;
-they do not certify alpha8. Ajent and Mushu custom-image rows remain pending
-until their host canaries run against this exact pair.
-
-The checked-in alpha8 local exact-image result is explicitly marked
-`not-certified` and `shared-client-contract-only`. It proves the Ruby/SSE probe
-on the recorded image IDs but does not claim Rails, plugin, application, or
-deployment canary coverage; exact-head CI still supplies reviewable workflow
-provenance.
 
 ## Adding an upstream release
 
-The scheduled watcher compares both the latest upstream GitHub release tag and
+The scheduled watcher compares the latest upstream GitHub release with the
-its resolved OCI digest with the manifest. A new release or a changed digest
+manifest. When a new release appears, it resolves the tag to an OCI digest and
-behind an existing tag gets a digest-specific branch and compatibility PR. The
+opens a compatibility PR. The PR adds a pending image-matrix entry, which runs
-PR adds a pending image-matrix entry, which runs the candidate suite after the
+the candidate suite. A person still decides whether to promote it and update
-normal GitHub workflow approval boundary. A person still decides whether to
+consumers.
-promote it and update consumers. The watcher never merges, dispatches consumer
-workflows, deploys, or force-pushes.
-
-`public_ci` is the active compatibility set, not an append-only release log.
-Keep images still referenced by a consumer's current, candidate, or previous
-runtime tuple plus the newest pending upstream candidate. When a watcher PR
-supersedes an unreferenced pending target, remove that older row during review;
-durable certification documents and Git history are the archive. This keeps a
-fast-moving upstream from making every future run retest every old release.
 
 See [docs/certification.md](docs/certification.md) for promotion, canary, and
 rollback evidence requirements.

docs/certification.md

@@ -6,44 +6,41 @@ A candidate tuple is the complete set of client version or commit, Rails gem
 version or commit where applicable, exact OpenCode image, profile, and consumer
 commit. Changing any member invalidates the certification.
 
+There are two distinct scopes:
+
+- `pre-merge-pr-head-candidate-only` proves that one reviewed PR head is
+  compatible. It is never a deployment or promotion authorization.
+- `promotion-deployed` is recorded only after a passing post-merge canary and
+  the consumer coordinate is the actual main/merge commit. If policy
+  deliberately retains the PR-head commit, the evidence must additionally
+  record both Git trees as identical and name the actual main/merge commit.
+  Comparing diffs is not an identical-tree attestation.
+
 The gate requires:
 
 1. repository validation and the shared fixture corpus;
-2. exact `opencode-ruby` and `opencode-rails` candidate checkouts, all Rails
+2. the public exact-image matrix against the deterministic model stub;
-   candidate tests on Ruby 3.2 through 4.0, an exact Rails-to-Ruby runtime
+3. an isolated custom-image canary for Ajent Rails and Mushu;
-   dependency, and loaded Bundler provenance for the Ruby commit;
+4. the consumer's own focused and full required tests in its devcontainer;
-3. the public exact-image matrix against the deterministic model stub;
+5. a user-visible canary turn for stream consumers;
-4. an isolated custom-image canary for Ajent Rails and Mushu;
+6. captured evidence including image ID/digest, server version, source commit,
-5. the consumer's own focused and full required tests in its devcontainer;
-6. a user-visible canary turn for stream consumers;
-7. captured evidence including image ID/digest, server version, source commit,
    gem commits, timestamps, and probe outcome.
 
+For a Git-sourced gem, “gem commit” means the peeled 40-character commit in
+both the Gemfile `ref` and lockfile `revision`, plus runtime loaded-source proof:
+the loaded version, `Bundler::Source::Git`, observed revision (and observed ref
+when the consumer test exposes it), and the consumer test that made those
+assertions. Annotated tag objects remain useful release provenance, but they
+are not an execution coordinate.
+
+Ajent's runtime is a three-product selection. The ledger records AIGL,
+Blackline, and Raven under one source commit. Candidate evidence may say that a
+product artifact has not been built; promotion may not. At promotion time the
+set of content-addressed product artifacts must exactly equal the selected
+product set.
+
 Health-only probes do not certify a tuple.
 
-### Client source provenance
-
-Before publication, `manifests/client-candidate.json` must use
-`publication_state: unpublished` and `kind: commit` for both clients. Each
-provenance commit must equal its full 40-character checkout ref, and the Rails
-Gemfile/runtime dependency must resolve the same exact Ruby commit and version.
-Commit-only evidence is candidate evidence; it is not proof of a gem release.
-The lockstep checkout fetches tags and fails unpublished mode if the matching
-`vVERSION` tag appears, forcing the manifest through the published gate.
-
-After publication, change the state to `published` and replace both commit
-provenance objects with `kind: annotated-tag`, the exact tag, annotated tag
-object ID, and peeled commit. The repository validator rejects a published
-commit-only candidate. The lockstep job additionally verifies that each local
-tag ref resolves to the declared annotated tag object and that both the object
-and ref peel to the tested checkout. This transition is a reviewed manifest
-change; CI does not create or publish tags.
-
-The image matrix's active candidate coordinates must equal the client manifest.
-Changing either commit resets the active matrix to `pending`. A
-`previous_certification` preserves historical evidence but does not certify the
-new candidate.
-
 The shared live probe is intentionally strict: `full_text` must equal the
 expected text byte-for-byte and the deterministic model must receive exactly
 one request. A response that merely contains the expected text, including a
@@ -52,9 +49,18 @@ duplicated `compat-ok\n\ncompat-ok`, fails.
 ## Promotion
 
 Promotion is a reviewed manifest change that moves the old `current` tuple to
-`previous` and the passing candidate to `current`. The consumer change is then
+`previous` and the passing candidate to `current`. The consumer change must
-merged and deployed separately. Workflows in this repository have no deploy
+already have a main/merge identity (or the equal-tree exception below) before
-credentials or deploy steps.
+that manifest change. Production rollout remains a separate consumer-owned
+operation; workflows in this repository have no deploy credentials or deploy
+steps.
+
+Before invoking the promoter, replace PR-head-only metadata with either the
+actual main/merge consumer ref and `main-commit` promotion provenance, or an
+explicit identical-tree attestation containing the main commit/tree. Both
+forms require a post-merge canary evidence path. Set `promotion_eligible` only
+after that evidence exists. The promoter rejects the current PR-head candidates
+even when their compatibility probes pass.
 
 Use the repository promotion command; do not hand-edit the three tuple slots.
 It binds evidence to a canonical SHA-256 of the complete tuple, requires full
@@ -115,27 +121,13 @@ being able to observe the underlying model request. Record that distinction
 explicitly; do not infer a model request count from an application prompt
 count. The exact-image shared contract supplies the model-request proof.
 
-Likewise, the public image job executes `ruby-rest-sse`; it does not silently
+Likewise, the public image job executes only `ruby-rest-sse`; it does not
-certify Rails persistence, plugin hooks, voice streaming, strict route gates,
+silently certify Rails persistence, plugin hooks, voice streaming, strict route
-or provider hooks. Those appear as `required_consumer_profiles` in the image
+gates, or provider hooks. Every other profile is labeled
-matrix and need their own consumer evidence before a full tuple can pass.
+`executable-consumer-attestation` with `shared_ruby_probe_sufficient: false`.
-
+Those profiles appear as `required_consumer_profiles` in the image matrix and
-The companion lockstep job proves that the exact Rails candidate loads and
+need executable evidence from their owning consumer before a full tuple can
-tests against the exact Ruby candidate on every supported Ruby version. That
+pass. A prose review or a successful shared Ruby probe is not that evidence.
-still does not certify a consumer's ActiveRecord schema, persistence callbacks,
-container adapter, or application canary; those remain consumer-owned profile
-evidence.
-
-GitHub CI writes canonical JSON artifacts for the shared fixture, lockstep
-client, and each exact-image target. Artifact retention is 30 days and supplies
-reviewable workflow provenance; it is not the long-term ledger. Gitea executes
-the same contracts, with its exact-image targets run sequentially from the full
-generated manifest, but its installed artifact service cannot accept the
-reviewed GitHub upload action. Gitea therefore keeps generated JSON transient
-and makes no artifact-evidence claim. After reviewing a GitHub artifact, copy
-the relevant facts into a repository evidence document bound to the complete
-tuple fingerprint. Automated workflows never update certified evidence or
-promote a tuple.
 
 The command clears `candidate` after promotion. It sets the repository-wide
 `migration_state` to `certified` only after every consumer has certified
@@ -148,21 +140,39 @@ coordinates for emergency recovery but mark it failed. Do not create passing
 evidence for it and do not promote it into `previous`. The promoter rejects
 known-failed baselines even if a document claims `pass`.
 
-The safe bootstrap is two-stage: certify and roll out the new candidate, then
+Do not manufacture a no-op second commit merely to fill `previous`. Once the
-create and canary a distinct consumer rollback commit that preserves the same
+candidate has been merged, deployed, and canaried under promotion-grade
-known-good client and exact runtime. Only after both immutable consumer commits
+provenance, a reviewer may use `bootstrap-current` with this exact
-have real passing evidence can the manifest honestly contain certified
+acknowledgement:
-`current` and `previous` tuples. Until then, `promotion_readiness` remains
-blocked and the candidate PR must not be treated as a deploy authorization.
 
-The schema-v1 promotion command deliberately cannot perform the first degraded
+```text
-bootstrap transition when `current` is a known-failing baseline. Do not bypass
+accept-degraded-rollback-with-failed-emergency-provenance
-that guard by hand-editing the manifest or relabeling alpha2 evidence. A
+```
-separate reviewed state-machine change must first add an explicit
+
-`bootstrap-current-only` state that preserves the failed baseline as
+That operation certifies only `current`, moves the failed baseline to
-uncertified emergency provenance and leaves `previous` null. Itemized rollback
+`emergency_provenance` without relabeling it, leaves `previous` null, and sets
-certification is complete only after a later, materially distinct passing tuple
+`migration_state` to `bootstrap-current-only`. This is an intentionally
-can move the first certified current into `previous`.
+degraded rollback state, not full certification. The next meaningful passing
+release uses normal promotion; the already-certified current tuple then becomes
+the first honest certified `previous` tuple.
+
+Until main/deploy evidence exists, `promotion_readiness` remains blocked and a
+candidate PR must not be treated as deploy authorization.
+
+After reviewing the degraded rollback consequence, preview the explicit
+bootstrap before writing it:
+
+```sh
+ruby scripts/promote_runtime_tuple.rb bootstrap-current \
+  --consumer travelwolf \
+  --consumer-commit FULL_MAIN_OR_ATTESTED_PR_COMMIT \
+  --status pass \
+  --certified-at 2026-07-18T12:00:00Z \
+  --evidence evidence/travelwolf-post-merge.json \
+  --acknowledge-degraded-rollback \
+    accept-degraded-rollback-with-failed-emergency-provenance \
+  --dry-run
+```
 
 ## Rollback
 
@@ -177,17 +187,11 @@ the source commit used to build it. A source tag alone is insufficient.
 Run the shared live contract on a host that can pull the exact image:
 
 ```sh
-BUNDLE_GEMFILE=/path/to/opencode-ruby/Gemfile \
 OPENCODE_RUBY_PATH=/path/to/opencode-ruby \
-OPENCODE_RUBY_COMMIT=FULL_40_HEX_COMMIT \
 OPENCODE_IMAGE='registry.example/image@sha256:...' \
-bundle exec scripts/run_image_contract.sh
+scripts/run_image_contract.sh
 ```
 
-The Ruby checkout must be clean and its `HEAD` must equal
-`OPENCODE_RUBY_COMMIT`. Install Bundler dependencies outside that checkout when
-the normal cache path would create untracked files.
-
 If an older private registry cannot expose an OCI repository digest, set
 `ALLOW_EXACT_IMAGE_ID=1` and pass the locally present `sha256:...` image ID.
 Record the registry tag, image ID, source commit, and reason a repository

evidence/2026-07-18-ajent-rails-alpha7-candidate.json

@@ -2,15 +2,87 @@
   "schema_version": 1,
   "consumer": "ajent-rails",
   "profile": "rails-persisted-turn",
-  "consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
+  "consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+  "consumer_tree": "9e93834ad16b60fa5edfe1cb3baaba193402be74",
+  "consumer_ref_kind": "pull-request-head",
+  "review_url": "https://gitea.ajay.to/ajaynomics/ajent-rails/pulls/946",
+  "certification_scope": "pre-merge-pr-head-candidate-only",
+  "promotion_eligible": false,
   "status": "pass",
-  "certified_at": "2026-07-18T22:03:14Z",
+  "certified_at": "2026-07-18T23:28:16.435369Z",
-  "tuple_sha256": "sha256:2fc1026cf247b5ad5677bfa4673c1073f7c2478769dca0cc8443a0924cebfca3",
+  "tuple_sha256": "sha256:e7026c294d0b2981f6ec785a45afb69969f4dc2b4d0ed6533f9bda5153304663",
   "shared_evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
-  "canary": {
+  "loaded_sources": {
-    "checked_at": "2026-07-18T21:58:00Z",
+    "opencode-ruby": {
-    "docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
+      "version": "0.0.1.alpha7",
+      "requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+      "locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+      "observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798"
+    },
+    "opencode-rails": {
+      "version": "0.0.1.alpha7",
+      "requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+      "locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+      "observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb"
+    },
+    "source_class": "Bundler::Source::Git",
+    "proof_test": "test/lib/opencode/runtime_image_provenance_test.rb",
+    "status": "pass"
+  },
+  "deterministic_contract": {
+    "checked_at": "2026-07-18T23:16:13Z",
+    "docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
+    "expected_text": "compat-ok",
+    "full_text": "compat-ok",
+    "authoritative_assistant_count": 1,
+    "model_request_count": 1,
+    "status": "pass"
+  },
+  "application_canary": {
+    "checked_at": "2026-07-18T23:28:16.435369Z",
+    "docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
     "persisted_final_text": "compat-ok",
-    "model_request_count": 1
+    "authoritative_final_text": "compat-ok",
+    "authoritative_assistant_count": 1,
+    "model_request_count": 1,
+    "cleanup_status": "pass",
+    "status": "pass"
+  },
+  "consumer_verification": {
+    "tests": {
+      "runs": 4077,
+      "assertions": 14495,
+      "failures": 0,
+      "errors": 0,
+      "existing_skips": 4
+    },
+    "rubocop": {
+      "files": 1365,
+      "offenses": 0
+    },
+    "gitea_actions": {
+      "run_id": 2545,
+      "status": "success",
+      "commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2"
+    },
+    "remotes_exact": [
+      "origin",
+      "github",
+      "backup"
+    ]
+  },
+  "product_artifact_coverage": {
+    "selected_products": [
+      "aigl",
+      "blackline",
+      "raven"
+    ],
+    "content_addressed_artifacts": [
+      "blackline"
+    ],
+    "missing_before_promotion": [
+      "aigl",
+      "raven"
+    ]
   }
 }

evidence/2026-07-18-mushu-alpha7-candidate.json

@@ -2,16 +2,88 @@
   "schema_version": 1,
   "consumer": "mushu",
   "profile": "ruby-rest-sse",
-  "consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
+  "consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
+  "consumer_tree": "762eb8dcc7042a52cd240ca69acdb9cb45150a84",
+  "consumer_ref_kind": "pull-request-head",
+  "review_url": "https://gitea.ajay.to/ajaynomics/mushu/pulls/1",
+  "certification_scope": "pre-merge-pr-head-candidate-only",
+  "promotion_eligible": false,
   "status": "pass",
-  "certified_at": "2026-07-18T22:03:14Z",
+  "certified_at": "2026-07-18T23:26:06.865190Z",
-  "tuple_sha256": "sha256:6171647c7db6d88d52882695c6106a4391e87d0bb1f9e0c48151b2bc1e95b318",
+  "tuple_sha256": "sha256:648d53b1d800c065e8ecdb95974049ee179617569170cfc169c31c3bfc1e8865",
   "shared_evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
-  "canary": {
+  "loaded_source": {
-    "run_id": "mushu-alpha7-20260718T215300Z-f26d958",
+    "gem": "opencode-ruby",
-    "checked_at": "2026-07-18T21:53:00Z",
+    "version": "0.0.1.alpha7",
-    "docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
+    "source_class": "Bundler::Source::Git",
-    "persisted_final_text": "compat-ok",
+    "requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-    "model_request_count": 1
+    "locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+    "observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+    "observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+    "loaded_file_within_spec": true,
+    "proof_test": "test/services/mushu/runtime/opencode_dependency_provenance_test.rb",
+    "status": "pass"
+  },
+  "deterministic_contract": {
+    "checked_at": "2026-07-18T23:23:41Z",
+    "image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
+    "expected_text": "compat-ok",
+    "full_text": "compat-ok",
+    "authoritative_assistant_count": 1,
+    "model_request_count": 1,
+    "status": "pass"
+  },
+  "application_canary": {
+    "checked_at": "2026-07-18T23:26:06.865190Z",
+    "response_text": "compat-ok",
+    "authoritative_final_text": "compat-ok",
+    "message_roles": [
+      "user",
+      "assistant"
+    ],
+    "authoritative_assistant_count": 1,
+    "provider_request_count": 1,
+    "mapping_and_last_turn_persisted": true,
+    "active_claim_cleared": true,
+    "opencode_session_deleted": true,
+    "synthetic_database_rows_after_cleanup": 0,
+    "status": "pass"
+  },
+  "consumer_verification": {
+    "focused_tests": {
+      "runs": 126,
+      "assertions": 1413,
+      "failures": 0,
+      "errors": 0
+    },
+    "full_tests": {
+      "runs": 632,
+      "assertions": 9013,
+      "failures": 0,
+      "errors": 0
+    },
+    "rubocop": {
+      "files": 216,
+      "offenses": 0
+    },
+    "gitea_actions": {
+      "run_id": 2544,
+      "url": "https://gitea.ajay.to/ajaynomics/mushu/actions/runs/2544",
+      "overall_status": "failure",
+      "commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
+      "classification": "inherited-unrelated-baseline-failures",
+      "jobs": {
+        "lint": "success",
+        "scan_js": "success",
+        "scan_ruby": "inherited-vendor-bundle-source-scan-failure",
+        "test": "inherited-evidence-report-single-failure",
+        "system-test": "inherited-missing-test-system-directory"
+      },
+      "baseline_run_id": 2508
+    },
+    "remotes_exact": [
+      "origin",
+      "backup"
+    ]
   }
 }

evidence/2026-07-18-opencode-ruby-alpha2-regression.json

@@ -36,7 +36,9 @@
     },
     {
       "target": "ajent-production-artifact",
-      "docker_image_id": "sha256:6fb2b3bf8e4cdf48e16bf6c3475e953df2f8304e77f5efe816ceb46f905eead8",
+      "consumer_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
+      "product": "blackline",
+      "docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60",
       "server_version": "1.18.3",
       "status": "fail"
     },
@@ -47,5 +49,38 @@
       "status": "fail"
     }
   ],
-  "promotion_effect": "The observed alpha2 consumer baselines are not eligible for certified previous tuples. A distinct, tested rollback consumer commit pinned to alpha7 is required before the two-certified-tuples policy can be satisfied."
+  "observed_ajent_production_runtime": {
+    "consumer_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
+    "upstream_base_layer_match": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
+    "shared_accessory": {
+      "product": "blackline",
+      "tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
+      "docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60"
+    },
+    "deployed_per_user_product_configuration": {
+      "strategy": "mutable-latest",
+      "status": "observed-configuration-drift-failure",
+      "references": {
+        "aigl": "docker-registry:5000/opencode-aigl:latest",
+        "blackline": "docker-registry:5000/opencode-blackline:latest",
+        "raven": "docker-registry:5000/opencode-raven:latest"
+      }
+    },
+    "ci_built_sha_artifacts": {
+      "aigl": {
+        "tag_provenance": "docker-registry:5000/opencode-aigl:8d8550265dca0ac06a41d5427c585ede56bbb808",
+        "docker_image_id": "sha256:72c454f39d423618b75439122c9073dbba7c9071421e5f3abd12cf288dc1f898"
+      },
+      "blackline": {
+        "tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
+        "docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60"
+      },
+      "raven": {
+        "tag_provenance": "docker-registry:5000/opencode-raven:8d8550265dca0ac06a41d5427c585ede56bbb808",
+        "docker_image_id": "sha256:6c4da94a8dec6160f0b1b4d0e2cd9ff38a3faa18dbd2a8d6023a71f6416a544c"
+      }
+    },
+    "scope_note": "The hardened alpha2 contract was rerun against the exact shared Blackline accessory. The three SHA-tagged image IDs are CI artifact provenance, not evidence that the deployed per-user ProductConfig selected them; it selected mutable latest references."
+  },
+  "promotion_effect": "The observed alpha2 consumer baselines are not eligible for certified previous tuples. After a real main/deploy/post-merge canary, an explicitly acknowledged bootstrap may certify current while leaving previous null and retaining alpha2 only as failed emergency provenance; the next meaningful passing release creates the first certified previous tuple."
 }

evidence/2026-07-18-opencode-ruby-alpha7.json

@@ -41,7 +41,7 @@
       "target": "travelwolf-1.16.1",
       "image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
       "server_version": "1.16.1",
-      "checked_at": "2026-07-18T22:03:12Z",
+      "checked_at": "2026-07-18T23:35:57Z",
       "expected_text": "compat-ok",
       "full_text": "compat-ok",
       "llm_request_count": 1,
@@ -51,7 +51,7 @@
       "target": "opencode-ajent-1.17.18",
       "image": "ghcr.io/anomalyco/opencode@sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97",
       "server_version": "1.17.18",
-      "checked_at": "2026-07-18T22:03:13Z",
+      "checked_at": "2026-07-18T23:35:58Z",
       "expected_text": "compat-ok",
       "full_text": "compat-ok",
       "llm_request_count": 1,
@@ -61,7 +61,7 @@
       "target": "ajent-base-1.18.3",
       "image": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
       "server_version": "1.18.3",
-      "checked_at": "2026-07-18T22:03:14Z",
+      "checked_at": "2026-07-18T23:35:58Z",
       "expected_text": "compat-ok",
       "full_text": "compat-ok",
       "llm_request_count": 1,
@@ -71,42 +71,55 @@
   "consumer_canaries": [
     {
       "consumer": "ajent-rails",
-      "consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
+      "consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
-      "tag_provenance": "ajent-opencode-blackline-canary:96552893",
+      "consumer_ref_kind": "pull-request-head",
-      "docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
+      "certification_scope": "pre-merge-pr-head-candidate-only",
-      "source_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
+      "tag_provenance": "ajent-opencode-blackline-canary:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+      "docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
+      "source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
       "upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
       "server_version": "1.18.3",
-      "checked_at": "2026-07-18T21:58:00Z",
+      "checked_at": "2026-07-18T23:28:16.435369Z",
       "application_path": "Blackline::GenerateResponseJob",
       "persisted_final_text": "compat-ok",
+      "authoritative_final_text": "compat-ok",
+      "authoritative_assistant_count": 1,
       "model_request_count": 1,
+      "cleanup_status": "pass",
       "status": "pass"
     },
     {
       "consumer": "mushu",
-      "consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
+      "consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
-      "run_id": "mushu-alpha7-20260718T215300Z-f26d958",
+      "consumer_ref_kind": "pull-request-head",
+      "certification_scope": "pre-merge-pr-head-candidate-only",
       "tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
+      "image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
       "docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
       "source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
       "server_version": "0.0.0-permission-shortcuts-202606300721",
-      "checked_at": "2026-07-18T21:53:00Z",
+      "checked_at": "2026-07-18T23:26:06.865190Z",
-      "persisted_final_text": "compat-ok",
+      "response_text": "compat-ok",
-      "model_request_count": 1,
+      "authoritative_final_text": "compat-ok",
+      "authoritative_assistant_count": 1,
+      "provider_request_count": 1,
+      "cleanup_status": "pass",
       "status": "pass"
     },
     {
       "consumer": "travelwolf",
-      "consumer_commit": "19747b59fa21e12560afd9edd73ed674ab3a644c",
+      "consumer_commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
-      "run_id": "20260718215135-8d8102c0",
+      "consumer_ref_kind": "pull-request-head",
+      "certification_scope": "pre-merge-pr-head-candidate-only",
+      "run_id": "travelwolf-alpha7-ref-20260718T232211Z-48eadf",
       "image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
       "server_version": "1.16.1",
-      "started_at": "2026-07-18T21:51:35Z",
+      "checked_at": "2026-07-18T23:22:26.216140Z",
-      "checked_at": "2026-07-18T21:51:56.552Z",
+      "final_text": "TRAVELWOLF_ALPHA7_REF_PIN_READY",
-      "final_text": "TRAVELWOLF_ALPHA7_SUBSCRIBE_READY",
+      "subscription_ready_before_prompt": true,
-      "application_prompt_count": 1,
+      "opencode_api_prompt_count": 1,
-      "model_request_count_observed": false,
+      "provider_request_count_observed": false,
+      "message_roles": ["user", "assistant"],
       "cleanup_status": "pass",
       "status": "pass"
     }

evidence/2026-07-18-travelwolf-alpha7-candidate.json

@@ -2,17 +2,86 @@
   "schema_version": 1,
   "consumer": "travelwolf",
   "profile": "rails-persisted-turn",
-  "consumer_commit": "19747b59fa21e12560afd9edd73ed674ab3a644c",
+  "consumer_commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
+  "consumer_tree": "8b3f8a97dc1f1d8b558a49523bf312d2810422df",
+  "consumer_ref_kind": "pull-request-head",
+  "review_url": "https://gitea.ajay.to/ajaynomics/travelwolf/pulls/29",
+  "certification_scope": "pre-merge-pr-head-candidate-only",
+  "promotion_eligible": false,
   "status": "pass",
-  "certified_at": "2026-07-18T22:03:14Z",
+  "certified_at": "2026-07-18T23:35:57Z",
-  "tuple_sha256": "sha256:a7519e661f74d86788928540429c953edcbf20d26321c0dd2b72cd0a1b995b61",
+  "tuple_sha256": "sha256:bed7d6f6a5e6dd9138c3b960b8bf13ac6f5bf402d0aa7e5c01a52a8e8ea1083d",
   "shared_evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
-  "canary": {
+  "loaded_sources": {
-    "run_id": "20260718215135-8d8102c0",
+    "opencode-ruby": {
-    "checked_at": "2026-07-18T21:51:56.552Z",
+      "version": "0.0.1.alpha7",
-    "final_text": "TRAVELWOLF_ALPHA7_SUBSCRIBE_READY",
+      "requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-    "application_prompt_count": 1,
+      "locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-    "model_request_count_observed": false,
+      "observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-    "cleanup_status": "pass"
+      "observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798"
+    },
+    "opencode-rails": {
+      "version": "0.0.1.alpha7",
+      "requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+      "locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+      "observed_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+      "observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb"
+    },
+    "source_class": "Bundler::Source::Git",
+    "proof_test": "test/services/travelwolf/opencode_env_wiring_test.rb",
+    "status": "pass"
+  },
+  "deterministic_contract": {
+    "checked_at": "2026-07-18T23:23:03Z",
+    "image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
+    "opencode_ruby_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+    "expected_text": "compat-ok",
+    "full_text": "compat-ok",
+    "authoritative_assistant_count": 1,
+    "model_request_count": 1,
+    "status": "pass"
+  },
+  "application_canary": {
+    "run_id": "travelwolf-alpha7-ref-20260718T232211Z-48eadf",
+    "checked_at": "2026-07-18T23:22:26.216140Z",
+    "final_text": "TRAVELWOLF_ALPHA7_REF_PIN_READY",
+    "subscription_ready_before_prompt": true,
+    "opencode_api_prompt_count": 1,
+    "provider_request_count_observed": false,
+    "message_roles": [
+      "user",
+      "assistant"
+    ],
+    "cleanup_status": "pass",
+    "status": "pass"
+  },
+  "consumer_verification": {
+    "source_guard": {
+      "runs": 4,
+      "assertions": 110,
+      "failures": 0,
+      "errors": 0
+    },
+    "focused_tests": {
+      "runs": 31,
+      "assertions": 248,
+      "failures": 0,
+      "errors": 0
+    },
+    "bounded_full_tests": {
+      "runs": 2300,
+      "assertions": 21679,
+      "failures": 0,
+      "errors": 0
+    },
+    "rubocop": {
+      "changed_ruby_files": 6,
+      "offenses": 0
+    },
+    "remotes_exact": [
+      "origin",
+      "github",
+      "backup"
+    ]
   }
 }

evidence/2026-07-20-opencode-alpha8-pre-release-shared-client.json

@@ -1,103 +0,0 @@
-{
-  "schema_version": 1,
-  "kind": "pre-release-client-image-review-input",
-  "status": "pass",
-  "certification_status": "not-certified",
-  "publication_state": "unpublished",
-  "coverage_scope": "shared-client-contract-only",
-  "clients": {
-    "opencode_ruby": {
-      "version": "0.0.1.alpha8",
-      "commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
-      "executed": true
-    },
-    "opencode_rails": {
-      "version": "0.0.1.alpha8",
-      "commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
-      "executed_by_image_contract": false
-    }
-  },
-  "checks": [
-    {
-      "id": "upstream-1.16.1",
-      "checked_at": "2026-07-20T05:38:34Z",
-      "image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
-      "docker_image_id": "sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
-      "platform": "linux/amd64",
-      "reported_version": "1.16.1",
-      "status": "pass",
-      "expected_text": "compat-ok",
-      "full_text": "compat-ok",
-      "authoritative_assistant_message_count": 1,
-      "llm_request_count": 1,
-      "executed_profiles": ["ruby-rest-sse"],
-      "required_consumer_profiles": ["rails-persisted-turn"]
-    },
-    {
-      "id": "upstream-1.17.18",
-      "checked_at": "2026-07-20T05:39:06Z",
-      "image": "ghcr.io/anomalyco/opencode@sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97",
-      "docker_image_id": "sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97",
-      "platform": "linux/amd64",
-      "reported_version": "1.17.18",
-      "status": "pass",
-      "expected_text": "compat-ok",
-      "full_text": "compat-ok",
-      "authoritative_assistant_message_count": 1,
-      "llm_request_count": 1,
-      "executed_profiles": ["ruby-rest-sse"],
-      "required_consumer_profiles": ["plugin-ledger"]
-    },
-    {
-      "id": "upstream-1.18.3",
-      "checked_at": "2026-07-20T05:39:18Z",
-      "image": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
-      "docker_image_id": "sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
-      "platform": "linux/amd64",
-      "reported_version": "1.18.3",
-      "status": "pass",
-      "expected_text": "compat-ok",
-      "full_text": "compat-ok",
-      "authoritative_assistant_message_count": 1,
-      "llm_request_count": 1,
-      "executed_profiles": ["ruby-rest-sse"],
-      "required_consumer_profiles": ["rails-persisted-turn", "plugin-ledger"]
-    },
-    {
-      "id": "ajent-blackline-alpha8-shared-contract",
-      "checked_at": "2026-07-20T05:39:57Z",
-      "image": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
-      "docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
-      "platform": "linux/amd64",
-      "reported_version": "1.18.3",
-      "status": "pass",
-      "expected_text": "compat-ok",
-      "full_text": "compat-ok",
-      "authoritative_assistant_message_count": 1,
-      "llm_request_count": 1,
-      "executed_profiles": ["ruby-rest-sse"],
-      "required_consumer_profiles": ["rails-persisted-turn", "plugin-ledger"]
-    },
-    {
-      "id": "mushu-permission-shortcuts-alpha8-shared-contract",
-      "checked_at": "2026-07-20T05:40:08Z",
-      "image": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
-      "docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
-      "platform": "linux/amd64",
-      "reported_version": "0.0.0-permission-shortcuts-202606300721",
-      "status": "pass",
-      "expected_text": "compat-ok",
-      "full_text": "compat-ok",
-      "authoritative_assistant_message_count": 1,
-      "llm_request_count": 1,
-      "executed_profiles": ["ruby-rest-sse"],
-      "required_consumer_profiles": []
-    }
-  ],
-  "limitations": [
-    "This local evidence has no GitHub workflow run provenance and is review input only.",
-    "The exact-image contract executed opencode-ruby but did not execute opencode-rails.",
-    "Rails persistence, plugin-ledger, consumer application, deployment, and user-visible canary profiles remain unverified.",
-    "No runtime tuple was promoted and no consumer was deployed."
-  ]
-}

lib/opencode_compat/client_candidate.rb

@@ -1,154 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "rubygems"
-
-module OpenCodeCompat
-  class ClientCandidate
-    class ValidationError < StandardError; end
-
-    SCHEMA_VERSION = 3
-    CLIENT_NAMES = %w[opencode-rails opencode-ruby].freeze
-    PUBLICATION_PROVENANCE = {
-      "published" => "annotated-tag",
-      "unpublished" => "commit"
-    }.freeze
-    SHA_PATTERN = /\A[0-9a-f]{40}\z/
-
-    def self.load(path)
-      new(JSON.parse(File.binread(path)))
-    rescue JSON::ParserError => error
-      raise ValidationError, "client candidate is not valid JSON: #{error.message}"
-    end
-
-    attr_reader :document
-
-    def initialize(document)
-      @document = document
-    end
-
-    def verify!
-      assert_exact_keys!(document,
-        %w[clients publication_state release_train schema_version status], "client candidate")
-      assert_equal!(SCHEMA_VERSION, document.fetch("schema_version"), "schema_version")
-      assert_equal!("candidate", document.fetch("status"), "status")
-
-      release_train = exact_version!(document.fetch("release_train"), "release_train")
-      publication_state = document.fetch("publication_state")
-      expected_kind = PUBLICATION_PROVENANCE.fetch(publication_state) do
-        raise ValidationError,
-          "publication_state must be one of #{PUBLICATION_PROVENANCE.keys.join(', ')}, got #{publication_state.inspect}"
-      end
-
-      clients = document.fetch("clients")
-      assert_equal!(CLIENT_NAMES, clients.keys.sort, "client names")
-      clients.each do |name, client|
-        validate_client!(name, client, release_train, expected_kind)
-      end
-      validate_runtime_dependency!(clients, release_train)
-
-      self
-    rescue KeyError => error
-      raise ValidationError, "client candidate is missing required field #{error.key.inspect}"
-    end
-
-    def github_outputs
-      verify!
-      clients = document.fetch("clients")
-
-      {
-        "publication_state" => document.fetch("publication_state"),
-        "ruby_provenance_kind" => provenance(clients, "opencode-ruby").fetch("kind"),
-        "ruby_ref" => clients.dig("opencode-ruby", "ref"),
-        "ruby_tag" => provenance(clients, "opencode-ruby")["tag"].to_s,
-        "ruby_tag_object" => provenance(clients, "opencode-ruby")["annotated_tag_object"].to_s,
-        "ruby_version" => clients.dig("opencode-ruby", "version"),
-        "rails_provenance_kind" => provenance(clients, "opencode-rails").fetch("kind"),
-        "rails_ref" => clients.dig("opencode-rails", "ref"),
-        "rails_tag" => provenance(clients, "opencode-rails")["tag"].to_s,
-        "rails_tag_object" => provenance(clients, "opencode-rails")["annotated_tag_object"].to_s,
-        "rails_version" => clients.dig("opencode-rails", "version")
-      }
-    end
-
-    private
-
-    def validate_client!(name, client, release_train, expected_kind)
-      expected_keys = %w[provenance ref repository version]
-      expected_keys << "runtime_dependencies" if name == "opencode-rails"
-      assert_exact_keys!(client, expected_keys.sort, "#{name} candidate")
-      assert_equal!("ajaynomics/#{name}", client.fetch("repository"), "#{name} repository")
-      assert_equal!(release_train, exact_version!(client.fetch("version"), "#{name} version"), "#{name} version")
-
-      ref = exact_commit!(client.fetch("ref"), "#{name} ref")
-      source = client.fetch("provenance")
-      assert_equal!(expected_kind, source.fetch("kind"), "#{name} provenance kind")
-
-      case expected_kind
-      when "commit"
-        assert_exact_keys!(source, %w[commit kind], "#{name} commit provenance")
-        assert_equal!(ref, exact_commit!(source.fetch("commit"), "#{name} provenance commit"),
-          "#{name} provenance commit")
-      when "annotated-tag"
-        assert_exact_keys!(source, %w[annotated_tag_object kind peeled_commit tag],
-          "#{name} annotated-tag provenance")
-        assert_equal!("v#{release_train}", exact_tag!(source.fetch("tag"), "#{name} tag"), "#{name} tag")
-        exact_commit!(source.fetch("annotated_tag_object"), "#{name} annotated tag object")
-        assert_equal!(ref, exact_commit!(source.fetch("peeled_commit"), "#{name} peeled commit"),
-          "#{name} peeled commit")
-      end
-    end
-
-    def validate_runtime_dependency!(clients, release_train)
-      dependency = clients.fetch("opencode-rails")
-        .fetch("runtime_dependencies")
-        .fetch("opencode-ruby")
-      assert_exact_keys!(dependency, %w[ref requirement], "opencode-rails runtime dependency")
-      assert_equal!("= #{release_train}", dependency.fetch("requirement"),
-        "opencode-rails runtime dependency requirement")
-      assert_equal!(clients.dig("opencode-ruby", "ref"),
-        exact_commit!(dependency.fetch("ref"), "opencode-rails runtime dependency ref"),
-        "opencode-rails runtime dependency ref")
-    end
-
-    def provenance(clients, name)
-      clients.fetch(name).fetch("provenance")
-    end
-
-    def exact_commit!(value, label)
-      return value if value.is_a?(String) && value.match?(SHA_PATTERN)
-
-      raise ValidationError, "#{label} must be a full lowercase 40-character Git commit, got #{value.inspect}"
-    end
-
-    def exact_tag!(value, label)
-      if value.is_a?(String) && value.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]*\z/) &&
-          !value.include?("..") && !value.end_with?(".")
-        return value
-      end
-
-      raise ValidationError, "#{label} must be a safe exact Git tag, got #{value.inspect}"
-    end
-
-    def exact_version!(value, label)
-      if value.is_a?(String) && value.match?(/\A[0-9A-Za-z][0-9A-Za-z.-]*\z/) && Gem::Version.correct?(value)
-        return value
-      end
-
-      raise ValidationError, "#{label} must be an exact RubyGems version, got #{value.inspect}"
-    end
-
-    def assert_exact_keys!(value, expected, label)
-      actual = value.keys.sort
-      return if actual == expected
-
-      raise ValidationError, "#{label} keys must equal #{expected.inspect}, got #{actual.inspect}"
-    end
-
-    def assert_equal!(expected, actual, label)
-      return if expected == actual
-
-      raise ValidationError, "#{label} must equal #{expected.inspect}, got #{actual.inspect}"
-    end
-  end
-end

lib/opencode_compat/runtime_tuple_promoter.rb

@@ -10,11 +10,14 @@ module OpenCodeCompat
   class PromotionError < StandardError; end
 
   class RuntimeTuplePromoter
+    SCHEMA_VERSION = 2
     FULL_COMMIT = /\A[0-9a-f]{40}\z/
     DIGEST = /\Asha256:[0-9a-f]{64}\z/
     IMMUTABLE_IMAGE = /\A[^@\s]+@sha256:[0-9a-f]{64}\z/
     UTC_TIMESTAMP = /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\z/
     CERTIFICATION_STATUS = "pass"
+    DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT =
+      "accept-degraded-rollback-with-failed-emergency-provenance"
     NON_CERTIFIABLE_TUPLE_STATUSES = %w[observed-production-contract-failed].freeze
     TUPLE_METADATA_KEYS = %w[
       certification
@@ -41,7 +44,7 @@ module OpenCodeCompat
       manifest = read_manifest
       consumer_entry = fetch_consumer!(manifest, consumer)
       profile = fetch_profile!(consumer_entry, consumer)
-      candidate = prepare_candidate!(consumer_entry, consumer_commit)
+      candidate = prepare_candidate!(consumer_entry, consumer_commit, for_promotion: false)
       current = consumer_entry.fetch("current") do
         raise PromotionError, "#{consumer} has no current tuple to preserve as previous"
       end
@@ -82,6 +85,37 @@ module OpenCodeCompat
       end
     end
 
+    def bootstrap_current(consumer:, consumer_commit:, certification:, acknowledgement:, dry_run: false)
+      validate_full_commit!(consumer_commit, "consumer commit")
+      unless acknowledgement == DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT
+        raise PromotionError,
+              "bootstrap requires explicit acknowledgement #{DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT.inspect}"
+      end
+
+      if dry_run
+        manifest = read_manifest
+        return bootstrap_current_manifest(
+          manifest,
+          consumer: consumer,
+          consumer_commit: consumer_commit,
+          certification: certification,
+          acknowledgement: acknowledgement
+        )
+      end
+
+      with_current_manifest_lock do |manifest|
+        bootstrapped = bootstrap_current_manifest(
+          manifest,
+          consumer: consumer,
+          consumer_commit: consumer_commit,
+          certification: certification,
+          acknowledgement: acknowledgement
+        )
+        atomic_write(bootstrapped)
+        bootstrapped
+      end
+    end
+
     private
 
     def read_manifest
@@ -93,7 +127,7 @@ module OpenCodeCompat
     def promote_manifest(manifest, consumer:, consumer_commit:, certification:, previous_certification:)
       consumer_entry = fetch_consumer!(manifest, consumer)
       profile = fetch_profile!(consumer_entry, consumer)
-      candidate = prepare_candidate!(consumer_entry, consumer_commit)
+      candidate = prepare_candidate!(consumer_entry, consumer_commit, for_promotion: true)
       current = consumer_entry.fetch("current") do
         raise PromotionError, "#{consumer} has no current tuple to preserve as previous"
       end
@@ -124,13 +158,60 @@ module OpenCodeCompat
       consumer_entry["previous"] = certified_previous
       consumer_entry["current"] = certified_candidate
       consumer_entry["candidate"] = nil
-      manifest["migration_state"] = all_consumers_certified?(manifest) ? "certified" : "candidate"
+      consumer_entry.delete("rollback_state")
+      manifest["migration_state"] = migration_state_for(manifest)
+      manifest
+    end
+
+    def bootstrap_current_manifest(manifest, consumer:, consumer_commit:, certification:, acknowledgement:)
+      consumer_entry = fetch_consumer!(manifest, consumer)
+      profile = fetch_profile!(consumer_entry, consumer)
+      candidate = prepare_candidate!(consumer_entry, consumer_commit, for_promotion: true)
+      current = consumer_entry.fetch("current") do
+        raise PromotionError, "#{consumer} has no current tuple to retain as emergency provenance"
+      end
+      validate_tuple!(current, "#{consumer} current")
+      unless NON_CERTIFIABLE_TUPLE_STATUSES.include?(current["status"])
+        raise PromotionError, "degraded bootstrap is only for a current tuple known to fail the contract"
+      end
+
+      candidate_fingerprint = tuple_fingerprint(candidate, consumer: consumer, profile: profile)
+      current_fingerprint = tuple_fingerprint(current, consumer: consumer, profile: profile)
+      if candidate_fingerprint == current_fingerprint
+        raise PromotionError, "#{consumer} candidate is identical to its failed current tuple"
+      end
+
+      certified_candidate = certify_tuple!(
+        candidate,
+        consumer: consumer,
+        profile: profile,
+        supplied: certification,
+        expected_fingerprint: candidate_fingerprint,
+        label: "bootstrap candidate"
+      )
+
+      consumer_entry["emergency_provenance"] = deep_copy(current)
+      consumer_entry["current"] = certified_candidate
+      consumer_entry["candidate"] = nil
+      consumer_entry["previous"] = nil
+      consumer_entry["rollback_state"] = {
+        "status" => "degraded-no-certified-previous",
+        "acknowledgement" => acknowledgement,
+        "recorded_at" => certification.fetch("certified_at"),
+        "emergency_provenance_status" => current.fetch("status")
+      }
+      manifest["migration_state"] = migration_state_for(manifest)
+      manifest["promotion_readiness"] = {
+        "status" => "bootstrap-current-only",
+        "reason" => "The current tuple is certified, but no independently passing previous tuple exists.",
+        "required_action" => "Certify the next meaningful release; normal promotion will then retain this current tuple as the first certified previous rollback."
+      }
       manifest
     end
 
     def fetch_consumer!(manifest, consumer)
-      unless manifest.is_a?(Hash) && manifest["schema_version"] == 1 && manifest["consumers"].is_a?(Hash)
+      unless manifest.is_a?(Hash) && manifest["schema_version"] == SCHEMA_VERSION && manifest["consumers"].is_a?(Hash)
-        raise PromotionError, "runtime tuple manifest must use schema_version 1 and contain consumers"
+        raise PromotionError, "runtime tuple manifest must use schema_version #{SCHEMA_VERSION} and contain consumers"
       end
 
       manifest.fetch("consumers").fetch(consumer) do
@@ -138,7 +219,7 @@ module OpenCodeCompat
       end
     end
 
-    def prepare_candidate!(consumer_entry, consumer_commit)
+    def prepare_candidate!(consumer_entry, consumer_commit, for_promotion:)
       candidate = consumer_entry["candidate"]
       unless candidate.is_a?(Hash)
         raise PromotionError, "consumer has no candidate tuple to promote"
@@ -155,9 +236,151 @@ module OpenCodeCompat
       prepared = deep_copy(candidate)
       prepared["consumer_commit"] = consumer_commit
       validate_tuple!(prepared, "candidate")
+      validate_candidate_consumer_ref!(prepared, consumer_commit)
+      validate_candidate_client_sources!(prepared)
+      if for_promotion
+        validate_promotion_provenance!(prepared, consumer_commit)
+        validate_promotion_product_artifacts!(prepared.fetch("runtime"))
+      end
       prepared
     end
 
+    def validate_candidate_consumer_ref!(candidate, consumer_commit)
+      reference = candidate["consumer_ref"]
+      unless reference.is_a?(Hash)
+        raise PromotionError, "candidate must record its exact consumer ref"
+      end
+
+      kind = reference["kind"]
+      unless %w[pull-request-head main-commit].include?(kind)
+        raise PromotionError, "candidate consumer ref must be a pull-request-head or main-commit"
+      end
+      validate_full_commit!(reference["commit"], "candidate consumer ref commit")
+      validate_full_commit!(reference["tree"], "candidate consumer ref tree")
+      unless reference["commit"] == consumer_commit
+        raise PromotionError, "candidate consumer ref does not match the tuple consumer commit"
+      end
+      unless reference["repository"].is_a?(String) && !reference["repository"].empty?
+        raise PromotionError, "candidate consumer ref must name its repository"
+      end
+
+      return unless kind == "pull-request-head"
+
+      validate_full_commit!(reference["base_commit"], "candidate pull request base commit")
+      unless reference["review_url"].is_a?(String) && reference["review_url"].start_with?("https://")
+        raise PromotionError, "candidate pull request ref must include its HTTPS review URL"
+      end
+    end
+
+    def validate_candidate_client_sources!(candidate)
+      %w[opencode_ruby opencode_rails].each do |client_name|
+        client = candidate[client_name]
+        next unless client
+
+        validate_client_source!(client, "candidate #{client_name}", required: true)
+      end
+    end
+
+    def validate_promotion_provenance!(candidate, consumer_commit)
+      unless candidate["certification_scope"] == "promotion-deployed" && candidate["promotion_eligible"] == true
+        raise PromotionError,
+              "pre-merge pull-request evidence is candidate-only; promotion requires deployed certification scope"
+      end
+
+      provenance = candidate["promotion_provenance"]
+      unless provenance.is_a?(Hash)
+        raise PromotionError, "promotion requires main-commit provenance or an identical-tree attestation"
+      end
+
+      case provenance["kind"]
+      when "main-commit"
+        unless candidate.dig("consumer_ref", "kind") == "main-commit" &&
+            provenance["main_commit"] == consumer_commit
+          raise PromotionError, "main-commit promotion provenance must match the tuple consumer commit"
+        end
+        validate_post_merge_canary!(
+          provenance["post_merge_canary"],
+          consumer_commit: provenance["main_commit"]
+        )
+      when "identical-tree-attestation"
+        validate_identical_tree_attestation!(candidate, provenance, consumer_commit)
+      else
+        raise PromotionError, "unknown promotion provenance kind #{provenance['kind'].inspect}"
+      end
+    end
+
+    def validate_identical_tree_attestation!(candidate, provenance, consumer_commit)
+      validate_full_commit!(provenance["pull_request_commit"], "attested pull request commit")
+      validate_full_commit!(provenance["pull_request_tree"], "attested pull request tree")
+      validate_full_commit!(provenance["main_commit"], "attested main commit")
+      validate_full_commit!(provenance["main_tree"], "attested main tree")
+      validate_timestamp!(provenance["attested_at"], "identical-tree attestation timestamp")
+
+      unless provenance["pull_request_commit"] == consumer_commit &&
+          provenance["pull_request_tree"] == candidate.dig("consumer_ref", "tree") &&
+          provenance["main_tree"] == provenance["pull_request_tree"]
+        raise PromotionError, "identical-tree attestation does not match the candidate and main trees"
+      end
+
+      validate_post_merge_canary!(
+        provenance["post_merge_canary"],
+        consumer_commit: provenance["main_commit"]
+      )
+    end
+
+    def validate_post_merge_canary!(canary, consumer_commit:)
+      unless canary.is_a?(Hash) && canary["status"] == "pass"
+        raise PromotionError, "promotion requires a passing post-merge canary"
+      end
+      validate_timestamp!(canary["checked_at"], "post-merge canary timestamp")
+      evidence = Array(canary["evidence"])
+      if evidence.empty? || evidence.any? { |path| !path.is_a?(String) || !path.start_with?("evidence/") }
+        raise PromotionError, "post-merge canary must reference evidence under evidence/"
+      end
+      evidence.each do |reference|
+        validate_post_merge_canary_evidence!(
+          reference,
+          checked_at: canary.fetch("checked_at"),
+          consumer_commit: consumer_commit
+        )
+      end
+    end
+
+    def validate_post_merge_canary_evidence!(reference, checked_at:, consumer_commit:)
+      relative = Pathname.new(reference).cleanpath
+      if relative.absolute? || relative.each_filename.first != "evidence"
+        raise PromotionError, "post-merge canary evidence must stay under evidence/"
+      end
+
+      evidence_root = File.realpath(File.join(@root, "evidence"))
+      real_path = File.realpath(File.join(@root, relative.to_s))
+      unless real_path.start_with?("#{evidence_root}#{File::SEPARATOR}")
+        raise PromotionError, "post-merge canary evidence resolves outside evidence/"
+      end
+
+      document = parse_json(File.read(real_path), relative.to_s)
+      unless document.is_a?(Hash) && document["schema_version"] == 1 &&
+          document["status"] == "pass" && document["checked_at"] == checked_at &&
+          document["consumer_commit"] == consumer_commit
+        raise PromotionError,
+              "post-merge canary evidence must match its passing timestamp and main consumer commit"
+      end
+    rescue Errno::ENOENT
+      raise PromotionError, "post-merge canary evidence does not exist: #{reference}"
+    end
+
+    def validate_promotion_product_artifacts!(runtime)
+      selection = runtime["product_selection"]
+      return unless selection
+
+      selected_products = selection.fetch("references").keys.sort
+      artifact_products = runtime.fetch("product_images", {}).keys.sort
+      return if selected_products == artifact_products
+
+      raise PromotionError,
+            "promotion requires exact content IDs or digests for every selected product image"
+    end
+
     def fetch_profile!(consumer_entry, consumer)
       profile = consumer_entry["profile"]
       unless profile.is_a?(String) && profile.match?(/\A[a-z0-9][a-z0-9-]*\z/)
@@ -346,6 +569,46 @@ module OpenCodeCompat
       end
 
       validate_full_commit!(client["git_commit"], "#{label} git commit")
+      validate_client_source!(client, label, required: false)
+    end
+
+    def validate_client_source!(client, label, required:)
+      source = client["source"]
+      if source.nil?
+        raise PromotionError, "#{label} must include loaded exact-ref source proof" if required
+
+        return
+      end
+      unless source.is_a?(Hash) && source["type"] == "git" && source["uri"].is_a?(String) && !source["uri"].empty?
+        raise PromotionError, "#{label} source must identify its Git URI"
+      end
+
+      commit = client.fetch("git_commit")
+      %w[requested_ref locked_revision].each do |key|
+        unless source[key] == commit
+          raise PromotionError, "#{label} source #{key} must equal the peeled client commit"
+        end
+      end
+
+      proof = source["loaded_source_proof"]
+      unless proof.is_a?(Hash) && proof["status"] == "pass" && proof["source_class"] == "Bundler::Source::Git"
+        raise PromotionError, "#{label} must include passing Bundler Git loaded-source proof"
+      end
+      expected = {
+        "loaded_version" => client.fetch("version"),
+        "observed_revision" => commit
+      }
+      expected.each do |key, value|
+        unless proof[key] == value
+          raise PromotionError, "#{label} loaded-source proof #{key} must equal #{value.inspect}"
+        end
+      end
+      if proof.key?("observed_ref") && proof["observed_ref"] != commit
+        raise PromotionError, "#{label} loaded-source proof observed_ref must equal #{commit.inspect}"
+      end
+      unless proof["test"].is_a?(String) && !proof["test"].empty?
+        raise PromotionError, "#{label} loaded-source proof must name the consumer test"
+      end
     end
 
     def validate_runtime!(runtime, label)
@@ -355,6 +618,47 @@ module OpenCodeCompat
       end
 
       exact_execution_coordinate = false
+      product_selection = runtime["product_selection"]
+      if product_selection
+        unless product_selection.is_a?(Hash) && product_selection["strategy"] == "full-consumer-commit-tag"
+          raise PromotionError, "#{label} product_selection must use the full-consumer-commit-tag strategy"
+        end
+        validate_full_commit!(product_selection["source_commit"], "#{label} product selection source commit")
+        references = product_selection["references"]
+        unless references.is_a?(Hash) && !references.empty?
+          raise PromotionError, "#{label} product selection references must be a non-empty object"
+        end
+        references.each do |product, reference|
+          unless product.match?(/\A[a-z0-9][a-z0-9-]*\z/) &&
+              reference.is_a?(String) && reference.end_with?(":#{product_selection['source_commit']}")
+            raise PromotionError,
+                  "#{label} #{product} selection must end in the full consumer commit tag"
+          end
+        end
+        exact_execution_coordinate = true
+      end
+
+      product_images = runtime["product_images"]
+      if product_images
+        unless product_images.is_a?(Hash) && !product_images.empty?
+          raise PromotionError, "#{label} product_images must be a non-empty object"
+        end
+        product_images.each do |product, coordinate|
+          unless product.match?(/\A[a-z0-9][a-z0-9-]*\z/) && coordinate.is_a?(Hash)
+            raise PromotionError, "#{label} product image entries must use named coordinate objects"
+          end
+          image_id = coordinate["docker_image_id"]
+          image = coordinate["image"]
+          unless (image_id.is_a?(String) && image_id.match?(DIGEST)) ||
+              (image.is_a?(String) && image.match?(IMMUTABLE_IMAGE))
+            raise PromotionError,
+                  "#{label} #{product} product image must include an exact sha256 image ID or OCI digest"
+          end
+          validate_full_commit!(coordinate["source_commit"], "#{label} #{product} source commit")
+          exact_execution_coordinate = true
+        end
+      end
+
       runtime.each do |key, value|
         if key == "docker_image_id" || key.end_with?("_image_id")
           unless value.is_a?(String) && value.match?(DIGEST)
@@ -455,6 +759,15 @@ module OpenCodeCompat
       end
     end
 
+    def migration_state_for(manifest)
+      return "certified" if all_consumers_certified?(manifest)
+
+      degraded = manifest.fetch("consumers").any? do |_consumer, entry|
+        entry.dig("rollback_state", "status") == "degraded-no-certified-previous"
+      end
+      degraded ? "bootstrap-current-only" : "candidate"
+    end
+
     def with_current_manifest_lock
       loop do
         retry_with_new_inode = false

manifests/client-candidate.json

@@ -1,32 +1,11 @@
 {
-  "schema_version": 3,
+  "repository": "ajaynomics/opencode-ruby",
-  "release_train": "0.0.1.alpha8",
+  "ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-  "publication_state": "unpublished",
+  "version": "0.0.1.alpha7",
-  "clients": {
+  "tag_provenance": {
-    "opencode-ruby": {
+    "tag": "v0.0.1.alpha7",
-      "repository": "ajaynomics/opencode-ruby",
+    "annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645",
-      "ref": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
+    "peeled_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798"
-      "version": "0.0.1.alpha8",
-      "provenance": {
-        "kind": "commit",
-        "commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766"
-      }
-    },
-    "opencode-rails": {
-      "repository": "ajaynomics/opencode-rails",
-      "ref": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
-      "version": "0.0.1.alpha8",
-      "provenance": {
-        "kind": "commit",
-        "commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f"
-      },
-      "runtime_dependencies": {
-        "opencode-ruby": {
-          "requirement": "= 0.0.1.alpha8",
-          "ref": "9277646a4bb2cf25a8384ffc140b154f49ea5766"
-        }
-      }
-    }
   },
   "status": "candidate"
 }

manifests/image-matrix.json

@@ -1,12 +1,5 @@
 {
-  "schema_version": 2,
+  "schema_version": 1,
-  "client_candidate": {
-    "release_train": "0.0.1.alpha8",
-    "publication_state": "unpublished",
-    "opencode_ruby_commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
-    "opencode_rails_commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
-    "certification_status": "pending"
-  },
   "public_ci": [
     {
       "id": "upstream-1.16.1",
@@ -16,15 +9,12 @@
       "consumers": ["travelwolf"],
       "profiles": ["ruby-rest-sse"],
       "required_consumer_profiles": ["rails-persisted-turn"],
-      "certification_status": "pending",
+      "certification_status": "certified",
-      "previous_certification": {
+      "certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-        "status": "certified",
+      "certified_at": "2026-07-18T23:35:57Z",
-        "client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+      "expected_text": "compat-ok",
-        "certified_at": "2026-07-18T22:03:12Z",
+      "full_text": "compat-ok",
-        "expected_text": "compat-ok",
+      "llm_request_count": 1
-        "full_text": "compat-ok",
-        "llm_request_count": 1
-      }
     },
     {
       "id": "upstream-1.17.18",
@@ -34,15 +24,12 @@
       "consumers": ["opencode-ajent"],
       "profiles": ["ruby-rest-sse"],
       "required_consumer_profiles": ["plugin-ledger"],
-      "certification_status": "pending",
+      "certification_status": "certified",
-      "previous_certification": {
+      "certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-        "status": "certified",
+      "certified_at": "2026-07-18T23:35:58Z",
-        "client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+      "expected_text": "compat-ok",
-        "certified_at": "2026-07-18T22:03:13Z",
+      "full_text": "compat-ok",
-        "expected_text": "compat-ok",
+      "llm_request_count": 1
-        "full_text": "compat-ok",
-        "llm_request_count": 1
-      }
     },
     {
       "id": "upstream-1.18.3",
@@ -52,56 +39,55 @@
       "consumers": ["ajent-rails"],
       "profiles": ["ruby-rest-sse"],
       "required_consumer_profiles": ["rails-persisted-turn", "plugin-ledger"],
-      "certification_status": "pending",
+      "certification_status": "certified",
-      "previous_certification": {
+      "certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-        "status": "certified",
+      "certified_at": "2026-07-18T23:35:58Z",
-        "client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+      "expected_text": "compat-ok",
-        "certified_at": "2026-07-18T22:03:14Z",
+      "full_text": "compat-ok",
-        "expected_text": "compat-ok",
+      "llm_request_count": 1
-        "full_text": "compat-ok",
-        "llm_request_count": 1
-      }
     }
   ],
   "host_canary": [
     {
       "id": "ajent-blackline-alpha7-canary",
       "consumer": "ajent-rails",
-      "consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
+      "consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
-      "tag_provenance": "ajent-opencode-blackline-canary:96552893",
+      "consumer_ref_kind": "pull-request-head",
-      "docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
+      "certification_scope": "pre-merge-pr-head-candidate-only",
-      "source_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
+      "promotion_eligible": false,
+      "tag_provenance": "ajent-opencode-blackline-canary:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+      "docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
+      "source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
       "reported_version": "1.18.3",
       "upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
       "profiles": ["rails-persisted-turn"],
-      "certification_status": "pending",
+      "certification_status": "candidate-certified",
-      "previous_certification": {
+      "certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-        "status": "candidate-certified",
+      "certified_rails_commit": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
-        "client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+      "certified_at": "2026-07-18T23:28:16.435369Z",
-        "rails_commit": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+      "persisted_final_text": "compat-ok",
-        "certified_at": "2026-07-18T21:58:00Z",
+      "authoritative_final_text": "compat-ok",
-        "persisted_final_text": "compat-ok",
+      "model_request_count": 1,
-        "model_request_count": 1
+      "product_artifacts_missing_before_promotion": ["aigl", "raven"]
-      }
     },
     {
       "id": "mushu-permission-shortcuts-alpha7-canary",
       "consumer": "mushu",
-      "consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
+      "consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
-      "run_id": "mushu-alpha7-20260718T215300Z-f26d958",
+      "consumer_ref_kind": "pull-request-head",
+      "certification_scope": "pre-merge-pr-head-candidate-only",
+      "promotion_eligible": false,
       "tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
+      "image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
       "docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
       "source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
       "reported_version": "0.0.0-permission-shortcuts-202606300721",
       "profiles": ["ruby-rest-sse"],
-      "certification_status": "pending",
+      "certification_status": "candidate-certified",
-      "previous_certification": {
+      "certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
-        "status": "candidate-certified",
+      "certified_at": "2026-07-18T23:26:06.865190Z",
-        "client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+      "authoritative_final_text": "compat-ok",
-        "certified_at": "2026-07-18T21:53:00Z",
+      "provider_request_count": 1
-        "persisted_final_text": "compat-ok",
-        "model_request_count": 1
-      }
     }
   ]
 }

manifests/runtime-tuples.json

@@ -1,18 +1,19 @@
 {
-  "schema_version": 1,
+  "$schema": "../schemas/runtime-tuples.schema.json",
+  "schema_version": 2,
   "migration_state": "candidate",
   "promotion_readiness": {
     "status": "blocked",
-    "reason": "Every observed alpha2 baseline fails the hardened exact-final-text contract, so none can be certified as the previous rollback tuple.",
+    "reason": "Every observed alpha2 baseline fails the hardened exact-final-text contract, so none can be certified as the previous rollback tuple; the passing evidence is also bound to unmerged pull-request heads.",
     "evidence": "evidence/2026-07-18-opencode-ruby-alpha2-regression.json",
-    "required_action": "Create and canary a distinct rollback consumer commit that pins alpha7 and the exact runtime before promoting any candidate."
+    "required_action": "Merge, deploy, and canary the exact main/merge tuple (or record an identical-tree attestation plus post-merge canary), then explicitly acknowledge bootstrap-current-only; previous remains null until the next meaningful independently passing release."
   },
   "consumers": {
     "ajent-rails": {
       "profile": "rails-persisted-turn",
       "current": {
         "status": "observed-production-contract-failed",
-        "consumer_commit": "83eed3c247a352842b08fc5cf339c4d0acdaacba",
+        "consumer_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
         "opencode_ruby": {
           "version": "0.0.1.alpha2",
           "git_commit": "889d38332f98f5f7b76d16952b7204d8a5b9a662"
@@ -22,21 +23,83 @@
           "git_commit": "9b0c4cd3cd31bdfebbb89567daca012d68a356ea"
         },
         "runtime": {
-          "tag_provenance": "docker-registry:5000/opencode-blackline:83eed3c247a352842b08fc5cf339c4d0acdaacba",
+          "tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
-          "docker_image_id": "sha256:6fb2b3bf8e4cdf48e16bf6c3475e953df2f8304e77f5efe816ceb46f905eead8",
+          "docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60",
+          "source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
           "reported_version": "1.18.3",
-          "upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e"
+          "upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
+          "upstream_base_proof": {
+            "method": "rootfs-prefix-layer-match",
+            "matched_layer_count": 4,
+            "status": "pass",
+            "note": "The deployed images match the exact 1.18.3 base layers even though this main commit selected the mutable upstream tag at build time."
+          },
+          "deployed_product_selection": {
+            "strategy": "mutable-latest",
+            "status": "observed-configuration-drift-failure",
+            "references": {
+              "aigl": "docker-registry:5000/opencode-aigl:latest",
+              "blackline": "docker-registry:5000/opencode-blackline:latest",
+              "raven": "docker-registry:5000/opencode-raven:latest"
+            },
+            "note": "The shared Blackline accessory used the SHA tag above, but Rails ProductConfig resolved per-user AIGL, Blackline, and Raven containers through mutable latest references."
+          },
+          "ci_built_product_images": {
+            "aigl": {
+              "tag_provenance": "docker-registry:5000/opencode-aigl:8d8550265dca0ac06a41d5427c585ede56bbb808",
+              "docker_image_id": "sha256:72c454f39d423618b75439122c9073dbba7c9071421e5f3abd12cf288dc1f898",
+              "source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808"
+            },
+            "blackline": {
+              "tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
+              "docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60",
+              "source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808"
+            },
+            "raven": {
+              "tag_provenance": "docker-registry:5000/opencode-raven:8d8550265dca0ac06a41d5427c585ede56bbb808",
+              "docker_image_id": "sha256:6c4da94a8dec6160f0b1b4d0e2cd9ff38a3faa18dbd2a8d6023a71f6416a544c",
+              "source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808"
+            }
+          }
         }
       },
       "candidate": {
         "status": "compatibility-certified",
-        "consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
+        "certification_scope": "pre-merge-pr-head-candidate-only",
+        "promotion_eligible": false,
+        "promotion_blockers": [
+          "consumer-ref-is-an-unmerged-pull-request-head",
+          "aigl-and-raven-candidate-content-artifacts-have-not-been-built-and-canaried",
+          "no-certified-previous-tuple"
+        ],
+        "consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+        "consumer_ref": {
+          "kind": "pull-request-head",
+          "repository": "ajaynomics/ajent-rails",
+          "commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+          "tree": "9e93834ad16b60fa5edfe1cb3baaba193402be74",
+          "base_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
+          "review_url": "https://gitea.ajay.to/ajaynomics/ajent-rails/pulls/946"
+        },
         "opencode_ruby": {
           "version": "0.0.1.alpha7",
           "git_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
           "tag_provenance": {
             "tag": "v0.0.1.alpha7",
             "annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645"
+          },
+          "source": {
+            "type": "git",
+            "uri": "https://gitea.krishnan.ca/ajaynomics/opencode-ruby.git",
+            "requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+            "locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+            "loaded_source_proof": {
+              "status": "pass",
+              "source_class": "Bundler::Source::Git",
+              "loaded_version": "0.0.1.alpha7",
+              "observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+              "test": "test/lib/opencode/runtime_image_provenance_test.rb"
+            }
           }
         },
         "opencode_rails": {
@@ -45,23 +108,61 @@
           "tag_provenance": {
             "tag": "v0.0.1.alpha7",
             "annotated_tag_object": "61e128084b2b665c0ba20b332987e41794948d7c"
+          },
+          "source": {
+            "type": "git",
+            "uri": "https://gitea.krishnan.ca/ajaynomics/opencode-rails.git",
+            "requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+            "locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+            "loaded_source_proof": {
+              "status": "pass",
+              "source_class": "Bundler::Source::Git",
+              "loaded_version": "0.0.1.alpha7",
+              "observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+              "test": "test/lib/opencode/runtime_image_provenance_test.rb"
+            }
           }
         },
         "runtime": {
-          "tag_provenance": "ajent-opencode-blackline-canary:96552893",
-          "docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
-          "source_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
           "reported_version": "1.18.3",
-          "upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e"
+          "upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
+          "product_selection": {
+            "strategy": "full-consumer-commit-tag",
+            "source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+            "references": {
+              "aigl": "docker-registry:5000/opencode-aigl:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+              "blackline": "docker-registry:5000/opencode-blackline:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+              "raven": "docker-registry:5000/opencode-raven:01cdf9da8e1b3f9a205d681e448aefefd9704db2"
+            }
+          },
+          "product_images": {
+            "blackline": {
+              "tag_provenance": "ajent-opencode-blackline-canary:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
+              "docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
+              "source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2"
+            }
+          }
         },
-        "application_canary": {
+        "deterministic_contract": {
-          "checked_at": "2026-07-18T21:58:00Z",
+          "checked_at": "2026-07-18T23:16:13Z",
-          "path": "Blackline::GenerateResponseJob",
+          "docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
-          "persisted_final_text": "compat-ok",
+          "expected_text": "compat-ok",
+          "full_text": "compat-ok",
+          "authoritative_assistant_count": 1,
           "model_request_count": 1,
           "status": "pass"
         },
-        "certified_at": "2026-07-18T22:03:14Z"
+        "application_canary": {
+          "checked_at": "2026-07-18T23:28:16.435369Z",
+          "path": "Blackline::GenerateResponseJob",
+          "persisted_final_text": "compat-ok",
+          "authoritative_final_text": "compat-ok",
+          "authoritative_assistant_count": 1,
+          "model_request_count": 1,
+          "cleanup_status": "pass",
+          "status": "pass"
+        },
+        "certified_at": "2026-07-18T23:28:16.435369Z"
       },
       "previous": null
     },
@@ -85,13 +186,41 @@
       },
       "candidate": {
         "status": "compatibility-certified",
-        "consumer_commit": "19747b59fa21e12560afd9edd73ed674ab3a644c",
+        "certification_scope": "pre-merge-pr-head-candidate-only",
+        "promotion_eligible": false,
+        "promotion_blockers": [
+          "consumer-ref-is-an-unmerged-pull-request-head",
+          "no-certified-previous-tuple"
+        ],
+        "consumer_commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
+        "consumer_ref": {
+          "kind": "pull-request-head",
+          "repository": "ajaynomics/travelwolf",
+          "commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
+          "tree": "8b3f8a97dc1f1d8b558a49523bf312d2810422df",
+          "base_commit": "75c92ed5248996e5278ac9a3351cc4eaf03df820",
+          "review_url": "https://gitea.ajay.to/ajaynomics/travelwolf/pulls/29"
+        },
         "opencode_ruby": {
           "version": "0.0.1.alpha7",
           "git_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
           "tag_provenance": {
             "tag": "v0.0.1.alpha7",
             "annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645"
+          },
+          "source": {
+            "type": "git",
+            "uri": "https://gitea.krishnan.ca/ajaynomics/opencode-ruby.git",
+            "requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+            "locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+            "loaded_source_proof": {
+              "status": "pass",
+              "source_class": "Bundler::Source::Git",
+              "loaded_version": "0.0.1.alpha7",
+              "observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+              "observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+              "test": "test/services/travelwolf/opencode_env_wiring_test.rb"
+            }
           }
         },
         "opencode_rails": {
@@ -100,22 +229,52 @@
           "tag_provenance": {
             "tag": "v0.0.1.alpha7",
             "annotated_tag_object": "61e128084b2b665c0ba20b332987e41794948d7c"
+          },
+          "source": {
+            "type": "git",
+            "uri": "https://gitea.krishnan.ca/ajaynomics/opencode-rails.git",
+            "requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+            "locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+            "loaded_source_proof": {
+              "status": "pass",
+              "source_class": "Bundler::Source::Git",
+              "loaded_version": "0.0.1.alpha7",
+              "observed_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+              "observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
+              "test": "test/services/travelwolf/opencode_env_wiring_test.rb"
+            }
           }
         },
         "runtime": {
           "image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
           "reported_version": "1.16.1"
         },
+        "deterministic_contract": {
+          "evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
+          "checked_at": "2026-07-18T23:23:03Z",
+          "image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
+          "opencode_ruby_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+          "expected_text": "compat-ok",
+          "full_text": "compat-ok",
+          "authoritative_assistant_count": 1,
+          "model_request_count": 1,
+          "status": "pass"
+        },
         "application_canary": {
-          "run_id": "20260718215135-8d8102c0",
+          "run_id": "travelwolf-alpha7-ref-20260718T232211Z-48eadf",
-          "checked_at": "2026-07-18T21:51:56.552Z",
+          "checked_at": "2026-07-18T23:22:26.216140Z",
-          "final_text": "TRAVELWOLF_ALPHA7_SUBSCRIBE_READY",
+          "final_text": "TRAVELWOLF_ALPHA7_REF_PIN_READY",
-          "application_prompt_count": 1,
+          "subscription_ready_before_prompt": true,
-          "model_request_count_observed": false,
+          "opencode_api_prompt_count": 1,
+          "provider_request_count_observed": false,
+          "message_roles": [
+            "user",
+            "assistant"
+          ],
           "cleanup_status": "pass",
           "status": "pass"
         },
-        "certified_at": "2026-07-18T22:03:14Z"
+        "certified_at": "2026-07-18T23:35:57Z"
       },
       "previous": null
     },
@@ -130,36 +289,87 @@
         },
         "runtime": {
           "tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
+          "image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
           "docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
           "source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
+          "base_image": "docker-registry:5000/mushu-opencode-base@sha256:de8a6adeefb30ce1c474cde23fe173dfe059434a13df0a54d14c7473edb33e16",
           "reported_version": "0.0.0-permission-shortcuts-202606300721"
         }
       },
       "candidate": {
         "status": "compatibility-certified",
-        "consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
+        "certification_scope": "pre-merge-pr-head-candidate-only",
+        "promotion_eligible": false,
+        "promotion_blockers": [
+          "consumer-ref-is-an-unmerged-pull-request-head",
+          "no-certified-previous-tuple"
+        ],
+        "consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
+        "consumer_ref": {
+          "kind": "pull-request-head",
+          "repository": "ajaynomics/mushu",
+          "commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
+          "tree": "762eb8dcc7042a52cd240ca69acdb9cb45150a84",
+          "base_commit": "fe16e5bab028e3c92cd5508ef2cebd9bfa23386f",
+          "review_url": "https://gitea.ajay.to/ajaynomics/mushu/pulls/1"
+        },
         "opencode_ruby": {
           "version": "0.0.1.alpha7",
           "git_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
           "tag_provenance": {
             "tag": "v0.0.1.alpha7",
             "annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645"
+          },
+          "source": {
+            "type": "git",
+            "uri": "https://gitea.krishnan.ca/ajaynomics/opencode-ruby.git",
+            "requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+            "locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+            "loaded_source_proof": {
+              "status": "pass",
+              "source_class": "Bundler::Source::Git",
+              "loaded_version": "0.0.1.alpha7",
+              "observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+              "observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
+              "loaded_file_within_spec": true,
+              "test": "test/services/mushu/runtime/opencode_dependency_provenance_test.rb"
+            }
           }
         },
         "runtime": {
           "tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
+          "image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
           "docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
           "source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
+          "base_image": "docker-registry:5000/mushu-opencode-base@sha256:de8a6adeefb30ce1c474cde23fe173dfe059434a13df0a54d14c7473edb33e16",
           "reported_version": "0.0.0-permission-shortcuts-202606300721"
         },
-        "application_canary": {
+        "deterministic_contract": {
-          "run_id": "mushu-alpha7-20260718T215300Z-f26d958",
+          "checked_at": "2026-07-18T23:23:41Z",
-          "checked_at": "2026-07-18T21:53:00Z",
+          "image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
-          "persisted_final_text": "compat-ok",
+          "expected_text": "compat-ok",
+          "full_text": "compat-ok",
+          "authoritative_assistant_count": 1,
           "model_request_count": 1,
           "status": "pass"
         },
-        "certified_at": "2026-07-18T22:03:14Z"
+        "application_canary": {
+          "checked_at": "2026-07-18T23:26:06.865190Z",
+          "response_text": "compat-ok",
+          "authoritative_final_text": "compat-ok",
+          "message_roles": [
+            "user",
+            "assistant"
+          ],
+          "authoritative_assistant_count": 1,
+          "provider_request_count": 1,
+          "mapping_and_last_turn_persisted": true,
+          "active_claim_cleared": true,
+          "opencode_session_deleted": true,
+          "synthetic_database_rows_after_cleanup": 0,
+          "status": "pass"
+        },
+        "certified_at": "2026-07-18T23:26:06.865190Z"
       },
       "previous": null
     }

profiles/plugin-ledger.json

@@ -1,6 +1,8 @@
 {
   "id": "plugin-ledger",
   "owner": "opencode-ajent",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "required_behaviors": [
     "exact-upstream-image",
     "exact-plugin-version",

profiles/provider-hooks.json

@@ -1,6 +1,8 @@
 {
   "id": "provider-hooks",
   "owner": "inference",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "required_behaviors": [
     "provider-schema",
     "model-routing",

profiles/rails-persisted-turn.json

@@ -1,6 +1,8 @@
 {
   "id": "rails-persisted-turn",
   "owner": "opencode-rails",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "extends": ["ruby-rest-sse"],
   "required_behaviors": [
     "session-recovery",

profiles/ruby-rest-sse.json

@@ -1,6 +1,8 @@
 {
   "id": "ruby-rest-sse",
   "owner": "opencode-ruby",
+  "certification_mode": "shared-ruby-fixture-and-live-probe",
+  "shared_ruby_probe_sufficient": true,
   "required_fixtures": [
     "legacy-idle",
     "current-status-idle",

profiles/strict-v2.json

@@ -1,6 +1,8 @@
 {
   "id": "strict-v2",
   "owner": "leela",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "required_behaviors": [
     "exact-upstream-version-and-commit",
     "bun-toolchain-provenance",

profiles/voice-stream.json

@@ -1,6 +1,8 @@
 {
   "id": "voice-stream",
   "owner": "greenroom",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "extends": ["ruby-rest-sse"],
   "required_behaviors": [
     "legacy-and-current-terminal-events",

ruby/exact_live_contract.rb

@@ -13,22 +13,13 @@ module OpenCodeCompat
     end
 
     def assert_model_request_count!(value)
-      count = Integer(value.to_s, 10)
+      count = Integer(value, 10)
       return if count == 1
 
       raise ContractError, "Expected exactly one deterministic model request, got #{count}"
     rescue ArgumentError, TypeError
       raise ContractError, "Deterministic model request count is not an integer: #{value.inspect}"
     end
-
-    def assert_authoritative_assistant_count!(value)
-      count = Integer(value.to_s, 10)
-      return if count == 1
-
-      raise ContractError, "Expected exactly one authoritative assistant message, got #{count}"
-    rescue ArgumentError, TypeError
-      raise ContractError, "Authoritative assistant message count is not an integer: #{value.inspect}"
-    end
   end
 end
 

ruby/live_probe.rb

@@ -37,7 +37,7 @@ begin
 
   messages = client.get_messages(session_id)
   assistant_messages = Array(messages).select { |message| message.dig(:info, :role) == "assistant" }
-  OpenCodeCompat::ExactLiveContract.assert_authoritative_assistant_count!(assistant_messages.length)
+  raise "No authoritative assistant exchange returned" if assistant_messages.empty?
 
   puts JSON.generate(
     status: "pass",

ruby/lockstep_client_contract.rb

@@ -1,422 +0,0 @@
-# frozen_string_literal: true
-
-require "fileutils"
-require "json"
-require "open3"
-require "rubygems"
-
-module OpenCodeCompat
-  class LockstepClientContract
-    class ContractError < StandardError; end
-    class GitCommandError < ContractError
-      attr_reader :exitstatus
-
-      def initialize(message, exitstatus:)
-        @exitstatus = exitstatus
-        super(message)
-      end
-    end
-
-    CONTRACT_NAME = "opencode-client-lockstep"
-    OPENCODE_RUBY_GIT_URI = "https://github.com/ajaynomics/opencode-ruby.git"
-    PUBLICATION_PROVENANCE = {
-      "published" => "annotated-tag",
-      "unpublished" => "commit"
-    }.freeze
-    REQUIRED_ENV = %w[
-      OPENCODE_CLIENT_PUBLICATION_STATE
-      OPENCODE_RUBY_PATH
-      OPENCODE_RUBY_COMMIT
-      OPENCODE_RUBY_PROVENANCE_KIND
-      OPENCODE_RUBY_VERSION
-      OPENCODE_RAILS_PATH
-      OPENCODE_RAILS_COMMIT
-      OPENCODE_RAILS_PROVENANCE_KIND
-      OPENCODE_RAILS_VERSION
-    ].freeze
-
-    def self.from_environment(env: ENV, git_resolver: nil, git_head_resolver: nil)
-      require "bundler"
-      require "opencode-rails"
-
-      new(
-        env: env,
-        git_resolver: git_resolver,
-        git_head_resolver: git_head_resolver,
-        loaded_specs: Gem.loaded_specs,
-        bundle_specs: Bundler.load.specs,
-        runtime_ruby_version: RUBY_VERSION,
-        ruby_version: Opencode::VERSION,
-        rails_version: Opencode::RAILS_VERSION
-      )
-    end
-
-    def self.canonical_json(value)
-      JSON.generate(canonicalize(value))
-    end
-
-    def self.canonicalize(value)
-      case value
-      when Hash
-        value.keys.map(&:to_s).sort.to_h do |key|
-          source_key = value.key?(key) ? key : value.keys.find { |candidate| candidate.to_s == key }
-          [key, canonicalize(value.fetch(source_key))]
-        end
-      when Array
-        value.map { |entry| canonicalize(entry) }
-      else
-        value
-      end
-    end
-    private_class_method :canonicalize
-
-    def initialize(
-      env:,
-      loaded_specs:,
-      bundle_specs:,
-      ruby_version:,
-      rails_version:,
-      runtime_ruby_version: RUBY_VERSION,
-      git_resolver: nil,
-      git_head_resolver: nil
-    )
-      @env = env
-      @loaded_specs = loaded_specs
-      @bundle_specs = bundle_specs
-      @ruby_version = ruby_version.to_s
-      @rails_version = rails_version.to_s
-      @runtime_ruby_version = runtime_ruby_version.to_s
-      @git_resolver = git_resolver || method(:resolve_git)
-      @git_head_resolver = git_head_resolver
-    end
-
-    def verify
-      ensure_required_environment!
-
-      ruby_path = realpath("OPENCODE_RUBY_PATH")
-      rails_path = realpath("OPENCODE_RAILS_PATH")
-      ruby_commit = exact_commit("OPENCODE_RUBY_COMMIT")
-      rails_commit = exact_commit("OPENCODE_RAILS_COMMIT")
-      expected_ruby_version = exact_version("OPENCODE_RUBY_VERSION")
-      expected_rails_version = exact_version("OPENCODE_RAILS_VERSION")
-      publication_state = exact_publication_state
-
-      assert_equal!(ruby_commit, checkout_head(ruby_path, "opencode-ruby"), "opencode-ruby checkout commit")
-      assert_equal!(rails_commit, checkout_head(rails_path, "opencode-rails"), "opencode-rails checkout commit")
-      ruby_source_provenance = source_provenance(
-        path: ruby_path,
-        label: "opencode-ruby",
-        prefix: "OPENCODE_RUBY",
-        publication_state: publication_state,
-        expected_commit: ruby_commit,
-        expected_version: expected_ruby_version
-      )
-      rails_source_provenance = source_provenance(
-        path: rails_path,
-        label: "opencode-rails",
-        prefix: "OPENCODE_RAILS",
-        publication_state: publication_state,
-        expected_commit: rails_commit,
-        expected_version: expected_rails_version
-      )
-      assert_equal!(expected_ruby_version, @ruby_version, "loaded Opencode::VERSION")
-      assert_equal!(expected_rails_version, @rails_version, "loaded Opencode::RAILS_VERSION")
-      assert_equal!(expected_ruby_version, expected_rails_version, "lockstep client version")
-
-      ruby_spec = loaded_spec!("opencode-ruby")
-      rails_spec = loaded_spec!("opencode-rails")
-      assert_equal!(expected_ruby_version, ruby_spec.version.to_s, "loaded opencode-ruby gem version")
-      assert_equal!(expected_rails_version, rails_spec.version.to_s, "loaded opencode-rails gem version")
-      assert_equal!(rails_path, File.realpath(rails_spec.full_gem_path), "loaded opencode-rails checkout")
-
-      dependency = exact_runtime_dependency!(rails_spec, expected_ruby_version)
-      bundle_spec = bundled_ruby_spec!
-      source = bundle_spec.source
-      unless source && source.respond_to?(:revision) && source.respond_to?(:ref) && source.respond_to?(:uri) &&
-          source.class.name.match?(/(?:\A|::)Git\z/)
-        raise ContractError, "Bundler opencode-ruby source must be a Git source"
-      end
-
-      bundler_revision = source.revision.to_s
-      bundler_ref = source.ref.to_s
-      bundler_uri = source.uri.to_s
-      assert_exact_commit!(bundler_revision, "Bundler opencode-ruby revision")
-      assert_exact_commit!(bundler_ref, "Bundler opencode-ruby ref")
-      assert_equal!(ruby_commit, bundler_revision, "Bundler opencode-ruby revision")
-      assert_equal!(ruby_commit, bundler_ref, "Bundler opencode-ruby ref")
-      assert_equal!(OPENCODE_RUBY_GIT_URI, bundler_uri, "Bundler opencode-ruby URI")
-
-      {
-        "contract" => CONTRACT_NAME,
-        "publication_state" => publication_state,
-        "opencode_rails" => {
-          "checkout_commit" => rails_commit,
-          "gem_version" => rails_spec.version.to_s,
-          "loaded_version" => @rails_version,
-          "source_provenance" => rails_source_provenance,
-          "runtime_dependency" => {
-            "name" => dependency.name,
-            "requirement" => dependency.requirement.to_s
-          }
-        },
-        "opencode_ruby" => {
-          "bundler_git_ref" => bundler_ref,
-          "bundler_git_revision" => bundler_revision,
-          "bundler_git_uri" => bundler_uri,
-          "bundler_source" => source.class.name,
-          "checkout_commit" => ruby_commit,
-          "gem_version" => ruby_spec.version.to_s,
-          "loaded_version" => @ruby_version,
-          "source_provenance" => ruby_source_provenance
-        },
-        "ruby_runtime_version" => @runtime_ruby_version,
-        "schema_version" => 2,
-        "status" => "pass",
-        "workflow" => {
-          "head_sha" => @env["OPENCODE_COMPAT_HEAD_SHA"],
-          "repository" => @env["OPENCODE_COMPAT_REPOSITORY"],
-          "run_attempt" => @env["OPENCODE_COMPAT_RUN_ATTEMPT"],
-          "run_id" => @env["OPENCODE_COMPAT_RUN_ID"],
-          "run_url" => @env["OPENCODE_COMPAT_RUN_URL"]
-        }
-      }
-    rescue Errno::ENOENT, Errno::EACCES => error
-      raise ContractError, error.message
-    end
-
-    def emit(io: $stdout)
-      document = verify
-      json = self.class.canonical_json(document)
-      evidence_path = @env["OPENCODE_COMPAT_EVIDENCE_PATH"].to_s
-
-      unless evidence_path.empty?
-        expanded_path = File.expand_path(evidence_path)
-        FileUtils.mkdir_p(File.dirname(expanded_path))
-        File.binwrite(expanded_path, "#{json}\n")
-      end
-
-      io.puts(json)
-      document
-    end
-
-    private
-
-    def ensure_required_environment!
-      missing = REQUIRED_ENV.select { |name| @env[name].to_s.empty? }
-      return if missing.empty?
-
-      raise ContractError, "missing required environment: #{missing.join(', ')}"
-    end
-
-    def realpath(name)
-      File.realpath(@env.fetch(name))
-    end
-
-    def exact_commit(name)
-      value = @env.fetch(name)
-      assert_exact_commit!(value, name)
-      value
-    end
-
-    def exact_publication_state
-      value = @env.fetch("OPENCODE_CLIENT_PUBLICATION_STATE")
-      return value if PUBLICATION_PROVENANCE.key?(value)
-
-      raise ContractError,
-        "OPENCODE_CLIENT_PUBLICATION_STATE must be one of #{PUBLICATION_PROVENANCE.keys.join(', ')}, got #{value.inspect}"
-    end
-
-    def exact_tag(name)
-      exact_tag_value(@env.fetch(name), name)
-    end
-
-    def exact_tag_value(value, label)
-      if value.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]*\z/) && !value.include?("..") && !value.end_with?(".")
-        return value
-      end
-
-      raise ContractError, "#{label} must be a safe exact Git tag name, got #{value.inspect}"
-    end
-
-    def exact_tag_object(name)
-      value = @env.fetch(name)
-      return value if value.match?(/\A[0-9a-f]{40}\z/)
-
-      raise ContractError,
-        "#{name} must be a full lowercase 40-character Git object ID, got #{value.inspect}"
-    end
-
-    def assert_exact_commit!(value, label)
-      return if value.match?(/\A[0-9a-f]{40}\z/)
-
-      raise ContractError, "#{label} must be a full lowercase 40-character Git commit, got #{value.inspect}"
-    end
-
-    def exact_version(name)
-      value = @env.fetch(name)
-      return value if Gem::Version.correct?(value)
-
-      raise ContractError, "#{name} must be an exact RubyGems version, got #{value.inspect}"
-    end
-
-    def checkout_head(path, label)
-      head = if @git_head_resolver
-        @git_head_resolver.call(path).to_s.strip
-      else
-        git_value(path, "#{label} checkout HEAD", "rev-parse", "--verify", "HEAD^{commit}")
-      end
-      assert_exact_commit!(head, "#{label} checkout HEAD")
-      head
-    rescue ContractError
-      raise
-    rescue StandardError => error
-      raise ContractError, "could not resolve #{label} checkout HEAD: #{error.message}"
-    end
-
-    def source_provenance(path:, label:, prefix:, publication_state:, expected_commit:, expected_version:)
-      kind_name = "#{prefix}_PROVENANCE_KIND"
-      kind = @env.fetch(kind_name)
-      expected_kind = PUBLICATION_PROVENANCE.fetch(publication_state)
-      assert_equal!(expected_kind, kind, "#{label} provenance kind for #{publication_state} candidate")
-
-      case kind
-      when "commit"
-        ensure_unpublished_tag_absent!(path, label, expected_version)
-        supplied_tag_fields = %W[#{prefix}_TAG #{prefix}_TAG_OBJECT].select do |name|
-          !@env[name].to_s.empty?
-        end
-        unless supplied_tag_fields.empty?
-          raise ContractError,
-            "#{label} unpublished commit provenance must not supply #{supplied_tag_fields.join(', ')}"
-        end
-
-        {"commit" => expected_commit, "kind" => "commit"}
-      when "annotated-tag"
-        annotated_tag_provenance(
-          path: path,
-          label: label,
-          tag_name: "#{prefix}_TAG",
-          tag_object: "#{prefix}_TAG_OBJECT",
-          expected_commit: expected_commit
-        ).merge("kind" => "annotated-tag")
-      else
-        raise ContractError, "#{kind_name} has unsupported value #{kind.inspect}"
-      end
-    end
-
-    def ensure_unpublished_tag_absent!(path, label, expected_version)
-      tag = exact_tag_value("v#{expected_version}", "#{label} expected release tag")
-      tag_ref = "refs/tags/#{tag}"
-      resolved = begin
-        @git_resolver.call(path, "rev-parse", "--verify", "--quiet", tag_ref).to_s.strip
-      rescue GitCommandError => error
-        raise ContractError, "could not check #{label} release tag: #{error.message}" unless error.exitstatus == 1
-
-        nil
-      rescue KeyError
-        nil
-      end
-      return if resolved.nil? || resolved.empty?
-
-      raise ContractError,
-        "#{label} release tag #{tag} already exists; publication_state must be published with annotated-tag provenance"
-    end
-
-    def annotated_tag_provenance(path:, label:, tag_name:, tag_object:, expected_commit:)
-      tag = exact_tag(tag_name)
-      object = exact_tag_object(tag_object)
-      tag_ref = "refs/tags/#{tag}"
-
-      object_type = git_value(path, "#{label} annotated tag object type", "cat-file", "-t", object)
-      assert_equal!("tag", object_type, "#{label} annotated tag object type")
-
-      resolved_object = git_value(path, "#{label} local tag ref", "rev-parse", "--verify", tag_ref)
-      assert_exact_commit!(resolved_object, "#{label} local tag ref object")
-      assert_equal!(object, resolved_object, "#{label} local tag ref object")
-
-      object_commit = git_value(path, "#{label} annotated tag peel", "rev-parse", "--verify", "#{object}^{commit}")
-      assert_exact_commit!(object_commit, "#{label} annotated tag peeled commit")
-      assert_equal!(expected_commit, object_commit, "#{label} annotated tag peeled commit")
-
-      ref_commit = git_value(path, "#{label} local tag ref peel", "rev-parse", "--verify", "#{tag_ref}^{commit}")
-      assert_exact_commit!(ref_commit, "#{label} local tag ref peeled commit")
-      assert_equal!(expected_commit, ref_commit, "#{label} local tag ref peeled commit")
-
-      {
-        "annotated_tag_object" => object,
-        "peeled_commit" => object_commit,
-        "tag" => tag
-      }
-    end
-
-    def git_value(path, label, *arguments)
-      @git_resolver.call(path, *arguments).to_s.strip
-    rescue StandardError => error
-      raise ContractError, "could not resolve #{label}: #{error.message}"
-    end
-
-    def resolve_git(path, *arguments)
-      stdout, stderr, status = Open3.capture3("git", "-C", path, *arguments)
-      return stdout.strip if status.success?
-
-      detail = stderr.strip
-      detail = "git exited #{status.exitstatus}" if detail.empty?
-      raise GitCommandError.new(detail, exitstatus: status.exitstatus)
-    end
-
-    def loaded_spec!(name)
-      @loaded_specs.fetch(name)
-    rescue KeyError
-      raise ContractError, "#{name} is not present in Gem.loaded_specs"
-    end
-
-    def exact_runtime_dependency!(rails_spec, ruby_version)
-      dependencies = rails_spec.runtime_dependencies.select { |dependency| dependency.name == "opencode-ruby" }
-      unless dependencies.length == 1
-        raise ContractError, "opencode-rails must declare exactly one runtime dependency on opencode-ruby"
-      end
-
-      dependency = dependencies.first
-      expected = [["=", Gem::Version.new(ruby_version)]]
-      unless dependency.requirement.requirements == expected
-        raise ContractError,
-          "opencode-rails must require opencode-ruby = #{ruby_version}, got #{dependency.requirement}"
-      end
-
-      dependency
-    end
-
-    def bundled_ruby_spec!
-      specs = @bundle_specs.select { |spec| spec.name == "opencode-ruby" }
-      return specs.first if specs.length == 1
-
-      raise ContractError, "Bundler must resolve exactly one opencode-ruby spec, found #{specs.length}"
-    end
-
-    def assert_equal!(expected, actual, label)
-      return if expected == actual
-
-      raise ContractError, "#{label} must equal #{expected.inspect}, got #{actual.inspect}"
-    end
-  end
-end
-
-if $PROGRAM_NAME == __FILE__
-  begin
-    OpenCodeCompat::LockstepClientContract.from_environment.emit
-  rescue StandardError => error
-    failure = OpenCodeCompat::LockstepClientContract.canonical_json(
-      "contract" => OpenCodeCompat::LockstepClientContract::CONTRACT_NAME,
-      "error" => "#{error.class}: #{error.message}",
-      "schema_version" => 2,
-      "status" => "fail"
-    )
-    if (evidence_path = ENV["OPENCODE_COMPAT_EVIDENCE_PATH"]) && !evidence_path.empty?
-      expanded_path = File.expand_path(evidence_path)
-      FileUtils.mkdir_p(File.dirname(expanded_path))
-      File.binwrite(expanded_path, "#{failure}\n")
-    end
-    warn failure
-    exit 1
-  end
-end

ruby/opencode_ruby_fixture_contract.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require "json"
-require "fileutils"
-require "time"
 
 root = File.expand_path("..", __dir__)
 gem_path = File.expand_path(ENV.fetch("OPENCODE_RUBY_PATH"))
@@ -11,12 +9,6 @@ require "opencode-ruby"
 
 manifest = JSON.parse(File.read(File.join(root, "fixtures/manifest.json")))
 failures = []
-write_evidence = lambda do |document|
-  next unless (evidence_path = ENV["OPENCODE_COMPAT_EVIDENCE_PATH"])
-
-  FileUtils.mkdir_p(File.dirname(evidence_path))
-  File.write(evidence_path, JSON.pretty_generate(document) + "\n")
-end
 
 manifest.fetch("fixtures").each do |entry|
   reply = Opencode::Reply.new
@@ -64,45 +56,14 @@ manifest.fetch("fixtures").each do |entry|
 end
 
 unless failures.empty?
-  evidence = {
-    schema_version: 1,
-    kind: "shared-ruby-fixture-contract",
-    status: "fail",
-    checked_at: Time.now.utc.iso8601,
-    adapter: "opencode-ruby",
-    adapter_version: Opencode::VERSION,
-    adapter_commit: ENV["OPENCODE_RUBY_COMMIT"],
-    fixture_count: manifest.fetch("fixtures").length,
-    failures: failures,
-    workflow: {
-      run_id: ENV["OPENCODE_COMPAT_RUN_ID"],
-      run_attempt: ENV["OPENCODE_COMPAT_RUN_ATTEMPT"],
-      head_sha: ENV["OPENCODE_COMPAT_HEAD_SHA"],
-      repository: ENV["OPENCODE_COMPAT_REPOSITORY"],
-      run_url: ENV["OPENCODE_COMPAT_RUN_URL"]
-    }
-  }
-  write_evidence.call(evidence)
   warn failures.join("\n")
   exit 1
 end
 
-evidence = {
+puts JSON.generate(
-  schema_version: 1,
-  kind: "shared-ruby-fixture-contract",
   status: "pass",
-  checked_at: Time.now.utc.iso8601,
   adapter: "opencode-ruby",
   adapter_version: Opencode::VERSION,
   adapter_commit: ENV["OPENCODE_RUBY_COMMIT"],
-  fixture_count: manifest.fetch("fixtures").length,
+  fixture_count: manifest.fetch("fixtures").length
-  workflow: {
+)
-    run_id: ENV["OPENCODE_COMPAT_RUN_ID"],
-    run_attempt: ENV["OPENCODE_COMPAT_RUN_ATTEMPT"],
-    head_sha: ENV["OPENCODE_COMPAT_HEAD_SHA"],
-    repository: ENV["OPENCODE_COMPAT_REPOSITORY"],
-    run_url: ENV["OPENCODE_COMPAT_RUN_URL"]
-  }
-}
-puts JSON.generate(evidence)
-write_evidence.call(evidence)

schemas/runtime-tuples.schema.json

@@ -0,0 +1,401 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/ajaynomics/opencode-compat/schemas/runtime-tuples.schema.json",
+  "title": "OpenCode runtime tuple ledger",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "migration_state",
+    "promotion_readiness",
+    "consumers"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": 2
+    },
+    "migration_state": {
+      "enum": [
+        "candidate",
+        "bootstrap-current-only",
+        "certified"
+      ]
+    },
+    "consumers": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "required": [
+          "profile",
+          "current",
+          "candidate",
+          "previous"
+        ],
+        "properties": {
+          "rollback_state": {
+            "type": "object",
+            "required": [
+              "status",
+              "acknowledgement",
+              "recorded_at",
+              "emergency_provenance_status"
+            ],
+            "properties": {
+              "status": {
+                "const": "degraded-no-certified-previous"
+              },
+              "acknowledgement": {
+                "const": "accept-degraded-rollback-with-failed-emergency-provenance"
+              },
+              "emergency_provenance_status": {
+                "const": "observed-production-contract-failed"
+              }
+            }
+          },
+          "candidate": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "$ref": "#/$defs/candidate"
+              }
+            ]
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "fullCommit": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{40}$"
+    },
+    "loadedGitSource": {
+      "type": "object",
+      "required": [
+        "type",
+        "uri",
+        "requested_ref",
+        "locked_revision",
+        "loaded_source_proof"
+      ],
+      "properties": {
+        "type": {
+          "const": "git"
+        },
+        "requested_ref": {
+          "$ref": "#/$defs/fullCommit"
+        },
+        "locked_revision": {
+          "$ref": "#/$defs/fullCommit"
+        },
+        "loaded_source_proof": {
+          "type": "object",
+          "required": [
+            "status",
+            "source_class",
+            "loaded_version",
+            "observed_revision",
+            "test"
+          ],
+          "properties": {
+            "status": {
+              "const": "pass"
+            },
+            "source_class": {
+              "const": "Bundler::Source::Git"
+            },
+            "observed_ref": {
+              "$ref": "#/$defs/fullCommit"
+            },
+            "observed_revision": {
+              "$ref": "#/$defs/fullCommit"
+            }
+          }
+        }
+      }
+    },
+    "client": {
+      "type": "object",
+      "required": [
+        "version",
+        "git_commit",
+        "source"
+      ],
+      "properties": {
+        "git_commit": {
+          "$ref": "#/$defs/fullCommit"
+        },
+        "source": {
+          "$ref": "#/$defs/loadedGitSource"
+        }
+      }
+    },
+    "consumerRef": {
+      "type": "object",
+      "required": [
+        "kind",
+        "repository",
+        "commit",
+        "tree"
+      ],
+      "properties": {
+        "kind": {
+          "enum": [
+            "pull-request-head",
+            "main-commit"
+          ]
+        },
+        "commit": {
+          "$ref": "#/$defs/fullCommit"
+        },
+        "tree": {
+          "$ref": "#/$defs/fullCommit"
+        },
+        "base_commit": {
+          "$ref": "#/$defs/fullCommit"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "kind": {
+                "const": "pull-request-head"
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "base_commit",
+              "review_url"
+            ]
+          }
+        }
+      ]
+    },
+    "promotionProvenance": {
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "kind",
+            "main_commit",
+            "post_merge_canary"
+          ],
+          "properties": {
+            "kind": {
+              "const": "main-commit"
+            },
+            "main_commit": {
+              "$ref": "#/$defs/fullCommit"
+            },
+            "post_merge_canary": {
+              "type": "object",
+              "required": [
+                "status",
+                "checked_at",
+                "evidence"
+              ],
+              "properties": {
+                "status": {
+                  "const": "pass"
+                },
+                "evidence": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string",
+                    "pattern": "^evidence/"
+                  }
+                }
+              }
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "kind",
+            "pull_request_commit",
+            "pull_request_tree",
+            "main_commit",
+            "main_tree",
+            "attested_at",
+            "post_merge_canary"
+          ],
+          "properties": {
+            "kind": {
+              "const": "identical-tree-attestation"
+            },
+            "pull_request_commit": {
+              "$ref": "#/$defs/fullCommit"
+            },
+            "pull_request_tree": {
+              "$ref": "#/$defs/fullCommit"
+            },
+            "main_commit": {
+              "$ref": "#/$defs/fullCommit"
+            },
+            "main_tree": {
+              "$ref": "#/$defs/fullCommit"
+            },
+            "post_merge_canary": {
+              "type": "object",
+              "required": [
+                "status",
+                "checked_at",
+                "evidence"
+              ],
+              "properties": {
+                "status": {
+                  "const": "pass"
+                },
+                "evidence": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string",
+                    "pattern": "^evidence/"
+                  }
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "runtime": {
+      "type": "object",
+      "required": [
+        "reported_version"
+      ],
+      "properties": {
+        "product_selection": {
+          "type": "object",
+          "required": [
+            "strategy",
+            "source_commit",
+            "references"
+          ],
+          "properties": {
+            "strategy": {
+              "const": "full-consumer-commit-tag"
+            },
+            "source_commit": {
+              "$ref": "#/$defs/fullCommit"
+            },
+            "references": {
+              "type": "object",
+              "minProperties": 1,
+              "additionalProperties": {
+                "type": "string",
+                "pattern": ":[0-9a-f]{40}$"
+              }
+            }
+          }
+        },
+        "product_images": {
+          "type": "object",
+          "minProperties": 1,
+          "additionalProperties": {
+            "type": "object",
+            "required": [
+              "source_commit"
+            ],
+            "properties": {
+              "source_commit": {
+                "$ref": "#/$defs/fullCommit"
+              },
+              "docker_image_id": {
+                "type": "string",
+                "pattern": "^sha256:[0-9a-f]{64}$"
+              },
+              "image": {
+                "type": "string",
+                "pattern": "@sha256:[0-9a-f]{64}$"
+              }
+            },
+            "anyOf": [
+              {
+                "required": [
+                  "docker_image_id"
+                ]
+              },
+              {
+                "required": [
+                  "image"
+                ]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "candidate": {
+      "type": "object",
+      "required": [
+        "status",
+        "certification_scope",
+        "promotion_eligible",
+        "consumer_commit",
+        "consumer_ref",
+        "opencode_ruby",
+        "runtime"
+      ],
+      "properties": {
+        "status": {
+          "const": "compatibility-certified"
+        },
+        "certification_scope": {
+          "enum": [
+            "pre-merge-pr-head-candidate-only",
+            "promotion-deployed"
+          ]
+        },
+        "promotion_eligible": {
+          "type": "boolean"
+        },
+        "consumer_commit": {
+          "$ref": "#/$defs/fullCommit"
+        },
+        "consumer_ref": {
+          "$ref": "#/$defs/consumerRef"
+        },
+        "promotion_provenance": {
+          "$ref": "#/$defs/promotionProvenance"
+        },
+        "opencode_ruby": {
+          "$ref": "#/$defs/client"
+        },
+        "opencode_rails": {
+          "$ref": "#/$defs/client"
+        },
+        "runtime": {
+          "$ref": "#/$defs/runtime"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "promotion_eligible": {
+                "const": true
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "promotion_provenance"
+            ],
+            "properties": {
+              "certification_scope": {
+                "const": "promotion-deployed"
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}

scripts/client_candidate_outputs.rb

@@ -1,9 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require_relative "../lib/opencode_compat/client_candidate"
-
-root = File.expand_path("..", __dir__)
-path = ARGV.fetch(0, File.join(root, "manifests/client-candidate.json"))
-candidate = OpenCodeCompat::ClientCandidate.load(path)
-candidate.github_outputs.each { |key, value| puts "#{key}=#{value}" }

scripts/matrix_json.rb

@@ -1,47 +1,14 @@
 # frozen_string_literal: true
 
 require "json"
-require_relative "../lib/opencode_compat/client_candidate"
 
 root = File.expand_path("..", __dir__)
 manifest = JSON.parse(File.read(File.join(root, "manifests/image-matrix.json")))
-candidate = OpenCodeCompat::ClientCandidate.load(File.join(root, "manifests/client-candidate.json"))
-candidate.verify!
-clients = candidate.document.fetch("clients")
-expected_candidate = {
-  "release_train" => candidate.document.fetch("release_train"),
-  "publication_state" => candidate.document.fetch("publication_state"),
-  "opencode_ruby_commit" => clients.dig("opencode-ruby", "ref"),
-  "opencode_rails_commit" => clients.dig("opencode-rails", "ref")
-}
-matrix_candidate = manifest.fetch("client_candidate")
-unless expected_candidate.all? { |key, value| matrix_candidate[key] == value }
-  abort "image matrix client_candidate must equal the exact client candidate"
-end
-unless %w[pending certified].include?(matrix_candidate.fetch("certification_status"))
-  abort "image matrix client_candidate certification_status must be pending or certified"
-end
-
 matrix = manifest.fetch("public_ci").map do |target|
-  id = target.fetch("id")
-  profiles = target.fetch("profiles")
-  certification_scope = target.fetch("certification_scope", "shared-client-contract-only")
-  unless profiles == ["ruby-rest-sse"]
-    abort "#{id}: public CI executes exactly ruby-rest-sse; got profiles=#{profiles.inspect}"
-  end
-  unless certification_scope == "shared-client-contract-only"
-    abort "#{id}: certification_scope must be shared-client-contract-only; got #{certification_scope.inspect}"
-  end
-
   {
-    "id" => id,
+    "id" => target.fetch("id"),
     "version" => target.fetch("version"),
-    "image" => target.fetch("image"),
+    "image" => target.fetch("image")
-    "consumers" => target.fetch("consumers"),
-    "profiles" => profiles,
-    "required_consumer_profiles" => target.fetch("required_consumer_profiles"),
-    "certification_scope" => certification_scope,
-    "certification_status" => target.fetch("certification_status")
   }
 end
 

scripts/private_default_gateway.rb

@@ -1,28 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require "ipaddr"
-
-route_path = ARGV.fetch(0, "/proc/net/route")
-routes = File.foreach(route_path).drop(1).filter_map do |line|
-  fields = line.split
-  next unless fields.length >= 8
-  next unless fields.fetch(1) == "00000000"
-  next unless (fields.fetch(3).to_i(16) & 0x2) == 0x2
-
-  fields
-end
-
-routes.sort_by { |fields| fields.fetch(6).to_i }.each do |fields|
-  gateway_hex = fields.fetch(2)
-  next unless gateway_hex.match?(/\A[0-9A-Fa-f]{8}\z/)
-
-  gateway = gateway_hex.scan(/../).reverse.map { |octet| octet.to_i(16) }.join(".")
-  address = IPAddr.new(gateway)
-  next unless address.ipv4? && address.private?
-
-  puts address
-  exit 0
-end
-
-abort "no private IPv4 default-route gateway found in #{route_path}"

scripts/promote_runtime_tuple.rb

@@ -20,6 +20,10 @@ parser = OptionParser.new do |opts|
         --status pass --certified-at TIMESTAMP --evidence evidence/FILE.json \\
         [--previous-status pass --previous-certified-at TIMESTAMP \\
          --previous-evidence evidence/FILE.json] [--dry-run]
+      ruby scripts/promote_runtime_tuple.rb bootstrap-current --consumer NAME --consumer-commit SHA \\
+        --status pass --certified-at TIMESTAMP --evidence evidence/FILE.json \\
+        --acknowledge-degraded-rollback \\
+          accept-degraded-rollback-with-failed-emergency-provenance [--dry-run]
   USAGE
 
   opts.on("--consumer NAME") { |value| options["consumer"] = value }
@@ -30,6 +34,9 @@ parser = OptionParser.new do |opts|
   opts.on("--previous-status STATUS") { |value| options["previous_status"] = value }
   opts.on("--previous-certified-at TIMESTAMP") { |value| options["previous_certified_at"] = value }
   opts.on("--previous-evidence PATH") { |value| options["previous_evidence"] << value }
+  opts.on("--acknowledge-degraded-rollback VALUE") do |value|
+    options["degraded_rollback_acknowledgement"] = value
+  end
   opts.on("--dry-run") { options["dry_run"] = true }
 end
 
@@ -94,8 +101,42 @@ begin
         "migration_state" => promoted.fetch("migration_state")
       )
     end
+  when "bootstrap-current"
+    required!(
+      options,
+      "consumer",
+      "consumer_commit",
+      "status",
+      "certified_at",
+      "evidence",
+      "degraded_rollback_acknowledgement"
+    )
+    bootstrapped = promoter.bootstrap_current(
+      consumer: options.fetch("consumer"),
+      consumer_commit: options.fetch("consumer_commit"),
+      certification: {
+        "status" => options.fetch("status"),
+        "certified_at" => options.fetch("certified_at"),
+        "evidence" => options.fetch("evidence")
+      },
+      acknowledgement: options.fetch("degraded_rollback_acknowledgement"),
+      dry_run: options.fetch("dry_run", false)
+    )
+    if options.fetch("dry_run", false)
+      puts JSON.pretty_generate(bootstrapped)
+    else
+      consumer = bootstrapped.fetch("consumers").fetch(options.fetch("consumer"))
+      puts JSON.pretty_generate(
+        "consumer" => options.fetch("consumer"),
+        "current_consumer_commit" => consumer.dig("current", "consumer_commit"),
+        "current_tuple_sha256" => consumer.dig("current", "certification", "tuple_sha256"),
+        "previous" => consumer.fetch("previous"),
+        "rollback_state" => consumer.fetch("rollback_state"),
+        "migration_state" => bootstrapped.fetch("migration_state")
+      )
+    end
   else
-    raise OptionParser::InvalidArgument, "command must be fingerprint or promote"
+    raise OptionParser::InvalidArgument, "command must be fingerprint, promote, or bootstrap-current"
   end
 rescue OpenCodeCompat::PromotionError, OptionParser::ParseError => e
   warn "error: #{e.message}"

scripts/record_upstream_candidate.rb

@@ -8,13 +8,6 @@ tag, published_at, release_url, digest = ARGV
 abort "usage: record_upstream_candidate.rb TAG PUBLISHED_AT RELEASE_URL DIGEST" unless digest
 abort "invalid upstream release tag: #{tag.inspect}" unless tag.match?(/\Av\d+\.\d+\.\d+\z/)
 abort "invalid OCI digest: #{digest.inspect}" unless digest.match?(/\Asha256:[0-9a-f]{64}\z/)
-begin
-  Time.iso8601(published_at)
-rescue ArgumentError, TypeError
-  abort "invalid upstream publication timestamp: #{published_at.inspect}"
-end
-expected_release_url = "https://github.com/anomalyco/opencode/releases/tag/#{tag}"
-abort "invalid upstream release URL: #{release_url.inspect}" unless release_url == expected_release_url
 
 version = tag.delete_prefix("v")
 image = "ghcr.io/anomalyco/opencode@#{digest}"
@@ -22,46 +15,30 @@ upstream_path = File.join(root, "manifests/upstream.json")
 matrix_path = File.join(root, "manifests/image-matrix.json")
 upstream = JSON.parse(File.read(upstream_path))
 matrix = JSON.parse(File.read(matrix_path))
-public_ci = matrix.fetch("public_ci")
-abort "public_ci must be an array" unless public_ci.is_a?(Array)
 
-matching_targets = public_ci.select { |target| target.fetch("image") == image }
+exit 0 if upstream.fetch("release_tag") == tag
-if matching_targets.length > 1
-  abort "image #{image} must appear exactly once in public_ci; found #{matching_targets.length}"
-end
 
-matrix_changed = false
+upstream.merge!(
-if matching_targets.empty?
+  "release_tag" => tag,
-  target_id = "upstream-#{version}-#{digest.delete_prefix('sha256:')}"
+  "version" => version,
-  if public_ci.any? { |target| target.fetch("id") == target_id }
+  "published_at" => published_at,
-    abort "cannot add #{image}: public_ci id #{target_id.inspect} is already used by another image"
+  "release_url" => release_url,
-  end
+  "image" => image,
+  "observed_at" => Time.now.utc.iso8601
+)
 
-  public_ci << {
+unless matrix.fetch("public_ci").any? { |target| target.fetch("image") == image }
-    "id" => target_id,
+  matrix.fetch("public_ci") << {
+    "id" => "upstream-#{version}",
     "version" => version,
     "image" => image,
     "tag_provenance" => "ghcr.io/anomalyco/opencode:#{version}",
-    "consumers" => [],
+    "consumers" => ["upstream-candidate"],
     "profiles" => ["ruby-rest-sse"],
-    "required_consumer_profiles" => [],
+    "required_consumer_profiles" => ["rails-persisted-turn", "voice-stream", "strict-v2", "plugin-ledger", "provider-hooks"],
-    "certification_scope" => "shared-client-contract-only",
     "certification_status" => "pending"
   }
-  matrix_changed = true
 end
 
-upstream_changed = upstream.fetch("release_tag") != tag || upstream.fetch("image") != image
+File.write(upstream_path, JSON.pretty_generate(upstream) + "\n")
-if upstream_changed
+File.write(matrix_path, JSON.pretty_generate(matrix) + "\n")
-  upstream.merge!(
-    "release_tag" => tag,
-    "version" => version,
-    "published_at" => published_at,
-    "release_url" => release_url,
-    "image" => image,
-    "observed_at" => Time.now.utc.iso8601
-  )
-end
-
-File.write(upstream_path, JSON.pretty_generate(upstream) + "\n") if upstream_changed
-File.write(matrix_path, JSON.pretty_generate(matrix) + "\n") if matrix_changed

scripts/run_image_contract.sh

@@ -2,146 +2,46 @@
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-image="${OPENCODE_IMAGE:-}"
+image="${OPENCODE_IMAGE:?set OPENCODE_IMAGE to an immutable image digest}"
-gem_path="${OPENCODE_RUBY_PATH:-}"
+gem_path="${OPENCODE_RUBY_PATH:?set OPENCODE_RUBY_PATH to the candidate checkout}"
-expected_gem_commit="${OPENCODE_RUBY_COMMIT:-}"
-evidence_path="${OPENCODE_COMPAT_EVIDENCE_PATH:-}"
-probe_host="${OPENCODE_PROBE_HOST:-127.0.0.1}"
-container_name="opencode-compat-${RANDOM}-$$"
-llm_container_name="opencode-compat-llm-${RANDOM}-$$"
-network_name="opencode-compat-net-${RANDOM}-$$"
-python_image="python@sha256:399babc8b49529dabfd9c922f2b5eea81d611e4512e3ed250d75bd2e7683f4b0"
-network_created=0
-llm_container_started=0
-opencode_container_started=0
-gem_commit=""
 
-write_failure_evidence() {
+if [[ "$image" != *@sha256:* ]]; then
-  local exit_status="$1"
+  if [[ "${ALLOW_EXACT_IMAGE_ID:-0}" != "1" || "$image" != sha256:* ]]; then
-  [[ -n "$evidence_path" ]] || return 0
-
-  mkdir -p "$(dirname "$evidence_path")"
-  jq -n \
-    --argjson schema_version 1 \
-    --arg kind shared-client-image-contract \
-    --arg status fail \
-    --arg checked_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-    --arg matrix_target "${OPENCODE_MATRIX_ID:-local}" \
-    --arg image "$image" \
-    --arg ruby_commit "${gem_commit:-}" \
-    --arg rails_commit "${OPENCODE_RAILS_COMMIT:-}" \
-    --arg run_id "${OPENCODE_COMPAT_RUN_ID:-}" \
-    --arg run_attempt "${OPENCODE_COMPAT_RUN_ATTEMPT:-}" \
-    --arg head_sha "${OPENCODE_COMPAT_HEAD_SHA:-}" \
-    --arg repository "${OPENCODE_COMPAT_REPOSITORY:-}" \
-    --arg run_url "${OPENCODE_COMPAT_RUN_URL:-}" \
-    --argjson exit_status "$exit_status" \
-    '{
-      schema_version:$schema_version,
-      kind:$kind,
-      status:$status,
-      checked_at:$checked_at,
-      matrix_target:$matrix_target,
-      certification_scope:"shared-client-contract-only",
-      executed_profiles:[],
-      image:{requested:$image},
-      clients:{opencode_ruby:{commit:$ruby_commit},opencode_rails:{commit:$rails_commit,executed:false}},
-      failure:{exit_status:$exit_status},
-      workflow:{run_id:$run_id,run_attempt:$run_attempt,head_sha:$head_sha,repository:$repository,run_url:$run_url}
-    }' >"$evidence_path"
-}
-
-cleanup() {
-  local status=$?
-  trap - EXIT
-  if [[ "$status" != "0" ]]; then
-    echo "OpenCode compatibility probe failed; container log follows" >&2
-    if [[ "$opencode_container_started" == "1" ]]; then
-      docker logs "$container_name" >&2 2>/dev/null || true
-    fi
-    echo "Deterministic model request summary follows" >&2
-    if [[ "$llm_container_started" == "1" ]]; then
-      docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/stats >&2 2>/dev/null || true
-    fi
-    echo >&2
-    write_failure_evidence "$status" || true
-  fi
-  if [[ "$opencode_container_started" == "1" ]]; then
-    docker rm -f "$container_name" >/dev/null 2>&1 || true
-  fi
-  if [[ "$llm_container_started" == "1" ]]; then
-    docker rm -f "$llm_container_name" >/dev/null 2>&1 || true
-  fi
-  if [[ "$network_created" == "1" ]]; then
-    docker network rm "$network_name" >/dev/null 2>&1 || true
-  fi
-  exit "$status"
-}
-trap cleanup EXIT
-
-if [[ -n "$evidence_path" ]]; then
-  mkdir -p "$(dirname "$evidence_path")"
-  : >"$evidence_path"
-fi
-
-if [[ -z "$image" ]]; then
-  echo "set OPENCODE_IMAGE to an immutable image digest" >&2
-  exit 2
-fi
-if [[ -z "$gem_path" ]]; then
-  echo "set OPENCODE_RUBY_PATH to the candidate checkout" >&2
-  exit 2
-fi
-if [[ ! "$image" =~ ^[^[:space:]@]+@sha256:[0-9a-f]{64}$ ]]; then
-  if [[ "${ALLOW_EXACT_IMAGE_ID:-0}" != "1" || ! "$image" =~ ^sha256:[0-9a-f]{64}$ ]]; then
     echo "OPENCODE_IMAGE must be an OCI digest (or an exact local image ID with ALLOW_EXACT_IMAGE_ID=1)" >&2
     exit 2
   fi
 fi
-if ! ruby -ripaddr -e '
-  begin
-    address = IPAddr.new(ARGV.fetch(0))
-    valid = address.ipv4? && (address.loopback? || address.private?)
-  rescue IPAddr::InvalidAddressError
-    valid = false
-  end
-  exit(valid ? 0 : 1)
-' "$probe_host"; then
-  echo "OPENCODE_PROBE_HOST must be a loopback or private IPv4 address" >&2
-  exit 2
-fi
 
-if [[ ! "$expected_gem_commit" =~ ^[0-9a-f]{40}$ ]]; then
+container_name="opencode-compat-${RANDOM}-$$"
-  echo "OPENCODE_RUBY_COMMIT must be a full lowercase 40-character Git commit" >&2
+llm_container_name="opencode-compat-llm-${RANDOM}-$$"
-  exit 2
+network_name="opencode-compat-net-${RANDOM}-$$"
-fi
+python_image="python@sha256:399babc8b49529dabfd9c922f2b5eea81d611e4512e3ed250d75bd2e7683f4b0"
-if ! gem_commit="$(git -C "$gem_path" rev-parse --verify 'HEAD^{commit}' 2>/dev/null)"; then
+
-  echo "OPENCODE_RUBY_PATH must be a readable Git checkout" >&2
+cleanup() {
-  exit 2
+  status=$?
-fi
+  if [[ "$status" != "0" ]]; then
-if [[ "$gem_commit" != "$expected_gem_commit" ]]; then
+    echo "OpenCode compatibility probe failed; container log follows" >&2
-  echo "opencode-ruby checkout HEAD $gem_commit does not match expected commit $expected_gem_commit" >&2
+    docker logs "$container_name" >&2 2>/dev/null || true
-  exit 2
+    echo "Deterministic model request summary follows" >&2
-fi
+    docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/stats >&2 2>/dev/null || true
-if [[ -n "$(git -C "$gem_path" status --porcelain --untracked-files=all)" ]]; then
+    echo >&2
-  echo "opencode-ruby checkout must be clean before certification" >&2
+  fi
-  exit 2
+  docker rm -f "$container_name" >/dev/null 2>&1 || true
-fi
+  docker rm -f "$llm_container_name" >/dev/null 2>&1 || true
+  docker network rm "$network_name" >/dev/null 2>&1 || true
+  return "$status"
+}
+trap cleanup EXIT
 
 docker network create "$network_name" >/dev/null
-network_created=1
 docker run --detach \
   --name "$llm_container_name" \
   --network "$network_name" \
   --network-alias compat-llm \
+  --volume "$repo_root/scripts:/compat:ro" \
   "$python_image" \
-  python -c 'import time; time.sleep(3600)' \
+  python /compat/fake_llm.py --port 8080 --port-file /tmp/compat-port \
   >/dev/null
-llm_container_started=1
-docker cp "$repo_root/scripts/fake_llm.py" "$llm_container_name:/tmp/fake_llm.py"
-docker exec --detach \
-  "$llm_container_name" \
-  python /tmp/fake_llm.py --port 8080 --port-file /tmp/compat-port
 
 for _ in $(seq 1 100); do
   if docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/health >/dev/null 2>&1; then
@@ -184,7 +84,7 @@ config_json="$(jq -cn --arg url "http://compat-llm:8080/v1" '{
 docker run --detach \
   --name "$container_name" \
   --network "$network_name" \
-  --publish "${probe_host}::4096" \
+  --publish 127.0.0.1::4096 \
   --env "OPENCODE_CONFIG_CONTENT=$config_json" \
   --env OPENCODE_DISABLE_AUTOUPDATE=1 \
   --env OPENCODE_DISABLE_AUTOCOMPACT=1 \
@@ -193,10 +93,9 @@ docker run --detach \
   --env OPENCODE_PURE=1 \
   "$image" serve --hostname 0.0.0.0 --port 4096 \
   >/dev/null
-opencode_container_started=1
 
 host_port="$(docker port "$container_name" 4096/tcp | sed -E 's/.*:([0-9]+)$/\1/' | head -1)"
-base_url="http://${probe_host}:${host_port}"
+base_url="http://127.0.0.1:${host_port}"
 
 ready=0
 for _ in $(seq 1 120); do
@@ -219,75 +118,22 @@ fi
 
 server_version="$(docker exec "$container_name" opencode --version)"
 image_id="$(docker inspect "$container_name" --format '{{.Image}}')"
-image_os="$(docker image inspect "$image_id" --format '{{.Os}}')"
+gem_commit="$(git -C "$gem_path" rev-parse HEAD 2>/dev/null || true)"
-image_architecture="$(docker image inspect "$image_id" --format '{{.Architecture}}')"
-image_platform="${image_os}/${image_architecture}"
-expected_version="${OPENCODE_EXPECTED_VERSION:-}"
 
-if [[ -n "$expected_version" && "$server_version" != "$expected_version" ]]; then
+OPENCODE_BASE_URL="$base_url" \
-  echo "OpenCode reported version $server_version; expected $expected_version" >&2
+OPENCODE_RUBY_PATH="$gem_path" \
-  exit 1
+OPENCODE_RUBY_COMMIT="$gem_commit" \
-fi
+  ruby "$repo_root/ruby/live_probe.rb"
-
-live_contract="$(
-  OPENCODE_BASE_URL="$base_url" \
-  OPENCODE_RUBY_PATH="$gem_path" \
-  OPENCODE_RUBY_COMMIT="$gem_commit" \
-    ruby "$repo_root/ruby/live_probe.rb"
-)"
-printf '%s\n' "$live_contract"
 
 llm_stats="$(docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/stats)"
 request_count="$(jq -r '.request_count' <<<"$llm_stats")"
 ruby "$repo_root/ruby/exact_live_contract.rb" "$request_count"
 
-evidence="$(jq -cn \
+jq -cn \
-  --argjson schema_version 1 \
   --arg status pass \
-  --arg kind shared-client-image-contract \
-  --arg matrix_target "${OPENCODE_MATRIX_ID:-local}" \
-  --arg certification_scope "shared-client-contract-only" \
-  --argjson executed_profiles '["ruby-rest-sse"]' \
-  --argjson required_consumer_profiles "${OPENCODE_REQUIRED_CONSUMER_PROFILES:-[]}" \
   --arg image "$image" \
   --arg image_id "$image_id" \
-  --arg image_platform "$image_platform" \
   --arg server_version "$server_version" \
   --arg gem_commit "$gem_commit" \
-  --arg companion_rails_commit "${OPENCODE_RAILS_COMMIT:-}" \
-  --arg run_id "${OPENCODE_COMPAT_RUN_ID:-}" \
-  --arg run_attempt "${OPENCODE_COMPAT_RUN_ATTEMPT:-}" \
-  --arg head_sha "${OPENCODE_COMPAT_HEAD_SHA:-}" \
-  --arg repository "${OPENCODE_COMPAT_REPOSITORY:-}" \
-  --arg run_url "${OPENCODE_COMPAT_RUN_URL:-}" \
-  --argjson live_contract "$live_contract" \
   --argjson llm_request_count "$request_count" \
-  '{
+  '{status:$status,image:$image,image_id:$image_id,server_version:$server_version,opencode_ruby_commit:$gem_commit,llm_request_count:$llm_request_count}'
-    schema_version:$schema_version,
-    kind:$kind,
-    status:$status,
-    checked_at:$live_contract.checked_at,
-    matrix_target:$matrix_target,
-    certification_scope:$certification_scope,
-    executed_profiles:$executed_profiles,
-    required_consumer_profiles:$required_consumer_profiles,
-    image:{requested:$image,docker_image_id:$image_id,platform:$image_platform,reported_version:$server_version},
-    clients:{
-      opencode_ruby:{version:$live_contract.opencode_ruby_version,commit:$gem_commit,executed:true},
-      opencode_rails:{commit:$companion_rails_commit,executed:false}
-    },
-    contract:{
-      expected_text:$live_contract.expected_text,
-      full_text:$live_contract.full_text,
-      observed_part_count:$live_contract.observed_part_count,
-      authoritative_assistant_message_count:$live_contract.authoritative_assistant_message_count,
-      llm_request_count:$llm_request_count
-    },
-    workflow:{run_id:$run_id,run_attempt:$run_attempt,head_sha:$head_sha,repository:$repository,run_url:$run_url}
-  }'
-)"
-printf '%s\n' "$evidence"
-
-if [[ -n "$evidence_path" ]]; then
-  printf '%s\n' "$evidence" >"$evidence_path"
-fi

scripts/run_image_matrix_contract.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-evidence_dir="${OPENCODE_COMPAT_EVIDENCE_DIR:-$repo_root/.compat-evidence}"
-matrix_json="$(ruby "$repo_root/scripts/matrix_json.rb")"
-entry_count="$(jq -er '.include | length' <<<"$matrix_json")"
-
-if [[ ! "$entry_count" =~ ^[1-9][0-9]*$ ]]; then
-  echo "exact image matrix must contain at least one entry" >&2
-  exit 2
-fi
-
-mkdir -p "$evidence_dir"
-
-for ((index = 0; index < entry_count; index++)); do
-  entry="$(jq -ec --argjson index "$index" '.include[$index]' <<<"$matrix_json")"
-  matrix_id="$(jq -er '.id' <<<"$entry")"
-  image="$(jq -er '.image' <<<"$entry")"
-  expected_version="$(jq -er '.version' <<<"$entry")"
-  required_profiles="$(jq -ec '.required_consumer_profiles' <<<"$entry")"
-  evidence_path="$evidence_dir/$matrix_id.json"
-
-  printf 'Running exact image matrix entry %s (%s)\n' "$matrix_id" "$image"
-  OPENCODE_IMAGE="$image" \
-  OPENCODE_EXPECTED_VERSION="$expected_version" \
-  OPENCODE_MATRIX_ID="$matrix_id" \
-  OPENCODE_REQUIRED_CONSUMER_PROFILES="$required_profiles" \
-  OPENCODE_COMPAT_EVIDENCE_PATH="$evidence_path" \
-    bundle exec "$repo_root/scripts/run_image_contract.sh"
-
-  jq -e \
-    --arg matrix_id "$matrix_id" \
-    --arg image "$image" \
-    --arg version "$expected_version" \
-    '.status == "pass" and
-      .matrix_target == $matrix_id and
-      .image.requested == $image and
-      .image.reported_version == $version' \
-    "$evidence_path" >/dev/null
-  printf 'Exact image matrix entry %s passed; JSON remains transient on this forge.\n' "$matrix_id"
-done
-
-printf 'Full exact image matrix passed (%s entries).\n' "$entry_count"

scripts/upstream_branch_name.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-tag = ARGV.fetch(0)
-digest = ARGV.fetch(1)
-disambiguator = ARGV[2]
-
-abort "release tag must be vMAJOR.MINOR.PATCH" unless tag.match?(/\Av\d+\.\d+\.\d+\z/)
-abort "digest must be an exact sha256" unless digest.match?(/\Asha256:[0-9a-f]{64}\z/)
-
-branch = "compat/upstream-#{tag.delete_prefix('v')}-#{digest.delete_prefix('sha256:')}"
-if disambiguator
-  unless disambiguator.match?(/\A[A-Za-z0-9][A-Za-z0-9-]*\z/)
-    abort "disambiguator must contain only letters, digits, and hyphens"
-  end
-
-  branch = "#{branch}-r#{disambiguator}"
-end
-
-abort "generated branch is longer than 128 characters" if branch.length > 128
-
-puts branch

test/client_candidate_test.rb

@@ -1,114 +0,0 @@
-# frozen_string_literal: true
-
-require "fileutils"
-require "json"
-require "minitest/autorun"
-require "open3"
-require "rbconfig"
-require "tmpdir"
-require_relative "../lib/opencode_compat/client_candidate"
-
-class ClientCandidateTest < Minitest::Test
-  ROOT = File.expand_path("..", __dir__)
-  RUBY_COMMIT = "9277646a4bb2cf25a8384ffc140b154f49ea5766"
-  RAILS_COMMIT = "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f"
-
-  def setup
-    @document = JSON.parse(File.binread(File.join(ROOT, "manifests/client-candidate.json")))
-  end
-
-  def test_accepts_exact_unpublished_commit_candidate_and_emits_safe_outputs
-    outputs = OpenCodeCompat::ClientCandidate.new(@document).github_outputs
-
-    assert_equal "unpublished", outputs.fetch("publication_state")
-    assert_equal "commit", outputs.fetch("ruby_provenance_kind")
-    assert_equal RUBY_COMMIT, outputs.fetch("ruby_ref")
-    assert_equal "", outputs.fetch("ruby_tag")
-    assert_equal "commit", outputs.fetch("rails_provenance_kind")
-    assert_equal RAILS_COMMIT, outputs.fetch("rails_ref")
-    assert_equal "", outputs.fetch("rails_tag_object")
-  end
-
-  def test_unpublished_candidate_rejects_mixed_or_mismatched_provenance
-    @document.dig("clients", "opencode-ruby", "provenance")["tag"] = "v0.0.1.alpha8"
-    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
-    assert_match(/commit provenance keys/, error.message)
-
-    @document.dig("clients", "opencode-ruby", "provenance").delete("tag")
-    @document.dig("clients", "opencode-ruby", "provenance")["commit"] = "f" * 40
-    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
-    assert_match(/provenance commit/, error.message)
-  end
-
-  def test_published_candidate_requires_annotated_tag_provenance_for_both_clients
-    publish_document!
-
-    candidate.verify!
-
-    @document.dig("clients", "opencode-ruby")["provenance"] = {
-      "kind" => "commit",
-      "commit" => RUBY_COMMIT
-    }
-    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
-    assert_match(/provenance kind must equal "annotated-tag"/, error.message)
-  end
-
-  def test_published_candidate_rejects_wrong_tag_object_shape_or_peel
-    publish_document!
-    ruby_provenance = @document.dig("clients", "opencode-ruby", "provenance")
-    ruby_provenance["annotated_tag_object"] = "short"
-    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
-    assert_match(/annotated tag object must be a full lowercase 40-character/, error.message)
-
-    ruby_provenance["annotated_tag_object"] = "3" * 40
-    ruby_provenance["peeled_commit"] = "f" * 40
-    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
-    assert_match(/peeled commit/, error.message)
-  end
-
-  def test_rejects_non_lockstep_runtime_dependency
-    dependency = @document.dig("clients", "opencode-rails", "runtime_dependencies", "opencode-ruby")
-    dependency["requirement"] = "~> 0.0.1.alpha8"
-    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
-    assert_match(/runtime dependency requirement/, error.message)
-
-    dependency["requirement"] = "= 0.0.1.alpha8"
-    dependency["ref"] = "f" * 40
-    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
-    assert_match(/runtime dependency ref/, error.message)
-  end
-
-  def test_output_script_validates_the_repository_manifest
-    output, error, status = Open3.capture3(
-      RbConfig.ruby,
-      File.join(ROOT, "scripts/client_candidate_outputs.rb")
-    )
-
-    assert status.success?, error
-    assert_includes output.lines, "ruby_ref=#{RUBY_COMMIT}\n"
-    assert_includes output.lines, "rails_ref=#{RAILS_COMMIT}\n"
-    assert_includes output.lines, "publication_state=unpublished\n"
-  end
-
-  private
-
-  def candidate
-    OpenCodeCompat::ClientCandidate.new(@document)
-  end
-
-  def publish_document!
-    @document["publication_state"] = "published"
-    {
-      "opencode-ruby" => "3" * 40,
-      "opencode-rails" => "4" * 40
-    }.each do |name, tag_object|
-      client = @document.fetch("clients").fetch(name)
-      client["provenance"] = {
-        "kind" => "annotated-tag",
-        "tag" => "v#{client.fetch('version')}",
-        "annotated_tag_object" => tag_object,
-        "peeled_commit" => client.fetch("ref")
-      }
-    end
-  end
-end

test/exact_live_contract_test.rb

@@ -26,14 +26,4 @@ class ExactLiveContractTest < Minitest::Test
       end
     end
   end
-
-  def test_accepts_only_one_authoritative_assistant_message
-    assert_nil OpenCodeCompat::ExactLiveContract.assert_authoritative_assistant_count!(1)
-
-    [0, 2, "not-a-number"].each do |count|
-      assert_raises(OpenCodeCompat::ExactLiveContract::ContractError) do
-        OpenCodeCompat::ExactLiveContract.assert_authoritative_assistant_count!(count)
-      end
-    end
-  end
 end

test/image_contract_evidence_test.rb

@@ -1,198 +0,0 @@
-# frozen_string_literal: true
-
-require "fileutils"
-require "json"
-require "minitest/autorun"
-require "open3"
-require "rbconfig"
-require "tmpdir"
-
-class ImageContractEvidenceTest < Minitest::Test
-  ROOT = File.expand_path("..", __dir__)
-  RUNNER = File.join(ROOT, "scripts/run_image_contract.sh")
-  GATEWAY_RESOLVER = File.join(ROOT, "scripts/private_default_gateway.rb")
-  VALID_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'a' * 64}"
-
-  def setup
-    @tmp = Dir.mktmpdir("opencode-image-evidence")
-    @bin = File.join(@tmp, "bin")
-    @docker_marker = File.join(@tmp, "docker-called")
-    FileUtils.mkdir_p(@bin)
-    docker = File.join(@bin, "docker")
-    File.write(docker, <<~SH)
-      #!/usr/bin/env bash
-      : >"$DOCKER_CALLED_MARKER"
-      exit 99
-    SH
-    FileUtils.chmod(0o755, docker)
-  end
-
-  def teardown
-    FileUtils.remove_entry(@tmp)
-  end
-
-  def test_invalid_input_overwrites_stale_pass_without_touching_docker
-    evidence_path = File.join(@tmp, "evidence.json")
-    File.write(evidence_path, JSON.generate("status" => "pass"))
-
-    _output, _error, status = run_contract(
-      "OPENCODE_IMAGE" => "latest",
-      "OPENCODE_RUBY_PATH" => ROOT,
-      "OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path
-    )
-
-    assert_equal 2, status.exitstatus
-    refute_path_exists @docker_marker
-    evidence = JSON.parse(File.read(evidence_path))
-    assert_equal "fail", evidence.fetch("status")
-    assert_equal 2, evidence.dig("failure", "exit_status")
-    assert_equal "latest", evidence.dig("image", "requested")
-    assert_equal [], evidence.fetch("executed_profiles")
-  end
-
-  def test_rejects_truncated_registry_and_local_image_ids_before_docker
-    {
-      "ghcr.io/anomalyco/opencode@sha256:#{'a' * 12}" => {},
-      "sha256:#{'b' * 12}" => {"ALLOW_EXACT_IMAGE_ID" => "1"}
-    }.each_with_index do |(image, extra_environment), index|
-      evidence_path = File.join(@tmp, "truncated-#{index}.json")
-      _output, error, status = run_contract(
-        {
-          "OPENCODE_IMAGE" => image,
-          "OPENCODE_RUBY_PATH" => ROOT,
-          "OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path
-        }.merge(extra_environment)
-      )
-
-      assert_equal 2, status.exitstatus
-      assert_match(/must be an OCI digest/, error)
-      assert_equal image, JSON.parse(File.read(evidence_path)).dig("image", "requested")
-    end
-    refute_path_exists @docker_marker
-  end
-
-  def test_rejects_a_checkout_at_a_different_commit_before_docker
-    checkout, _commit = git_checkout
-    evidence_path = File.join(@tmp, "mismatch.json")
-
-    _output, error, status = run_contract(
-      base_environment(checkout, "f" * 40, evidence_path)
-    )
-
-    assert_equal 2, status.exitstatus
-    assert_match(/does not match expected commit/, error)
-    assert_failed_without_docker(evidence_path)
-  end
-
-  def test_rejects_a_dirty_checkout_before_docker
-    checkout, commit = git_checkout
-    File.write(File.join(checkout, "dirty.txt"), "not certified\n")
-    evidence_path = File.join(@tmp, "dirty.json")
-
-    _output, error, status = run_contract(base_environment(checkout, commit, evidence_path))
-
-    assert_equal 2, status.exitstatus
-    assert_match(/checkout must be clean/, error)
-    assert_failed_without_docker(evidence_path)
-  end
-
-  def test_rejects_a_non_git_path_before_docker
-    checkout = File.join(@tmp, "not-a-checkout")
-    FileUtils.mkdir_p(checkout)
-    evidence_path = File.join(@tmp, "not-git.json")
-
-    _output, error, status = run_contract(
-      base_environment(checkout, "f" * 40, evidence_path)
-    )
-
-    assert_equal 2, status.exitstatus
-    assert_match(/readable Git checkout/, error)
-    assert_failed_without_docker(evidence_path)
-  end
-
-  def test_rejects_malformed_ipv6_and_public_probe_hosts_before_docker
-    checkout, commit = git_checkout
-
-    ["not-an-address", "::1", "8.8.8.8"].each_with_index do |probe_host, index|
-      evidence_path = File.join(@tmp, "probe-host-#{index}.json")
-      environment = base_environment(checkout, commit, evidence_path).merge(
-        "OPENCODE_PROBE_HOST" => probe_host
-      )
-
-      _output, error, status = run_contract(environment)
-
-      assert_equal 2, status.exitstatus
-      assert_match(/loopback or private IPv4 address/, error)
-      assert_failed_without_docker(evidence_path)
-    end
-  end
-
-  def test_resolves_a_private_default_gateway_from_linux_route_hex
-    route_path = File.join(@tmp, "route")
-    File.write(route_path, <<~ROUTES)
-      Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT
-      eth0 00000000 010011AC 0003 0 0 10 00000000 0 0 0
-    ROUTES
-
-    output, error, status = Open3.capture3(RbConfig.ruby, GATEWAY_RESOLVER, route_path)
-
-    assert status.success?, error
-    assert_equal "172.17.0.1\n", output
-  end
-
-  def test_gateway_resolver_rejects_a_public_default_gateway
-    route_path = File.join(@tmp, "public-route")
-    File.write(route_path, <<~ROUTES)
-      Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT
-      eth0 00000000 08080808 0003 0 0 10 00000000 0 0 0
-    ROUTES
-
-    _output, error, status = Open3.capture3(RbConfig.ruby, GATEWAY_RESOLVER, route_path)
-
-    refute status.success?
-    assert_match(/no private IPv4 default-route gateway found/, error)
-  end
-
-  private
-
-  def base_environment(checkout, commit, evidence_path)
-    {
-      "OPENCODE_IMAGE" => VALID_IMAGE,
-      "OPENCODE_RUBY_PATH" => checkout,
-      "OPENCODE_RUBY_COMMIT" => commit,
-      "OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path
-    }
-  end
-
-  def run_contract(environment)
-    env = {
-      "PATH" => "#{@bin}:#{ENV.fetch('PATH')}",
-      "DOCKER_CALLED_MARKER" => @docker_marker
-    }.merge(environment)
-    Open3.capture3(env, "bash", RUNNER)
-  end
-
-  def git_checkout
-    path = File.join(@tmp, "checkout-#{rand(1_000_000)}")
-    FileUtils.mkdir_p(path)
-    run_git!(path, "init", "--quiet")
-    run_git!(path, "config", "user.name", "Compatibility Test")
-    run_git!(path, "config", "user.email", "compat@example.test")
-    File.write(File.join(path, "tracked.txt"), "clean\n")
-    run_git!(path, "add", "tracked.txt")
-    run_git!(path, "commit", "--quiet", "-m", "fixture")
-    commit = run_git!(path, "rev-parse", "HEAD").strip
-    [path, commit]
-  end
-
-  def run_git!(path, *arguments)
-    output, error, status = Open3.capture3("git", "-C", path, *arguments)
-    assert status.success?, error
-    output
-  end
-
-  def assert_failed_without_docker(evidence_path)
-    refute_path_exists @docker_marker
-    assert_equal "fail", JSON.parse(File.read(evidence_path)).fetch("status")
-  end
-end

test/lockstep_client_contract_test.rb

@@ -1,415 +0,0 @@
-# frozen_string_literal: true
-
-require "minitest/autorun"
-require "rbconfig"
-require "stringio"
-require "tmpdir"
-require_relative "../ruby/lockstep_client_contract"
-
-module LockstepClientContractTestSources
-  class Git
-    attr_reader :ref, :revision, :uri
-
-    def initialize(revision, ref: revision, uri: OpenCodeCompat::LockstepClientContract::OPENCODE_RUBY_GIT_URI)
-      @revision = revision
-      @ref = ref
-      @uri = uri
-    end
-  end
-
-  class Path; end
-end
-
-class LockstepClientContractTest < Minitest::Test
-  RUBY_COMMIT = "1" * 40
-  RAILS_COMMIT = "2" * 40
-  RUBY_TAG_OBJECT = "3" * 40
-  RAILS_TAG_OBJECT = "4" * 40
-  RUBY_TAG = "v0.0.1.alpha7"
-  RAILS_TAG = "v0.0.1.alpha7"
-  VERSION = "0.0.1.alpha7"
-
-  FakeSpec = Struct.new(:name, :version, :runtime_dependencies, :source, :full_gem_path, keyword_init: true)
-
-  def setup
-    @root = Dir.mktmpdir("opencode-lockstep-contract")
-    @ruby_path = File.join(@root, "opencode-ruby")
-    @rails_path = File.join(@root, "opencode-rails")
-    Dir.mkdir(@ruby_path)
-    Dir.mkdir(@rails_path)
-    @env = {
-      "OPENCODE_CLIENT_PUBLICATION_STATE" => "published",
-      "OPENCODE_RUBY_PATH" => @ruby_path,
-      "OPENCODE_RUBY_COMMIT" => RUBY_COMMIT,
-      "OPENCODE_RUBY_PROVENANCE_KIND" => "annotated-tag",
-      "OPENCODE_RUBY_TAG" => RUBY_TAG,
-      "OPENCODE_RUBY_TAG_OBJECT" => RUBY_TAG_OBJECT,
-      "OPENCODE_RUBY_VERSION" => VERSION,
-      "OPENCODE_RAILS_PATH" => @rails_path,
-      "OPENCODE_RAILS_COMMIT" => RAILS_COMMIT,
-      "OPENCODE_RAILS_PROVENANCE_KIND" => "annotated-tag",
-      "OPENCODE_RAILS_TAG" => RAILS_TAG,
-      "OPENCODE_RAILS_TAG_OBJECT" => RAILS_TAG_OBJECT,
-      "OPENCODE_RAILS_VERSION" => VERSION
-    }
-    @heads = {@ruby_path => RUBY_COMMIT, @rails_path => RAILS_COMMIT}
-    @git_results = {}
-    seed_annotated_tag(@ruby_path, RUBY_TAG, RUBY_TAG_OBJECT, RUBY_COMMIT)
-    seed_annotated_tag(@rails_path, RAILS_TAG, RAILS_TAG_OBJECT, RAILS_COMMIT)
-    @ruby_spec = FakeSpec.new(name: "opencode-ruby", version: Gem::Version.new(VERSION))
-    @rails_spec = FakeSpec.new(
-      name: "opencode-rails",
-      version: Gem::Version.new(VERSION),
-      runtime_dependencies: [Gem::Dependency.new("opencode-ruby", "= #{VERSION}")],
-      full_gem_path: @rails_path
-    )
-    @bundle_ruby_spec = FakeSpec.new(
-      name: "opencode-ruby",
-      source: LockstepClientContractTestSources::Git.new(RUBY_COMMIT)
-    )
-  end
-
-  def teardown
-    FileUtils.remove_entry(@root)
-  end
-
-  def test_verifies_and_emits_canonical_lockstep_evidence
-    evidence_path = File.join(@root, "evidence", "lockstep.json")
-    @env["OPENCODE_COMPAT_EVIDENCE_PATH"] = evidence_path
-    output = StringIO.new
-
-    document = contract.emit(io: output)
-
-    expected_json = OpenCodeCompat::LockstepClientContract.canonical_json(document)
-    assert_equal "#{expected_json}\n", output.string
-    assert_equal "#{expected_json}\n", File.binread(evidence_path)
-    assert_equal "pass", document.fetch("status")
-    assert_equal 2, document.fetch("schema_version")
-    assert_equal "published", document.fetch("publication_state")
-    assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "checkout_commit")
-    assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "bundler_git_ref")
-    assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "bundler_git_revision")
-    assert_equal OpenCodeCompat::LockstepClientContract::OPENCODE_RUBY_GIT_URI,
-      document.dig("opencode_ruby", "bundler_git_uri")
-    assert_equal "annotated-tag", document.dig("opencode_ruby", "source_provenance", "kind")
-    assert_equal RUBY_TAG_OBJECT, document.dig("opencode_ruby", "source_provenance", "annotated_tag_object")
-    assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "source_provenance", "peeled_commit")
-    assert_equal RUBY_TAG, document.dig("opencode_ruby", "source_provenance", "tag")
-    assert_equal RAILS_COMMIT, document.dig("opencode_rails", "checkout_commit")
-    assert_equal RAILS_TAG_OBJECT, document.dig("opencode_rails", "source_provenance", "annotated_tag_object")
-    assert_equal RAILS_COMMIT, document.dig("opencode_rails", "source_provenance", "peeled_commit")
-    assert_equal "= #{VERSION}", document.dig("opencode_rails", "runtime_dependency", "requirement")
-    assert_equal RUBY_VERSION, document.fetch("ruby_runtime_version")
-    assert_nil document.dig("workflow", "run_id")
-    assert_equal expected_json, JSON.generate(JSON.parse(expected_json).sort.to_h)
-  end
-
-  def test_accepts_unpublished_commit_only_provenance_without_tag_lookup
-    use_commit_only_provenance!
-
-    document = contract.verify
-
-    assert_equal "unpublished", document.fetch("publication_state")
-    assert_equal({"commit" => RUBY_COMMIT, "kind" => "commit"},
-      document.dig("opencode_ruby", "source_provenance"))
-    assert_equal({"commit" => RAILS_COMMIT, "kind" => "commit"},
-      document.dig("opencode_rails", "source_provenance"))
-  end
-
-  def test_publication_state_cannot_weaken_published_tag_binding
-    @env["OPENCODE_RUBY_PROVENANCE_KIND"] = "commit"
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/published candidate/, error.message)
-
-    use_commit_only_provenance!
-    @env["OPENCODE_RAILS_PROVENANCE_KIND"] = "annotated-tag"
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/unpublished candidate/, error.message)
-  end
-
-  def test_commit_only_provenance_rejects_residual_tag_coordinates
-    use_commit_only_provenance!
-    @env["OPENCODE_RUBY_TAG"] = RUBY_TAG
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-
-    assert_match(/must not supply OPENCODE_RUBY_TAG/, error.message)
-  end
-
-  def test_commit_only_provenance_stops_when_the_release_tag_appears
-    use_commit_only_provenance!
-    set_git_result(
-      @ruby_path,
-      ["rev-parse", "--verify", "--quiet", "refs/tags/#{RUBY_TAG}"],
-      RUBY_TAG_OBJECT
-    )
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-
-    assert_match(/release tag #{Regexp.escape(RUBY_TAG)} already exists/, error.message)
-    assert_match(/publication_state must be published/, error.message)
-  end
-
-  def test_commit_only_provenance_does_not_treat_git_errors_as_an_absent_tag
-    use_commit_only_provenance!
-    @git_results[[@ruby_path, ["rev-parse", "--verify", "--quiet", "refs/tags/#{RUBY_TAG}"]]] =
-      OpenCodeCompat::LockstepClientContract::GitCommandError.new("corrupt ref", exitstatus: 128)
-
-    resolver = lambda do |path, *arguments|
-      result = resolve_git(path, *arguments)
-      raise result if result.is_a?(Exception)
-
-      result
-    end
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) do
-      contract(git_resolver: resolver).verify
-    end
-
-    assert_match(/could not check opencode-ruby release tag: corrupt ref/, error.message)
-  end
-
-  def test_rejects_checkout_commit_mismatch_for_either_client
-    {
-      @ruby_path => "opencode-ruby checkout commit",
-      @rails_path => "opencode-rails checkout commit"
-    }.each do |path, message|
-      original = @heads.fetch(path)
-      @heads[path] = "f" * 40
-
-      error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-      assert_match message, error.message
-    ensure
-      @heads[path] = original
-    end
-  end
-
-  def test_rejects_non_annotated_tag_object_for_either_client
-    {
-      @ruby_path => RUBY_TAG_OBJECT,
-      @rails_path => RAILS_TAG_OBJECT
-    }.each do |path, object|
-      set_git_result(path, ["cat-file", "-t", object], "commit")
-
-      error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-      assert_match(/annotated tag object type must equal "tag"/, error.message)
-    ensure
-      set_git_result(path, ["cat-file", "-t", object], "tag")
-    end
-  end
-
-  def test_rejects_tampered_annotated_tag_object_coordinate
-    tampered_object = "f" * 40
-    @env["OPENCODE_RUBY_TAG_OBJECT"] = tampered_object
-    set_git_result(@ruby_path, ["cat-file", "-t", tampered_object], "tag")
-    set_git_result(@ruby_path, ["rev-parse", "--verify", "#{tampered_object}^{commit}"], RUBY_COMMIT)
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-
-    assert_match(/opencode-ruby local tag ref object/, error.message)
-    assert_match(/#{RUBY_TAG_OBJECT}/, error.message)
-  end
-
-  def test_rejects_local_tag_ref_resolving_to_another_object
-    set_git_result(
-      @rails_path,
-      ["rev-parse", "--verify", "refs/tags/#{RAILS_TAG}"],
-      "e" * 40
-    )
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-
-    assert_match(/opencode-rails local tag ref object/, error.message)
-  end
-
-  def test_rejects_wrong_object_or_ref_peel
-    object_peel_key = ["rev-parse", "--verify", "#{RUBY_TAG_OBJECT}^{commit}"]
-    set_git_result(@ruby_path, object_peel_key, "e" * 40)
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/opencode-ruby annotated tag peeled commit/, error.message)
-
-    set_git_result(@ruby_path, object_peel_key, RUBY_COMMIT)
-    set_git_result(
-      @ruby_path,
-      ["rev-parse", "--verify", "refs/tags/#{RUBY_TAG}^{commit}"],
-      "e" * 40
-    )
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/opencode-ruby local tag ref peeled commit/, error.message)
-  end
-
-  def test_rejects_missing_local_tag
-    @git_results.delete([@ruby_path, ["rev-parse", "--verify", "refs/tags/#{RUBY_TAG}"]])
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-
-    assert_match(/could not resolve opencode-ruby local tag ref/, error.message)
-  end
-
-  def test_rejects_loaded_or_gem_version_drift
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) do
-      contract(ruby_version: "0.0.1.alpha8").verify
-    end
-    assert_match(/loaded Opencode::VERSION/, error.message)
-
-    @rails_spec.version = Gem::Version.new("0.0.1.alpha8")
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/loaded opencode-rails gem version/, error.message)
-  end
-
-  def test_rejects_non_lockstep_expected_versions
-    @env["OPENCODE_RAILS_VERSION"] = "0.0.1.alpha8"
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) do
-      contract(rails_version: "0.0.1.alpha8").verify
-    end
-
-    assert_match(/lockstep client version/, error.message)
-  end
-
-  def test_rejects_non_exact_or_wrong_rails_runtime_dependency
-    ["~> #{VERSION}", "= 0.0.1.alpha6"].each do |requirement|
-      @rails_spec.runtime_dependencies = [Gem::Dependency.new("opencode-ruby", requirement)]
-
-      error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-      assert_match(/must require opencode-ruby = #{Regexp.escape(VERSION)}/, error.message)
-    end
-  end
-
-  def test_rejects_missing_or_duplicate_rails_runtime_dependency
-    @rails_spec.runtime_dependencies = []
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/exactly one runtime dependency/, error.message)
-
-    @rails_spec.runtime_dependencies = [
-      Gem::Dependency.new("opencode-ruby", "= #{VERSION}"),
-      Gem::Dependency.new("opencode-ruby", "= #{VERSION}")
-    ]
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/exactly one runtime dependency/, error.message)
-  end
-
-  def test_rejects_non_git_or_mismatched_bundler_source
-    @bundle_ruby_spec.source = LockstepClientContractTestSources::Path.new
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/must be a Git source/, error.message)
-
-    @bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new("f" * 40)
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/Bundler opencode-ruby revision/, error.message)
-
-    @bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new(RUBY_COMMIT, ref: "main")
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/Bundler opencode-ruby ref/, error.message)
-
-    @bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new(
-      RUBY_COMMIT,
-      uri: "https://example.test/opencode-ruby.git"
-    )
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/Bundler opencode-ruby URI/, error.message)
-  end
-
-  def test_rejects_loaded_rails_gem_from_another_checkout
-    other_path = File.join(@root, "other-opencode-rails")
-    Dir.mkdir(other_path)
-    @rails_spec.full_gem_path = other_path
-
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-
-    assert_match(/loaded opencode-rails checkout/, error.message)
-  end
-
-  def test_requires_full_exact_candidate_coordinates
-    @env.delete("OPENCODE_RUBY_COMMIT")
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/missing required environment: OPENCODE_RUBY_COMMIT/, error.message)
-
-    @env["OPENCODE_RUBY_COMMIT"] = "main"
-    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
-    assert_match(/full lowercase 40-character Git commit/, error.message)
-  end
-
-  def test_cli_failure_writes_failure_evidence
-    stub_path = File.join(@root, "cli-stubs")
-    evidence_path = File.join(@root, "cli-evidence", "lockstep.json")
-    FileUtils.mkdir_p(stub_path)
-    File.binwrite(File.join(stub_path, "bundler.rb"), <<~RUBY)
-      module Bundler
-        LoadedDefinition = Struct.new(:specs)
-
-        def self.load
-          LoadedDefinition.new([])
-        end
-      end
-    RUBY
-    File.binwrite(File.join(stub_path, "opencode-rails.rb"), <<~RUBY)
-      module Opencode
-        VERSION = #{VERSION.inspect}
-        RAILS_VERSION = #{VERSION.inspect}
-      end
-    RUBY
-
-    _stdout, stderr, status = Open3.capture3(
-      {"OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path},
-      RbConfig.ruby,
-      "-I",
-      stub_path,
-      File.expand_path("../ruby/lockstep_client_contract.rb", __dir__),
-      unsetenv_others: true
-    )
-
-    refute status.success?
-    assert_equal 1, status.exitstatus
-    failure = JSON.parse(File.binread(evidence_path))
-    assert_equal "opencode-client-lockstep", failure.fetch("contract")
-    assert_equal 2, failure.fetch("schema_version")
-    assert_equal "fail", failure.fetch("status")
-    assert_match(/missing required environment/, failure.fetch("error"))
-    assert_equal failure, JSON.parse(stderr)
-  end
-
-  private
-
-  def contract(ruby_version: VERSION, rails_version: VERSION, git_resolver: method(:resolve_git))
-    OpenCodeCompat::LockstepClientContract.new(
-      env: @env,
-      git_resolver: git_resolver,
-      loaded_specs: {
-        "opencode-ruby" => @ruby_spec,
-        "opencode-rails" => @rails_spec
-      },
-      bundle_specs: [@bundle_ruby_spec],
-      ruby_version: ruby_version,
-      rails_version: rails_version
-    )
-  end
-
-  def resolve_git(path, *arguments)
-    return @heads.fetch(path) if arguments == ["rev-parse", "--verify", "HEAD^{commit}"]
-
-    @git_results.fetch([path, arguments])
-  end
-
-  def seed_annotated_tag(path, tag, object, commit)
-    set_git_result(path, ["cat-file", "-t", object], "tag")
-    set_git_result(path, ["rev-parse", "--verify", "refs/tags/#{tag}"], object)
-    set_git_result(path, ["rev-parse", "--verify", "#{object}^{commit}"], commit)
-    set_git_result(path, ["rev-parse", "--verify", "refs/tags/#{tag}^{commit}"], commit)
-  end
-
-  def set_git_result(path, arguments, result)
-    @git_results[[path, arguments]] = result
-  end
-
-  def use_commit_only_provenance!
-    @env["OPENCODE_CLIENT_PUBLICATION_STATE"] = "unpublished"
-    @env["OPENCODE_RUBY_PROVENANCE_KIND"] = "commit"
-    @env["OPENCODE_RAILS_PROVENANCE_KIND"] = "commit"
-    @env.delete("OPENCODE_RUBY_TAG")
-    @env.delete("OPENCODE_RUBY_TAG_OBJECT")
-    @env.delete("OPENCODE_RAILS_TAG")
-    @env.delete("OPENCODE_RAILS_TAG_OBJECT")
-  end
-end

test/matrix_json_test.rb

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-
-require "fileutils"
-require "json"
-require "minitest/autorun"
-require "open3"
-require "rbconfig"
-require "tmpdir"
-
-class MatrixJsonTest < Minitest::Test
-  ROOT = File.expand_path("..", __dir__)
-
-  def setup
-    @tmp = Dir.mktmpdir("opencode-matrix-json")
-    FileUtils.mkdir_p(File.join(@tmp, "lib/opencode_compat"))
-    FileUtils.mkdir_p(File.join(@tmp, "scripts"))
-    FileUtils.mkdir_p(File.join(@tmp, "manifests"))
-    FileUtils.cp(File.join(ROOT, "scripts/matrix_json.rb"), File.join(@tmp, "scripts"))
-    FileUtils.cp(
-      File.join(ROOT, "lib/opencode_compat/client_candidate.rb"),
-      File.join(@tmp, "lib/opencode_compat")
-    )
-    FileUtils.cp(
-      File.join(ROOT, "manifests/client-candidate.json"),
-      File.join(@tmp, "manifests")
-    )
-    @manifest = JSON.parse(File.read(File.join(ROOT, "manifests/image-matrix.json")))
-  end
-
-  def teardown
-    FileUtils.remove_entry(@tmp)
-  end
-
-  def test_emits_only_the_actual_shared_client_contract_profile
-    output, error, status = run_matrix(@manifest)
-
-    assert status.success?, error
-    JSON.parse(output).fetch("include").each do |target|
-      assert_equal ["ruby-rest-sse"], target.fetch("profiles")
-      assert_equal "shared-client-contract-only", target.fetch("certification_scope")
-    end
-  end
-
-  def test_rejects_a_manifest_that_overstates_the_executed_profile
-    @manifest.fetch("public_ci").first["profiles"] = ["rails-persisted-turn"]
-
-    _output, error, status = run_matrix(@manifest)
-
-    refute status.success?
-    assert_match(/executes exactly ruby-rest-sse/, error)
-  end
-
-  def test_rejects_a_manifest_that_overstates_the_certification_scope
-    @manifest.fetch("public_ci").first["certification_scope"] = "consumer-runtime"
-
-    _output, error, status = run_matrix(@manifest)
-
-    refute status.success?
-    assert_match(/certification_scope must be shared-client-contract-only/, error)
-  end
-
-  def test_rejects_a_matrix_bound_to_another_client_candidate
-    @manifest.fetch("client_candidate")["opencode_ruby_commit"] = "f" * 40
-
-    _output, error, status = run_matrix(@manifest)
-
-    refute status.success?
-    assert_match(/must equal the exact client candidate/, error)
-  end
-
-  def test_allows_reviewed_candidate_certification_without_changing_coordinates
-    @manifest.fetch("client_candidate")["certification_status"] = "certified"
-
-    _output, error, status = run_matrix(@manifest)
-
-    assert status.success?, error
-  end
-
-  def test_rejects_unknown_candidate_certification_status
-    @manifest.fetch("client_candidate")["certification_status"] = "deployed"
-
-    _output, error, status = run_matrix(@manifest)
-
-    refute status.success?
-    assert_match(/certification_status must be pending or certified/, error)
-  end
-
-  private
-
-  def run_matrix(manifest)
-    File.write(
-      File.join(@tmp, "manifests/image-matrix.json"),
-      JSON.pretty_generate(manifest) + "\n"
-    )
-    Open3.capture3(RbConfig.ruby, File.join(@tmp, "scripts/matrix_json.rb"))
-  end
-end

test/repository_test.rb

@@ -2,7 +2,6 @@
 
 require "json"
 require "minitest/autorun"
-require_relative "../lib/opencode_compat/client_candidate"
 require_relative "../lib/opencode_compat/runtime_tuple_promoter"
 
 class RepositoryTest < Minitest::Test
@@ -13,7 +12,7 @@ class RepositoryTest < Minitest::Test
   end
 
   def test_every_json_document_parses
-    paths = Dir.glob(File.join(ROOT, "{evidence,fixtures,manifests,profiles}/**/*.json"))
+    paths = Dir.glob(File.join(ROOT, "{evidence,fixtures,manifests,profiles,schemas}/**/*.json"))
     refute_empty paths
     paths.each { |path| JSON.parse(File.read(path)) }
   end
@@ -37,96 +36,42 @@ class RepositoryTest < Minitest::Test
     end
   end
 
+  def test_only_ruby_rest_sse_can_be_certified_by_the_shared_ruby_probe
+    Dir.glob(File.join(ROOT, "profiles/*.json")).each do |path|
+      profile = JSON.parse(File.read(path))
+      if profile.fetch("id") == "ruby-rest-sse"
+        assert_equal "shared-ruby-fixture-and-live-probe", profile.fetch("certification_mode")
+        assert_equal true, profile.fetch("shared_ruby_probe_sufficient")
+      else
+        assert_equal "executable-consumer-attestation", profile.fetch("certification_mode")
+        assert_equal false, profile.fetch("shared_ruby_probe_sufficient")
+      end
+    end
+  end
+
   def test_public_matrix_uses_only_immutable_oci_digests
-    manifest = json("manifests/image-matrix.json")
+    targets = json("manifests/image-matrix.json").fetch("public_ci")
-    assert_equal 2, manifest.fetch("schema_version")
-    targets = manifest.fetch("public_ci")
     refute_empty targets
     targets.each do |target|
       assert_match %r{\Aghcr\.io/anomalyco/opencode@sha256:[0-9a-f]{64}\z}, target.fetch("image")
       refute_includes target.fetch("image"), ":latest"
-      assert_equal ["ruby-rest-sse"], target.fetch("profiles")
+      refute_empty target.fetch("profiles")
-      assert_equal "shared-client-contract-only",
+      next unless target.fetch("certification_status") == "certified"
-        target.fetch("certification_scope", "shared-client-contract-only")
-      assert_equal "pending", target.fetch("certification_status")
-      previous = target["previous_certification"]
-      next unless previous
 
-      assert_equal "certified", previous.fetch("status")
+      assert_match(/\A[0-9a-f]{40}\z/, target.fetch("certified_client_commit"))
-      assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
+      assert_equal target.fetch("expected_text"), target.fetch("full_text")
-      assert_equal previous.fetch("expected_text"), previous.fetch("full_text")
+      assert_equal 1, target.fetch("llm_request_count")
-      assert_equal 1, previous.fetch("llm_request_count")
     end
   end
 
-  def test_candidate_client_train_is_lockstep_and_bound_to_unpublished_commits
+  def test_candidate_is_bound_to_an_annotated_tag
     candidate = json("manifests/client-candidate.json")
-    OpenCodeCompat::ClientCandidate.new(candidate).verify!
+    provenance = candidate.fetch("tag_provenance")
-    clients = candidate.fetch("clients")
-    release_train = candidate.fetch("release_train")
 
-    assert_equal 3, candidate.fetch("schema_version")
+    assert_match(/\A[0-9a-f]{40}\z/, candidate.fetch("ref"))
-    assert_equal "candidate", candidate.fetch("status")
+    assert_match(/\Av\d+\.\d+\.\d+\.alpha\d+\z/, provenance.fetch("tag"))
-    assert_equal "unpublished", candidate.fetch("publication_state")
+    assert_match(/\A[0-9a-f]{40}\z/, provenance.fetch("annotated_tag_object"))
-    assert_equal "0.0.1.alpha8", release_train
+    assert_equal candidate.fetch("ref"), provenance.fetch("peeled_commit")
-    assert_equal %w[opencode-rails opencode-ruby], clients.keys.sort
-
-    clients.each do |name, client|
-      provenance = client.fetch("provenance")
-      assert_equal "ajaynomics/#{name}", client.fetch("repository")
-      assert_equal release_train, client.fetch("version")
-      assert_match(/\A[0-9a-f]{40}\z/, client.fetch("ref"))
-      assert_equal "commit", provenance.fetch("kind")
-      assert_equal client.fetch("ref"), provenance.fetch("commit")
-      refute provenance.key?("tag")
-    end
-
-    assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766", clients.dig("opencode-ruby", "ref")
-    assert_equal "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f", clients.dig("opencode-rails", "ref")
-    dependency = clients.fetch("opencode-rails").fetch("runtime_dependencies").fetch("opencode-ruby")
-    assert_equal "= #{release_train}", dependency.fetch("requirement")
-    assert_equal clients.fetch("opencode-ruby").fetch("ref"), dependency.fetch("ref")
-  end
-
-  def test_image_matrix_is_pending_and_bound_to_the_exact_client_candidate
-    candidate = json("manifests/client-candidate.json")
-    clients = candidate.fetch("clients")
-    matrix_candidate = json("manifests/image-matrix.json").fetch("client_candidate")
-
-    assert_equal "pending", matrix_candidate.fetch("certification_status")
-    assert_equal candidate.fetch("release_train"), matrix_candidate.fetch("release_train")
-    assert_equal candidate.fetch("publication_state"), matrix_candidate.fetch("publication_state")
-    assert_equal clients.dig("opencode-ruby", "ref"), matrix_candidate.fetch("opencode_ruby_commit")
-    assert_equal clients.dig("opencode-rails", "ref"), matrix_candidate.fetch("opencode_rails_commit")
-
-    json("manifests/image-matrix.json").fetch("host_canary").each do |target|
-      assert_equal "pending", target.fetch("certification_status")
-      previous = target.fetch("previous_certification")
-      assert_includes %w[candidate-certified certified], previous.fetch("status")
-      assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
-    end
-  end
-
-  def test_alpha8_local_image_evidence_is_review_input_not_app_certification
-    evidence = json("evidence/2026-07-20-opencode-alpha8-pre-release-shared-client.json")
-    candidate = json("manifests/client-candidate.json").fetch("clients")
-
-    assert_equal "not-certified", evidence.fetch("certification_status")
-    assert_equal "shared-client-contract-only", evidence.fetch("coverage_scope")
-    assert_equal "unpublished", evidence.fetch("publication_state")
-    assert_equal candidate.dig("opencode-ruby", "ref"), evidence.dig("clients", "opencode_ruby", "commit")
-    assert_equal candidate.dig("opencode-rails", "ref"), evidence.dig("clients", "opencode_rails", "commit")
-    assert_equal true, evidence.dig("clients", "opencode_ruby", "executed")
-    assert_equal false, evidence.dig("clients", "opencode_rails", "executed_by_image_contract")
-    assert_equal 5, evidence.fetch("checks").length
-    evidence.fetch("checks").each do |check|
-      assert_equal "pass", check.fetch("status")
-      assert_equal ["ruby-rest-sse"], check.fetch("executed_profiles")
-      assert_equal check.fetch("expected_text"), check.fetch("full_text")
-      assert_equal 1, check.fetch("authoritative_assistant_message_count")
-      assert_equal 1, check.fetch("llm_request_count")
-    end
-    assert evidence.fetch("limitations").any? { |entry| entry.include?("remain unverified") }
   end
 
   def test_certified_migration_keeps_previous_tuple
@@ -146,6 +91,10 @@ class RepositoryTest < Minitest::Test
 
   def test_runtime_tuple_profiles_exist
     tuples = json("manifests/runtime-tuples.json")
+    schema = json("schemas/runtime-tuples.schema.json")
+
+    assert_equal 2, tuples.fetch("schema_version")
+    assert_equal 2, schema.dig("properties", "schema_version", "const")
     tuples.fetch("consumers").each_value do |consumer|
       profile = consumer.fetch("profile")
       assert_path_exists File.join(ROOT, "profiles", "#{profile}.json")
@@ -188,6 +137,96 @@ class RepositoryTest < Minitest::Test
     end
   end
 
+  def test_pull_request_heads_are_explicitly_candidate_only
+    tuples = json("manifests/runtime-tuples.json")
+
+    tuples.fetch("consumers").each do |name, consumer|
+      candidate = consumer.fetch("candidate")
+      reference = candidate.fetch("consumer_ref")
+
+      assert_equal "pre-merge-pr-head-candidate-only", candidate.fetch("certification_scope"), name
+      assert_equal false, candidate.fetch("promotion_eligible"), name
+      assert_equal "pull-request-head", reference.fetch("kind"), name
+      assert_equal candidate.fetch("consumer_commit"), reference.fetch("commit"), name
+      assert_match(/\A[0-9a-f]{40}\z/, reference.fetch("tree"), name)
+      assert_match(%r{\Ahttps://.+/pulls/\d+\z}, reference.fetch("review_url"), name)
+    end
+  end
+
+  def test_candidate_gems_use_peeled_refs_and_loaded_source_proof
+    tuples = json("manifests/runtime-tuples.json")
+
+    tuples.fetch("consumers").each do |consumer_name, consumer|
+      candidate = consumer.fetch("candidate")
+      %w[opencode_ruby opencode_rails].each do |client_name|
+        client = candidate[client_name]
+        next unless client
+
+        commit = client.fetch("git_commit")
+        source = client.fetch("source")
+        proof = source.fetch("loaded_source_proof")
+
+        assert_equal "git", source.fetch("type"), "#{consumer_name} #{client_name}"
+        assert_equal commit, source.fetch("requested_ref"), "#{consumer_name} #{client_name}"
+        assert_equal commit, source.fetch("locked_revision"), "#{consumer_name} #{client_name}"
+        assert_equal "pass", proof.fetch("status"), "#{consumer_name} #{client_name}"
+        assert_equal "Bundler::Source::Git", proof.fetch("source_class"), "#{consumer_name} #{client_name}"
+        assert_equal client.fetch("version"), proof.fetch("loaded_version"), "#{consumer_name} #{client_name}"
+        assert_equal commit, proof.fetch("observed_ref"), "#{consumer_name} #{client_name}" if proof.key?("observed_ref")
+        assert_equal commit, proof.fetch("observed_revision"), "#{consumer_name} #{client_name}"
+        refute_empty proof.fetch("test"), "#{consumer_name} #{client_name}"
+      end
+    end
+  end
+
+  def test_ajent_records_current_selection_drift_and_exact_candidate_selection
+    ajent = json("manifests/runtime-tuples.json").fetch("consumers").fetch("ajent-rails")
+    expected_products = %w[aigl blackline raven]
+
+    current_runtime = ajent.fetch("current").fetch("runtime")
+    assert_match(/\Asha256:[0-9a-f]{64}\z/, current_runtime.fetch("docker_image_id"))
+    deployed = current_runtime.fetch("deployed_product_selection")
+    assert_equal "mutable-latest", deployed.fetch("strategy")
+    assert_equal "observed-configuration-drift-failure", deployed.fetch("status")
+    assert_equal expected_products, deployed.fetch("references").keys.sort
+    deployed.fetch("references").each_value { |reference| assert reference.end_with?(":latest") }
+
+    built = current_runtime.fetch("ci_built_product_images")
+    assert_equal expected_products, built.keys.sort
+    built.each_value do |coordinate|
+      assert_match(/\Asha256:[0-9a-f]{64}\z/, coordinate.fetch("docker_image_id"))
+      assert_equal ajent.dig("current", "consumer_commit"), coordinate.fetch("source_commit")
+    end
+
+    candidate_runtime = ajent.fetch("candidate").fetch("runtime")
+    selected = candidate_runtime.fetch("product_selection")
+    assert_equal expected_products, selected.fetch("references").keys.sort
+    selected.fetch("references").each_value do |reference|
+      assert reference.end_with?(":#{ajent.dig('candidate', 'consumer_commit')}")
+      refute reference.end_with?(":latest")
+    end
+    assert_equal ["blackline"], candidate_runtime.fetch("product_images").keys
+    assert_includes ajent.dig("candidate", "promotion_blockers"),
+      "aigl-and-raven-candidate-content-artifacts-have-not-been-built-and-canaried"
+  end
+
+  def test_manifest_candidates_cannot_be_promoted_from_pre_merge_evidence
+    promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: ROOT)
+    tuples = json("manifests/runtime-tuples.json")
+
+    tuples.fetch("consumers").each do |name, consumer|
+      error = assert_raises(OpenCodeCompat::PromotionError) do
+        promoter.promote(
+          consumer: name,
+          consumer_commit: consumer.dig("candidate", "consumer_commit"),
+          certification: {},
+          dry_run: true
+        )
+      end
+      assert_match(/pre-merge pull-request evidence is candidate-only/, error.message)
+    end
+  end
+
   def test_candidate_evidence_is_bound_to_complete_tuple_fingerprints
     promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: ROOT)
     evidence_paths = {
@@ -206,6 +245,8 @@ class RepositoryTest < Minitest::Test
       assert_equal consumer, evidence.fetch("consumer")
       assert_equal fingerprints.fetch("profile"), evidence.fetch("profile")
       assert_equal fingerprints.fetch("candidate_tuple_sha256"), evidence.fetch("tuple_sha256")
+      assert_equal "pre-merge-pr-head-candidate-only", evidence.fetch("certification_scope")
+      assert_equal false, evidence.fetch("promotion_eligible")
       assert_equal "pass", evidence.fetch("status")
     end
   end
@@ -215,98 +256,6 @@ class RepositoryTest < Minitest::Test
     refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, workflow)
   end
 
-  def test_workflow_actions_are_pinned_to_exact_commits
-    workflows = Dir.glob(File.join(ROOT, ".github/workflows/*.{yml,yaml}"))
-    refute_empty workflows
-
-    workflows.each do |path|
-      File.foreach(path).with_index(1) do |line, number|
-        next unless (match = line.match(/\buses:\s+[^\s@]+@([^\s#]+)/))
-
-        assert_match(/\A[0-9a-f]{40}\z/, match[1], "#{path}:#{number} must pin an exact action commit")
-      end
-    end
-  end
-
-  def test_workflow_actions_use_reviewed_node24_compatible_pins
-    expected = {
-      "actions/checkout" => "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
-      "actions/upload-artifact" => "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
-      "ruby/setup-ruby" => "003a5c4d8d6321bd302e38f6f0ec593f77f06600"
-    }
-    observed = Hash.new { |hash, key| hash[key] = [] }
-
-    Dir.glob(File.join(ROOT, ".github/workflows/*.{yml,yaml}")).each do |path|
-      File.read(path).scan(/\buses:\s+([^\s@]+)@([0-9a-f]{40})/) do |action, commit|
-        observed[action] << commit if expected.key?(action)
-      end
-    end
-
-    expected.each do |action, commit|
-      refute_empty observed.fetch(action), "expected at least one #{action} use"
-      assert_equal [commit], observed.fetch(action).uniq, "#{action} must stay on the reviewed Node 24 pin"
-    end
-  end
-
-  def test_candidate_workflow_verifies_and_preserves_the_lockstep_client_tuple
-    workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
-
-    refute_includes workflow, "inputs.opencode_ruby_ref"
-    refute_includes workflow, "inputs.opencode_rails_ref"
-    assert_includes workflow, "repository: ajaynomics/opencode-ruby"
-    assert_includes workflow, "repository: ajaynomics/opencode-rails"
-    assert_includes workflow, "path: opencode-rails"
-    assert_includes workflow, "ruby: [\"3.2\", \"3.3\", \"3.4\", \"4.0\"]"
-    assert_includes workflow, "scripts/client_candidate_outputs.rb"
-    assert_includes workflow, "OPENCODE_CLIENT_PUBLICATION_STATE"
-    assert_includes workflow, "OPENCODE_RUBY_PROVENANCE_KIND"
-    assert_includes workflow, "OPENCODE_RAILS_PROVENANCE_KIND"
-    assert_includes workflow, "ruby/lockstep_client_contract.rb"
-    assert_includes workflow, "OPENCODE_RUBY_TAG_OBJECT"
-    assert_includes workflow, "OPENCODE_RAILS_TAG_OBJECT"
-    assert_operator workflow.scan("fetch-tags: true").length, :>=, 2
-    assert_operator workflow.scan("actions/upload-artifact@").length, :>=, 3
-    assert_includes workflow, "OPENCODE_COMPAT_EVIDENCE_PATH"
-    assert_includes workflow, "OPENCODE_REQUIRED_CONSUMER_PROFILES"
-    assert_includes workflow, 'BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle'
-    assert_includes workflow, "Install candidate dependencies outside the checkout"
-    refute_includes workflow, "OPENCODE_MATRIX_PROFILES"
-    refute_includes workflow, "OPENCODE_CERTIFICATION_SCOPE"
-    refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service|gh\s+pr\s+merge)\b/i, workflow)
-  end
-
-  def test_candidate_workflow_has_an_explicit_dual_forge_evidence_boundary
-    workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
-    upload_conditions = workflow.scan(
-      /- name: Upload (?:fixture|lockstep|exact-image) evidence\n\s+if: ([^\n]+)\n\s+uses: actions\/upload-artifact@/
-    ).flatten
-
-    assert_equal 3, upload_conditions.length
-    assert_equal ["always() && github.server_url == 'https://github.com'"], upload_conditions.uniq
-    assert_includes workflow, "bundler-cache: ${{ github.server_url == 'https://github.com' }}"
-    assert_includes workflow, "exact-image-contract-gitea:"
-    assert_includes workflow, "if: github.server_url != 'https://github.com'"
-    assert_includes workflow, "run: scripts/run_image_matrix_contract.sh"
-    assert_includes workflow, 'probe_host="$(ruby scripts/private_default_gateway.rb)"'
-    assert_includes workflow, 'echo "OPENCODE_PROBE_HOST=$probe_host" >> "$GITHUB_ENV"'
-    assert_operator workflow.scan('BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile').length, :>=, 2
-    assert_operator workflow.scan("generated JSON is transient and is not review evidence").length, :>=, 3
-
-    gitea_job = workflow.split(/^  exact-image-contract-gitea:\n/, 2).fetch(1)
-    refute_includes gitea_job, "actions/upload-artifact@"
-  end
-
-  def test_gitea_matrix_runner_uses_every_generated_entry_without_hardcoded_coordinates
-    runner = File.read(File.join(ROOT, "scripts/run_image_matrix_contract.sh"))
-
-    assert_includes runner, 'matrix_json="$(ruby "$repo_root/scripts/matrix_json.rb")"'
-    assert_includes runner, 'for ((index = 0; index < entry_count; index++))'
-    assert_includes runner, 'bundle exec "$repo_root/scripts/run_image_contract.sh"'
-    assert_includes runner, '.image.reported_version == $version'
-    refute_match(/upstream-[0-9]/, runner)
-    refute_match(/ghcr\.io\/anomalyco/, runner)
-  end
-
   def test_tuple_promotion_has_no_command_execution_or_deployment_client
     paths = %w[
       lib/opencode_compat/runtime_tuple_promoter.rb
@@ -324,16 +273,8 @@ class RepositoryTest < Minitest::Test
     runner = File.read(File.join(ROOT, "scripts/run_image_contract.sh"))
 
     assert_includes probe, "ExactLiveContract.assert_final_text!"
-    assert_includes probe, "ExactLiveContract.assert_authoritative_assistant_count!"
     refute_includes probe, "full_text.include?"
     assert_includes runner, "exact_live_contract.rb"
-    assert_includes runner, 'docker cp "$repo_root/scripts/fake_llm.py"'
-    refute_includes runner, '--volume "$repo_root/scripts:/compat:ro"'
-    assert_includes runner, '--publish "${probe_host}::4096"'
-    assert_includes runner, 'base_url="http://${probe_host}:${host_port}"'
-    refute_includes runner, "--publish 0.0.0.0"
-    assert_includes runner, "OPENCODE_COMPAT_EVIDENCE_PATH"
-    assert_includes runner, "OPENCODE_EXPECTED_VERSION"
     refute_match(/request_count.*-lt\s+1/, runner)
   end
 end

test/runtime_tuple_promoter_test.rb

@@ -18,6 +18,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
   CANDIDATE_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'b' * 64}"
   CURRENT_TIME = "2026-07-17T12:00:00Z"
   CANDIDATE_TIME = "2026-07-18T12:00:00Z"
+  CANDIDATE_TREE = "7" * 40
 
   def setup
     @root = Dir.mktmpdir("opencode-compat-promotion")
@@ -25,6 +26,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
     FileUtils.mkdir_p(File.join(@root, "evidence"))
     FileUtils.mkdir_p(File.join(@root, "profiles"))
     File.write(File.join(@root, "profiles", "rails-persisted-turn.json"), "{}\n")
+    write_post_merge_canary_evidence("post-merge-canary.json", CANDIDATE_COMMIT)
     write_manifest(valid_manifest)
     @promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: @root)
   end
@@ -175,6 +177,154 @@ class RuntimeTuplePromoterTest < Minitest::Test
     assert_equal before, File.binread(manifest_path)
   end
 
+  def test_rejects_pre_merge_pull_request_evidence_as_candidate_only
+    manifest = valid_manifest
+    candidate = manifest.dig("consumers", CONSUMER, "candidate")
+    candidate["certification_scope"] = "pre-merge-pr-head-candidate-only"
+    candidate["promotion_eligible"] = false
+    candidate["consumer_ref"] = {
+      "kind" => "pull-request-head",
+      "repository" => "example/consumer",
+      "commit" => CANDIDATE_COMMIT,
+      "tree" => CANDIDATE_TREE,
+      "base_commit" => CURRENT_COMMIT,
+      "review_url" => "https://example.test/pulls/1"
+    }
+    candidate.delete("promotion_provenance")
+    write_manifest(manifest)
+    candidate_evidence, previous_evidence = write_matching_evidence
+
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.promote(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: certification(CANDIDATE_TIME, candidate_evidence),
+        previous_certification: certification(CURRENT_TIME, previous_evidence),
+        dry_run: true
+      )
+    end
+
+    assert_match(/pre-merge pull-request evidence is candidate-only/, error.message)
+  end
+
+  def test_accepts_explicit_identical_tree_attestation_with_post_merge_canary
+    manifest = valid_manifest
+    candidate = manifest.dig("consumers", CONSUMER, "candidate")
+    candidate["consumer_ref"] = {
+      "kind" => "pull-request-head",
+      "repository" => "example/consumer",
+      "commit" => CANDIDATE_COMMIT,
+      "tree" => CANDIDATE_TREE,
+      "base_commit" => CURRENT_COMMIT,
+      "review_url" => "https://example.test/pulls/1"
+    }
+    main_commit = "8" * 40
+    write_post_merge_canary_evidence("post-merge-attested-canary.json", main_commit)
+    candidate["promotion_provenance"] = {
+      "kind" => "identical-tree-attestation",
+      "pull_request_commit" => CANDIDATE_COMMIT,
+      "pull_request_tree" => CANDIDATE_TREE,
+      "main_commit" => main_commit,
+      "main_tree" => CANDIDATE_TREE,
+      "attested_at" => CANDIDATE_TIME,
+      "post_merge_canary" => {
+        "status" => "pass",
+        "checked_at" => CANDIDATE_TIME,
+        "evidence" => ["evidence/post-merge-attested-canary.json"]
+      }
+    }
+    write_manifest(manifest)
+    candidate_evidence, previous_evidence = write_matching_evidence
+
+    promoted = @promoter.promote(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT,
+      certification: certification(CANDIDATE_TIME, candidate_evidence),
+      previous_certification: certification(CURRENT_TIME, previous_evidence),
+      dry_run: true
+    )
+
+    assert_equal "certified", promoted.dig("consumers", CONSUMER, "current", "status")
+  end
+
+  def test_main_commit_promotion_still_requires_a_post_merge_canary
+    manifest = valid_manifest
+    manifest.dig("consumers", CONSUMER, "candidate", "promotion_provenance").delete("post_merge_canary")
+    write_manifest(manifest)
+
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.promote(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: {},
+        dry_run: true
+      )
+    end
+
+    assert_match(/passing post-merge canary/, error.message)
+  end
+
+  def test_rejects_candidate_without_loaded_exact_ref_source_proof
+    manifest = valid_manifest
+    manifest.dig("consumers", CONSUMER, "candidate", "opencode_ruby").delete("source")
+    write_manifest(manifest)
+
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
+    end
+
+    assert_match(/loaded exact-ref source proof/, error.message)
+  end
+
+  def test_explicit_degraded_bootstrap_certifies_current_without_faking_previous
+    manifest = valid_manifest
+    failed = manifest.dig("consumers", CONSUMER, "current")
+    failed["status"] = "observed-production-contract-failed"
+    write_manifest(manifest)
+    fingerprint = @promoter.fingerprints(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT
+    ).fetch("candidate_tuple_sha256")
+    evidence = write_evidence(
+      "bootstrap-candidate.json",
+      commit: CANDIDATE_COMMIT,
+      timestamp: CANDIDATE_TIME,
+      fingerprint: fingerprint
+    )
+
+    bootstrapped = @promoter.bootstrap_current(
+      consumer: CONSUMER,
+      consumer_commit: CANDIDATE_COMMIT,
+      certification: certification(CANDIDATE_TIME, evidence),
+      acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT,
+      dry_run: true
+    )
+
+    consumer = bootstrapped.dig("consumers", CONSUMER)
+    assert_equal "certified", consumer.dig("current", "status")
+    assert_equal CANDIDATE_COMMIT, consumer.dig("current", "consumer_commit")
+    assert_nil consumer["candidate"]
+    assert_nil consumer["previous"]
+    assert_equal "observed-production-contract-failed", consumer.dig("emergency_provenance", "status")
+    assert_nil consumer.dig("emergency_provenance", "certification")
+    assert_equal "degraded-no-certified-previous", consumer.dig("rollback_state", "status")
+    assert_equal "bootstrap-current-only", bootstrapped.fetch("migration_state")
+  end
+
+  def test_degraded_bootstrap_requires_exact_explicit_acknowledgement
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.bootstrap_current(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: {},
+        acknowledgement: "yes",
+        dry_run: true
+      )
+    end
+
+    assert_match(/explicit acknowledgement/, error.message)
+  end
+
   def test_rejects_evidence_that_does_not_match_the_complete_tuple
     candidate, previous = write_matching_evidence
     manifest = JSON.parse(File.read(manifest_path))
@@ -254,7 +404,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
 
   def valid_manifest
     {
-      "schema_version" => 1,
+      "schema_version" => 2,
       "migration_state" => "candidate",
       "consumers" => {
         CONSUMER => {
@@ -269,8 +419,25 @@ class RuntimeTuplePromoterTest < Minitest::Test
           "candidate" => {
             "status" => "compatibility-certified",
             "certified_at" => "2026-07-18T10:00:00Z",
-            "opencode_ruby" => {"version" => "0.0.1.alpha7", "git_commit" => RUBY_CANDIDATE},
+            "certification_scope" => "promotion-deployed",
-            "opencode_rails" => {"version" => "0.0.1.alpha7", "git_commit" => RAILS_CANDIDATE},
+            "promotion_eligible" => true,
+            "consumer_ref" => {
+              "kind" => "main-commit",
+              "repository" => "example/consumer",
+              "commit" => CANDIDATE_COMMIT,
+              "tree" => CANDIDATE_TREE
+            },
+            "promotion_provenance" => {
+              "kind" => "main-commit",
+              "main_commit" => CANDIDATE_COMMIT,
+              "post_merge_canary" => {
+                "status" => "pass",
+                "checked_at" => CANDIDATE_TIME,
+                "evidence" => ["evidence/post-merge-canary.json"]
+              }
+            },
+            "opencode_ruby" => client("0.0.1.alpha7", RUBY_CANDIDATE),
+            "opencode_rails" => client("0.0.1.alpha7", RAILS_CANDIDATE),
             "runtime" => {"image" => CANDIDATE_IMAGE, "reported_version" => "1.18.3"}
           },
           "previous" => nil
@@ -279,6 +446,27 @@ class RuntimeTuplePromoterTest < Minitest::Test
     }
   end
 
+  def client(version, commit)
+    {
+      "version" => version,
+      "git_commit" => commit,
+      "source" => {
+        "type" => "git",
+        "uri" => "https://example.test/client.git",
+        "requested_ref" => commit,
+        "locked_revision" => commit,
+        "loaded_source_proof" => {
+          "status" => "pass",
+          "source_class" => "Bundler::Source::Git",
+          "loaded_version" => version,
+          "observed_ref" => commit,
+          "observed_revision" => commit,
+          "test" => "test/dependency_provenance_test.rb"
+        }
+      }
+    }
+  end
+
   def write_matching_evidence
     fingerprints = @promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
     candidate = write_evidence(
@@ -311,6 +499,16 @@ class RuntimeTuplePromoterTest < Minitest::Test
     {"path" => path, "tuple_sha256" => fingerprint}
   end
 
+  def write_post_merge_canary_evidence(name, commit)
+    document = {
+      "schema_version" => 1,
+      "status" => "pass",
+      "checked_at" => CANDIDATE_TIME,
+      "consumer_commit" => commit
+    }
+    File.write(File.join(@root, "evidence", name), JSON.pretty_generate(document) + "\n")
+  end
+
   def certification(timestamp, evidence)
     {
       "status" => "pass",

test/watcher_test.rb

@@ -1,234 +0,0 @@
-# frozen_string_literal: true
-
-require "fileutils"
-require "json"
-require "minitest/autorun"
-require "open3"
-require "rbconfig"
-require "tmpdir"
-
-class WatcherTest < Minitest::Test
-  ROOT = File.expand_path("..", __dir__)
-  RUBY = RbConfig.ruby
-
-  def setup
-    @tmp = Dir.mktmpdir("opencode-watcher")
-    FileUtils.mkdir_p(File.join(@tmp, "scripts"))
-    FileUtils.mkdir_p(File.join(@tmp, "manifests"))
-    FileUtils.cp(File.join(ROOT, "scripts/record_upstream_candidate.rb"), File.join(@tmp, "scripts"))
-    %w[upstream.json image-matrix.json].each do |name|
-      FileUtils.cp(File.join(ROOT, "manifests", name), File.join(@tmp, "manifests"))
-    end
-  end
-
-  def teardown
-    FileUtils.remove_entry(@tmp)
-  end
-
-  def test_same_tag_and_digest_is_an_exact_noop
-    upstream = read_json("manifests/upstream.json")
-    before = watched_bytes
-
-    run_recorder!(
-      upstream.fetch("release_tag"),
-      upstream.fetch("published_at"),
-      upstream.fetch("release_url"),
-      upstream.fetch("image").split("@").last
-    )
-
-    assert_equal before, watched_bytes
-  end
-
-  def test_same_tag_and_digest_repairs_a_missing_public_target_then_noops
-    upstream = read_json("manifests/upstream.json")
-    matrix = read_json("manifests/image-matrix.json")
-    image = upstream.fetch("image")
-    matrix.fetch("public_ci").reject! { |target| target.fetch("image") == image }
-    write_json("manifests/image-matrix.json", matrix)
-    upstream_before = File.binread(File.join(@tmp, "manifests/upstream.json"))
-
-    arguments = [
-      upstream.fetch("release_tag"),
-      upstream.fetch("published_at"),
-      upstream.fetch("release_url"),
-      image.split("@").last
-    ]
-    run_recorder!(*arguments)
-
-    repaired = read_json("manifests/image-matrix.json")
-    targets = repaired.fetch("public_ci").select { |target| target.fetch("image") == image }
-    assert_equal 1, targets.length
-    assert_equal "pending", targets.first.fetch("certification_status")
-    assert_equal ["ruby-rest-sse"], targets.first.fetch("profiles")
-    assert_equal upstream_before, File.binread(File.join(@tmp, "manifests/upstream.json"))
-
-    after = watched_bytes
-    run_recorder!(*arguments)
-    assert_equal after, watched_bytes
-  end
-
-  def test_duplicate_public_targets_are_rejected_without_writing_either_manifest
-    upstream = read_json("manifests/upstream.json")
-    matrix = read_json("manifests/image-matrix.json")
-    target = matrix.fetch("public_ci").find { |entry| entry.fetch("image") == upstream.fetch("image") }
-    duplicate = target.merge("id" => "#{target.fetch('id')}-duplicate")
-    matrix.fetch("public_ci") << duplicate
-    write_json("manifests/image-matrix.json", matrix)
-    before = watched_bytes
-
-    _output, error, status = capture_recorder(
-      upstream.fetch("release_tag"),
-      upstream.fetch("published_at"),
-      upstream.fetch("release_url"),
-      upstream.fetch("image").split("@").last
-    )
-
-    refute status.success?
-    assert_match(/must appear exactly once in public_ci; found 2/, error)
-    assert_equal before, watched_bytes
-  end
-
-  def test_missing_public_target_with_conflicting_generated_id_is_rejected_without_writing
-    upstream = read_json("manifests/upstream.json")
-    matrix = read_json("manifests/image-matrix.json")
-    image = upstream.fetch("image")
-    removed = matrix.fetch("public_ci").find { |target| target.fetch("image") == image }
-    matrix.fetch("public_ci").reject! { |target| target.fetch("image") == image }
-    matrix.fetch("public_ci") << removed.merge(
-      "id" => "upstream-#{upstream.fetch('version')}-#{image.split('sha256:').last}",
-      "image" => "ghcr.io/anomalyco/opencode@sha256:#{'e' * 64}"
-    )
-    write_json("manifests/image-matrix.json", matrix)
-    before = watched_bytes
-
-    _output, error, status = capture_recorder(
-      upstream.fetch("release_tag"),
-      upstream.fetch("published_at"),
-      upstream.fetch("release_url"),
-      image.split("@").last
-    )
-
-    refute status.success?
-    assert_match(/public_ci id .* is already used by another image/, error)
-    assert_equal before, watched_bytes
-  end
-
-  def test_same_tag_with_new_digest_records_a_distinct_pending_target_once
-    upstream = read_json("manifests/upstream.json")
-    replacement = "sha256:#{'f' * 64}"
-    arguments = [
-      upstream.fetch("release_tag"),
-      upstream.fetch("published_at"),
-      upstream.fetch("release_url"),
-      replacement
-    ]
-
-    run_recorder!(*arguments)
-    changed_upstream = read_json("manifests/upstream.json")
-    matrix = read_json("manifests/image-matrix.json")
-    target = matrix.fetch("public_ci").last
-
-    assert_equal "ghcr.io/anomalyco/opencode@#{replacement}", changed_upstream.fetch("image")
-    expected_version = upstream.fetch("release_tag").delete_prefix("v")
-    assert_equal "upstream-#{expected_version}-#{'f' * 64}", target.fetch("id")
-    assert_equal "ghcr.io/anomalyco/opencode@#{replacement}", target.fetch("image")
-    assert_equal "pending", target.fetch("certification_status")
-    assert_equal "shared-client-contract-only", target.fetch("certification_scope")
-    assert_empty target.fetch("consumers")
-    assert_empty target.fetch("required_consumer_profiles")
-
-    after = watched_bytes
-    run_recorder!(*arguments)
-    assert_equal after, watched_bytes
-  end
-
-  def test_recorder_rejects_untrusted_release_metadata
-    upstream = read_json("manifests/upstream.json")
-    digest = upstream.fetch("image").split("@").last
-
-    refute recorder_status("branch-name", upstream.fetch("published_at"), upstream.fetch("release_url"), digest).success?
-    refute recorder_status(upstream.fetch("release_tag"), "yesterday", upstream.fetch("release_url"), digest).success?
-    refute recorder_status(upstream.fetch("release_tag"), upstream.fetch("published_at"), "https://example.test/release", digest).success?
-    refute recorder_status(upstream.fetch("release_tag"), upstream.fetch("published_at"), upstream.fetch("release_url"), "sha256:nope").success?
-  end
-
-  def test_branch_names_bind_the_full_tag_and_digest_and_support_retries
-    script = File.join(ROOT, "scripts/upstream_branch_name.rb")
-    digest = "sha256:#{'a' * 64}"
-    replacement = "sha256:#{'b' * 64}"
-
-    base = run_script!(script, "v1.18.3", digest).strip
-    changed = run_script!(script, "v1.18.3", replacement).strip
-    retry_branch = run_script!(script, "v1.18.3", digest, "123-2").strip
-
-    assert_equal "compat/upstream-1.18.3-#{'a' * 64}", base
-    refute_equal base, changed
-    assert_equal "#{base}-r123-2", retry_branch
-    refute run_status(script, "v1.18.3", digest, "bad/value").success?
-  end
-
-  def test_workflow_can_only_update_manifests_and_open_a_pr
-    workflow = File.read(File.join(ROOT, ".github/workflows/watch-upstream.yml"))
-
-    assert_includes workflow, "contents: write"
-    assert_includes workflow, "pull-requests: write"
-    assert_includes workflow, "git add manifests/image-matrix.json manifests/upstream.json"
-    assert_includes workflow, "gh pr create"
-    assert_includes workflow, "scripts/upstream_branch_name.rb"
-    assert_includes workflow, "git ls-remote --exit-code --heads"
-    assert_includes workflow, "--base main"
-    assert_includes workflow, ".baseRefName == \"main\""
-    assert_includes workflow, "isCrossRepository == false"
-    assert_includes workflow, "headRefOid"
-    assert_includes workflow, "application/vnd.github.raw+json"
-    assert_includes workflow, "current_image_count"
-    assert_includes workflow, '[.public_ci[]? | select(.image == $image)] | length'
-    assert_includes workflow, '[ "$current_image_count" -eq 1 ]'
-    assert_includes workflow, ".release_tag == $tag and .image == $image"
-    assert_includes workflow, "([.public_ci[]? | select(.image == $image)] | length) == 1"
-    content_check = workflow.index(".release_tag == $tag and .image == $image")
-    skip = workflow.index('echo "skip=true"')
-    assert_operator content_check, :<, skip
-    refute_match(/gh\s+pr\s+merge|repository_dispatch|workflow_dispatches|git\s+push\s+--force/i, workflow)
-    refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, workflow)
-  end
-
-  private
-
-  def run_recorder!(*arguments)
-    run_script!(File.join(@tmp, "scripts/record_upstream_candidate.rb"), *arguments)
-  end
-
-  def recorder_status(*arguments)
-    run_status(File.join(@tmp, "scripts/record_upstream_candidate.rb"), *arguments)
-  end
-
-  def capture_recorder(*arguments)
-    Open3.capture3(RUBY, File.join(@tmp, "scripts/record_upstream_candidate.rb"), *arguments)
-  end
-
-  def run_script!(script, *arguments)
-    output, error, status = Open3.capture3(RUBY, script, *arguments)
-    assert status.success?, error
-    output
-  end
-
-  def run_status(script, *arguments)
-    _output, _error, status = Open3.capture3(RUBY, script, *arguments)
-    status
-  end
-
-  def read_json(relative_path)
-    JSON.parse(File.read(File.join(@tmp, relative_path)))
-  end
-
-  def write_json(relative_path, value)
-    File.write(File.join(@tmp, relative_path), JSON.pretty_generate(value) + "\n")
-  end
-
-  def watched_bytes
-    %w[manifests/upstream.json manifests/image-matrix.json].map do |relative_path|
-      File.binread(File.join(@tmp, relative_path))
-    end
-  end
-end